# SyzHarness: Patch-Based Kernel Bug Reproduction with LLM-Synthesized Fuzzing Harnesses

arXiv: https://arxiv.org/abs/2609.23889 · HTML: https://mlsanity.com/paper/2609.23889/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 19 of its 61 references that are in the map.
- First posted on arXiv 20 Sep 2026.

## Builds on (most cited first, 19 of 19)

- [Large Language Models are Zero-Shot Fuzzers: Fuzzing Deep-Learning Libraries via Large Language Models](https://mlsanity.com/paper/2212.14834/) (2022)
- [Fuzz4All: Universal Fuzzing with Large Language Models](https://mlsanity.com/paper/2308.04748/) (2023)
- [CyberGym: Evaluating AI Agents' Real-World Cybersecurity Capabilities at Scale](https://mlsanity.com/paper/2506.02548/) (2025)
- [Prompt Fuzzing for Fuzz Driver Generation](https://mlsanity.com/paper/2312.17677/) (2023)
- [How Effective Are They? Exploring Large Language Model Based Fuzz Driver Generation](https://mlsanity.com/paper/2307.12469/) (2023)
- [From CVE Entries to Verifiable Exploits: An Automated Multi-Agent Framework for Reproducing CVEs](https://mlsanity.com/paper/2509.01835/) (2025)
- [LLAMAFUZZ: Large Language Model Enhanced Greybox Fuzzing](https://mlsanity.com/paper/2406.07714/) (2024)
- [Locus: Agentic Predicate Synthesis for Directed Fuzzing](https://mlsanity.com/paper/2508.21302/) (2025)
- [Cottontail: Large Language Model-Driven Concolic Execution for Highly Structured Test Input Generation](https://mlsanity.com/paper/2504.17542/) (2025)
- [SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel](https://mlsanity.com/paper/2111.06002/) (2021)
- [HOPPER: Interpretative Fuzzing for Libraries](https://mlsanity.com/paper/2309.03496/) (2023)
- [HarnessAgent: Scaling Automatic Fuzzing Harness Construction with Tool-Augmented LLM Pipelines](https://mlsanity.com/paper/2512.03420/) (2025)
- [PBFuzz: Agentic Directed Fuzzing for PoV Generation](https://mlsanity.com/paper/2512.04611/) (2025)
- [Directed Greybox Fuzzing via Large Language Model](https://mlsanity.com/paper/2505.03425/) (2025)
- [LibLMFuzz: LLM-Augmented Fuzz Target Generation for Black-box Libraries](https://mlsanity.com/paper/2507.15058/) (2025)
- [KernJC: Automated Vulnerable Environment Generation for Linux Kernel Vulnerabilities](https://mlsanity.com/paper/2404.11107/) (2024)
- [Attention Distance: A Novel Metric for Directed Fuzzing with Large Language Models](https://mlsanity.com/paper/2512.19758/) (2025)
- [PILOT: Command-line Interface Fuzzing via Path-Guided, Iterative Large Language Model Prompting](https://mlsanity.com/paper/2511.20555/) (2025)
- [GPTrace: Effective Crash Deduplication Using LLM Embeddings](https://mlsanity.com/paper/2512.01609/) (2025)

## Abstract (arXiv)

Automated kernel vulnerability reproduction is essential for bug triage, patch validation, and regression testing, but still lacks an effective and efficient solution. The core challenge is twofold: a reproducer must first recover the trigger scaffold needed to reach the vulnerable state and determine the precise concrete values that actually trigger the bug. Existing directed fuzzing approaches are ineffective at recovering the necessary trigger scaffold, while LLM-only generation is brittle because it struggles with concrete-value discovery and runtime nondeterminism. We design SyzHarness, a framework that combines LLM reasoning with coverage-guided fuzzing for patch-based Linux kernel vulnerability reproduction. Given a patch, SyzHarness uses an LLM agent grounded by code navigation tools to synthesize a parameterized fuzzing harness that fixes the prerequisite setup logic while exposing only uncertain, bug-critical input parameters to be mutated by Syzkaller. SyzHarness then translates this harness into a Syzkaller compatible interface and iteratively refines it using hierarchical reachability feedback. We evaluate SyzHarness on multiple datasets of triggerable real-world Linux kernel vulnerabilities. On 100 KernelCTF cases, SyzHarness achieves a 78% bug reproduction success rate. On the SyzDirect benchmark, SyzHarness achieves a 73% bug reproduction success rate, substantially outperforming prior directed greybox fuzzing. On 50 recent, known-triggerable syzbot bugs fixed after March 2026, SyzHarness reproduces 40/50 (80%) using only the fix commits as input.