The man page for vsnprintf states: RETURN VALUE If the output was truncated, the return value is -1, otherwise it is the number of characters stored, not including the terminating null. That is not the case. If I give it a string 10 characters long, and ask it to print out a string with 18 characters vnsprintf will return 18, and not -1. If this is not considered a bug in the in man page, then it's the implementation of vsnprintf.
The man page that I have states: RETURN VALUE If the output was truncated, the return value is -1, otherwise it is the number of characters stored, not including the terminating null. (Thus until glibc 2.0.6. Since glibc 2.1 these functions return the number of characters (excluding the trailing null) which would have been written to the final string if enough space had been available.) Thus, the behavior (as mandated by Single Unix Specification ver 2) is documented also in the man page.