Roll AFL 2.31b:2.38b and switch coverage to use trace-pc-guard.

third_party/afl/src/docs/env_variables.txt

 =======================
 Environmental variables
 =======================
 
   This document discusses the environment variables used by American Fuzzy Lop
   to expose various exotic functions that may be (rarely) useful for power
   users or for some types of custom fuzzing setups. See README for the general
   instruction manual.
 
 1) Settings for afl-gcc, afl-clang, and afl-as
@@ skipping 127 matching lines @@
   - The CPU widget shown at the bottom of the screen is fairly simplistic and
     may complain of high load prematurely, especially on systems with low core
     counts. To avoid the alarming red color, you can set AFL_NO_CPU_RED.
 
   - In QEMU mode (-Q), AFL_PATH will be searched for afl-qemu-trace.
 
   - Setting AFL_PRELOAD causes AFL to set LD_PRELOAD for the target binary
     without disrupting the afl-fuzz process itself. This is useful, among other
     things, for bootstrapping libdislocator.so.
 
+  - Setting AFL_NO_UI inhibits the UI altogether, and just periodically prints
+    some basic stats. This behavior is also automatically triggered when the
+    output from afl-fuzz is redirected to a file or to a pipe.
+
   - If you are Jakub, you may need AFL_I_DONT_CARE_ABOUT_MISSING_CRASHES.
     Others need not apply.
 
   - Benchmarking only: AFL_BENCH_JUST_ONE causes the fuzzer to exit after
     processing the first queue entry; and AFL_BENCH_UNTIL_CRASH causes it to
     exit soon after the first crash is found.
 
 4) Settings for afl-qemu-trace
 ------------------------------
 
@@ skipping 78 matching lines @@
 
     exit_code=86 (required for legacy reasons)    
     abort_on_error=1
     symbolize=0
     msan_track_origins=0
     allocator_may_return_null=1
 
     Be sure to include the first one when customizing anything, since some
     MSAN versions don't call abort() on error, and we need a way to detect
     faults.