Played around with coverage-guided fuzzing using honggfuzz and Intel BTS/PT a while back. Didn't have much time to fine-tune, but it seemed solid. It'd need a couple of months to properly dial in and see real results. The coverage was increasing, and aligning with the symbol tables, it was hitting the right parts of the kernel.

Harness: https://github.com/google/honggfuzz/tree/master/examples/lin...