The latter one is not discovered by fuzzing itself. I was writing a type constraint to be put in the fuzzer, and thinking what will happen if we violate the constraint, so I tried it out manually and discovered the issue.
In my experience this happens a lot :) John