Does coverage guidance actually help much here, or does most of the value come from having a good generator and reference model?
Under the hood, the fuzzer actually works with _features_, not source code coverage and there are ways in explicitly giving the fuzzer additional feedback. Some early data suggests that this is very effevtive.