This is a strange way to call strlcpy() - it does its own check against the length of the string (it only copies up to the first '\0' byte) and why are you lying to it about the size of the buffer ?  The buffer's size is dst_size, not dst_size - 1.  When dst_size is 26, you should succeed in transcribing all 25 bytes of the string, plus a trailing '\0', into dst; but you've told strlcpy to truncate the G in this case, even though there was space for it, by claiming the buffer only has space for 25 bytes, thereby forcing strlcpy() to put a '\0' where the 'G' would have gone, while not using dst[25].