Maybe also consider “symbolic execution” for fuzzing, there are numerous structures in Bitcoin consensus that are quite unique, e.g the Segwit pattern in themselves (<OP_0> <20-byte-key-hash>) and that is probabilistically very low when you generate input in a blind fuzzing approach.

By the way, you didn’t answered here: #1233827