@sjw AFAIK musl only had one and in a pretty niche function, wcsnrtombs (who uses wchar_t in 202x…): https://www.openwall.com/lists/musl/2020/11/19/1

And ⑨ I'm not sure, I know 9front had a bug in something like werc that lead to 4chan injecting commands on their server but Plan9 is pretty old, in fact it predates the CVE system.