Problem

printbuf_memset() violates the invariant every other printbuf operation maintains — buf[bpos] == '\0' — because it never NUL-terminates at the new position and doesn't reserve space for the terminator (printbuf.c):

if (pb->size < size_needed) { printbuf_extend(pb, size_needed); ... }
memset(pb->buf + offset, charvalue, len);
if (pb->bpos < size_needed) pb->bpos = size_needed;
/* no buf[bpos] = '\0' */

Any consumer reading pb->buf as a C string immediately after an indent() (which calls printbuf_memset) reads uninitialized bytes. Latent today because serializers append before reading, but it is a foot-gun for any new consumer.

Fix

Reserve size_needed + 1 and NUL-terminate at the new bpos, matching printbuf_memappend's contract.

Verification

29/29 ctest tests pass (printbuf + serialization suites).