This paper presents Locus, a novel framework for improving the efficiency of directed fuzzing, which identifies program inputs that lead to a specified target program state. Existing approaches rely on branch distances or manually specified constraints, but these lack the ability to accurately characterize progress toward the target state and are limited by their specificity and generalizability to specific bug types. Locus synthesizes predicates that capture meaningful intermediate states that serve as waypoints toward the target state to determine fuzzing progress. An agent framework, leveraging program analysis tools, synthesizes and iteratively refines candidate predicates, and symbolic execution prevents false rejections. Evaluation results demonstrate that Locus significantly improves the efficiency of eight state-of-the-art fuzzers, achieving an average speedup of 41.6x and uncovering eight previously unpatched bugs.
