Make [nonce] work as it's supposed to.

Specifically:
- Generate arg*2, not arg+2, characters.
- strdup() str, so we don't have a value pointing into the stack.