The QB_MIN(maxlen-1, srclen) expression underflows for maxlen=0 because maxlen is unsigned, thus strlcpy(d,s,0) becomes strcpy(d,s) contrary to the function documentation. I don't think it affects the current code base, but probably worth fixing nevertheless to avoid future accidents.