一句话：提出 VAFuzz，将变异性感知分析融入模糊测试过程，通过新的种子队列与变异策略提升配置空间探索能力。
现代软件系统为提升复用性与适应性提供了庞大的配置空间，但可配置性也让缺陷发现变得更加困难。现有的静态与动态变异性感知分析虽能系统性地探索配置空间，却常受可扩展性限制；而灰盒模糊测试虽在漏洞检测上表现出色，当前主流的配置模糊测试器却未将变异性感知分析整合进模糊测试循环。本文提出 VAFuzz，一个新颖的变异性感知模糊测试器，把有原则的动态变异性感知分析嵌入模糊测试过程以增强配置空间探索。VAFuzz 引入变异性感知的种子选择与变异操作，其基础是新的存在条件（presence condition）种子队列——用于跟踪配置空间中的覆盖率与崩溃贡献——以及刻画数据种子与存在条件之间关系的映射。在多样化程序上的评估表明，VAFuzz 在 25 个程序中的 21 个上代码覆盖率优于当前最优的配置模糊测试器，并检测到更多漏洞，其中包括此前未知的缺陷。
Modern software systems often provide a vast configuration space to enhance reusability and adaptability, but this configurability also significantly complicates bug finding. While existing static and dynamic variability-aware analysis approaches systematically explore the configuration space, they often suffer from scalability limitations. Conversely, grey-box fuzzing has demonstrated remarkable success in vulnerability detection through lightweight, iterative input space exploration, yet the state-of-the-art configuration fuzzers overlook the potential of integrating variability-aware analysis within the fuzzing process. In this paper, we present VAFuzz, a novel variability-aware fuzzer that integrates principled dynamic variability-aware analysis within the fuzzing process to enhance configuration space exploration. VAFuzz introduces new variability-aware seed selection and mutations to drive the fuzzing process. These are enabled by a new presence condition seed queue that tracks coverage and crash contributions across the configuration space, and a map that captures the relationship between data seeds and presence conditions. Our evaluation on a diverse set of programs show that VAFuzz outperforms the state-of-the-art configuration fuzzers on 21 out of 25 programs in terms of code coverage. It also detects more vulnerabilities than these baselines, including previous unknown bugs.