{
  "slug": "semantic-filesystem-fuzzing",
  "term": "Semantic filesystem fuzzing",
  "aliases": [
    "Semantic file-system fuzzing"
  ],
  "definition": "Semantic filesystem fuzzing generates filesystem inputs and checks their effects against explicit behavioral rules, including errors that do not crash the kernel.",
  "note": "Exploration and checking: Hydra combines input mutation with pluggable checkers; its released artifact includes the SymC3 recovery checker. A sanitizer-only campaign does not establish persistence or API conformance. [artifact]\n\nAllowed outcomes: SymC3 models a set of permitted recovered states. Comparing against one reference image can reject another legitimate outcome. The oracle must match the selected filesystem contract. [hydra]\n\nInput dimensions: Janus mutates metadata and image-dependent operations, repairing metadata checksums to reach deeper code. Its evaluated executor did not support DAX without modification. Repaired checksums do not make deliberately altered metadata trustworthy. [janus]",
  "related": [
    "crash-test-oracle",
    "bounded-crash-testing",
    "fault-model",
    "crash-refinement",
    "filesystem-consistency-invariant",
    "checksum"
  ],
  "citations": [
    {
      "id": "hydra",
      "title": "Kim et al. Finding Semantic Bugs in File Systems with an Extensible Fuzzing Framework. SOSP 2019, sections 3.4-3.7 and 6.",
      "url": "https://seulbae-security.github.io/pubs/hydra-sosp19.pdf",
      "accessed": "2026-11-12"
    },
    {
      "id": "janus",
      "title": "Xu et al. Fuzzing File Systems via Two-Dimensional Input Space Exploration. IEEE S&P 2019, sections IV and VI.",
      "url": "https://gts3.org/assets/papers/2019/xu:janus.pdf",
      "accessed": "2026-11-12"
    },
    {
      "id": "artifact",
      "title": "Hydra authors. README: checker, setup and compatibility; revision fd16457ba756ed602ab8fca378458838cea8e409.",
      "url": "https://github.com/sslab-gatech/hydra/blob/fd16457ba756ed602ab8fca378458838cea8e409/README.md",
      "accessed": "2026-11-12"
    },
    {
      "id": "hesela",
      "title": "Hesela. Crash-consistency tests: the oracle is part of the result.",
      "url": "https://hesela.com/analyses/crash-testing-oracles-and-bounds/#semantic-fuzzing",
      "accessed": "2026-11-12"
    }
  ],
  "status": "research",
  "advantages": [],
  "limitations": [
    {
      "text": "A clean run covers only the exercised inputs and enabled checks; it is not a proof that other states are safe.",
      "citationIds": [
        "hydra"
      ]
    }
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-11-12",
  "provenance": [
    "Primary-source review, not a new fuzzing campaign or present-day vulnerability claim. Historical tool and executor scope retained.",
    "Hydra SOSP 2019 DOI: 10.1145/3341301.3359662. Source sections reviewed beyond the abstract; no bug-count or performance comparison reproduced."
  ]
}