> Property-based testing requires you to define the condition of success or failure (the "property" you're testing for) too, right?

That property can be "does not crash".

And I'd say this is the structured / language-awareness part: with fuzzing you can't generally build an oracle.

And if you can it's of course trivial: just have a wrapper script check the result against the oracle, and trigger whatever the fuzzer looks for indicating "failure" whether it's a return code or a segfault or…