It’s easy to say this, but see the note underneath it: “(The above routine is actually inspired by the DNS decoding routine from Nut/OS”… Clearly, this stuff gets written and shipped to production. Maybe it is time to admit that in 2025 it is not a good idea to have C code anywhere near untrusted input?

this is typical K&R style C. The rabbit hole of unsafety in C is very deep