%n writes to a pointer that's provided as a parameter. We didn't have a custom implementation of this before, meaning that %n would trigger a write to the host memory instead of the emulated memory!
3d80d454ce