A 4GB buffer is allocated internally when formatting this:

fmt::format("{:= }", 1.0)

In format.h:2790, as.width_ is zero and wraps to UINT_MAX when being decremented.

I'm not sure if the calculation is also off by one in other cases.