It fuzzes individual syscalls. Does it string them together into sequences? (Edit: yes it does, but it doesn't look for priv escalations, only crashes, kernel panics and the like)
When you have root, it doesn't take many more random syscalls to cause a panic.
Or just try a not-so-random one:
kill(1, 9);
Huh. I guess it’s not too surprising, but that doesn’t work at all. init gets special treatment for signals.
It can be adapted to privlege escalations, but it doesn't do it on it's own. You have to give it a stub to check after running the syscalls to check if the permissions are intact.
Does it trace existing programs and use those as seeds in how to compose syscalls?
I don't think it's got the ability on it's own to do that, but I can imagine you could do it with strace and some other scripting.