passing an actual count alongside a table or buffer — prevents the called program from accessing uninitialized or out-of-bounds storage.