Wi-Fi is a widely used wireless protocol, and mobile hotspot functionality has become essential for on-the-go connectivity. Bugs in the hotspot protocol stack can cause crashes, performance degradation, and semantic inconsistencies. Fuzzing is a promising technique for detecting such vulnerabilities. However, existing fuzzers typically test by modeling protocol inputs but ignore some critical dependencies among Wi-Fi fields, leading to inefficient testing. In this work, we present WiDepFuzz, a fuzzing framework designed to detect bugs in Mobile Hotspot implementations by modeling field dependencies in the Wi-Fi protocol. First, WiDepFuzz automatically identifies the semantic dependencies among Wi-Fi fields based on the IEEE 802.11 standard and constructs a Field Dependency Model (FDModel) to characterize various direct and indirect dependencies. Second, leveraging the FDModel, WiDepFuzz utilizes dependency-combination guided fuzzing to constantly generate Wi-Fi test frames that efficiently explore deep paths and trigger hidden bugs. Finally, we propose liveness and dependency detectors that enable real-time monitoring to identify abnormal states and uncover potential bugs in mobile hotspots. We implemented WiDepFuzz and evaluated it in six widely used mobile hotspots, covering major smartphone manufacturers, including Samsung, Xiaomi, OPPO, Honor, Huawei, and Nokia. Compared to SOTA Wi-Fi fuzzers like Peach, OwFuzz, wpaspy, and Greyhound, WiDepFuzz detects 15 more bugs and improves bug detection speed by 37% on average. In total, it uncovered 20 new bugs.

@inproceedings{paperbot12205,
  title = {WiDepFuzz: Finding Wi-Fi Protocol Bugs in Mobile Hotspot via Field Dependency Model},
  author = {Yuanliang Chen and Fuchen Ma and Taotao Gu and Yu Jiang},
  booktitle = {ASE},
  year = {2026},
  doi = {10.1145/3832783.3837483}
}