The effectiveness of a fuzzing campaign is assessed by program coverage. In complex real-world programs, the total reachable coverage is unknown, making it difficult to determine when fuzzing has sufficiently explored the program. Existing approaches use non-parametric estimators, but these can be inaccurate and unstable, often overestimating the coverage. Parametric estimators offer an alternative by assuming an underlying distribution for coverage discovery, potentially improving accuracy and stability, yet remain largely unexplored in fuzzing. For these to work, however, we need to find a parametric model that fits best to coverage discovery.

We evaluate parametric models for coverage discovery by fitting Poisson, Exponential, Gamma, Gamma–Poisson, Negative Binomial, and Zipf–Mandelbrot distributions on seven benchmark programs. Our results show that coverage discovery is best characterized by the Zipf–Mandelbrot distribution, achieving the lowest AIC and BIC and the highest log-likelihood. However, despite this superior fit, the resulting parametric estimators are no more accurate than non-parametric estimators, with both predicting similar values.

This is a negative result: modeling coverage discovery more accurately does not translate into better reachable-coverage estimates. While parametric models provide a principled charac- terization of coverage behavior, improving estimation remains an open challenge for fuzz testing.