Implementing snapshot fuzzing in QEMU