"dtcm: Coverity 88006" fixed this for buf, but not for string in the same function (and we may as well initialise string_head for consistency too).