diff --git a/doc/fuzzing.md b/doc/fuzzing.md
index bf3ad1786..5dedcb51c 100644
--- a/doc/fuzzing.md
+++ b/doc/fuzzing.md
@@ -1,66 +1,72 @@
 Fuzz-testing Bitcoin Core
 ==========================
 
 A special test harness `test_bitcoin_fuzzy` is provided to provide an easy
 entry point for fuzzers and the like. In this document we'll describe how to
 use it with AFL.
 
 Building AFL
 -------------
 
 It is recommended to always use the latest version of afl:
 ```
 wget http://lcamtuf.coredump.cx/afl/releases/afl-latest.tgz
 tar -zxvf afl-latest.tgz
 cd afl-<version>
 make
 export AFLPATH=$PWD
 ```
 
 Instrumentation
 ----------------
 
 To build Bitcoin Core using AFL instrumentation (this assumes that the
 `AFLPATH` was set as above):
 ```
 ./configure --disable-ccache --disable-shared --enable-tests CC=${AFLPATH}/afl-gcc CXX=${AFLPATH}/afl-g++
 export AFL_HARDEN=1
 cd src/
 make test/test_bitcoin_fuzzy
 ```
 We disable ccache because we don't want to pollute the ccache with instrumented
 objects, and similarly don't want to use non-instrumented cached objects linked
 in.
 
+The fuzzing can be sped up significantly (~200x) by using `afl-clang-fast` and
+`afl-clang-fast++` in place of `afl-gcc` and `afl-g++` when compiling. When
+compiling using `afl-clang-fast`/`afl-clang-fast++` the resulting
+`test_bitcoin_fuzzy` binary will be instrumented in such a way that the AFL
+features "persistent mode" and "deferred forkserver" can be used. See
+https://github.com/mcarpenter/afl/tree/master/llvm_mode for details.
+
 Preparing fuzzing
 ------------------
 
 AFL needs an input directory with examples, and an output directory where it
 will place examples that it found. These can be anywhere in the file system,
 we'll define environment variables to make it easy to reference them.
 
 ```
 mkdir inputs
 AFLIN=$PWD/inputs
 mkdir outputs
 AFLOUT=$PWD/outputs
 ```
 
 Example inputs are available from:
 
 - https://download.visucore.com/bitcoin/bitcoin_fuzzy_in.tar.xz
 - http://strateman.ninja/fuzzing.tar.xz
 
 Extract these (or other starting inputs) into the `inputs` directory before starting fuzzing.
 
 Fuzzing
 --------
 
 To start the actual fuzzing use:
 ```
 $AFLPATH/afl-fuzz -i ${AFLIN} -o ${AFLOUT} -m52 -- test/test_bitcoin_fuzzy
 ```
 
 You may have to change a few kernel parameters to test optimally - `afl-fuzz`
 will print an error and suggestion if so.
-
diff --git a/src/test/test_bitcoin_fuzzy.cpp b/src/test/test_bitcoin_fuzzy.cpp
index 71a315dbe..e4ea969ad 100644
--- a/src/test/test_bitcoin_fuzzy.cpp
+++ b/src/test/test_bitcoin_fuzzy.cpp
@@ -1,260 +1,279 @@
 // Copyright (c) 2009-2016 The Bitcoin Core developers
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #if defined(HAVE_CONFIG_H)
 #include <config/bitcoin-config.h>
 #endif
 
 #include <addrman.h>
 #include <chain.h>
 #include <coins.h>
 #include <compressor.h>
 #include <consensus/merkle.h>
 #include <net.h>
 #include <primitives/block.h>
 #include <protocol.h>
 #include <pubkey.h>
 #include <script/script.h>
 #include <streams.h>
 #include <undo.h>
 #include <version.h>
 
 #include <algorithm>
 #include <cstdint>
 #include <unistd.h>
 #include <vector>
 
 const std::function<std::string(const char *)> G_TRANSLATION_FUN = nullptr;
 
 enum TEST_ID {
     CBLOCK_DESERIALIZE = 0,
     CTRANSACTION_DESERIALIZE,
     CBLOCKLOCATOR_DESERIALIZE,
     CBLOCKMERKLEROOT,
     CADDRMAN_DESERIALIZE,
     CBLOCKHEADER_DESERIALIZE,
     CBANENTRY_DESERIALIZE,
     CTXUNDO_DESERIALIZE,
     CBLOCKUNDO_DESERIALIZE,
     COIN_DESERIALIZE,
     CNETADDR_DESERIALIZE,
     CSERVICE_DESERIALIZE,
     CMESSAGEHEADER_DESERIALIZE,
     CADDRESS_DESERIALIZE,
     CINV_DESERIALIZE,
     CBLOOMFILTER_DESERIALIZE,
     CDISKBLOCKINDEX_DESERIALIZE,
     CTXOUTCOMPRESSOR_DESERIALIZE,
     TEST_ID_END
 };
 
 static bool read_stdin(std::vector<char> &data) {
     char buffer[1024];
     ssize_t length = 0;
     while ((length = read(STDIN_FILENO, buffer, 1024)) > 0) {
         data.insert(data.end(), buffer, buffer + length);
 
         if (data.size() > (1 << 20)) return false;
     }
     return length == 0;
 }
 
-int main(int argc, char **argv) {
-    ECCVerifyHandle globalVerifyHandle;
+int do_fuzz() {
     std::vector<char> buffer;
     if (!read_stdin(buffer)) return 0;
 
     if (buffer.size() < sizeof(uint32_t)) return 0;
 
     uint32_t test_id = 0xffffffff;
     memcpy(&test_id, buffer.data(), sizeof(uint32_t));
     buffer.erase(buffer.begin(), buffer.begin() + sizeof(uint32_t));
 
     if (test_id >= TEST_ID_END) return 0;
 
     CDataStream ds(buffer, SER_NETWORK, INIT_PROTO_VERSION);
     try {
         int nVersion;
         ds >> nVersion;
         ds.SetVersion(nVersion);
     } catch (const std::ios_base::failure &e) {
         return 0;
     }
 
     switch (test_id) {
         case CBLOCK_DESERIALIZE: {
             try {
                 CBlock block;
                 ds >> block;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CTRANSACTION_DESERIALIZE: {
             try {
                 CTransaction tx(deserialize, ds);
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CBLOCKLOCATOR_DESERIALIZE: {
             try {
                 CBlockLocator bl;
                 ds >> bl;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CBLOCKMERKLEROOT: {
             try {
                 CBlock block;
                 ds >> block;
                 bool mutated;
                 BlockMerkleRoot(block, &mutated);
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CADDRMAN_DESERIALIZE: {
             try {
                 CAddrMan am;
                 ds >> am;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CBLOCKHEADER_DESERIALIZE: {
             try {
                 CBlockHeader bh;
                 ds >> bh;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CBANENTRY_DESERIALIZE: {
             try {
                 CBanEntry be;
                 ds >> be;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CTXUNDO_DESERIALIZE: {
             try {
                 CTxUndo tu;
                 ds >> tu;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CBLOCKUNDO_DESERIALIZE: {
             try {
                 CBlockUndo bu;
                 ds >> bu;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case COIN_DESERIALIZE: {
             try {
                 Coin coin;
                 ds >> coin;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CNETADDR_DESERIALIZE: {
             try {
                 CNetAddr na;
                 ds >> na;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CSERVICE_DESERIALIZE: {
             try {
                 CService s;
                 ds >> s;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CMESSAGEHEADER_DESERIALIZE: {
             CMessageHeader::MessageMagic pchMessageStart = {
                 {0x00, 0x00, 0x00, 0x00}};
             try {
                 CMessageHeader mh(pchMessageStart);
                 ds >> mh;
                 if (!mh.IsValidWithoutConfig(pchMessageStart)) {
                     return 0;
                 }
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CADDRESS_DESERIALIZE: {
             try {
                 CAddress a;
                 ds >> a;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CINV_DESERIALIZE: {
             try {
                 CInv i;
                 ds >> i;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CBLOOMFILTER_DESERIALIZE: {
             try {
                 CBloomFilter bf;
                 ds >> bf;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CDISKBLOCKINDEX_DESERIALIZE: {
             try {
                 CDiskBlockIndex dbi;
                 ds >> dbi;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
             break;
         }
         case CTXOUTCOMPRESSOR_DESERIALIZE: {
             CTxOut to;
             CTxOutCompressor toc(to);
             try {
                 ds >> toc;
             } catch (const std::ios_base::failure &e) {
                 return 0;
             }
 
             break;
         }
         default:
             return 0;
     }
     return 0;
 }
+
+int main(int argc, char **argv) {
+    ECCVerifyHandle globalVerifyHandle;
+#ifdef __AFL_INIT
+    // Enable AFL deferred forkserver mode. Requires compilation using
+    // afl-clang-fast++. See fuzzing.md for details.
+    __AFL_INIT();
+#endif
+
+#ifdef __AFL_LOOP
+    // Enable AFL persistent mode. Requires compilation using afl-clang-fast++.
+    // See fuzzing.md for details.
+    while (__AFL_LOOP(1000)) {
+        do_fuzz();
+    }
+    return 0;
+#else
+    return do_fuzz();
+#endif
+}