format string c42_write_vfmt() doesn't write a NUL; added rbtree dump funcs