A fuzzer feeds a program a torrent of malformed, random, or mutated inputs and watches for the one that makes it crash, hang, or trip an assertion. It is the crudest falsifier and one of the most effective: it does not understand the code, it just keeps knocking until something breaks. Modern coverage-guided fuzzers steer the noise toward inputs that reach new code paths, homing in on the rare input that hides a bug.
THE TECHNIQUE drive inputs at a guard until one satisfies the crash condition
A function is safe except where a hidden guard x²−20x+91 = 0 holds (its roots, 7 and 13, are the crashing inputs). The fuzzer sweeps the domain and reports the first input that trips it: live demo
HISTORY & CREDIT Barton Miller, 1990
“Random garbage inputs are a waste of time.” — random garbage found crashes in a quarter of standard Unix utilities in Miller's first study, and fuzzers still find critical bugs in browsers, kernels, and crypto today. The machine's tirelessness beats the tester's imagination at reaching the input no one thought to try. cited
1990 · Barton Miller et al. — coins fuzz: random inputs crash 25–33% of tested Unix utilities. 2013 · AFL (Michał Zalewski) — coverage-guided fuzzing: keep inputs that reach new edges, evolve toward deeper paths. now · libFuzzer, OSS-Fuzz — continuous fuzzing finds tens of thousands of bugs across open-source software.
The fuzzer has no theory of your program and needs none. It embodies the falsifier's humility: do not argue that the code is correct — try, relentlessly, to break it, and let the crash speak. Miller 1990
RECOMMEND FOR I-13 the crashing input, found by search, computed
On the canonical compiler, a guard crashes only at the roots of x²−20x+91; the fuzzer sweeps 0..30 and returns the first crashing input:
$ i13 run fuzz.i13 # crashes when x^2 - 20x + 91 == 0 (roots 7, 13)
crashing_input = 7 -- the first input that trips the hidden guard
Recommend: the fuzzer is LIT for I-13 — verified it locates the crashing input x=7, the first root of a hidden guard x²−20x+91, by blind sweep. No model of the program, just relentless knocking until something breaks — the humblest and most outward-facing falsifier there is.