Controlling the Written Value

Width specifiers pad the output, inflating the "characters printed" counter

without needing a huge literal string.

%100c%7$n     -> prints 100 chars, writes 100 to *slot7
%65536c%7$hn  -> writes 0x10000 (low 16 bits) via short write

• To write a full 64-bit address you split it into 2-byte chunks and use several %hn writes, each targeting a different address (addr, addr+2, addr+4, …).
• Chunks are ordered by ascending value so the running counter only increases between writes.
• Doing this by hand is fiddly and error-prone —- so we let a tool generate it.