From 371eac8069a47f27c3c388c7cb2251f0a2a1d8e8 Mon Sep 17 00:00:00 2001
From: frankomosh <frankomosh197@gmail.com>
Date: Fri, 27 Mar 2026 11:14:50 +0300
Subject: [PATCH] fuzz: exercise ForNode/ForEachNode callbacks in connman fuzz
 harness

Track inserted node IDs and select from them when calling ForNode, so the ID-match branch is hit more frequently. Replace no-op callbacks with CNode accessor calls to exercise previously uncovered code paths (IsFullOutboundConn, ConnectionTypeAsString) through the iteration.
---
 src/test/fuzz/connman.cpp | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/src/test/fuzz/connman.cpp b/src/test/fuzz/connman.cpp
index 1b0859d6ffe..7ac4f3b8c54 100644
--- a/src/test/fuzz/connman.cpp
+++ b/src/test/fuzz/connman.cpp
@@ -99,12 +99,14 @@ FUZZ_TARGET(connman, .init = initialize_connman)
     CNode random_node = ConsumeNode(fuzzed_data_provider);
     CSubNet random_subnet;
     std::string random_string;
+    std::vector<NodeId> node_ids;
 
     LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 100) {
         CNode& p2p_node{*ConsumeNodeAsUniquePtr(fuzzed_data_provider).release()};
         // Simulate post-handshake state.
         p2p_node.fSuccessfullyConnected = true;
         connman.AddTestNode(p2p_node);
+        node_ids.push_back(p2p_node.GetId());
     }
 
     LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 10000) {
@@ -141,10 +143,15 @@ FUZZ_TARGET(connman, .init = initialize_connman)
                 connman.DisconnectNode(random_subnet);
             },
             [&] {
-                connman.ForEachNode([](auto) {});
-            },
-            [&] {
-                (void)connman.ForNode(fuzzed_data_provider.ConsumeIntegral<NodeId>(), [&](auto) { return fuzzed_data_provider.ConsumeBool(); });
+                NodeId id = node_ids.empty() || fuzzed_data_provider.ConsumeBool()
+                    ? fuzzed_data_provider.ConsumeIntegral<NodeId>()
+                    : PickValue(fuzzed_data_provider, node_ids);
+                (void)connman.ForNode(id, [&](CNode* pnode) {
+                    (void)pnode->GetId();
+                    (void)pnode->IsInboundConn();
+                    (void)pnode->IsFullOutboundConn();
+                    return true;
+                });
             },
             [&] {
                 auto max_addresses = fuzzed_data_provider.ConsumeIntegral<size_t>();
@@ -228,6 +235,12 @@ FUZZ_TARGET(connman, .init = initialize_connman)
                 connman.SocketHandlerPublic();
             });
     }
+    connman.ForEachNode([](CNode* pnode) {
+        (void)pnode->GetId();
+        (void)pnode->IsInboundConn();
+        (void)pnode->IsFullOutboundConn();
+        (void)pnode->ConnectionTypeAsString();
+    });
     (void)connman.GetAddedNodeInfo(fuzzed_data_provider.ConsumeBool());
     (void)connman.GetExtraFullOutboundCount();
     (void)connman.GetLocalServices();