printf: a malformed \u or \U in a %b argument drops characters and exits 0

printf '%b' doesn't reject a malformed \x, \u or \U in its argument the way the format string does, and for \u and \U it also loses the characters it consumed.

$ printf '%b\n' 'C:\users\file'
C:\x^Lile
$ echo $?
0

sers is gone. The \u consumed the four characters after it, failed to parse them as hex, wrote a literal \x — the input said \u — and dropped them. The \f in \file then produced the form feed. Nothing on stderr, exit status 0.

GNU 9.7 stops at the bad escape:

$ printf '%b\n' 'C:\users\file'
printf: missing hexadecimal number in escape
$ echo $?
1

The same escapes are already handled in the format string — it is only the %b argument path:

GNU exits 1 in all eight cells.

How much text disappears follows the escape form — four characters for \u, eight for \U — and nothing disappears when fewer than that remain:

$ printf '%b' '\uABCZ|TAIL'       ->  \x|TAIL
$ printf '%b' '\U0000004Z|TAIL'   ->  \x|TAIL
$ printf '%b' 'x\unit'            ->  x\xnit      (only three characters left)

Well-formed escapes are unaffected: \u0041Z, \U00000041Z and \x41Z all give AZ in both implementations.

The \x part of this looks like the tail of #7259, which taught the format string to error on a missing hex value in February 2025; the %b argument path wasn't included.

uutils 0.11.0 built from main, GNU coreutils 9.7 on Ubuntu 26.04, LC_ALL=C.

The payload names no source file or test; start by reproducing the %b cases under LC_ALL=C and compare that path with the format-string handling described in issue #7259. Done means malformed \x, \u, and \U report errors, preserve consumed characters, and exit 1, while valid escapes remain unchanged.