This makes xSnprintf more robust against large input buffer sizes. There is an API defect in the snprintf() function, of which the return type is signed int and not size_t. If the specified input buffer length is > INT_MAX, the behavior is undefined in standard C. (In POSIX, the function would fail with errno = EOVERFLOW.) Rather than let the caller ensure the buffer length is <= INT_MAX, it's better to let xSnprintf() clamp the buffer length.