sscanf has an "additional" way of specifying strings using regex-like character classes. It's handy when parsing strings with non-space separators. These character classes are not correctly detected by PHPStan.

sscanf call like the following one throws Call to sscanf contains 1 placeholder, 3 values given.

sscanf('foo,bar,2600', '%20[^,],%20[^,],%d', $foo, $bar, $baz);

but it's actually a correct sscanf call, see https://3v4l.org/PNEok (also explains the character classes thing)