There's no VLA in my example.

Your example doesn't do any bounds checks, it just lets you get the sizeof. And the reason the sizeof works is the VLA infrastructure (which is not supported by MSVC so it won't compile the code).

What I want is -fbounds-safety from clang.

it does do bounds checks if you -fsanitize=bounds, in gcc at least

(and msvc is stuck on partial c11 support to this day, so imo, i don't quite think it's a fair target when comparing things to new features anyway)