Right now, we rely on debug_message: Vec<u8> as a callback to pass execution feedback to AFL++ from the WASM VM. It might be possible to instrument the WASM directly with debug_message at each Control Flow Graph node.
If debug_message is callable across most of the code without issues, we could achieve full coverage guidance. This could eliminate the need for forking (like WASMI or cargo-contract). It could even enable blackbox fuzzing.