If you really hit the pathological edge case of needed sprintf at runtime with runtime-only buffer sizes, you can still work out the size safely, albeit slowly.

I've done it to make a "safe" sprintf function that allocates the destination buffer, so that the caller cannot overrun it: https://github.com/lelanthran/libds/blob/56d6e18c8970b84c9fa...