SymSyz: Improving Hybrid Kernel Fuzzing With Environment Synchronization and Optimized Symbolic Execution

SymDict: A novel hybrid fuzzing method based on symbolic dictionaries

Forbench: Symbolic Simulation Helps Make Your Testbench More Formal

Forbench is introduced, a word-level symbolic simulation framework that retains the familiar execution semantics of simulation but augments it with solver-backed symbolic signals and state transitions, enabling systematic exploration of RTL behaviors under symbolic inputs and conditions.

Towards a Vertically Integrated Compiler Infrastructure to Improve Solver Time during Symbolic Execution

PMDangNull: Preventing use-After-Free for Persistent Memory Applications

Use-After-Free (UAF) remains one of the most critical security threats affecting C/C++ programs. Moreover, the cross-restart persistence semantics of persistent memory (PM) programming models significantly broaden the UAF attack surface. Existing DRAM-based protection schemes lack crash consistency guarantees, whereas existing PM-specific solution, which is based on ASan, suffers from high runtime overhead and offers incomplete protection against UAF. In this paper, we present PMDangNull, a collaborative compiler-allocator protection framework built atop LLVM. PMDangNull instruments protected applications with escape-tracking instructions via a compiler plugin, coordinating with its allocator runtime module to enforce pointer nullification upon deallocation. Experimental results under single-threaded execution with no compiler optimization demonstrate that, compared with the existing solution SafePM, PMDangNull reduces performance and space overheads by up to 62.46% and 41.83%, respectively, and successfully prevents all eight UAF exploits in our test suite.

CHISEL-ing Back Source Code with AI-enabled Iterative Recovery

Decompilation aims to recover high-level, compilable, and semantically equivalent code from binaries. Traditional decompilers produce pseudo-C that is difficult to read and does not compile, while the recent LLM-assisted approaches generate readable, but semantically incorrect code. LLM-aided iterative recovery is an emerging branch of research, but prior works rely on supplied test suites for semantic recovery. In this work, we present CHISEL, a test suite-free framework to iteratively recover source code from Ghidra-derived pseudo-C. CHISEL uses simple yet effective feedback from a compiler (static analysis) and a coverage-guided fuzzer (differential analysis), augmented by rich observables for grounded divergence detection and feedback, cross-iteration divergence memory, and best candidate retention. We systematically evaluate CHISEL for compilation and semantic recovery, feedback oracle soundness, and iteration overhead on 120 ExeBench functions compiled for the x86-64 architecture, across four optimizations (O0-O3), in both stripped and unstripped variants, using the open-weight Gemma4:31b LLM. CHISEL, with all recommended features, achieves an average of 96.1% re-compilability and 79.8% re-executability rates at an average of 2.1 iterations. Significantly, CHISEL recovers 26% of first-generation execution errors. At the same time, CHISEL feedback oracle falsely accepts only 9.4% candidates. Lastly, CHISEL performs significantly better than two recent prior work on LLM-assisted decompilation.

ASFuzz: Detecting Linux Kernel Asynchronous Concurrency Bugs via Asynchronous Shadow Fuzzing

Concurrency bugs arising from asynchronous-synchronous interactions pose a serious and underexplored threat to OS kernel security. Conventional detection methods often fail to capture the delayed triggering nature of asynchronous tasks and their semantic relationships with synchronous execution contexts, limiting their ability to detect such bugs. We propose two key insights: explicit dependency modeling between execution paths, and contingent triggering of asynchronous tasks during associated synchronous execution. Based on this, we develop ASFuzz, an asynchronous fuzzing system that builds a Shadow Dependency Graph to capture scheduling relations, context-matched resource relations, and operation types. Leveraging the Shadow Dependency Graph, ASFuzz employs a dual-mode architecture: a coverage-guided phase explores synchronous paths and collects legitimate asynchronous-triggering seeds, while a shadow execution phase generates legal syscall programs that naturally schedule related asynchronous tasks during relevant synchronous contexts. An adaptive scheduler coordinates the process, balancing broad state exploration and targeted interleaving stress. We evaluated ASFuzz on Linux kernel versions 6.6 to 6.15. The results demonstrate that ASFuzz successfully uncovered 14 previously unknown concurrency-related bugs, including 10 asynchronous concurrency bugs; 5 of the 14 bugs have been assigned CVE identifiers. These findings validate the effectiveness of our dual insights and highlight ASFuzz’s capability in exposing deep and subtle asynchronous concurrency bugs through dependency-driven and context-sensitive testing.