read what the binary says about itself: names, signatures, prototypes; gen v2

fuzz.sh

@@ -3,7 +3,9 @@
 #
 # Fans all offline-derivation fuzz targets out across the box with GNU parallel (each target getting
 # N libFuzzer workers), tee's per-target logs to a timestamped dir, then prints a coverage/execs/crash
-# table. Tuned for 8C/16T: 5 targets x 3 workers = 15 threads by default.
+# table. 8 targets x 3 workers = 24 threads by default — above an 8C/16T box's thread count, so pass a
+# smaller `workers` there rather than trusting the default (the thread count is computed from TARGETS,
+# so it moves when a target is added; this comment is the part that does not).
 #
 # Usage:
 #   ./fuzz.sh [seconds] [workers]   run for `seconds` (default 60) with `workers`/target (default 3),
@@ -14,12 +16,18 @@ set -euo pipefail
 CRATE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"   # source2rosetta/ — cargo fuzz runs from here
 cd "$CRATE_DIR"
 
-TARGETS=(fuzz_elf fuzz_schema fuzz_rtti fuzz_sig_abi fuzz_xref)
+TARGETS=(fuzz_elf fuzz_schema fuzz_rtti fuzz_sig_abi fuzz_xref fuzz_valvetab fuzz_pulse fuzz_concmd)
 FUZZ_ROOT="$CRATE_DIR/fuzz"
 LOG_BASE="$FUZZ_ROOT/logs"
 
 # Ignore iced_x86's intentional one-time 'static decoder-table allocation (see lsan_suppressions.txt);
 # a real leak in our own code still fails the run.
+#
+# CAVEAT: an LSan suppression matches on SYMBOLIZED frames, so if symbolization stalls — which it can
+# under this script's own load, every target symbolizing at once — the frame list comes back bare and the
+# suppression misses. That surfaces as a spurious iced_x86 leak artifact under a decoder-heavy target
+# (fuzz_xref, fuzz_sig_abi). Before triaging one, replay it single-target: a false positive reports
+# "Suppressions used: iced_x86" and exits 0.
 export LSAN_OPTIONS="suppressions=$FUZZ_ROOT/lsan_suppressions.txt"
 
 STATS_ONLY=false