That's what OpenBSD did: > The %n conversion specifier has serious security implications, so it was changed to no longer store the number of bytes written so f

That's what OpenBSD did: > The %n conversion specifier has serious security implications, so it was changed to no longer store the number of bytes written so far into the variable indicated by the pointer argument. Instead a syslog(3) message will be generated, after which the program is aborted with SIGABRT. https://man.openbsd.org/printf.3 https://man.openbsd.org/printf.3