dnsmasq: enable the four C harnesses that have never built since 2021

[tc-agent]

Summary

Enables four libFuzzer harnesses in projects/dnsmasq/ that have been
in-tree since 2021 but never compiled by build.sh. The
copyright-2021 headers and lack of any working ASan crash artifact for
those harness names confirm they have been dormant. Fuzz Introspector
shows fuzz_util is the only running fuzzer today (baseline 1.65%,
418/25,357 lines):
https://introspector.oss-fuzz.com/project-profile?project=dnsmasq

Supersedes the abandoned google/oss-fuzz#11779. Builds on
google/oss-fuzz#15091 (David Korczynski's fuzz_util restoration); this
PR is additive and uses the same toolchain.

What changed

build.sh now produces five libFuzzer binaries:

Harness	Targets
fuzz_util	C++ harness; util/hostname/canonicalise helpers
fuzz_rfc1035	DNS server: extract_addresses, answer_request, extract_request, setup_reply, resize_packet, check_for_bogus_wildcard, etc.
fuzz_auth	Authoritative DNS: answer_auth
fuzz_dhcp	DHCPv4: dhcp_reply
fuzz_dhcp6	DHCPv6: dhcp6_reply

Harness updates

• Updated the four C harnesses' function calls to current dnsmasq
  signatures (extract_addresses 9 args, answer_request 11 args,
  extract_request 5 args, answer_auth 6 args).
• fuzz_blockdata_cleanup was declared extern with no definition;
  replaced with a static stub that calls blockdata_init().
• gb_cleanup() was reordered to free daemon last (dnsmasq's free
  wrapper dereferences daemon).
• fuzz_dhcp / fuzz_dhcp6 invoke dhcp_reply / dhcp6_reply
  directly instead of dhcp_packet / dhcp6_packet, which require a
  real socket for recvmsg().
• init_daemon and fuzz_util substitute a 1-char placeholder when a
  fuzzed string would otherwise be empty, scoped to
  gb_get_null_terminated (the helper called for strings stored in
  daemon-> linked-list fields). This avoids hitting helpers that walk
  past the NUL terminator on zero-length input — unrelated to the new
  harnesses' attack surface.
• dhcp_context->prefix is clamped to a valid IPv4/IPv6 prefix length.
• extract_name output buffers are sized for NAME_ESCAPE 2× expansion.
• Unused fuzz_recvmsg / fuzz_ioctl / syscall_data stubs removed.

Seeds

Generated at build time by two Python scripts under projects/dnsmasq/scripts/.

Coverage

Local 5-minute fuzz_for_pr (concurrent run, same primitive CI uses):

Global: lines 10.5% (2754/26230)  branches 7.3% (1208/16534)
  rfc1035.c                       lines  25.5% ( 423/1662)
  util.c                          lines  47.7% ( 288/604)
  rfc2131.c                       lines  11.1% ( 264/2372)
  edns0.c                         lines  38.6% ( 144/373)
  auth.c                          lines  15.7% ( 113/719)
  dhcp.c                          lines  16.8% ( 118/701)
  rfc3315.c                       lines   5.8% (  99/1704)

Per-harness coverage:

• fuzz_rfc1035: rfc1035.c 22%, cache.c 4%, util.c 10%
• fuzz_auth: auth.c 15.7%, rfc1035.c 8.7%
• fuzz_dhcp: rfc2131.c 11%, dhcp.c 17%
• fuzz_dhcp6: rfc3315.c 0.5%, dhcp6.c 4%
• fuzz_util: util.c 34%

6.4× the Fuzz Introspector baseline.

Build infrastructure

• Always links harnesses with -fuse-ld=lld. GNU ld fails with
  "invalid or unhandled FORM value: 0x25" on DWARF-5 from newer clang.
• fuzz_dhcp.options / fuzz_dhcp6.options set detect_leaks=0
  because dhcp_reply / dhcp6_reply retain allocations in daemon->
  linked lists across iterations.

[github-actions]

Fuzzing Coverage Report

Tested: project dnsmasq · base 0575acd → head 1000fb4 · 300s total fuzz budget · updated 2026-05-28 00:10 UTC · workflow run

Metric	Before	After	Delta
Static reachability	5.4% (29/533)	71.1% (396/557)	+65.7%
Line coverage	1.5% (382/25382)	10.4% (2718/26094)	+611.5%
Branch coverage	0.9% (139/16210)	7.4% (1216/16478)	+774.8%
Function coverage	3.2% (17/533)	23.8% (137/575)	+705.9%

Per-harness

Harness	Lines before	Lines after	Δ
fuzz_auth	0%	3.9% (1001/25532)	new
fuzz_dhcp	0%	4.2% (1065/25541)	new
fuzz_dhcp6	0%	2.3% (585/25547)	new
fuzz_rfc1035	0%	3.7% (948/25668)	new
fuzz_util	1.5% (382/25382)	2.0% (512/25466)	+34.0%

_{Δ = (after − before) / before, to accommodate that denominators may change. "new" when before is 0; "deleted" when after is 0.}