> The OP's vulnerability requires passing an insanely long string to a C api, which isn't something you'd expect to be secure.

Yes it is!

Rust would help here - not the borrow checker, but the bounds checking.