Ok.  That seems to be the behavior on fedora 27 (gcc (GCC) 7.3.1 20180303 (Red Hat 7.3.1-5)) and rhel7 (gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-16)).  Trying various ways to break snprintf with a simple test program shows that it always null terminates the string and returns the correct result code.    Consider my objection withdrawn.  