@@ -2234,8 +2234,11 @@ fn vformatWithCVaListPtr(
22342234 return vformat (out_written , writer , format , @ptrCast (& arg [0 ]));
22352235 }
22362236 if (comptime va_list_tag == .pointer ) {
2237- const va = arg .* ;
2238- return vformat (out_written , writer , format , @ptrCast (va ));
2237+ // Pointer-shaped C va_list ABIs (notably Darwin arm64) still require
2238+ // passing the address of the va_list object to @cVaArg so the cursor
2239+ // advances in the caller-owned list object. Dereferencing here makes
2240+ // @cVaArg walk the payload address instead and crashes on native macOS.
2241+ return vformat (out_written , writer , format , @ptrCast (arg ));
22392242 }
22402243 if (comptime va_list_tag == .@"struct" ) {
22412244 return vformat (out_written , writer , format , @ptrCast (arg ));
@@ -2487,7 +2490,7 @@ fn vscanWithCVaListPtr(reader: *FixedReader, fmt: [*:0]const u8, arg: *c.va_list
24872490 return vscan (reader , fmt , @ptrCast (& arg [0 ]));
24882491 }
24892492 if (comptime va_list_tag == .pointer ) {
2490- return vscan (reader , fmt , @ptrCast (arg .* ));
2493+ return vscan (reader , fmt , @ptrCast (arg ));
24912494 }
24922495 if (comptime va_list_tag == .@"struct" ) {
24932496 return vscan (reader , fmt , @ptrCast (arg ));
0 commit comments