Chased a similar bug in a KDF once and only caught it by histogramming the 16 bit draws, statistical suites never flagged it.