In the long-string (%ls) branch dbGetLink(DBR_CHAR) / dbLoadLinkLS can leave n at vspace+1, so pval[n] = 0 writes at pval[vspace+1], one byte past the sizv-byte VAL buffer (pval + vspace + 1 == prec->val + sizv). Clamp n to vspace immediately before writing the terminator. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>