Off-by-one snprintf