illumos gate

custr_append_vprintf has the following bits of code:

        int len = vsnprintf(NULL, 0, fmt, ap);
...
        /*
         * Append new string to existing string:
         */
        if ((len = vsnprintf(cus->cus_data + cus->cus_strlen,
            cus->cus_datalen - cus->cus_strlen, fmt, ap)) < 0) {
                return (len);
        }

While this seems to work, this almost certainly feels wrong -- ap should be copied prior to the first call to vsnprintf(3C), and one of the invocations of vsnprintf(3C ) should use the copy while the other uses ap