The fuzzer instruments the program, and an input that executes a branch no earlier input reached is kept as “interesting” and mutated further. This steers the search deep into the parser instead of guessing blindly.