This sentence is confusing:
> I have size_with_nul because snprintf man pages say
> The functions snprintf() and vsnprintf() write at most size bytes (including the terminating null byte (‘\0’)) to str.
If 'size' includes the null byte, why do we have to add 1?
> If the output was truncated due to this limit, then the return value is the number of characters (excluding the terminating null byte) which would have been written to the final string if enough space had been available.
The initial call with size 0 tells you the necessary length of the buffer for the string you want, but does not include the null byte.