According to the linux man pages:
http://man7.org/linux/man-pages/man3/wcsnrtombs.3.html
http://man7.org/linux/man-pages/man3/mbsnrtowcs.3.html
"If dest is NULL, len is ignored, and the conversion proceeds as above..."
The current code still uses len when the output buffer is NULL, i.e. the len *isn't* ignored.
The fix simply forces len to be the maz val for size_t when the output buffer is NULL.
You write (size_t)-1; here, but below in this same routine is the code:
Please use one or the other.