You can download and visualize the instruction-level coverage from the fuzzer in BinaryNinja via the Lighthouse plugin. This will help inform where the fuzzer may be getting stuck, which you could address via binary patching (discussed in Additional Settings).
On the Run Page, click the
Download button of the Coverage section.
In BinaryNinja, open the firmware under test and from
Plugins > Lighthouse > Load coverage file... :
The covered instructions will then be highlighted as shown:
