So wasn't Heartbleed caused by a single overly large value coming directly from the attacker?

So, yeah, fuzzing could find that but it seems like wild overkill. The normal sort of manual range checking one does when implementing a protocol would of worked too...