Claude review: scripts: modpost: detect and report truncated buf_printf() output

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Verdict: Good bugfix, should likely be submitted independently.**

This is a genuine pre-existing bug. When `vsnprintf` returns `len >= SZ`, the current code passes that unclamped length to `buf_write`, which reads `len` bytes from a buffer that only has `SZ` bytes — a classic buffer over-read:

```c
len = vsnprintf(tmp, SZ, fmt, ap);
buf_write(buf, tmp, len);
```

The fix correctly checks both error return (`len < 0`) and truncation (`len >= SZ`):

```c
if (len < 0) {
    perror("vsnprintf failed");
    exit(1);
}
if (len >= SZ)
    fatal("buf_printf output was truncated: %d bytes needed, %d available\n",
          len + 1, SZ);
```

Minor nits:

1. The error message says `%d available` but prints `SZ` (the buffer size). Since `vsnprintf` reserves one byte for the NUL terminator, `SZ` is the buffer capacity, not the available character count. `len + 1` is the needed bytes *including* NUL, and `SZ` is available *including* NUL, so this is consistent — but it could be clearer. Consider wording like "needed %d bytes but buffer is only %d" without the `+1`.

2. This patch is a standalone bugfix applicable to all of modpost, not Nova-specific. It would benefit from being submitted separately or at minimum noted as such in the cover letter, since it could be picked up independently.

---
Generated by Claude Code Patch Reviewer