snprintf_count returns UINT_MAX when called with bufSize==0 risking wild-pointer writes (latent: no caller in tree)

Summary

snprintf_count L56-64: ret_vsnprintf=vsnprintf(pBuf,bufSize,fmt,args) well-defined for bufSize==0 (writes nothing returns positive). L60 if(ret>0) TRUE. L61 if(ret<bufSize) becomes <0u FALSE. L64 chars_printed=bufSize-1=(unsigned)(0-1)=UINT_MAX. Callers remaining_buffer-=UINT_MAX underflows huge positive; pBuf+=UINT_MAX wild pointer ~4GiB; next vsnprintf writes through corrupted pointer -> kernel heap corruption/panic. Current top-level dcn10_get_hw_state guards remaining_buf_size>0 before each subfunction L511/517/523/529/535/541/547/553/559 so bufSize>0 helper returns at most bufSize-1 interior loop cant drain below 1 BUG NOT REACHABLE through dcn10_get_hw_state today. Filed because subfunctions (get_hubbub_state L89/get_hubp_states L132/get_rq_states L202/get_dlg_states L247/get_ttu_states L301/get_cm_states L340/get_mpcc_states L393/get_otg_states L425) do NOT re-check remaining_buffer>0 inside per-iteration loops so any future caller with small/zero buffer corrupts. LATENT: no in-tree caller of dc->hwss.get_hw_state exists (rg confirmed). Fix: snprintf_count return 0 for bufSize==0 and negative vsnprintf returns.