This is caused by the vsprintf() changes. Right now, if you doDamn. This patch doesn't look right; the intent is that 'end' point to just beyond the formatted string. I'm pretty sure I tested this, since its the most obvious test. Clearly not enough. I'll look into it.
snprintf(buf, 4, "1111111111111");
the memory at `buf' gets [31 31 31 31 00], which is not good.
This'll plug it, but I didn't check very hard whether it still has any
off-by-ones, or if breaks the intent of Jeremy's patch. I think it's OK..