In practice, it is almost always a compile-time-known string. gcc will warn you if it isn't, especially since allowing the use of untrusted input for the format can lead to vulnerabilities:

https://en.wikipedia.org/wiki/Uncontrolled_format_string

sprintf tells you how many characters it has written, so there's no reason you can't use it for non-null-terminated strings.

Anywhere that this format is a variable, you probably already screwed up. C allows that, but if I see it that's getting flagged in my review.

So long as the format string is a literal you needn't care how it works.

Now, one of the places where C makes this nastier than it needed to be is that C built-in types are silly, and so any non-trivial program is using better fundamental types like uint32_t (or the more succinct u32), for which the built-in formatter offers no syntax. So you end up writing format strings like "There are "PRIu32" dogs\n" using macros to bring in the appropriate specifier for your literal. Blergh.