replace: Don't run over dst in strlcat