fuzz_ide: implement enlightened port fuzzing for INT13 fast path coverage

Summary

fuzz_ide achieves ~81% line coverage on ide/src/lib.rs but the enlightened INT13 optimization path is largely untested. This path is a real Windows boot optimization and processes guest-supplied data.

Current coverage (93 min, 20-fork campaign)

Enlightened port gap

The IDE device has two enlightened ports (0x1E0 primary, 0x160 secondary) for Microsoft's INT13 optimization. When the guest writes to these ports, the value is interpreted as a GPA pointing to a 16-byte EnlightenedInt13Command structure in guest memory.

The fuzzer has this TODO at the action loop:

// TODO: when hitting enlightened ports, make value point into guest memory

Currently, FuzzChipset writes arbitrary values to these ports. Since the values are treated as GPAs, they almost never point into the valid 4KB guest memory range (0-4095), causing the read_plain to fail silently and skip the entire fast path.

Suggested fix

When chipset.exec_action() generates a PortIoWrite targeting 0x1E0 or 0x160, replace the write value with a GPA that points into the fuzzer's guest memory. The guest memory is already populated with fuzzed data (the 256-byte static_config.memory pattern), so the EnlightenedInt13Command structure will be naturally fuzzed.

Options:

1. Post-process in the fuzzer: intercept PortIoWrite actions for enlightened ports and clamp the value to 0..guest_mem_size
2. Populate more guest memory: increase guest memory to cover more of the GPA space
3. Explicit action variant: add an EnlightenedWrite action that generates a valid GPA + writes an EnlightenedInt13Command to that location first

Option 3 gives the best coverage since it can generate well-formed commands that exercise the full enlightened_hdd_command() / enlightened_cd_command() dispatch.

Related

• Part of the fuzzer optimization work in branch fuzz-optimize-all

Start at the action loop containing the TODO in the fuzzer and read the enlightened_hdd_command() and enlightened_cd_command() paths in ide/src/lib.rs. Run the existing fuzz campaign to confirm enlightened-port writes currently miss guest memory, then implement a valid action or write strategy that reaches those paths. Done means the fast paths execute during fuzzing and coverage improves beyond the current gaps.