This seems to be caused by faulty pointer/buffer-length
tracking. Pointer position 'p', meant to be incremented
by the length of the string written to the buffer, is
instead incremented by (length of the buffer - length of
the string written to the buffer), quickly shooting past
the end of the allocated buffer space.