From 375724bcc87e7ba0fae176d6584b5d4c9b7667b2 Mon Sep 17 00:00:00 2001
From: hsh814 <shhan@unist.ac.kr>
Date: Wed, 24 Jun 2026 05:43:35 +0000
Subject: [PATCH 1/2] Fix: prevent re-registraion of instruction hooks in
 gen_blocks_calls in CallTracerModule

---
 crates/libafl_qemu/src/modules/calls.rs | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/crates/libafl_qemu/src/modules/calls.rs b/crates/libafl_qemu/src/modules/calls.rs
index 65d0f065bdc..86da12a5956 100644
--- a/crates/libafl_qemu/src/modules/calls.rs
+++ b/crates/libafl_qemu/src/modules/calls.rs
@@ -1,4 +1,5 @@
 use core::{cell::UnsafeCell, fmt::Debug};
+use std::collections::HashSet;
 
 use capstone::prelude::*;
 use libafl::{
@@ -235,6 +236,8 @@ where
     filter: StdAddressFilter,
     cs: Capstone,
     collectors: Option<T>,
+    registered_call_addrs: HashSet<GuestAddr>,
+    registered_ret_addrs: HashSet<GuestAddr>,
 }
 
 impl<T> CallTracerModule<T>
@@ -247,6 +250,8 @@ where
             filter,
             cs: capstone().detail(true).build().unwrap(),
             collectors: Some(collectors),
+            registered_call_addrs: HashSet::new(),
+            registered_ret_addrs: HashSet::new(),
         }
     }
 
@@ -379,6 +384,14 @@ where
         }
 
         for (call_addr, call_len) in call_addrs {
+            // Skip registration if we already have a hook at this address.
+            if !emulator_modules
+                .get_mut::<Self>()
+                .is_none_or(|h| h.registered_call_addrs.insert(call_addr))
+            {
+                continue;
+            }
+
             // TODO do not use a closure, find a more efficient way to pass call_len
             let call_cb = Box::new(
                 move |_qemu: Qemu,
@@ -405,6 +418,13 @@ where
         }
 
         for ret_addr in ret_addrs {
+            // Skip registration if we already have a hook at this address.
+            if !emulator_modules
+                .get_mut::<Self>()
+                .is_none_or(|h| h.registered_ret_addrs.insert(ret_addr))
+            {
+                continue;
+            }
             emulator_modules.instruction_function(ret_addr, Self::on_ret, false);
         }
 

From 1bbac3138468fc47f4d7939abfb87ada465b0056 Mon Sep 17 00:00:00 2001
From: hsh814 <shhan@unist.ac.kr>
Date: Wed, 24 Jun 2026 07:36:36 +0000
Subject: [PATCH 2/2] Use hashbrown::HashSet

---
 crates/libafl_qemu/src/modules/calls.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crates/libafl_qemu/src/modules/calls.rs b/crates/libafl_qemu/src/modules/calls.rs
index 86da12a5956..ab26a2a7d3e 100644
--- a/crates/libafl_qemu/src/modules/calls.rs
+++ b/crates/libafl_qemu/src/modules/calls.rs
@@ -1,5 +1,5 @@
 use core::{cell::UnsafeCell, fmt::Debug};
-use std::collections::HashSet;
+use hashbrown::HashSet;
 
 use capstone::prelude::*;
 use libafl::{