  We present a novel gray-box fuzzing algorithm monitoring executions of
instructions converting numerical values to Boolean ones. An important class of
such instructions evaluate predicates, e.g., *cmp in LLVM. That alone allows us
to infer the input dependency (c.f. the taint analysis) during the fuzzing
on-the-fly with reasonable accuracy, which in turn enables an effective use of
the gradient descent on these instructions (to invert the result of their
evaluation). Although the fuzzing attempts to maximize the coverage of the
instructions, there is an interesting correlation with the standard branch
coverage, which we are able to achieve indirectly. The evaluation on Test-Comp
2023 benchmarks shows that our approach, despite being a pure gray-box fuzzing,
is able to compete with the leading tools in the competition, which combine
fuzzing with other powerful techniques like model checking, symbolic execution,
or abstract interpretation.
