fix: use bounded strlcat in sp1.c

[orbisai0security]

Summary

Fix critical severity security issue in src/mem_leak/sp1.c.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	src/mem_leak/sp1.c:15

Description: The strcat() calls in sp1.c, sp1a.c, sp3.c, and sp3a.c append strings to fixed-size buffers without checking remaining capacity. strcat() does not perform bounds checking; if the combined length of the existing buffer content and the appended string exceeds the allocated buffer size, the overflow corrupts adjacent stack or heap memory. This vulnerability appears in four separate files, indicating a systemic use of unsafe string concatenation throughout the memory test suite.

Changes

• src/mem_leak/sp1.c
• src/mem_leak/sp1a.c
• src/mem_leak/sp3.c
• src/mem_leak/sp3a.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security