test(gap): make fuzz test deterministic and cover all parse entry points

Replace ad-hoc random fuzz with a seeded random.Random so any crash is
reproducible from the CI log alone, drop the per-iteration print() that
flooded test output, and exercise every public parse entry point (not
just _uncached_parse_advertisement_data) plus a targeted truncated-length
case that overruns the buffer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bluetoothbot

tests/test_gap_fuzzer.py

@@ -1,15 +1,52 @@
+"""Deterministic fuzz coverage for the GAP parser.
+
+Generates pseudo-random advertisement payloads with a fixed seed so any
+crash is reproducible from a CI log alone, and exercises every public
+parse entry point so failures aren't hidden behind a single code path.
+"""
+
 import random
 
+from bluetooth_data_tools import (
+    parse_advertisement_data,
+    parse_advertisement_data_bytes,
+    parse_advertisement_data_tuple,
+)
 from bluetooth_data_tools.gap import _uncached_parse_advertisement_data
 
+_FUZZ_SEED = 0xB1EC0FFEE
+_FUZZ_ITERATIONS = 1000
+
+
+def _random_chunks(rng: random.Random) -> tuple[bytes, ...]:
+    return tuple(
+        bytes(rng.randint(0, 255) for _ in range(rng.randint(1, 31)))
+        for _ in range(rng.randint(1, 3))
+    )
+
+
+def test_gap_fuzzer_random_bytes_do_not_crash() -> None:
+    rng = random.Random(_FUZZ_SEED)
+    for _ in range(_FUZZ_ITERATIONS):
+        chunks = _random_chunks(rng)
+        joined = b"".join(chunks)
+        # Every public entry point must tolerate arbitrary bytes without raising.
+        _uncached_parse_advertisement_data(joined)
+        parse_advertisement_data_bytes(joined)
+        parse_advertisement_data_tuple(chunks)
+        parse_advertisement_data(chunks)
+
 
-def test_gap_fuzzer() -> None:
-    """Test random data does not crash."""
-    for i in range(1000):
-        adv = (
-            bytes([random.randint(0, 255) for _ in range(random.randint(1, 31))]),
-            bytes([random.randint(0, 255) for _ in range(random.randint(1, 31))]),
-            bytes([random.randint(0, 255) for _ in range(random.randint(1, 31))]),
-        )
-        print([i, adv])
-        _uncached_parse_advertisement_data(b"".join(adv))
+def test_gap_fuzzer_truncated_length_does_not_crash() -> None:
+    """An AD struct that claims more bytes than remain must be rejected, not read."""
+    rng = random.Random(_FUZZ_SEED ^ 0x1)
+    for _ in range(200):
+        # Claim a length that overruns the buffer, then provide a smaller body.
+        body = bytes(rng.randint(0, 255) for _ in range(rng.randint(0, 5)))
+        # length byte = 100 (huge), random type, short body
+        payload = bytes([100, rng.randint(1, 0xFF)]) + body
+        adv = parse_advertisement_data((payload,))
+        assert adv.local_name is None
+        assert adv.manufacturer_data == {}
+        assert adv.service_data == {}
+        assert adv.service_uuids == []