I took a quick skim of the code and nothing obviously popped out at me. How do you preserve architectural behavior of the emulator while 'fuzzing'? How does the emulator know where the boundary of the code under test is?