We should fuzz HttpCache::Transaction, with a mock HttpTransaction. Exploring multiple paths trough this code gets complicated. I'd suggest requesting teh same resource twice: Split the input into two HTTP responses, and then requesting the resource twice, and use the second part of the input (If there is one) for the second HTTP responses. Can fuzz the headers, content of, length, and number of reads.
I'd think we'd want to either run each fuzzer with the 3 cache implementations, or have three fuzzers, one using each implementation. Alternatively, we could mock out the cache - haven't really thought about it.
May also be worth writing a second fuzzer that uses range requests, though I'm less familiar with that.