Seeing the Boot

Standard kernel fuzzers rely on KCOV, which requires user space to open a debugfs file and misses everything start_kernel() executes during early boot. This blind spot spans over 860 boot parameter handlers that configure permanent global kernel state. Because modern cloud, confidential-computing, and embedded pipelines assemble command lines automatically from templates, orchestrator metadata, and untrusted host inputs, malformed boot parameters can silently corrupt system state. Early KCOV & ek-fuzz Early KCOV extends KCOV to the boot path on x86-64, arm64, and 32-bit ARM without hypervisor support or impact on regular KCOV users. Phase 1 logs early parameter parsing into a static 2 MiB __initdata bootstrap buffer, and Phase 2 records argument parsing and subsystem initialization up to rest_init() in a memblock buffer for post-boot debugfs export. Atop this, the authors apply a two-stage pollution analysis and ek-fuzz, a specification-driven fuzzer (backed by FuzzTest and Centipede) combining early-boot block and edge feedback with five single-run and differential state oracles (crash, canary, wb, split, and alias). Findings in Linux 7.3 rc Testing the Linux 7.3 rc development tree uncovered 15 new bugs (all patched and verified) across core parameter parsing, memory management, scheduler isolation, block device, PCI, serial, and ALSA subsystems. Thirteen allow normal booting to user space while planting latent runtime vulnerabilities or silent security-state corruption: Dormant KASAN slab-use-after-free and divide-by-zero bugs in the RAM disk driver (brd.max_part=). Out-of-bounds global array reads and writes in ALSA (snd.cards_limit=) and 8250 serial (8250.nr_uarts=). An integer wrap that zeroes the Stack Clash guard gap (stack_guard_gap=). A dormant memblock out-of-bounds writer in tag-based KASAN (kasan.stack_ring_size=). Command-line overruns that reinterpret or silently drop subsequent security parameters (isolcpus=, test_suspend).