fuzz_storvsp: improve coverage of storvsp/src/lib.rs beyond 58%

Summary

After optimizing the storvsp fuzzer (merging duplicate send functions, adding 0-disk paths, always negotiating protocol), coverage of storvsp/src/lib.rs improved from 41% to 58%. The remaining 42% includes several addressable gaps.

Current coverage (93 min, 20-fork campaign)

Identified gaps

Structurally unreachable — sub-channel code

The fuzzer creates a single primary channel. StorVSP supports sub-channels (Win8+ protocol), but the fuzzer doesn't exercise CreateSubChannels or start sub-channel workers. Adding sub-channel support would unlock the EndInitialization sub-channel path and multi-channel SCSI request handling.

Missing SCSI operations

The fuzzer generates READ, WRITE, REPORT_LUNS, and INQUIRY CDBs. StorVSP also handles these in the SCSI dispatch:

• Other SCSI ops delegated to scsidisk (MODE_SENSE, TEST_UNIT_READY, READ_CAPACITY, etc.) — currently only reachable via the GpaDirectPacket raw path which generates arbitrary CDBs but rarely produces valid ones
• Adding explicit FuzzCdbType variants for high-value SCSI ops would improve scsidisk coverage significantly

io_queue_depth threshold behavior

The process_ready function has branching around max_io_queue_depth for queue saturation. The fuzzer passes None for io_queue_depth (defaults to 256). Fuzzing with a small queue depth (e.g., 1-4) would exercise the saturation/backpressure paths.

Protocol version coverage

The fuzzer always negotiates VERSION_BLUE. StorVSP has version-dependent behavior for Win6/Win7/Win8 (different request_size, multi_channel_supported flag). Adding version variation back (without the old 3-way ratio approach) would cover these paths.

Related

• Part of the fuzzer optimization work in branch fuzz-optimize-all

Start by reading storvsp/src/lib.rs and the current fuzzer behavior described in the issue, then compare its coverage with storvsp/src/test_helpers.rs and scsidisk/src/lib.rs. Choose an identified gap—sub-channels, explicit SCSI operations, queue-depth thresholds, or protocol versions—and run a fuzzing campaign to verify that the targeted paths and coverage improve.