With the current setup it successfully finds the (fixed) DOCTYPE buffer overrun in ~50 minutes (on a single core).