The terminating NULL string is already included (see sys_exec()).

If va % PGSIZE == 0 and size == 0, we have last < a at the start of
the loop so we might never terminate.  That being said, this
particular case couldn't be triggered for now.

The inode cache isn't really a cache. The main purpose of it is to
allow for synchronization (locking individual inodes), providing
long-lived references to inodes, and ensuring that there is only inode
in memory.