Consider using attribute counted_by

IDK if it's applicable here, but recent versions of clang and gcc have added support for having the compiler insert runtime checks when you have a flexible array member and a distinct member for a count, that upon access to the flexible array member, the compiler will insert checks against the count member (which may be optimized out as being redundant if there are explicit length checks).

https://people.kernel.org/gustavoars/how-to-use-the-new-counted_by-attribute-in-c-and-linux