In glibc if the format string ends in %, strftime and wcsftime will turn it into a %. In musl libc, if the format string ends in %, both wcsftime and strftime return 0 with errno 0 and leave random stuff in the buffer. There's no way for us to distinguish between this and "out of space" without looking at the format string. The following 7 character patch would fix musl to behave the same as glibc:

--- a/src/time/strftime.c
+++ b/src/time/strftime.c
@@ -225,7 +225,7 @@ size_t __strftime_l(char *restrict s, size_t n, const char
*restrict f, const st
 			s[l] = 0;
 			return l;
		}
-		if (*f != '%') {
+		if (*f != '%' || !f[1]) {
 			s[l++] = *f;
 			continue;
 		}

but it sounds like musl may be against applying this patch because it is their position that the behavior is undefined? See this thread:
https://www.openwall.com/lists/musl/2022/12/19/3

So in this case, we repeatedly get format_string returning 0 and end up here:
https://github.com/python/cpython/blob/main/Modules/timemodule.c?plain=1#L844
Then if HAVE_WCSFTIME we call PyUnicode_FromWideChar(*outbuf, 0) which notices we're making an empty string and returns here:
https://github.com/python/cpython/blob/main/Objects/unicodeobject.c?plain=1#L2004-L2005
On the other hand, if !HAVE_WCSFTIME we call PyUnicode_DecodeLocaleAndSize which checks if str[len] != '\0' and raises ValueError("Embedded null byte") here:
https://github.com/python/cpython/blob/main/Objects/unicodeobject.c?plain=1#L4004

So what to do? Well for one thing, it seems to me that we can tell whether format_time is trying to return an empty string by checking if the string ends in a null byte as it should e.g., *outbuf[buflen] == 0. This can allow us to be a bit more conservative in time_strftime1.

Linked PRs

• gh-127527: Improve error handling in time_strftime1 #127528