fuzzer: make replay a little more robust with NULL mmap values

You can find this when hand-bisecting.