Off-by-one NUL write before caller buffer when inlen <= 0

Summary

hexncpy() asserts outb/inb non-NULL and outlen>=3 but never requires inlen>0. If caller passes inlen<=0 the conversion loop body never runs outb never advanced and terminator *--outb=0 at line 62 writes NUL byte one position BEFORE start of caller output buffer deterministic 1-byte heap/stack underflow write. KKASSERT at :52 omits any check on inlen. for loop at :56 gated by inlen>0 && outlen>=MIN_OUTBLEN when inlen<=0 loop body/post-expr never execute outb remains equal to addr (saved :55). *--outb=0 at :62 performs *(addr-1)=0. Decrement-and-write idiom only safe when at least one iteration advanced outb past addr. At least one in-tree caller m_print uipc_mbuf.c:2537 passes m2->m_len with no zero-guard can reach with m_len==0 mbuf. When outb is stack buffer corrupted byte is byte just below it adjacent local saved frame-pointer low byte or length/metadata field classic off-by-one stack-corruption primitive on heap corrupts preceding allocations tail. Debug/dump path not hot syscall. Real deterministic memory-corruption primitive in shared libkern routine exploitable moment any current/future caller passes non-positive length.