Be careful when replacing strlcpy() with strncpy(). The latter can handle
arbitrary data which is not terminated by a NUL-character while strlcpy()
cannot. strncpy() does also pad the remaining space with NUL-characters
while strlcpy() doesn't write beyond the necessary space.

In the patch for ``who'' you might truncate the last characters of the
entries. IIRC, the entries in ``struct utmpx'' are not necessarily
NUL-terminated. The usage of strlcpy() is improper in these cases anyway
because you use the source size as limit instead of the target size.
[The definition of ``struct utmpentry'' in utmpentry.h is bad because
it uses arbitrary values instead of using the appropriate values from
utmpx.h.]

The code in bootpd.c looks bad at first sight anyway because it constantly
truncates pathnames instead of issuing an error. The same applies to
modload.c.

The rest of the patch looks alright. However, it's purely cosmetic and
doesn't use the return value of strlcpy() to check for truncations.

-- 
Christian