Using the tracing facility would be cool if you can pass something like AFL_QEMU_DRCOV_TRACE="/tmp/trace.drcov" and qemu will trace the execution with -trace exec_tb and, once done, it convert the trace into drcov format like in https://github.com/RobertBuhren/qemutrace2drcov/blob/master/qemutrace2drcov.py that u can drop into lighthouse.
What u think?