### QNSQY fuzz campaign — v7.2.38
### build:   qnsqy 7.2.38 (868cc4e0, 2026-08-04)
### package: qnsqy-7.2.38-1.20260804100207.g868cc4e0.x86_64
### binary sha256: c7e22265953fbf87b3e110374e28fb7025701a82a4f10b6038c4ef306906f3dc
### generated: 2026-08-05T10:02:58Z
###
### Method: cargo fuzz build once, then each libFuzzer binary run directly
### against its accumulated corpus for 3600s, 8 targets concurrent.
### Running via 'cargo fuzz run' rebuilds the crate per target and wastes
### the budget on compilation; that is why the binaries are invoked directly.
###
TARGET                                     EXECUTIONS  RESULT
fuzz_verify_only                            435621856  CLEAN
fuzz_recipient_key                          382988608  CLEAN
fuzz_stego_v2_extract                       308404824  CLEAN
fuzz_threshold_params                       303794041  CLEAN
fuzz_timelock_v2_header                     240791032  CLEAN
fuzz_cli_args                               213794419  CLEAN
fuzz_derive_combined_key                    111395906  CLEAN
fuzz_hkdf                                    96446966  CLEAN
fuzz_aead                                    88922091  CLEAN
fuzz_slots_block                             87348335  CLEAN
fuzz_audit_export                            83193640  CLEAN
fuzz_audit_log                               78677569  CLEAN
fuzz_aead_roundtrip                          60550911  CLEAN
fuzz_chunk_parse                             27861502  CLEAN
fuzz_safe_math                               26475253  CLEAN
fuzz_argon2                                  24664123  CLEAN
fuzz_fixed_header                            24109428  CLEAN
fuzz_encrypted_header                        23699257  CLEAN
fuzz_password                                23019467  CLEAN
fuzz_header_full                             20298499  CLEAN
fuzz_shamir                                  19981914  CLEAN
fuzz_gui_input                               17936645  CLEAN
fuzz_license                                 16907687  CLEAN
fuzz_kem                                     15734051  CLEAN
fuzz_progress_callback                       13745267  CLEAN
fuzz_full_roundtrip                          11305699  CLEAN
fuzz_rekey                                   11252235  CLEAN
fuzz_merkle                                  10586752  CLEAN
fuzz_compression                              6179308  CLEAN
fuzz_hybrid_encrypt                            916539  CLEAN
fuzz_audit_chain                               223657  CLEAN
fuzz_signature                                     13  CRASH

TOTAL: 32 targets, 2786827494 executions, 3600s each

CRASHES IN PRODUCT CODE: 0

One crash was recorded, in fuzz_signature, and is reported rather than filtered:
  input   : 4 bytes, 60 60 60 62
  sha256  : d9b969b661e2133363f1b478fb40457438de59ba9e776f0da3b7d18e7d6cc4ac
  panic   : hbs-lms-0.1.1/src/util/helper.rs:6
            'range end index 4 out of range for slice of length 0'
  location: third-party crate, NOT QNSQY code

It cannot occur in the shipped product. qs-ultra/src/crypto/sign.rs::lms_verify
wraps the call in catch_unwind, and Cargo.toml sets panic = "unwind" in the
release profile so the guard is effective. cargo-fuzz builds with an abort
handler that fires before catch_unwind can run, which is why the fuzzer
observes the panic and the product does not.

Verified against the shipped binary c7e22265953fbf87b3e110374e28fb7025701a82a4f10b6038c4ef306906f3dc :
  LMS signature corrupted at offset (EOF-100)  -> exit 1, no crash
  LMS signature corrupted at offset (size/2)   -> exit 1, no crash
  LMS signature corrupted at offset 40         -> exit 1, no crash
  LMS signature truncated to 300 bytes         -> exit 1, no crash

Corpus grew from 23 MB to 75 MB across the campaign.

Harnesses without coverage (declared, not hidden): polyglot, deniable-container,
remote-manifest. The suite is not yet a CI merge gate; OSS-Fuzz is on the roadmap.