diff --git a/src/lib/string/printf.c b/src/lib/string/printf.c
index 82d38242dd525debd7eb34371591a0571fa7b5e4..e23da69d0e266cb27ffc303293b32c9415b3ac79 100644
--- a/src/lib/string/printf.c
+++ b/src/lib/string/printf.c
@@ -101,7 +101,7 @@ tor_vasprintf(char **strp, const char *fmt, va_list args)
   /* If the platform gives us one, use it. */
   int r = vasprintf(&strp_tmp, fmt, args);
   if (r < 0)
-    *strp = NULL;
+    *strp = NULL; // LCOV_EXCL_LINE -- no cross-platform way to force this
   else
     *strp = strp_tmp;
   return r;
diff --git a/src/test/test_util.c b/src/test/test_util.c
index 99fee4c5a504b05a85e6a9edb29526effcbab847..888038bea595c9dcae0455919268ac35accdafcc 100644
--- a/src/test/test_util.c
+++ b/src/test/test_util.c
@@ -3163,6 +3163,21 @@ test_util_sscanf(void *arg)
   test_feq(d3, -900123123.2000787);
   test_feq(d4, 3.2);
 
+  /* missing float */
+  r = tor_sscanf("3 ", "%d %lf", &int1, &d1);
+  tt_int_op(r, OP_EQ, 1);
+  tt_int_op(int1, OP_EQ, 3);
+
+  /* not a float */
+  r = tor_sscanf("999 notafloat", "%d %lf", &int1, &d1);
+  tt_int_op(r, OP_EQ, 1);
+  tt_int_op(int1, OP_EQ, 999);
+
+  /* %s but no buffer. */
+  char *nullbuf = NULL;
+  r = tor_sscanf("hello", "%3s", nullbuf);
+  tt_int_op(r, OP_EQ, 0);
+
  done:
   tor_free(huge);
 }