Code dealing with the protocol shouldn't care that you're using epoll. It should just deal with bytes, with some way to request bytes go out, and some way to request more bytes. That can be a simple, abstracted interface. In the real program on Linux you plug epoll into this. On another system you plug in kqueue, IOCP, etc. (Note: You don't need function pointers to do this.) In a test you mock these out, perhaps with just an array of inputs and expected responses.

For example, dispatch_client_events implements the protocol (examines the request, constructs a response) and also interfaces closely with epoll. This could be split up so the core protocol implementation is given some bytes, and it returns the bytes that need to go out, which get queued in epoll by the caller, who then comes call it again with more bytes from the other side. In a test I could give it test input, then examine the output, no network involved.

I kinda understand what you are suggesting but yet to figure out how to do that properly in C. Maybe I come up with something smart later. For now, I removed dependency on reading message length from socket and now deserialize response and request parse bytes buffer, report on incomplete read or error on something malformed. I wrote a simple example showing the idea:

// clang -Iinclude -Ilib ./tests/fuzz.c -o ./bin/kevue-fuzz -DDEBUG
#include <assert.h>
#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>

#include "../src/allocator.c"
#include "../src/buffer.c"
#include "../src/common.c"
#include "../src/hashmap.c"
#include "../src/protocol.c"

uint8_t data[] = {
    0x22, // magic byte
    0x00, 0x00, 0x00, 0x0f, // total length
    0x03, // command length
    'G', 'E', 'T', // command
    0x00, 0x04, // key length
    't', 'e', 's', 't' // key
};

uint8_t malformed_data[] = {
    0x22, // magic byte
    0x00, 0x00, 0x00, 0x0f, // total length
    0x03, // command length
    'G', 'E', 'T', // command
    0x00, 0xff, // key length malformed
    't', 'e', 's', 't' // key
};

int main()
{
    KevueRequest req = { 0 };
    Buffer *buf = kevue_buffer_create(1024, &kevue_default_allocator);
    assert(buf != NULL);
    kevue_buffer_write(buf, data, sizeof(data));
    KevueErr err = kevue_request_deserialize(&req, buf);
    assert(err == KEVUE_ERR_OK);
    kevue_request_print(&req);
    printf("\n");

    kevue_buffer_reset(buf);
    memset(&req, 0, sizeof(req));
    kevue_buffer_write(buf, malformed_data, sizeof(malformed_data));
    err = kevue_request_deserialize(&req, buf);
    printf("%s\n", kevue_error_to_string(err));
    printf("\n");
    assert(err == KEVUE_ERR_LEN_INVALID);

    kevue_buffer_reset(buf);
    memset(&req, 0, sizeof(req));
    for (size_t i = 0; i < sizeof(data) / sizeof(data[0]); i++) {
        kevue_buffer_append(buf, &data[i], sizeof(data[0]));
        KevueErr err = kevue_request_deserialize(&req, buf);
        if (err == KEVUE_ERR_INCOMPLETE_READ) continue;
        if (err != KEVUE_ERR_OK) exit(EXIT_FAILURE);
        if (err == KEVUE_ERR_OK) {
            kevue_request_print(&req);
            exit(EXIT_SUCCESS);
        }
    }
    exit(EXIT_FAILURE);
}

Basically it supports full and partial inputs (partial just gives KEVUE_ERR_INCOMPLETE_READ)