Fix mbsrtowcs(3)'s handling of len parameter.

The len parameter is a _maximum_ length. The previous code was treating
it as an exact length, causing the following typical call to fail:

    mbsrtowcs(out, &in, sizeof(out), state); // sizeof(out) > strlen(in)

Change-Id: I48e474fd54ea5f122bc168a4d74bfe08704f28cc