tor is in OSS-Fuzz, and I recently found this very slick dashboard that shows you just what coverage tor is getting out of it: https://storage.googleapis.com/oss-fuzz-coverage/tor/reports/20180829/linux/...

Thought I'd share in case others hadn't seen it (I think it's fairly new.)

-tom