Sorry, I overlooked the underlying issue myself. Must have been too tired last night 🙂
Incidentally, merely testing it as is will not guarantee that it works since the PRNG might not generate the edge cases that may make it fail. Consequently, an "investigation with many attempts and trials" is not enough.
However, now that I have come back to this thread to check, I see that indeed your calculations are correct since it is the maximum bound that is in question, not the size of the range of the mt_rand() call.
The problem as it stands (which NogDog has solved, I think) is that you may generate IP addresses that are not suitable/realistic for testing. A quick fix for this is to check the generated number against a list of unsuitable IP addresses (e.g., 0), and if there is a match, generate a new number.