“As such, compilers have had to assume that trailing arrays must be intended to be dynamically sized (even though most are intended to be fixed-size).”
GCC and Clang treat every trailing array in a struct as flexible, so they can’t bounds-check any of them. The cause is decades of fake flexible arrays declared as foo[1] or foo[0] and quirks like struct sockaddr. Linux now has to convert all of them to C99 syntax before -fsanitize=bounds can catch a single overflow. C99 is from the last millennium, and the kernel is still catching up to it.