diff --git a/libc/dns/include/resolv_private.h b/libc/dns/include/resolv_private.h
index a91a4b80c..4a832d0e3 100644
--- a/libc/dns/include/resolv_private.h
+++ b/libc/dns/include/resolv_private.h
@@ -426,7 +426,7 @@ int		b64_ntop(u_char const *, size_t, char *, size_t);
 int		b64_pton(char const *, u_char *, size_t);
 #endif
 int		loc_aton(const char *, u_char *);
-const char *	loc_ntoa(const u_char *, char *);
+const char *	loc_ntoa(const u_char *, char *, size_t);
 int		dn_skipname(const u_char *, const u_char *);
 void		putlong(uint32_t, u_char *);
 void		putshort(uint16_t, u_char *);
diff --git a/libc/dns/nameser/ns_name.c b/libc/dns/nameser/ns_name.c
index e3759abd7..3a202c15f 100644
--- a/libc/dns/nameser/ns_name.c
+++ b/libc/dns/nameser/ns_name.c
@@ -43,12 +43,6 @@ __RCSID("$NetBSD: ns_name.c,v 1.9 2012/03/13 21:13:39 christos Exp $");
 #include <stdlib.h>
 #include <limits.h>
 
-#ifdef SPRINTF_CHAR
-# define SPRINTF(x) ((int)strlen(sprintf/**/x))
-#else
-# define SPRINTF(x) (sprintf x)
-#endif
-
 #define NS_TYPE_ELT			0x40 /* EDNS0 extended label type */
 #define DNS_LABELTYPE_BITSTRING		0x41
 
@@ -1012,31 +1006,31 @@ decode_bitstring(const unsigned char **cpp, char *dn, const char *eom)
 		return(-1);
 
 	cp++;
-	i = SPRINTF((dn, "\\[x"));
+	i = snprintf(dn, eom - dn, "\\[x");
 	if (i < 0)
 		return (-1);
 	dn += i;
 	for (b = blen; b > 7; b -= 8, cp++) {
-		i = SPRINTF((dn, "%02x", *cp & 0xff));
+		i = snprintf(dn, eom - dn, "%02x", *cp & 0xff);
 		if (i < 0)
 			return (-1);
 		dn += i;
 	}
 	if (b > 4) {
 		tc = *cp++;
-		i = SPRINTF((dn, "%02x", tc & (0xff << (8 - b))));
+		i = snprintf(dn, eom - dn, "%02x", tc & (0xff << (8 - b)));
 		if (i < 0)
 			return (-1);
 		dn += i;
 	} else if (b > 0) {
 		tc = *cp++;
-		i = SPRINTF((dn, "%1x",
-			       (((u_int32_t)tc >> 4) & 0x0f) & (0x0f << (4 - b))));
+		i = snprintf(dn, eom - dn, "%1x",
+			       (((u_int32_t)tc >> 4) & 0x0f) & (0x0f << (4 - b)));
 		if (i < 0)
 			return (-1);
 		dn += i;
 	}
-	i = SPRINTF((dn, "/%d]", blen));
+	i = snprintf(dn, eom - dn, "/%d]", blen);
 	if (i < 0)
 		return (-1);
 	dn += i;
diff --git a/libc/dns/nameser/ns_print.c b/libc/dns/nameser/ns_print.c
index 0a6a1d6e5..32c87157c 100644
--- a/libc/dns/nameser/ns_print.c
+++ b/libc/dns/nameser/ns_print.c
@@ -48,12 +48,6 @@ __RCSID("$NetBSD: ns_print.c,v 1.11 2012/03/13 21:13:39 christos Exp $");
 #include <string.h>
 #include <ctype.h>
 
-#ifdef SPRINTF_CHAR
-# define SPRINTF(x) ((int)strlen(sprintf/**/x))
-#else
-# define SPRINTF(x) (sprintf x)
-#endif
-
 #ifndef MIN
 #define	MIN(x,y)	((x)<(y)?(x):(y))
 #endif
@@ -155,7 +149,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 	 */
 	T(x = ns_format_ttl(ttl, buf, buflen));
 	addlen((size_t)x, &buf, &buflen);
-	len = SPRINTF((tmp, " %s %s", p_class(class), p_type(type)));
+	len = snprintf(tmp, sizeof(tmp), " %s %s", p_class(class), p_type(type));
 	T(addstr(tmp, (size_t)len, &buf, &buflen));
 	T(spaced = addtab((size_t)(x + len), (size_t)16, spaced, &buf, &buflen));
 
@@ -218,7 +212,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		/* Serial number. */
 		t = ns_get32(rdata);  rdata += NS_INT32SZ;
 		T(addstr("\t\t\t\t\t", (size_t)5, &buf, &buflen));
-		len = SPRINTF((tmp, "%lu", t));
+		len = snprintf(tmp, sizeof(tmp), "%lu", t);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		T(spaced = addtab((size_t)len, (size_t)16, spaced, &buf, &buflen));
 		T(addstr("; serial\n", (size_t)9, &buf, &buflen));
@@ -275,7 +269,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		/* Priority. */
 		t = ns_get16(rdata);
 		rdata += NS_INT16SZ;
-		len = SPRINTF((tmp, "%u ", t));
+		len = snprintf(tmp, sizeof(tmp), "%u ", t);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* Target. */
@@ -293,7 +287,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		/* Priority. */
 		t = ns_get16(rdata);
 		rdata += NS_INT16SZ;
-		len = SPRINTF((tmp, "%u ", t));
+		len = snprintf(tmp, sizeof(tmp), "%u ", t);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* Name1. */
@@ -344,7 +338,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		char t[255];
 
 		/* XXX protocol format checking? */
-		(void) loc_ntoa(rdata, t);
+		(void) loc_ntoa(rdata, t, sizeof(t));
 		T(addstr(t, strlen(t), &buf, &buflen));
 		break;
 	    }
@@ -359,7 +353,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		/* Order, Precedence. */
 		order = ns_get16(rdata);	rdata += NS_INT16SZ;
 		preference = ns_get16(rdata);	rdata += NS_INT16SZ;
-		len = SPRINTF((t, "%u %u ", order, preference));
+		len = snprintf(t, sizeof(t), "%u %u ", order, preference);
 		T(addstr(t, (size_t)len, &buf, &buflen));
 
 		/* Flags. */
@@ -401,7 +395,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		priority = ns_get16(rdata);  rdata += NS_INT16SZ;
 		weight   = ns_get16(rdata);  rdata += NS_INT16SZ;
 		port     = ns_get16(rdata);  rdata += NS_INT16SZ;
-		len = SPRINTF((t, "%u %u %u ", priority, weight, port));
+		len = snprintf(t, sizeof(t), "%u %u %u ", priority, weight, port);
 		T(addstr(t, (size_t)len, &buf, &buflen));
 
 		/* Server. */
@@ -432,7 +426,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		rdata += NS_INADDRSZ;
 
 		/* Protocol. */
-		len = SPRINTF((tmp, " %u ( ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), " %u ( ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		rdata += NS_INT8SZ;
 
@@ -449,7 +443,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 						lcnt = 10;
 						spaced = 0;
 					}
-					len = SPRINTF((tmp, "%d ", n));
+					len = snprintf(tmp, sizeof(tmp), "%d ", n);
 					T(addstr(tmp, (size_t)len, &buf, &buflen));
 					lcnt--;
 				}
@@ -480,8 +474,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		keyflags = ns_get16(rdata);  rdata += NS_INT16SZ;
 		protocol = *rdata++;
 		algorithm = *rdata++;
-		len = SPRINTF((tmp, "0x%04x %u %u",
-			       keyflags, protocol, algorithm));
+		len = snprintf(tmp, sizeof(tmp), "0x%04x %u %u",
+			       keyflags, protocol, algorithm);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* Public key data. */
@@ -502,7 +496,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		}
 		if (len > 15)
 			T(addstr(" )", (size_t)2, &buf, &buflen));
-		n = SPRINTF((tmp, " ; key_tag= %u", key_id));
+		n = snprintf(tmp, sizeof(tmp), " ; key_tag= %u", key_id);
 		T(addstr(tmp, (size_t)n, &buf, &buflen));
 
 		break;
@@ -524,25 +518,25 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		algorithm = *rdata++;
 		labels = *rdata++;
 		t = ns_get32(rdata);  rdata += NS_INT32SZ;
-		len = SPRINTF((tmp, "%s %d %d %lu ",
-			       p_type((int)typ), algorithm, labels, t));
+		len = snprintf(tmp, sizeof(tmp), "%s %d %d %lu ",
+			       p_type((int)typ), algorithm, labels, t);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		if (labels > (u_int)dn_count_labels(name))
 			goto formerr;
 
 		/* Signature expiry. */
 		t = ns_get32(rdata);  rdata += NS_INT32SZ;
-		len = SPRINTF((tmp, "%s ", p_secstodate(t)));
+		len = snprintf(tmp, sizeof(tmp), "%s ", p_secstodate(t));
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* Time signed. */
 		t = ns_get32(rdata);  rdata += NS_INT32SZ;
-		len = SPRINTF((tmp, "%s ", p_secstodate(t)));
+		len = snprintf(tmp, sizeof(tmp), "%s ", p_secstodate(t));
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* Signature Footprint. */
 		footprint = ns_get16(rdata);  rdata += NS_INT16SZ;
-		len = SPRINTF((tmp, "%u ", footprint));
+		len = snprintf(tmp, sizeof(tmp), "%u ", footprint);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* Signer's name. */
@@ -579,7 +573,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		n = edata - rdata;
 		for (c = 0; c < n*8; c++)
 			if (NS_NXT_BIT_ISSET(c, rdata)) {
-				len = SPRINTF((tmp, " %s", p_type((int)c)));
+				len = snprintf(tmp, sizeof(tmp), " %s", p_type((int)c));
 				T(addstr(tmp, (size_t)len, &buf, &buflen));
 			}
 		break;
@@ -596,7 +590,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
 		alg = (u_int) *rdata++;
 
-		len = SPRINTF((tmp1, "%d %d %d ", c_type, key_tag, alg));
+		len = snprintf(tmp1, sizeof(tmp1), "%d %d %d ", c_type, key_tag, alg);
 		T(addstr(tmp1, (size_t)len, &buf, &buflen));
 		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
 		if (siz > sizeof(base64_cert) * 3/4) {
@@ -640,12 +634,12 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 
 		/* Inception. */
 		t = ns_get32(rdata);  rdata += NS_INT32SZ;
-		len = SPRINTF((tmp, "%s ", p_secstodate(t)));
+		len = snprintf(tmp, sizeof(tmp), "%s ", p_secstodate(t));
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* Experation. */
 		t = ns_get32(rdata);  rdata += NS_INT32SZ;
-		len = SPRINTF((tmp, "%s ", p_secstodate(t)));
+		len = snprintf(tmp, sizeof(tmp), "%s ", p_secstodate(t));
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* Mode , Error, Key Size. */
@@ -653,7 +647,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		mode = ns_get16(rdata);  rdata += NS_INT16SZ;
 		err  = ns_get16(rdata);  rdata += NS_INT16SZ;
 		keysize  = ns_get16(rdata);  rdata += NS_INT16SZ;
-		len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
+		len = snprintf(tmp, sizeof(tmp), "%u %u %u ", mode, err, keysize);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		/* XXX need to dump key, print otherdata length & other data */
@@ -670,7 +664,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 		n = ns_get16(rdata); rdata += INT16SZ;
 		rdata += n; /* sig */
 		n = ns_get16(rdata); rdata += INT16SZ; /* original id */
-		sprintf(buf, "%d", ns_get16(rdata));
+		snprintf(buf, buflen, "%d", ns_get16(rdata));
 		rdata += INT16SZ;
 		addlen(strlen(buf), &buf, &buflen);
 		break;
@@ -682,7 +676,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 
 		/* prefix length */
 		if (rdlen == 0U) goto formerr;
-		len = SPRINTF((tmp, "%d ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), "%d ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		pbit = *rdata;
 		if (pbit > 128) goto formerr;
@@ -710,7 +704,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 	    }
 
 	case ns_t_opt: {
-		len = SPRINTF((tmp, "%u bytes", class));
+		len = snprintf(tmp, sizeof(tmp), "%u bytes", class);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		break;
 	    }
@@ -724,21 +718,21 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 			if (rdlen < 4U) goto formerr;
 			t = ns_get16(rdata);
 			rdata += NS_INT16SZ;
-			len = SPRINTF((tmp, "%u ", t));
+			len = snprintf(tmp, sizeof(tmp), "%u ", t);
 			T(addstr(tmp, (size_t)len, &buf, &buflen));
 		} else
 			if (rdlen < 2U) goto formerr;
 
-		len = SPRINTF((tmp, "%u ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), "%u ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		rdata++;
 
-		len = SPRINTF((tmp, "%u ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), "%u ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		rdata++;
 
 		while (rdata < edata) {
-			len = SPRINTF((tmp, "%02X", *rdata));
+			len = snprintf(tmp, sizeof(tmp), "%02X", *rdata);
 			T(addstr(tmp, (size_t)len, &buf, &buflen));
 			rdata++;
 		}
@@ -749,17 +743,17 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 	case ns_t_nsec3param: {
 		u_int t, w, l, j, k, c;
 
-		len = SPRINTF((tmp, "%u ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), "%u ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		rdata++;
 
-		len = SPRINTF((tmp, "%u ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), "%u ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		rdata++;
 
 		t = ns_get16(rdata);
 		rdata += NS_INT16SZ;
-		len = SPRINTF((tmp, "%u ", t));
+		len = snprintf(tmp, sizeof(tmp), "%u ", t);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 		t = *rdata++;
@@ -767,7 +761,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 			T(addstr("-", 1, &buf, &buflen));
 		} else {
 			while (t-- > 0) {
-				len = SPRINTF((tmp, "%02X", *rdata));
+				len = snprintf(tmp, sizeof(tmp), "%02X", *rdata);
 				T(addstr(tmp, (size_t)len, &buf, &buflen));
 				rdata++;
 			}
@@ -851,7 +845,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 					if ((rdata[j] & (0x80 >> k)) == 0)
 						continue;
 					c = w * 256 + j * 8 + k;
-					len = SPRINTF((tmp, " %s", p_type((ns_type)c)));
+					len = snprintf(tmp, sizeof(tmp), " %s", p_type((ns_type)c));
 					T(addstr(tmp, (size_t)len, &buf, &buflen));
 				}
 			}
@@ -875,7 +869,7 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 					if ((rdata[j] & (0x80 >> k)) == 0)
 						continue;
 					c = w * 256 + j * 8 + k;
-					len = SPRINTF((tmp, " %s", p_type((ns_type)c)));
+					len = snprintf(tmp, sizeof(tmp), " %s", p_type((ns_type)c));
 					T(addstr(tmp, (size_t)len, &buf, &buflen));
 				}
 			}
@@ -949,15 +943,15 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 			goto hexify;
 		}
 
-		len = SPRINTF((tmp, "%u ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), "%u ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		rdata++;
 
-		len = SPRINTF((tmp, "%u ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), "%u ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		rdata++;
 
-		len = SPRINTF((tmp, "%u ", *rdata));
+		len = snprintf(tmp, sizeof(tmp), "%u ", *rdata);
 		T(addstr(tmp, (size_t)len, &buf, &buflen));
 		rdata++;
 
@@ -1030,11 +1024,11 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 			const char *str = "record too long to print";
 			T(addstr(str, strlen(str), &buf, &buflen));
 		} else {
-			len = sprintf(tmp, "( %u ", algorithm);
+			len = snprintf(tmp, sizeof(tmp), "( %u ", algorithm);
 			T(addstr(tmp, (size_t)len, &buf, &buflen));
 
 			for (i = 0; i < hip_len; i++) {
-				len = sprintf(tmp, "%02X", *rdata);
+				len = snprintf(tmp, sizeof(tmp), "%02X", *rdata);
 				T(addstr(tmp, (size_t)len, &buf, &buflen));
 				rdata++;
 			}
@@ -1069,23 +1063,23 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
 	int n, m;
 	char *p;
 
-	len = SPRINTF((tmp, "\\# %u%s\t; %s", (unsigned)(edata - rdata),
-		       rdlen != 0U ? " (" : "", comment));
+	len = snprintf(tmp, sizeof(tmp), "\\# %u%s\t; %s", (unsigned)(edata - rdata),
+		       rdlen != 0U ? " (" : "", comment);
 	T(addstr(tmp, (size_t)len, &buf, &buflen));
 	while (rdata < edata) {
 		p = tmp;
-		p += SPRINTF((p, "\n\t"));
+		p += snprintf(p, sizeof(tmp), "\n\t");
 		spaced = 0;
 		n = MIN(16, (int)(edata - rdata));
 		for (m = 0; m < n; m++)
-			p += SPRINTF((p, "%02x ", rdata[m]));
+			p += snprintf(p, sizeof(tmp) - (p - tmp), "%02x ", rdata[m]);
 		T(addstr(tmp, (size_t)(p - tmp), &buf, &buflen));
 		if (n < 16) {
 			T(addstr(")", (size_t)1, &buf, &buflen));
 			T(addtab((size_t)(p - tmp + 1), (size_t)48, spaced, &buf, &buflen));
 		}
 		p = tmp;
-		p += SPRINTF((p, "; "));
+		p += snprintf(p, sizeof(tmp), "; ");
 		for (m = 0; m < n; m++)
 			*p++ = (isascii(rdata[m]) && isprint(rdata[m]))
 				? rdata[m]
diff --git a/libc/dns/nameser/ns_ttl.c b/libc/dns/nameser/ns_ttl.c
index 2395b9950..de073b8c6 100644
--- a/libc/dns/nameser/ns_ttl.c
+++ b/libc/dns/nameser/ns_ttl.c
@@ -36,12 +36,6 @@ __RCSID("$NetBSD: ns_ttl.c,v 1.8 2012/03/13 21:13:39 christos Exp $");
 #include <stdio.h>
 #include <string.h>
 
-#ifdef SPRINTF_CHAR
-# define SPRINTF(x) strlen(sprintf/**/x)
-#else
-# define SPRINTF(x) ((size_t)sprintf x)
-#endif
-
 /* Forward. */
 
 static int	fmt1(int t, char s, char **buf, size_t *buflen);
@@ -157,8 +151,8 @@ fmt1(int t, char s, char **buf, size_t *buflen) {
 	char tmp[50];
 	size_t len;
 
-	len = SPRINTF((tmp, "%d%c", t, s));
-	if (len + 1 > *buflen)
+	len = (size_t)snprintf(tmp, sizeof(tmp), "%d%c", t, s);
+	if ((int)len < 0 || len + 1 > *buflen)
 		return (-1);
 	strcpy(*buf, tmp);
 	*buf += len;
diff --git a/libc/dns/resolv/res_cache.c b/libc/dns/resolv/res_cache.c
index 4c9deab25..15d04c2fa 100644
--- a/libc/dns/resolv/res_cache.c
+++ b/libc/dns/resolv/res_cache.c
@@ -1949,7 +1949,7 @@ _resolv_set_nameservers_for_net(unsigned netid, const char** servers, int numser
         hints.ai_family = PF_UNSPEC;
         hints.ai_socktype = SOCK_DGRAM; /*dummy*/
         hints.ai_flags = AI_NUMERICHOST;
-        sprintf(sbuf, "%u", NAMESERVER_PORT);
+        snprintf(sbuf, sizeof(sbuf), "%u", NAMESERVER_PORT);
 
         index = 0;
         for (i = 0; i < numservers && i < MAXNS; i++) {
diff --git a/libc/dns/resolv/res_debug.c b/libc/dns/resolv/res_debug.c
index 7a05a5fc8..5f889cb23 100644
--- a/libc/dns/resolv/res_debug.c
+++ b/libc/dns/resolv/res_debug.c
@@ -126,14 +126,6 @@ __RCSID("$NetBSD: res_debug.c,v 1.13 2012/06/25 22:32:45 abs Exp $");
 #include <strings.h>
 #include <time.h>
 
-
-
-#ifdef SPRINTF_CHAR
-# define SPRINTF(x) strlen(sprintf/**/x)
-#else
-# define SPRINTF(x) sprintf x
-#endif
-
 extern const char * const _res_opcodes[];
 extern const char * const _res_sectioncodes[];
 
@@ -588,7 +580,7 @@ sym_ntos(const struct res_sym *syms, int number, int *success) {
 		}
 	}
 
-	sprintf(unname, "%d", number);		/* XXX nonreentrant */
+	snprintf(unname, sizeof(unname), "%d", number);		/* XXX nonreentrant */
 	if (success)
 		*success = 0;
 	return (unname);
@@ -605,7 +597,7 @@ sym_ntop(const struct res_sym *syms, int number, int *success) {
 			return (syms->humanname);
 		}
 	}
-	sprintf(unname, "%d", number);		/* XXX nonreentrant */
+	snprintf(unname, sizeof(unname), "%d", number);		/* XXX nonreentrant */
 	if (success)
 		*success = 0;
 	return (unname);
@@ -625,7 +617,7 @@ p_type(int type) {
 		return (result);
 	if (type < 0 || type > 0xffff)
 		return ("BADTYPE");
-	sprintf(typebuf, "TYPE%d", type);
+	snprintf(typebuf, sizeof(typebuf), "TYPE%d", type);
 	return (typebuf);
 }
 
@@ -661,7 +653,7 @@ p_class(int class) {
 		return (result);
 	if (class < 0 || class > 0xffff)
 		return ("BADCLASS");
-	sprintf(classbuf, "CLASS%d", class);
+	snprintf(classbuf, sizeof(classbuf), "CLASS%d", class);
 	return (classbuf);
 }
 
@@ -703,7 +695,7 @@ p_option(u_long option) {
 	case RES_NO_NIBBLE2:	return "no-nibble2";
 #endif
 				/* XXX nonreentrant */
-	default:		sprintf(nbuf, "?0x%lx?", (u_long)option);
+	default:		snprintf(nbuf, sizeof(nbuf), "?0x%lx?", (u_long)option);
 				return (nbuf);
 	}
 }
@@ -716,7 +708,7 @@ p_time(u_int32_t value) {
 	static char nbuf[40];		/* XXX nonreentrant */
 
 	if (ns_format_ttl((u_long)value, nbuf, sizeof nbuf) < 0)
-		sprintf(nbuf, "%u", value);
+		snprintf(nbuf, sizeof(nbuf), "%u", value);
 	return (nbuf);
 }
 
@@ -745,7 +737,7 @@ p_sockun(union res_sockaddr_union u, char *buf, size_t size) {
 		break;
 #endif
 	default:
-		sprintf(ret, "[af%d]", u.sin.sin_family);
+		snprintf(ret, sizeof(ret), "[af%d]", u.sin.sin_family);
 		break;
 	}
 	if (size > 0U) {
@@ -777,7 +769,7 @@ precsize_ntoa(u_int32_t prec)
 
 	val = mantissa * poweroften[exponent];
 
-	(void) sprintf(retbuf, "%lu.%.2lu", val/100, val%100);
+	(void) snprintf(retbuf, sizeof(retbuf), "%lu.%.2lu", val/100, val%100);
 	return (retbuf);
 }
 
@@ -1028,7 +1020,7 @@ loc_aton(const char *ascii, u_char *binary)
 
 /* takes an on-the-wire LOC RR and formats it in a human readable format. */
 const char *
-loc_ntoa(const u_char *binary, char *ascii)
+loc_ntoa(const u_char *binary, char *ascii, size_t bufsiz)
 {
 	static const char *error = "?";
 	static char tmpbuf[sizeof
@@ -1055,7 +1047,7 @@ loc_ntoa(const u_char *binary, char *ascii)
 		ascii = tmpbuf;
 
 	if (versionval) {
-		(void) sprintf(ascii, "; error: unknown LOC RR version");
+		(void) snprintf(ascii, bufsiz, "; error: unknown LOC RR version");
 		return (ascii);
 	}
 
@@ -1114,7 +1106,7 @@ loc_ntoa(const u_char *binary, char *ascii)
 	hpstr = strdup(precsize_ntoa((u_int32_t)hpval));
 	vpstr = strdup(precsize_ntoa((u_int32_t)vpval));
 
-	sprintf(ascii,
+	snprintf(ascii, bufsiz,
 	    "%d %.2d %.2d.%.3d %c %d %.2d %.2d.%.3d %c %s%d.%.2dm %sm %sm %sm",
 		latdeg, latmin, latsec, latsecfrac, northsouth,
 		longdeg, longmin, longsec, longsecfrac, eastwest,
@@ -1180,7 +1172,7 @@ p_secstodate (u_long secs) {
 #endif
 	mytime->tm_year += 1900;
 	mytime->tm_mon += 1;
-	sprintf(output, "%04d%02d%02d%02d%02d%02d",
+	snprintf(output, sizeof(output), "%04d%02d%02d%02d%02d%02d",
 		mytime->tm_year, mytime->tm_mon, mytime->tm_mday,
 		mytime->tm_hour, mytime->tm_min, mytime->tm_sec);
 	return (output);
diff --git a/libc/dns/resolv/res_query.c b/libc/dns/resolv/res_query.c
index 6cd9b15a6..09be8b4ab 100644
--- a/libc/dns/resolv/res_query.c
+++ b/libc/dns/resolv/res_query.c
@@ -414,7 +414,7 @@ res_nquerydomain(res_state statp,
 			RES_SET_H_ERRNO(statp, NO_RECOVERY);
 			return (-1);
 		}
-		sprintf(nbuf, "%s.%s", name, domain);
+		snprintf(nbuf, sizeof(nbuf), "%s.%s", name, domain);
 	}
 	return (res_nquery(statp, longname, class, type, answer, anslen));
 }