verify_lock(): report errors via a strbuf