It's theoretically possible that two branches with relevantly different behavior will each result in the execution of an equal number of instructions, though. T

It's theoretically possible that two branches with relevantly different behavior will each result in the execution of an equal number of instructions, though. Then you can't actually tell that the behavior behind the scenes was different if the data sent over the wire is unchanged. (By contrast, AFL can tell that a branch was taken or missed even if the output is the same because it directly sees the execution state, just like in the beginning of this JPEG synthesis example where it noticed that the first byte should be 0xff even though that didn't change the output.) But your idea is very clever and seems like a potential new application of timing attacks! Someone should definitely try this.