>Format specifiers can take extra “arguments”. - "%hhn": store the number of bytes written mod 256 to the char pointer ...

Oh boy. I'll put that down for my "thing I don't think I wanted to know" of the day.

There is some innocent beauty in the twistedness of printf - especially with GNU extensions.

GNU's printf specifier language is Turing complete, I believe.

Presumably it needs a loop around it, so it's not Turing-complete by itself?

It does not need the loop. It might be easier to understand by looking at something like this. [0] That printf allows for this kind of Turing complete control flow is well known [1].

[0] https://github.com/HexHive/printbf

[1] http://nebelwelt.net/publications/files/15SEC.pdf