The perils of relying on output streams in C (2011) [pdf] (gnu.org)

djb's old daemontools suite had an interesting solution to the "how to log failure when you can't write to a log" problem: a persistent child process with some space reserved in its argv, where it can stash some error messages which you can see with "ps" even when disks have failed.

http://cr.yp.to/daemontools/readproctitle.html

for the corresponding text and video see-- https://www.gnu.org/ghm/2011/paris/#sec-2-1 and https://audio-video.gnu.org/video/ghm2011/Jim_Meyering-Goodb...

printf and friends was not supposed to be robust, was supposed to be easy to use. C already provides the means to write robust libraries, if that is necessary.

The "loosing the errno" issue seems to me easily avoidable: just save the current value if ferror returns an error.