read what the binary says about itself: names, signatures, prototypes; gen v2

fuzz/gen_corpus.rs

@@ -11,12 +11,20 @@
 use std::fs;
 use std::path::Path;
 
+/// Every target that takes a whole ELF image as its input, and therefore cannot reach anything
+/// interesting without a real one to start from. `fuzz_valvetab` and `fuzz_pulse` read Valve's
+/// in-binary tables out of `.data.rel.ro`, so an unseeded run spends its whole budget failing to
+/// mutate a valid ELF header into existence — the corpus they accumulate from a previous run hides
+/// that, right up until someone clones the repo or clears the corpus.
 const TARGETS: &[&str] = &[
     "fuzz_elf",
     "fuzz_schema",
     "fuzz_rtti",
     "fuzz_sig_abi",
     "fuzz_xref",
+    "fuzz_valvetab",
+    "fuzz_pulse",
+    "fuzz_concmd",
 ];
 
 fn w16(v: &mut [u8], o: usize, x: u16) {