Also, `#define countof(a) (sizeof(a) / sizeof(*(a)))` is unsafe since the arg is evaluated twice.
The general rule for sizeof is to apply it only to variable names or directly to typenames.
Don't let attackers influence the size of a buffer (neither for VLAs nor for heap allocations).