etc

diff --git a/fuzzing/linux-usb-stack/cleanup.sh b/fuzzing/linux-usb-stack/cleanup.sh
@@ -57,7 +57,7 @@ fi
 if [[ "${KEEP_BUILDS}" -eq 0 ]]; then
     log "Removing compiled kernel + initramfs..."
     rm -f bzImage
-    rm -f qemu/initramfs.cpio.gz
+    rm -f qemu/initramfs.cpio.gz qemu/disk.img
     rm -rf initramfs/
 
     log "Removing source trees (kernel, busybox, dropbear, syzkaller, Go)..."

diff --git a/fuzzing/linux-usb-stack/setup.sh b/fuzzing/linux-usb-stack/setup.sh
@@ -263,7 +263,20 @@ else
     ok "qemu/initramfs.cpio.gz: $(du -sh qemu/initramfs.cpio.gz | cut -f1)"
 fi
 
-# ── 9. Workdirs ───────────────────────────────────────────────────────────────
+# ── 9. Disk image (required by syzkaller's QEMU VM type) ─────────────────────
+# syzkaller validates that the image file exists even when booting from
+# kernel + initramfs. We create a minimal ext4 image; QEMU attaches it as
+# an unused second drive — the actual rootfs comes from the initramfs.
+if [[ -f "qemu/disk.img" ]]; then
+    ok "qemu/disk.img already exists, skipping."
+else
+    log "Creating minimal disk image (128M)..."
+    dd if=/dev/zero of=qemu/disk.img bs=1M count=128 status=none
+    mkfs.ext4 -q qemu/disk.img
+    ok "qemu/disk.img created."
+fi
+
+# ── 10. Workdirs ──────────────────────────────────────────────────────────────
 for profile in raw-gadget gadget-fw usbfs; do
     mkdir -p "workdir-${profile}"
 done

diff --git a/fuzzing/linux-usb-stack/syzkaller-gadget-fw.cfg b/fuzzing/linux-usb-stack/syzkaller-gadget-fw.cfg
@@ -3,6 +3,7 @@
     "http": "127.0.0.1:56742",
     "workdir": "__DIR__/workdir-gadget-fw",
     "kernel_obj": "__DIR__/linux",
+    "image": "__DIR__/qemu/disk.img",
     "sshkey": "__DIR__/qemu/id_rsa",
     "syzkaller": "__DIR__/syzkaller",
     "sandbox": "none",

diff --git a/fuzzing/linux-usb-stack/syzkaller-raw-gadget.cfg b/fuzzing/linux-usb-stack/syzkaller-raw-gadget.cfg
@@ -3,6 +3,7 @@
     "http": "127.0.0.1:56741",
     "workdir": "__DIR__/workdir-raw-gadget",
     "kernel_obj": "__DIR__/linux",
+    "image": "__DIR__/qemu/disk.img",
     "sshkey": "__DIR__/qemu/id_rsa",
     "syzkaller": "__DIR__/syzkaller",
     "sandbox": "none",

diff --git a/fuzzing/linux-usb-stack/syzkaller-usbfs.cfg b/fuzzing/linux-usb-stack/syzkaller-usbfs.cfg
@@ -3,6 +3,7 @@
     "http": "127.0.0.1:56743",
     "workdir": "__DIR__/workdir-usbfs",
     "kernel_obj": "__DIR__/linux",
+    "image": "__DIR__/qemu/disk.img",
     "sshkey": "__DIR__/qemu/id_rsa",
     "syzkaller": "__DIR__/syzkaller",
     "sandbox": "none",