Gömülü sınıf donanımda MQTT broker gerçeklemelerinin eşit girdi bütçeli fuzzing ile karşılaştırmalı değerlendirmesi — replication package (v3)

Replication package for a comparative fuzzing study of three open source MQTT brokers — Eclipse Mosquitto v2.1.2 (single threaded event loop), NanoMQ 0.25.6 (actor model) and FlashMQ v1.27.1 (thread per core) — carried out on a Raspberry Pi 3 Model B+ with 1 GB of memory running Debian 13 (trixie) on aarch64. Six independent five-hour sessions were executed, one per broker-tool pair, using Radamsa (blind mutation) and Boofuzz (field aware). The harness transmitted 10,621,437 application layer packets in total. Four independent oracles were monitored concurrently: process termination, memory safety violation reported by AddressSanitizer, unresponsiveness probed every 500 packets, and protocol violation. No anomaly was observed on Mosquitto or NanoMQ. On FlashMQ v1.27.1 a reachable assertion (CWE-617) in the retained message handler produced 2,137 recorded events; it is reachable by an unauthenticated client sending a single PUBLISH packet with the retain flag set and a malformed topic field. The finding was reported to the maintainer before publication. The package contains the fuzzing harnesses, the validated 51-packet seed corpus, per-campaign event logs and summary statistics, line/function/branch coverage data produced with gcov, lcov and gcovr, and a full record of the hardware and software environment. SHA-256 checksums are included. The package also documents a virtual address space constraint that prevents AddressSanitizer from operating under the default Raspberry Pi kernel, and the kernel substitution used to resolve it. Version 2 (27 Sep 2026): Coverage data in 04_kapsama/ re-measured on coverage builds of the exact commits used in the campaigns (Mosquitto 99fa50f, NanoMQ 926179e, FlashMQ c371f4e) with a consistent gcovr filter; previous coverage files were measured on different commits and have been withdrawn. Added the complete event/resource records for the two Radamsa sessions that were empty in v1, the FlashMQ configuration file used in the campaigns, and crash-fingerprint evidence (03_kampanya_kayitlari/parmak_izi/). README updated to match the manuscript; SHA256SUMS regenerated. Version 3.0 (1 November 2026) — Experiment 2 added Version 3.0 adds a second, controlled experiment to the replication package. Experiment 1 (exploratory, 5-hour time budget, one run per configuration) is unchanged. Experiment 2 design: Equal input budget: 500,000 mutated inputs per tool–broker pair (Radamsa, Boofuzz × Mosquitto v2.1.2, NanoMQ 0.25.6, FlashMQ v1.27.1), three repetitions. Equal packet-type mix for both tools: CONNECT, retained PUBLISH and SUBSCRIBE in equal shares; a fixed MQTT 3.1.1 CONNECT precedes every input. A 10-minute idle baseline per broker and repetition; resource usage is reported relative to it. 27 runs in total (18 fuzzing + 9 idle), 9,000,000 inputs, 30.2 hours. Main results: No process termination (O1), AddressSanitizer report (O2) or unresponsiveness (O3) for Mosquitto and NanoMQ. FlashMQ: O1 per 10^5 inputs 245.9 ± 0.3 with Boofuzz and 4.0 ± 0.6 with Radamsa (about 61×). All assertion lines point to the same location, subscriptionstore.cpp:993 (CWE-617, SubscriptionStore::setRetainedMessage), as in Experiment 1. Per-input CPU time: Mosquitto 1.1–1.2 ms, FlashMQ 3.4 ms, NanoMQ 4.1–4.2 ms. Files: mqtt-fuzzing-v3.0.zip: complete replication package (Experiment 1 and Experiment 2); Experiment 2 is in 06_deney2/ (summary, tables A–C, 27 run folders with events, resources, manifests, harness logs, truncated broker logs, FlashMQ assertion fingerprint) and its scripts in 01_betikler/v2/. deney2_ham.tar.gz: untruncated raw output of Experiment 2 as produced on the Raspberry Pi (runs_v2/, including full broker logs, input samples and per-repetition backups).