Try this

Class test.SQL
{

ClassMethod GetMsg(length As %Integer) As %Stream.TmpCharacter [ SqlProc ]
{
    Set stream = ##class(%Stream.TmpCharacter).%New()
    Set chunkLength = 32000
    Set chunk = $tr($j("", chunkLength)," ", "A")
    
    If length>=chunkLength {
        For i=1:chunkLength:length {
            Do stream.Write(chunk)
        }
    }
    
    Set tailLength = length#chunkLength
    Do:tailLength>0 stream.Write($e(chunk, 1, tailLength))
    
    Set sc = stream.%Save()

    Quit stream  //."%%OID" <- also works for persisted streams
}
}

Worked for me with this SQL (in SMP):

SELECT test.SQL_GetMsg(10), test.SQL_GetMsg(1)
UNION
SELECT test.SQL_GetMsg(10), test.SQL_GetMsg(2)  

As it looks like a security issue I would recommend a slightly different approach.

1. If you do not have the class for your XML, create it from XSD or manually.

2. Convert your XML string into an object of class (1).

3A. If you  want just to skip some properties (like RollNo) set availability of these projected properties to IN - this way property is used by import but is ignored on export. Alternatively disable projection of this property altogether.

3B. If you really want to return *** from your value (what's the use case?) add a new datatype test.PrivateString and use it to store RollNo value - during OBJ->XML projection it would be exported as ***.

Class test.PrivateString Extends %String
{

/// Declares the XSD type used when projecting XML Schemas.
Parameter XSDTYPE = "string";

/// Return "***"
ClassMethod LogicalToXSD(%val As %TimeStamp) As %String [ CodeMode = generator, ServerOnly = 1 ]
{
    If ($$$getClassType(%class)=$$$cCLASSCLASSTYPEDATATYPE) || $$$comMemberKeyGet(%class,$$$cCLASSparameter,"XMLENABLED",$$$cPARAMdefault) {
        Set %codemode=$$$cMETHCODEMODEEXPRESSION
        Set %code="""***"""
    } Else {
        Set %code=0
    }
    Quit $$$OK
}

}