Update documentation on fuzzer mode

Noticed some things were out-of-date or confusing.

Change-Id: Ib71155fcaa5962aeff89a3ba00f1a1246ac79bff
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/89248
Commit-Queue: Lily Chen <chlily@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Lily Chen <chlily@google.com>

FUZZING.md

diff --git a/FUZZING.md b/FUZZING.md
index 3689ad0..741eee8 100644
--- a/FUZZING.md
+++ b/FUZZING.md
@@ -54,15 +54,19 @@
 
 Additionally, if `CRYPTO_set_fuzzer_mode()` is called to enable fuzzer mode, BoringSSL will:
 
-* Modify the TLS stack to perform all signature checks (CertificateVerify and ServerKeyExchange) and the Finished check, but always act as if the check succeeded.
+* Ignore the result of the PKCS#12 MAC check.
 
-* Treat every cipher as the NULL cipher.
+* Ignore the result of TLS signature checks (CertificateVerify and ServerKeyExchange), Finished checks, and PSK binder checks.
 
-* Tickets are unencrypted and the MAC check is performed but ignored.
+* Treat every TLS cipher as the NULL cipher.
 
-* renegotiation\_info checks are ignored.
+* Skip encrypting TLS EncryptedClientHello payloads.
 
-This is to prevent the fuzzer from getting stuck at a cryptographic invariant in the protocol.
+* Skip TLS ticket encryption and ignore the result of the MAC check.
+
+* Ignore the result of the TLS `renegotiation\_info` check.
+
+This is to prevent the fuzzer from getting stuck on cryptographic invariants.
 
 ## TLS transcripts