ovl: Use "buf" flexible array for memcpy() destination (CVE-2022-49743) | HOL Guard CVE