this was not found by me

but by the texlive and git creators.
if the value returned was actually just a negative number it wouldnt have mattered but it translates to 'bogus value' in msvc syntax and triggers a fault because the functions need to know the size it could have allocated even if the string is empty.
part of the patch with comments from the git folks.
+# Define SNPRINTF_RETURNS_BOGUS if your are on a system which snprintf()
+# returns -1 instead of number of characters which would have been written
+# to the final string if enough space had been available.
+#
+# Define VSNPRINTF_RETURNS_BOGUS if your are on a system which vsnprintf()
+# returns -1 instead of number of characters which would have been written
+# to the final string if enough space had been available.
+#
the above applies to msvc/mingw64/mac and a few other obscure systems where it returns -1 the edge case here is mingw which has a vsnprintf without the _ in front which works.
i tried with both just for fun using C::B + mingw and _vsnprintf crashes kernel32.dll while vsnprintf works as expected. mingw64 does not have the vsnprintf function from mingw so it also goes bad :S
Productivity is a state of mind.