i really should do this in bionic... currently we only abort on %n (which is explicitly _not_ supported) or %w with a silly size.
for random junk, we currently do what the BSDs do (since that's where this code originally came from):
default: /* "%?" prints ?, unless ? is NUL */
if (ch == '\0') goto done;
/* pretend it was %c with argument ch */
cp = buf;
*cp = ch;
size = 1;
sign = '\0';
break;
from running a quick test program, macOS and glibc seem to work similarly, which increases the chances that there's incorrect code out there. (clang does at least warn "warning: invalid conversion specifier '?' [-Wformat-invalid-specifier]" by default, though. gcc doesn't.)