diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 6403eb1191..ff7aeecc1e 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -47,6 +47,7 @@
 
 //// --- Begin LibAFL code ---
 
+#include "libafl/defs.h"
 #include "libafl/exit.h"
 #include "libafl/tcg.h"
 #include "libafl/hooks/tcg/edge.h"
diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index ebc5d29394..ba81363c45 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -35,6 +35,13 @@
 #include "tcg-accel-ops.h"
 #include "tcg-accel-ops-mttcg.h"
 
+//// --- Begin LibAFL code ---
+
+#include "libafl/defs.h"
+
+//// --- End LibAFL code ---
+
+
 typedef struct MttcgForceRcuNotifier {
     Notifier notifier;
     CPUState *cpu;
@@ -55,12 +62,6 @@ static void mttcg_force_rcu(Notifier *notify, void *data)
     async_run_on_cpu(cpu, do_nothing, RUN_ON_CPU_NULL);
 }
 
-//// --- Begin LibAFL code ---
-
-#include "libafl/exit.h"
-
-//// --- End LibAFL code ---
-
 /*
  * In the multi-threaded case each vCPU has its own thread. The TLS
  * variable current_cpu can be used deep in the code to find the
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 465151cbc3..92f6e5ba7f 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -37,6 +37,12 @@
 #include "tcg-accel-ops-rr.h"
 #include "tcg-accel-ops-icount.h"
 
+//// --- Begin LibAFL code ---
+
+#include "libafl/defs.h"
+
+//// --- End LibAFL code ---
+
 /* Kick all RR vCPUs */
 void rr_kick_vcpu_thread(CPUState *unused)
 {
@@ -169,12 +175,6 @@ static int rr_cpu_count(void)
     return cpu_count;
 }
 
-//// --- Begin LibAFL code ---
-
-#include "libafl/exit.h"
-
-//// --- End LibAFL code ---
-
 /*
  * In the single-threaded case each vCPU is simulated in turn. If
  * there is more than a single vCPU we create a simple timer to kick
diff --git a/include/libafl/defs.h b/include/libafl/defs.h
new file mode 100644
index 0000000000..b0b0d04dcb
--- /dev/null
+++ b/include/libafl/defs.h
@@ -0,0 +1,3 @@
+#pragma once
+
+#define EXCP_LIBAFL_EXIT 0xf4775747
diff --git a/include/libafl/exit.h b/include/libafl/exit.h
index 5af1be547b..5ad5ddac68 100644
--- a/include/libafl/exit.h
+++ b/include/libafl/exit.h
@@ -1,10 +1,8 @@
 #pragma once
 
 #include "qemu/osdep.h"
-#include "exec/cpu_ldst.h"
 #include "hw/core/cpu.h"
-
-#define EXCP_LIBAFL_EXIT 0xf4775747
+#include "exec/cpu-defs.h"
 
 struct libafl_breakpoint {
     target_ulong addr;
diff --git a/include/libafl/system.h b/include/libafl/system.h
index 9a6e9c6d4d..6e69ebf430 100644
--- a/include/libafl/system.h
+++ b/include/libafl/system.h
@@ -1,9 +1,6 @@
 #pragma once
 
 #include "hw/core/cpu.h"
-#include "gdbstub/enums.h"
-#include "sysemu/accel-ops.h"
-#include "sysemu/cpus.h"
 
 int libafl_qemu_set_hw_breakpoint(vaddr addr);
 int libafl_qemu_remove_hw_breakpoint(vaddr addr);
diff --git a/include/libafl/syx-snapshot/syx-snapshot.h b/include/libafl/syx-snapshot/syx-snapshot.h
index 5a6cbbc85c..fd021f4691 100644
--- a/include/libafl/syx-snapshot/syx-snapshot.h
+++ b/include/libafl/syx-snapshot/syx-snapshot.h
@@ -10,14 +10,9 @@
 
 #include "qemu/osdep.h"
 
-#include "qom/object.h"
-#include "sysemu/sysemu.h"
-
 #include "device-save.h"
 #include "syx-cow-cache.h"
 
-#include "libafl/syx-misc.h"
-
 #define SYX_SNAPSHOT_COW_CACHE_DEFAULT_CHUNK_SIZE 64
 #define SYX_SNAPSHOT_COW_CACHE_DEFAULT_MAX_BLOCKS (1024 * 1024)
 
diff --git a/libafl/cpu.c b/libafl/cpu.c
index 409fcb3aab..112e15a7ca 100644
--- a/libafl/cpu.c
+++ b/libafl/cpu.c
@@ -11,7 +11,7 @@
 #include "hw/core/sysemu-cpu-ops.h"
 
 #include "libafl/cpu.h"
-
+#include "libafl/exit.h"
 #include "libafl/hook.h"
 
 int gdb_write_register(CPUState* cpu, uint8_t* mem_buf, int reg);
diff --git a/libafl/exit.c b/libafl/exit.c
index 2a6efeaf6d..7dfbcf9712 100644
--- a/libafl/exit.c
+++ b/libafl/exit.c
@@ -4,8 +4,13 @@
 #include "tcg/tcg-op.h"
 
 #include "cpu.h"
+#include "libafl/defs.h"
 #include "libafl/cpu.h"
 
+#ifndef CONFIG_USER_ONLY
+#include "system/runstate.h"
+#endif
+
 #ifdef CONFIG_USER_ONLY
 #define THREAD_MODIFIER __thread
 #else
diff --git a/libafl/qemu_snapshot.c b/libafl/qemu_snapshot.c
index b742465fa6..190f701c93 100644
--- a/libafl/qemu_snapshot.c
+++ b/libafl/qemu_snapshot.c
@@ -1,14 +1,15 @@
-#include "libafl/qemu_snapshot.h"
-
-#include "sysemu/runstate.h"
-#include "migration/snapshot.h"
+#include "qemu/osdep.h"
 #include "qapi/error.h"
+
+#include <stdlib.h>
+#include <string.h>
+
+#include "migration/snapshot.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "hw/core/cpu.h"
-#include "sysemu/hw_accel.h"
-#include <stdlib.h>
-#include <string.h>
+#include "system/runstate.h"
+#include "libafl/qemu_snapshot.h"
 
 static void save_snapshot_cb(void* opaque)
 {
diff --git a/libafl/system.c b/libafl/system.c
index 66b8e38e1f..09a9a2d383 100644
--- a/libafl/system.c
+++ b/libafl/system.c
@@ -1,5 +1,9 @@
 #include "qemu/osdep.h"
-#include "sysemu/sysemu.h"
+#include "exec/vaddr.h"
+#include "system/system.h"
+#include "system/accel-ops.h"
+#include "system/cpus.h"
+#include "gdbstub/enums.h"
 
 #include "libafl/system.h"
 
diff --git a/libafl/syx-snapshot/syx-cow-cache.c b/libafl/syx-snapshot/syx-cow-cache.c
index 10f5de0fe2..f89fa4832a 100644
--- a/libafl/syx-snapshot/syx-cow-cache.c
+++ b/libafl/syx-snapshot/syx-cow-cache.c
@@ -1,6 +1,7 @@
-#include "libafl/syx-snapshot/syx-cow-cache.h"
+#include "qemu/osdep.h"
 
-#include "sysemu/block-backend.h"
+#include "libafl/syx-snapshot/syx-cow-cache.h"
+#include "system/block-backend-io.h"
 
 #define IS_POWER_OF_TWO(x) ((x != 0) && ((x & (x - 1)) == 0))
 
diff --git a/libafl/syx-snapshot/syx-snapshot.c b/libafl/syx-snapshot/syx-snapshot.c
index 7eb4ad79e8..a9f3f60b52 100644
--- a/libafl/syx-snapshot/syx-snapshot.c
+++ b/libafl/syx-snapshot/syx-snapshot.c
@@ -1,16 +1,14 @@
 #include "qemu/osdep.h"
 
 #include "qemu/main-loop.h"
-#include "sysemu/sysemu.h"
-#include "migration/vmstate.h"
 #include "cpu.h"
 
 #include "exec/ramlist.h"
 #include "exec/ram_addr.h"
-#include "exec/exec-all.h"
 
 #include "libafl/syx-snapshot/syx-snapshot.h"
 #include "libafl/syx-snapshot/device-save.h"
+#include "libafl/syx-misc.h"
 
 #define SYX_SNAPSHOT_LIST_INIT_SIZE 4096
 #define SYX_SNAPSHOT_LIST_GROW_FACTOR 2