audit the use of `strcpy` and `sprintf` to ensure overflow protection

[jummy0]

idk enough to say definitively whether sb's use is safe or not

[jummy0]

if retail behavior is determined to be unsafe, it should be preserved under the _LEGACY flag