If the caller has nbytes = 4 and sizeof(hwrpb) is now 16 bytes, then you will be copying 12 bytes of data too many from the caller, potentially reading into m

If the caller has nbytes = 4 and sizeof(hwrpb) is now 16 bytes, then you will be copying 12 bytes of data too many from the caller, potentially reading into memory it doesn't own. I would say that should be avoided. The better solution I believe would be to only copy the minimum amount of bytes supported by caller & callee. So: nbytes = MIN(nbytes, sizeof(hwrpb)); Which should ensure backwards and forwards compatibility, assuming the version info of hwrpb->size is respected then the fact that part of the hwrpb struct isn't initialized shouldn't matter.