I tracked this down to a problem in the function _wcsrtombs_r.
The condition to write a converted character into the destination string
and to continue the loop is (wcsrtombs.c, line 48):
if (n <= len - bytes && bytes < len)
The second half of this condition is wrong, AFAICS. First of all, it
should be bytes <= len instead of bytes < len. Second, this part of the
condition is already catched by the first part of the condition:
n <= len - bytes <==> n + bytes <= len
with n always >= 0, bytes is always <= len if n + bytes is <= len. So
the condition is redundant.