Testing foreign-function targets.

A FFIHypothesis works in one pinned workspace, allocated once outside the timed region and reused for every pair. The samplers fill it in place and the target reads (and may write) it, at offsets of the caller's choosing.

Only ffiTarget is timed, so keep it to a single ccall unsafe FFI call: marshalling or allocation inside it lands in the timed region, and a safe call adds the RTS's thread suspend/resume.

Example

-- C side: void ct_mul(const uint8_t *a, const uint8_t *b,
--                     uint8_t *out);  -- 32-byte operands.
foreign import ccall unsafe "ct_mul"
  c_mul :: Ptr Word8 -> Ptr Word8 -> Ptr Word8 -> IO ()

mulHyp :: Rng -> FFIHypothesis
mulHyp g = FFIHypothesis
  { ffiWorkspaceBytes = 96
  , ffiPrepare = pure ()
  , ffiSampleA = \p -> do
      fillRandom g (p `plusPtr` 0) 32    -- draw and discard,
      fillBytes (p `plusPtr` 0) 0 32     -- then fix: input a
      fillRandom g (p `plusPtr` 32) 32   -- input b: random
  , ffiSampleB = \p -> do
      fillRandom g (p `plusPtr` 0)  32
      fillRandom g (p `plusPtr` 32) 32
  , ffiTarget = \p ->
      c_mul p (p `plusPtr` 32) (p `plusPtr` 64)
  }

result <- withFFIHypothesis (mulHyp g) $ \h ->
  runCT wallClock defaultConfig h

fillBytes is fillBytes. The discarded fillRandom in ffiSampleA keeps the two samplers' generator work symmetric before the fixed operand overwrites it.