diff --git a/tests/test_strerror.c b/tests/test_strerror.c
index 828f13f..f143e93 100644
--- a/tests/test_strerror.c
+++ b/tests/test_strerror.c
@@ -18,22 +18,44 @@
  * writing it would corrupt the host (see tests/syscall_test.c). All coverage
  * here is through the errnum parameters.
  *
+ * All diagnostics go through raw SYS_write (no stdio): under -Iinclude the
+ * vlibc public headers shadow GCC's internal ones, so mixing in a host
+ * <stdio.h> breaks compilation (glibc's stdio.h pulls in our minimal
+ * <stdarg.h>, which lacks __gnuc_va_list). <string.h> below is vlibc's own
+ * header, which is safe.
+ *
  * Not part of the library proper; compiled manually for this todo (the
  * tests/ + make check wiring is owned by a later todo).
  */
 
 #include <errno.h>
-#include <stdio.h>
 #include <string.h>
 
+#include "../src/internal/syscall.h"
+
 static int failures;
 
+/* Write a NUL-terminated string to fd via the raw syscall layer. */
+static void
+say(int fd, const char *s)
+{
+    long n = 0;
+
+    while (s[n] != '\0')
+    {
+        n++;
+    }
+    __syscall3(SYS_write, fd, (long)s, n);
+}
+
 static void
 check(int cond, const char *what)
 {
     if (!cond)
     {
-        printf("FAIL: %s\n", what);
+        say(2, "FAIL: ");
+        say(2, what);
+        say(2, "\n");
         failures++;
     }
 }
@@ -50,10 +72,12 @@ failure_scenario(void)
 
     if (s == NULL)
     {
-        printf("strerror(9999)=NULL\n");
+        say(1, "strerror(9999)=NULL\n");
         return 1;
     }
-    printf("strerror(9999)=%s\n", s);
+    say(1, "strerror(9999)=");
+    say(1, s);
+    say(1, "\n");
     return strcmp(s, "Unknown error 9999") == 0 ? 0 : 1;
 }
 
@@ -135,11 +159,11 @@ main(int argc, char **argv)
 
     if (failures > 0)
     {
-        printf("FAILED\n");
+        say(2, "FAILED\n");
     }
     else
     {
-        printf("strerror ok\n");
+        say(1, "strerror ok\n");
     }
     return failures == 0 ? 0 : 1;
 }