I\'m trying to create a script that helps creating shebangs (Ok, it may not be that useful but has advantages when you don\'t know where the program is, for example), here\'
^@ at the end of command is a newline translated to NULL by append() function, see :h NL-used-for-Nul (it the reason why your substitute(...\%d000...) worked while you don't have NULL in your string). As which command always outputs newline at the end of string, I suggest you to slightly modify your code by adding [:-2] to the end of the system() call. This construction will strip just the last byte of function output:
let path = system('which ' . program)[:-2]
If you use substitute, use
let path=substitute(path, '\n', '', 'g')
, don't confuse yourself with \%d000 which is semantically wrong.