The buffer passed to an sbuf drain callback is not necessarily

null-terminated, so don't assume that it is.

Reported by:	pho
X-MFC-With:	r291059

sys/kern/subr_witness.c

@@ -2987,7 +2987,7 @@ static int
 witness_output_drain(void *arg __unused, const char *data, int len)
 {
 
-	witness_output("%s", data);
+	witness_output("%.*s", len, data);
 	return (len);
 }