DrFuzz mutator weird case

**Describe the bug**

Hello! I'm playing with the DrFuzz and looks like the mutator with default options avoids some obvious cases.

Here is the spaghetti-like program which crashes at input `13371337`
```c++
#include
#include

void printOnce(int idx){
static bool buf[8] = {0};
if (!buf[idx]) {
printf("Stage %d reached\n", idx);
buf[idx] = 1;
}
}

extern "C"
__declspec(dllexport)
void
DRFuzzMe1(const char* data, unsigned int len) {

static size_t i = 0;

i++;

if ((i % 1000000) == 0) {
printf("Fuzzing continues: %llu\n", i);
}

if (len != 8) {
printf("Len != 8");
return;
}

if (data[0] == '1') {
printOnce(1);
if (data[1] == '3') {
printOnce(2);
if (data[2] == '3') {
printOnce(3);
if (data[3] == '7') {
printOnce(4);
if (data[4] == '1') {
printOnce(5);
if (data[5] == '3') {
printOnce(6);
if (data[6] == '3') {
printOnce(7);
if (data[7] == '7') {
printOnce(8);
*(size_t*)0 = 0;
}
}
}
}
}
}
}
}
}

int main(int argc, char** argv) {

if (argc != 3) {
printf("Usage: %s \n", argv[0]);
return 1;
}

DRFuzzMe1(argv[1], atoi(argv[2]));
return 0;
}
````

I'm running it with next options:
```
drrun.exe -t drmemory -fuzz_function DRFuzzMe1 -fuzz_module drbug-16.exe -fuzz_coverage -fuzz_num_iters 1000000000 -- drbug-16.exe 11111111 8
```

And I'm getting the log like this:
```
~~Dr.M~~ Dr. Memory version 2.3.18665
~~Dr.M~~ Running "c:\git\codespirit\build\RelWithDebInfo\drbug-16.exe 11111111 8"
~~Dr.M~~ Using system call file z:\dr\drmemory\drmemory\logs\symcache\syscalls_x64.txt
Stage 1 reached
Stage 2 reached
Stage 3 reached
Stage 4 reached
Stage 5 reached
Stage 6 reached
Stage 7 reached
Fuzzing continues: 1000000
Fuzzing continues: 2000000
Fuzzing continues: 3000000
Fuzzing continues: 4000000
Fuzzing continues: 5000000
Fuzzing continues: 6000000
Fuzzing continues: 7000000
Fuzzing continues: 8000000
Fuzzing continues: 9000000
Fuzzing continues: 10000000
Fuzzing continues: 11000000
Fuzzing continues: 12000000
Fuzzing continues: 13000000
...
```

So, first 7 bytes were matched almost instantly, but the last one is just not covered. Fuzzer is not producing such a sample.

It really depends on the input case itself, for example, we can feed:
```
...\drbug-16.exe 13111111 8
```
And the target sample will be discovered instantly, and at the same time we can run `...drbug-16.exe 11211111 8` for a significant amount of time without luck.

---

**Expected behavior**

The crashing path should be discovered for `11111111` input case

**Versions**
> - What version of Dr. Memory are you using?

drrun version 8.0.18687 -- build 0
Dr. Memory version 2.3.18665 -- build 0

>- What operating system version are you running on? ("Windows 10" is *not* sufficient: give the release number.)

Microsoft Windows [Version 10.0.19042.867]

> - Is your application 32-bit or 64-bit?

64-bit