Not enough bugs? Coverage can sometimes be improved by specifying a dictonary (-x dictionary-dir). Some dictonaries are included with afl. For example: /usr/local/share/afl/_extras/png/ "Somewhat predictably, when the syntax tokens are around 1-2 bytes long (as is the case for GIF and JPEG), the benefits of fuzzing with a dictionary are fairly modest and the ultimate coverage does not differ much. For data formats that rely on longer atomically checked tokens (e.g., 4-byte PNG section headers), the gains are are much more profound." /usr/local/share/afl/testcases_readme.txt