Regarding AFL and AFL++. It’s my understanding that the current testcase is selected and mutated in the main function (during stages). However, I am confused. Within the fuzz_one function, the target binary is ran and forked. Since the chosen testcase and its mutation is selected outside the scope of the fuzz_one function, how is the forked processes ran using different testcases and mutations? I had read somewhere that once the target binary is forked that it continues forking inside the forking function, but my best guess is that this is not the case since mutations are created outside of the scope of the functions which call fork.

So, essentially I just want to confirm that each testcase/mutated testcase is indeed being selected outside the scope of the fuzz_one function (in main), and then once inside the fuzz_one functions the target binary is run with the given testcase/mutated testcase.