If I know what the state machine/protocol looks like, I can have a better idea about how much stuff should be present. For example, if the vendor claims that t

If I know what the state machine/protocol looks like, I can have a better idea about how much stuff should be present. For example, if the vendor claims that the product is limited to a regular grammar (a “plus” for security), but the implementation contains extra stuff in the data section, then an audit can flag it since a finite state machine should (theoretically) only need code.