UBSan, running printf-test under clang -fsanitize=undefined:
include/fmt/printf.h:497:26: runtime error: applying non-zero offset 3 to null pointerfmt::sprintf("%.3s", (const char*)nullptr) reaches it. The plain %s null path already prints (null), but once a precision is present detail::vprintf enters the cstring-truncation block and evaluates str + specs.precision, then std::find over that range, while str is still null. That runs before printf_arg_formatter's null check, so the (null) output is never reached and the pointer arithmetic is undefined behaviour.
Guarded the block with if (str). A null argument now falls through to the formatter and prints (null) exactly as it does without a precision. Valid strings are unaffected.
Added %.3s and %.0s null cases to printf_test.string. They abort under UBSan on the previous revision and pass now, with the rest of the suite clean under ASan and UBSan.