Buggy ksnprintf length tracking in dm_target_stripe_table/info overruns heap params buffer when output is truncated

Summary

Both status-output routines manage single DM_MAX_PARAMS_SIZE(1024) heap buffer with ret=ksnprintf(ptr len ...); ptr+=ret; len-=ret. ksnprintf returns C99 would-be count EXCLUDING nul even when output truncated; snprintf_func only writes while remain>=2. So once any single call truncates ptr advances past buffer end and size_t len underflows to ~SIZE_MAX. Next ksnprintf call then writes full formatted run into heap memory adjacent to params allocation. With stripe_num=32 attacker-chosen offset 0x8000000000000000 (21 chars %jd) and udev_name>=10 chars per-iter output=33 truncation begins at iter 30. ptr jumps past params+1024 next ksnprintf writes into heap ~34-byte overflow. Confidence speculative: practical precondition restrictive (needs >=8-digit minor device).