I ran this query today and found a false positive on an sscanf call. Because the source is a buffer, its perfectly possible to know or check the length beforehand and allocate sufficient space in the destination buffer, unlike for scanf or fscanf where you don't tend to know what's coming.

I was tempted to exclude sscanf results from the query, but this seems to be the majority of results in the wild and some of them look like good results to me. Maybe we can do something more clever. But for now I've just documented the problem through a test.

Also fixed a mistake in one of the examples.