__sccl scanset range-fill writes tab[256] when range endpoint is 0xFF

Summary

__sccl range-fill loop (:612-614) pre-increments c before bounds test. If c==n==0xFF, writes tab[256]=1 byte past char ccltab[256]. Format strings are compile-time kernel literals, not attacker-controlled -- defense-in-depth only.