I've been thinking about this for fuzzing my own ssh server, there are various paths that depend on external stimuli other than the main network stream - TCP data incoming or writable, TCP sockets closed, processes exiting etc.

It seems that wrapping select()/read()/write() to have random readability/writability/closing seeded by a fuzz input might exercise those code paths. I'm yet to implement it though - be interested to hear of prior work. Getting the fuzz input corpus to correlate to program actions might be problematic.