sep==NULL misplaces NUL terminator and truncates output

Summary

Terminator *--outb=0 assumes every loop iteration wrote trailing separator at outb[-1]. When sep is NULL no separator written yet code still decrements outb so NUL overwrites low nibble of last hex digit. When caller sizes outlen for separator (HEX_NCPYLEN) but passes sep==NULL outlen drains by 3 per 2-byte iteration loop stops early converting only fraction of input. Net effect for sep==NULL callers: truncated wrong hex output. Concrete reachable instance: sys/netinet/if_ether.c:643 hexncpy(&ar->ar_hrd 2 hexstr 5 NULL) outlen 5 drains to 2 after one iteration (<MIN_OUTBLEN=3) loop runs once for 2-byte input line 62 clobbers low nibble of single converted byte. arp unknown hardware address format log prints incorrect 1-digit value for attacker-supplied ARP frames. Unauthenticated remote peer anyone who can send ARP frame with ar_hrd not in {ETHER IEEE802}. Impact limited to misleading diagnostics no memory corruption no info leak beyond what frame contained no DoS.