Razzer

Specifically focuses on race condition bugs, combining static analysis with dynamic fuzzing to efficiently uncover concurrency vulnerabilities, as highlighted in its two-phase approach and paper.

Uses LLVM toolchain and SVF static analysis to identify potential race-prone kernel code paths, improving fuzzing efficiency, as documented in the static analysis section.

Has discovered numerous critical kernel vulnerabilities like use-after-free and null-pointer dereferences, evidenced by the extensive trophies list in the README.

Leverages Syzkaller with a deterministic scheduler via QEMU/KVM for systematic fuzzing, enhancing reproducibility, as outlined in the fuzzing documentation.