Description of problem:
One of the patches backported for bug 2033684 results in a regression for mbsrtowcs where providing a NULL destination should result in the input length being ignored, but it isn't.

Version-Release number of selected component (if applicable):
glibc-2.28-194.el8

How reproducible:
Always

Steps to Reproduce:

$ cat > test.c
    #include <wchar.h>

    int main (void)
    {
        const char *hw = "HelloWorld";
        mbsrtowcs (NULL, &hw, (size_t)-1, NULL);
        return 0;
    }

$ gcc -O2 -Wp,-D_FORTIFY_SOURCE=2 test.c -o test && ./test

Actual results:
    In file included from /usr/include/features.h:490,
                     from /usr/include/bits/libc-header-start.h:33,
                     from /usr/include/wchar.h:27,
                     from test.c:1:
    In function 'mbsrtowcs',
        inlined from 'main' at test.c:6:9:
    /usr/include/bits/wchar2.h:428:10: warning: call to '__mbsrtowcs_chk_warn' declared with attribute warning: mbsrtowcs called with dst buffer smaller than len * sizeof (wchar_t) [-Wattribute-warning]
      428 |   return __glibc_fortify_n (mbsrtowcs, __len, sizeof (wchar_t),
          |          ^~~~~~~~~~~~~~~~~

Expected results:
No warnings and no crash.

Additional info: