Previously I’ve fuzzed hivex and nbdkit using my favourite fuzzing tool, Michał Zalewski’s American Fuzzy Lop (AFL).
AFL works by creating test cases which are files on disk, and then feeding those to programs which have been specially compiled so that AFL can trace into them and find out which parts of the code are run by the test case. It then adjusts the test cases and repeats, aiming to run more parts of the code and find ways to crash the program.
This works well for programs that parse files (like hivex, but also binary parsers of all sorts and XML parsers and similar). It can also be used to fuzz some servers where you can feed a file to the server and discard anything the server sends back. In nbdkit we can use the nbdkit -s option to do exactly this, making it easy to fuzz.
However it’s not obvious how you could use this to fuzz network clients. As readers will know we’ve been writing a new NBD client library called libnbd. But can we fuzz this? And find bugs? As it happens yes, and ooops — yes — AFL found a remote code execution bug allowing complete takeover of the client by a malicious server.
The trick to fuzzing a network client is to do the server thing in reverse. We set up a phony server which feeds the test case back to the client socket, while discarding anything that the client writes:
This is wrapped up into a single wrapper program which takes the test case on the command line and forks itself to make the client and server sides connected by a socket. This allows easy integration into an AFL workflow.
We found our Very Serious Bug within 3 days of fuzzing.
Richard WM Jones 
how does the fuzz wrapper and libnbd client talk to each other without previously being connected through the terminal by using IP address and socket?
Not exactly sure I understand the question, but the way it works is the program creates a socketpair, and immediately forks, creating a libnbd client in one half of the fork, and the phony server in the other half. May be best to read the code: https://github.com/libguestfs/libnbd/blob/master/fuzzing/libnbd-fuzz-wrapper.c
So I did read the libnbd-fuzz-wrapper.c it make sense but I was wondering how can I check if the connection between the phony server and the client is really working and they are communicating correctly during the fuzzing process