KLEE is a symbolic execution engine. You can use it to analyse your program. A symbolic execution considers all possible values for all variables. E.g.:

   int x = readIntFromIO(); // -2147483648 to 2147483647

On branches constraints are added.

    if(x < 3) {
        // -2147483648 to 2
    } else {
        // 3 to 2147483647
    }

In this way all possible paths of the program are considered. When the execution terminates, e.g. on reaching a abort() or fail() statemant, a constraint solver calculates the input values to reach this statement. This values could be considers as test cases.

You can add assert() statements to your code for expressions (e.g. assert(x != 3) ) that you assume to be an inconsistent states and solver will give you test cases for this.