Fix bounds testing bug in dw_substr()