From d522fd3196368d4be337bff7bc2a5f33ce3ed1c4 Mon Sep 17 00:00:00 2001
From: Hao Xu <hao.xu@linux.dev>
Date: Wed, 17 Jun 2026 20:10:20 +0800
Subject: [PATCH] fuzz: prepare deterministic mempool rebuilds

Reset the global PRNG before the dirty-state reset in process_message
and process_messages.

This prepares the reset path for the following change, which rebuilds
the reused mempool together with the chainman. The mempool construction
path consumes PRNG-backed state, so the rebuild should start from a
fixed seed rather than from the RNG state left by the fuzz input.
---
 src/test/fuzz/process_message.cpp  | 7 ++++++-
 src/test/fuzz/process_messages.cpp | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/src/test/fuzz/process_message.cpp b/src/test/fuzz/process_message.cpp
index 932a4c2fa15..b35c4021ae0 100644
--- a/src/test/fuzz/process_message.cpp
+++ b/src/test/fuzz/process_message.cpp
@@ -23,6 +23,7 @@
 #include <test/util/setup_common.h>
 #include <test/util/time.h>
 #include <test/util/validation.h>
+#include <uint256.h>
 #include <util/check.h>
 #include <util/time.h>
 #include <validation.h>
@@ -57,6 +58,8 @@ void ResetChainman(TestingSetup& setup)
 }
 } // namespace
 
+extern void MakeRandDeterministicDANGEROUS(const uint256& seed) noexcept;
+
 void initialize_process_message()
 {
     if (const auto val{std::getenv("LIMIT_TO_MESSAGE_TYPE")}) {
@@ -143,7 +146,9 @@ FUZZ_TARGET(process_message, .init = initialize_process_message)
     node.validation_signals->UnregisterValidationInterface(node.peerman.get());
     node.connman->StopNodes();
     if (block_index_size != WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())) {
-        // Reuse the global chainman, but reset it when it is dirty
+        // Reuse the global chainman, but reset it when it is dirty. Reset the
+        // rng first, so ResetChainman() consumes it from a fixed seed.
+        MakeRandDeterministicDANGEROUS(uint256::ZERO);
         ResetChainman(*g_setup);
     }
 }
diff --git a/src/test/fuzz/process_messages.cpp b/src/test/fuzz/process_messages.cpp
index 094c956f777..9a1f28af92c 100644
--- a/src/test/fuzz/process_messages.cpp
+++ b/src/test/fuzz/process_messages.cpp
@@ -23,6 +23,7 @@
 #include <test/util/setup_common.h>
 #include <test/util/time.h>
 #include <test/util/validation.h>
+#include <uint256.h>
 #include <util/time.h>
 #include <validation.h>
 #include <validationinterface.h>
@@ -51,6 +52,8 @@ void ResetChainman(TestingSetup& setup)
 }
 } // namespace
 
+extern void MakeRandDeterministicDANGEROUS(const uint256& seed) noexcept;
+
 void initialize_process_messages()
 {
     static const auto testing_setup{
@@ -142,7 +145,9 @@ FUZZ_TARGET(process_messages, .init = initialize_process_messages)
     node.validation_signals->UnregisterValidationInterface(node.peerman.get());
     node.connman->StopNodes();
     if (block_index_size != WITH_LOCK(chainman.GetMutex(), return chainman.BlockIndex().size())) {
-        // Reuse the global chainman, but reset it when it is dirty
+        // Reuse the global chainman, but reset it when it is dirty. Reset the
+        // rng first, so ResetChainman() consumes it from a fixed seed.
+        MakeRandDeterministicDANGEROUS(uint256::ZERO);
         ResetChainman(*g_setup);
     }
 }