The root cause is that the maybe_emit_sprintf_chk_warning function in builtins.c uses c_strlen() to compute the length of the string argument to the "%s" directive.  The function should instead leave the length computation to the check_sizes() function which has the smarts to figure out the (minimum) length even from a non-literal argument.

The following untested patch makes this change and allows the test case to be diagnosed.

@ -9734,33 +9793,26 @@ maybe_emit_sprintf_chk_warning (tree exp, enum built_in_function fcode)
   if (!init_target_chars ())
     return;
 
+  tree arg;
   /* If the format doesn't contain % args or %%, we know its size.  */
   if (strchr (fmt_str, target_percent) == 0)
-    len = build_int_cstu (size_type_node, strlen (fmt_str));
+    arg = build_int_cstu (size_type_node, strlen (fmt_str));
   /* If the format is "%s" and first ... argument is a string literal,
      we know it too.  */
   else if (fcode == BUILT_IN_SPRINTF_CHK
           && strcmp (fmt_str, target_percent_s) == 0)
     {
-      tree arg;
-
       if (nargs < 5)
        return;
       arg = CALL_EXPR_ARG (exp, 4);
       if (! POINTER_TYPE_P (TREE_TYPE (arg)))
        return;
-
-      len = c_strlen (arg, 1);
-      if (!len || ! tree_fits_uhwi_p (len))
-       return;
     }
   else
     return;
 
-  /* Add one for the terminating nul.  */
-  len = fold_build2 (PLUS_EXPR, TREE_TYPE (len), len, size_one_node);
   check_sizes (OPT_Wstringop_overflow_,
-              exp, /*size=*/NULL_TREE, /*maxlen=*/NULL_TREE, len, size);
+              exp, /*size=*/NULL_TREE, /*maxlen=*/NULL_TREE, arg, size);
 }
 
 /* Emit warning if a free is called with address of a variable.  */

GCC 10 issues:

pr80074.c: In function ‘main’:
pr80074.c:7:53: warning: ‘%s’ directive writing 3 bytes into a region of size 1 [-Wformat-overflow=]
    7 |   int n = __builtin___sprintf_chk (d, 0, sizeof d, "%s", s);
      |                                                     ^~
pr80074.c:7:11: note: ‘__builtin___sprintf_chk’ output 4 bytes into a destination of size 1
    7 |   int n = __builtin___sprintf_chk (d, 0, sizeof d, "%s", s);
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This was implemented in r240298:

commit 88d0c3f0a1448e71dcf49c2f34909ec8d7ce348f
Author: Martin Sebor <msebor@redhat.com>
Date:   Wed Sep 21 01:39:27 2016 +0000

    PR middle-end/49905 - Better sanity checking on sprintf src & dest to
    
    gcc/ChangeLog:
    
            PR middle-end/49905
            * Makefile.in (OBJS): Add gimple-ssa-sprintf.o.
            * config/linux.h (TARGET_PRINTF_POINTER_FORMAT): Redefine.
            * config/linux.c (gnu_libc_printf_pointer_format): New function.
            * config/sol2.h (TARGET_PRINTF_POINTER_FORMAT): Same.
            * config/sol2.c (solaris_printf_pointer_format): New function.
            * doc/invoke.texi (-Wformat-length, -fprintf-return-value): New
            options.
            * doc/tm.texi.in (TARGET_PRINTF_POINTER_FORMAT): Document.
            * doc/tm.texi: Regenerate.
            * gimple-fold.h (get_range_strlen): New function.
            (get_maxval_strlen): Declare existing function.
            * gimple-fold.c (get_range_strlen): Add arguments and compute both
            maximum and minimum.
             (get_range_strlen): Define overload.
            (get_maxval_strlen): Adjust.
            * gimple-ssa-sprintf.c: New file and pass.
            * passes.def (pass_sprintf_length): Add new pass.
            * targhooks.h (default_printf_pointer_format): Declare new function.
            (gnu_libc_printf_pointer_format): Same.
            (solaris_libc_printf_pointer_format): Same.
            * targhooks.c (default_printf_pointer_format): Define new function.
            * tree-pass.h (make_pass_sprintf_length): Declare new function.
            * print-tree.c: Increase buffer size.
    
    gcc/c-family/ChangeLog:
    
            PR middle-end/49905
            * c.opt: Add -Wformat-length and -fprintf-return-value.
    
    gcc/testsuite/ChangeLog:
    
            PR middle-end/49905
            * gcc.dg/builtin-stringop-chk-1.c: Adjust.
            * gcc.dg/tree-ssa/builtin-sprintf-warn-1.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-warn-2.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-warn-3.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-warn-4.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-2.c: New test.
    
    From-SVN: r240298