Even with 100% coverage, there might be the following code (just a one of numerous examples): char buffer[15]; ..... memcpy(buffer, source, strlen(source));

Even with 100% coverage, there might be the following code (just a one of numerous examples): char buffer[15]; ..... memcpy(buffer, source, strlen(source)); Depending on the `source`, the bug can be triggered or not, but the coverage is the same for different `source` values.