The seeds are byte-for-byte captures of the client->server stream of a real FreeRDP client connection against the fuzz server configuration:

RDP security, local (plaintext) peer path;
RemoteFX + NSCodec enabled;
multitransport + network autodetect enabled;
MCS channel join enabled;

handshake_input includes post-activation input PDUs (keyboard/mouse), handshake_noinput is the plain handshake up to the Confirm Active PDU. The cut* files are truncations at phase boundaries to give the fuzzer incremental starting points.

The captured stream is deterministic: the fuzz server uses a fixed embedded RSA certificate/key and the local peer path performs no encryption, so the server responses are identical on every connection. This means the captured client stream replays cleanly against a fresh fuzz server session.

Regenerating the seeds

The corpus is generated by TestFuzzServerSeedGen (built by the same CMake configuration as the fuzz target):

# With post-connect input PDUs:
./Testing/TestFuzzServerSeedGen <output-dir> 1
# Handshake only:
./Testing/TestFuzzServerSeedGen <output-dir> 0

Notes:

The generator runs a real freerdp-client in-process against the fuzz server configuration (the server side is identical to TestFuzzServer.c) and captures the client->server stream through a TCP relay.
It requires a build with WITH_CHANNELS=ON so the client channel addins (e.g. rdpdr) are available and the client can negotiate the MCS message channel. WITH_CLIENT_COMMON (default ON) provides the client library.
Byte-exact reproducibility is not guaranteed: the client stream may contain random values that differ between runs. The corpus entries are starting points for the fuzzer, minor differences do not matter.
Keep the fuzz server configuration in TestFuzzServer.c in sync with configure_server() in TestFuzzServerSeedGen.c, otherwise freshly generated seeds will not replay against the fuzzer.