--- a/kern/subr_prf.c
+++ b/kern/subr_prf.c
@@ -686,18 +686,10 @@
 				lflag = 1;
 			goto reswitch;
 		case 'n':
-			if (cflag)
-				*(__va_arg(ap, char *)) = retval;
-			else if (hflag)
-				*(__va_arg(ap, short *)) = retval;
-			else if (jflag)
-				*(__va_arg(ap, intmax_t *)) = retval;
-			else if (lflag)
-				*(__va_arg(ap, long *)) = retval;
-			else if (qflag)
-				*(__va_arg(ap, quad_t *)) = retval;
-			else
-				*(__va_arg(ap, int *)) = retval;
+			/* %n is a no-op: no in-tree consumers, and its availability
+			 * converts any format-string bug into an arbitrary kernel write.
+			 * Consume the pointer to preserve va_list alignment. */
+			(void)__va_arg(ap, void *);
 			break;
 		case 'o':
 			base = 8;