But isn't the point of afl-fuzz that it knows deeply about the executable its targeting (watches its state)? So it would be like inspecting the test cases deep

But isn't the point of afl-fuzz that it knows deeply about the executable its targeting (watches its state)? So it would be like inspecting the test cases deeply as you fuzz, as opposed to treating them as a black box to hill-climb...