Not necessarily because the fuzzer has visibility into the execution pathways triggered, so it can "feel" its way through the maze. For example, say any certif

Not necessarily because the fuzzer has visibility into the execution pathways triggered, so it can "feel" its way through the maze. For example, say any certificate that starts with 0x00 is invalid (and there's an up-front test and return). Once the fuzzer has tried 0x00 and concluded that the pathway is a dead end, it won't try again, even though there are squillions of data blocks beginning 0x00. It's not a highly efficient way to generate a valid certificate (especially when you have to navigate the network code as well), but it's also not just rolling 'n' 256-sided dice until the end of the universe.