https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103961
--- Comment #12 from Martin Liška <marxin at gcc dot gnu.org> --- Self-contained test-case: extern __inline __attribute__((__gnu_inline__)) int sprintf( char *__restrict __s, const char *__restrict __fmt, ...) { return __builtin___sprintf_chk(__s, 2 - 1, __builtin_object_size(__s, 2 > 1), __fmt, __builtin_va_arg_pack()); } int main() { char buf[16]; char *p = buf; for (int t = 0; t < 1; t++) { for (int n = 0; n < 1; n++) p += sprintf(p, "a,"); p--; sprintf(p, "+"); } __builtin_printf("buf: %s\n", buf); if (buf[0] != 'a') __builtin_abort(); return 0; }