https://redvice.org/2026/coverage-the-wrong-way/ wrote a blogpost about using kvm to collect code coverage for blackbox binaries.