Probably sprintf(), but same idea, I’d assume. Accidentally passing the user provided string (the SSID) as the first parameter (format string). Too bad Apple’s release notes aren’t descriptive enough. We’ll probably just get “a maliciously crafted network SSID could cause issues requiring a full reset to fix”.