Two years ago, as my bachelor's thesis (unfortunately in Estonian) I added quickchecking of domain properties to Goblint. The code for that still lives on qcheck branch of my fork: https://github.com/sim642/goblint/tree/qcheck.

It might be a good starting point for introducing fuzzing as well (issue #85).

I will look into bringing it up to date so it can be merged into mainline Goblint.