[bitexploder]

I would bet they were all memory corruption related. They were using AFL to manage their test corpus. It is probably a good guess to say they were all memory corruption related. I am pretty sure the definition of bug is "unique crash". Crash means memory corruption. Probably, the only way they knew they had a bug in such a scenario is from an instrumented process crashing in the first place. I doubt they were checking for much else in terms of instrumented process behavior.