The code looks pretty rough

sanitise.c -> get_interesting_value:
i = rand() & 20;
...
switch (i) {
case 0: return 0x00000001;
...
case 20: return 0xffffffffffffffff;

So I think that should have been rand() % 21...

sanitise.c -> get_address:
i = rand() % 2
...
switch (i) {
case 0: return KERNEL_ADDR;
...
case 2: return get_interesting_value();

So that probably should be rand() % 3

That's not to mention how horrible rand() is at actually being random, especially
in the lower two bits of output. Between those bugs it really reduces the number
of addresses that are tried. I notice that random() is used other places but
srandom() isn't ever called (though srand() is called twice).

I also wonder if address space randomization makes this less useful -- how
often does it fail to reproduce the same crash or misbehavior because memory
has shifted around?

I suppose I should send a patch instead of complaining.

-Ross