Index: generic/nsf.c
===================================================================
diff -u -N -r500a581f91a732e73ddec184c1fd2ac1c2f19aa5 -rea63ea318ca3bb4936fa4130c98db2e4d52eac9d
--- generic/nsf.c	(.../nsf.c)	(revision 500a581f91a732e73ddec184c1fd2ac1c2f19aa5)
+++ generic/nsf.c	(.../nsf.c)	(revision ea63ea318ca3bb4936fa4130c98db2e4d52eac9d)
@@ -26809,6 +26809,7 @@
 NsfDebugGetDict(Tcl_Interp *interp, Tcl_Obj *obj) {
   Tcl_Obj    *resultObj;
   const char *typeString;
+  #define BUFSIZE 24
 
   nonnull_assert(interp != NULL);
   nonnull_assert(obj != NULL);
@@ -26826,13 +26827,14 @@
 
   if (obj->bytes != NULL) {
     int i;
-    char buffer[24];
+    char buffer[BUFSIZE];
 
     for (i = 0; i < 10 && i < obj->length; i++) {
-      snprintf(buffer + i*2, 24, "%.2x", (unsigned)(*((obj->bytes)+i) & 0xff));
+      snprintf(buffer + i*2, BUFSIZE, "%.2x", (unsigned)(*((obj->bytes)+i) & 0xff));
     }
     if (obj->length > 10) {
-      strncat(buffer, "...", 3u);
+      strncat(buffer, "...", 4u);
+      buffer[BUFSIZE-1] = '\0';
     }
     Tcl_ListObjAppendElement(interp, resultObj, Tcl_NewStringObj(buffer, -1));