Memory safety is a critical issue in embedded systems. Although high-level languages like MicroPython simplify IoT development, their C-based runtimes remain vulnerable to memory errors triggered by Python code or native extensions. The CHERI (Capability Hardware Enhanced RISC Instructions) architecture offers hardware-enforced memory safety, but its effectiveness for exposing latent bugs in real-world interpreters has not yet been fully explored.

We present diffCHERI:FruitFly, a differential testing framework for systematically uncovering memory defects in MicroPython across conventional (x86) and CHERI-enabled (Arm Morello) platforms. We mine historic vulnerabilities from diverse Python runtimes to extract recurring stress patterns, then use a large language model to generate new test programs, and apply Concrete Syntax Tree (CST) mutation to diversify inputs.

On 24-hour automated testing, our framework executed 8,189 generated programs on MicroPython v1.20 and the development branch, identifying 40 distinct defects in the conventional build and 51 in the CHERI port. Memory errors that caused silent corruption or weak symptoms on conventional hardware were converted into precise capability faults on CHERI. These results show that CHERI not only shrinks the attack surface but also serves as an effective memory safety oracle for revealing latent vulnerabilities in embedded interpreters.