strncat Buffer Overflow in OpenBIOS

It's easy to get strncat wrong. Here is an example from OpenBIOS.

int load_plugin(const char *plugin_name)
{
        void *handle;
        char *error;
        char path[PATHSIZE];

        int (*init_plugin) (void);
        char **deps;
        char **plugin_info;
        plugin_t *p;

        if (is_loaded(plugin_name)) {
                printf("Plugin %s already loaded.\n", plugin_name);
                return 0;
        }

        strncpy(path, PLUGINDIR, PATHSIZE);
        strncat(path, "/plugin_", PATHSIZE);
        strncat(path, plugin_name, PATHSIZE);
        strncat(path, ".so", PATHSIZE);

What does setting the size field in strncat to PATHSIZE do? It won't prevent the destination string from exceeding the size PATHSIZE. It will prevent the source string being copied to copy at most PATHSIZE characters. In the above code, if the plugin_name is near PATHSIZE, then a buffer overflow will occur. There are more bugs like this in OpenBIOS.