Upstream insists the implementation is correct, and is looking for a different solution. I've submitted a different patch for turning off this warning, given that a code audit finds all strncpy and strncat usages are behaving as intended. On a related note, does anyone know of the expected release date for gcc8?