Fuzz4DB: A Practice of LLM-Agent-Guided Fuzzing for Database Feature-Level Delta Testing

Abstract

Modern database management systems (DBMSs) evolve rapidly via frequent feature commits, yet validating each code delta within a 24-hour Continuous Integration (CI) budget remains an industrial challenge. Traditional manual regression testing is labor-intensive, while existing automated tools fall short: generation-based fuzzers achieve high throughput but are change-unaware, whereas LLM-based agents understand feature deltas but are orders of magnitude too slow for systematic testing. This paper presents Fuzz4DB, an LLM-agent-guided fuzzer designed for targeted DBMS feature testing. Fuzz4DB decouples LLM-based semantic planning from grammar-based test instantiation, bridging the gap between semantic awareness and generation efficiency. The LLM-powered agent of Fuzz4DB analyzes code deltas and coverage feedback to synthesize test directives—structured specifications at three precision levels, namely grammar scopes, derivation paths, and context–query template pairs. A grammar-based fuzzer then expands each directive into batches of valid SQL test cases. A coverage feedback loop escalates directive precision as coverage growth stalls. Running in the TDSQL production environment for over six months, Fuzz4DB has intercepted 74 zero-day bugs, accounting for ∼40% of all SQL-subsystem bugs. In evaluations across 12 feature commits from 5 mainstream DBMSs, Fuzz4DB achieved 86.9% delta code coverage, outperforming the best automated baseline by 36.9%. Over its full lifecycle on four open-source DBMSs, Fuzz4DB discovered a total of 62 unique bugs (45 newly confirmed by upstream communities), 59 of which were undetectable by state-of-the-art tools within the 24-hour CI window. Furthermore, Fuzz4DB reduces per-commit validation effort from ∼5 person-days to ∼1 person-day, an ∼80% reduction.