diff --git a/CMakeLists.txt b/CMakeLists.txt
index 4f430a100..966ecec7e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -30,6 +30,8 @@ set(CMAKE_CXX_EXTENSIONS OFF)
 # target-specific crypto code paths not
 # applicable to the host's FPU -rick
 add_compile_options(-Wall -Wextra -Werror -Wno-unknown-pragmas)
+# vla are evil
+add_compile_options(-Wvla)
 add_compile_options($<$<COMPILE_LANGUAGE:CXX>:-fpermissive>)
 add_compile_options(-Wno-unused-function -Wno-deprecated-declarations -Wno-unknown-pragmas)
 
diff --git a/crypto/libntrup/src/ref/r3_recip.c b/crypto/libntrup/src/ref/r3_recip.c
index 12b185e38..567c6a30c 100644
--- a/crypto/libntrup/src/ref/r3_recip.c
+++ b/crypto/libntrup/src/ref/r3_recip.c
@@ -4,27 +4,35 @@
 #include "r3.h"
 
 /* caller must ensure that x-y does not overflow */
-static int smaller_mask(int x,int y)
+static int
+smaller_mask(int x, int y)
 {
   return (x - y) >> 31;
 }
 
-static void vectormod3_product(small *z,int len,const small *x,const small c)
+static void
+vectormod3_product(small *z, int len, const small *x, const small c)
 {
   int i;
-  for (i = 0;i < len;++i) z[i] = mod3_product(x[i],c);
+  for(i = 0; i < len; ++i)
+    z[i] = mod3_product(x[i], c);
 }
 
-static void vectormod3_minusproduct(small *z,int len,const small *x,const small *y,const small c)
+static void
+vectormod3_minusproduct(small *z, int len, const small *x, const small *y,
+                        const small c)
 {
   int i;
-  for (i = 0;i < len;++i) z[i] = mod3_minusproduct(x[i],y[i],c);
+  for(i = 0; i < len; ++i)
+    z[i] = mod3_minusproduct(x[i], y[i], c);
 }
 
-static void vectormod3_shift(small *z,int len)
+static void
+vectormod3_shift(small *z, int len)
 {
   int i;
-  for (i = len - 1;i > 0;--i) z[i] = z[i - 1];
+  for(i = len - 1; i > 0; --i)
+    z[i] = z[i - 1];
   z[0] = 0;
 }
 
@@ -34,42 +42,45 @@ or returning -1 if s is not invertible mod m
 r,s are polys of degree <p
 m is x^p-x-1
 */
-int r3_recip(small *r,const small *s)
+#define LOOPS (2 * p + 1)
+int
+r3_recip(small *r, const small *s)
 {
-  const int loops = 2*p + 1;
   int loop;
-  small f[p + 1]; 
-  small g[p + 1]; 
-#ifdef _MSC_VER
+  small f[p + 1];
+  small g[p + 1];
+
   small u[LOOPS + 1];
   small v[LOOPS + 1];
-#else
-  small u[loops + 1];
-  small v[loops + 1];
-#endif
+
   small c;
   int i;
   int d = p;
   int e = p;
   int swapmask;
 
-  for (i = 2;i < p;++i) f[i] = 0;
+  for(i = 2; i < p; ++i)
+    f[i] = 0;
   f[0] = -1;
   f[1] = -1;
   f[p] = 1;
   /* generalization: can initialize f to any polynomial m */
   /* requirements: m has degree exactly p, nonzero constant coefficient */
 
-  for (i = 0;i < p;++i) g[i] = s[i];
+  for(i = 0; i < p; ++i)
+    g[i] = s[i];
   g[p] = 0;
 
-  for (i = 0;i <= loops;++i) u[i] = 0;
+  for(i = 0; i <= LOOPS; ++i)
+    u[i] = 0;
 
   v[0] = 1;
-  for (i = 1;i <= loops;++i) v[i] = 0;
+  for(i = 1; i <= LOOPS; ++i)
+    v[i] = 0;
 
   loop = 0;
-  for (;;) {
+  for(;;)
+  {
     /* e == -1 or d + e + loop <= 2*p */
 
     /* f has degree p: i.e., f[p]!=0 */
@@ -80,29 +91,35 @@ int r3_recip(small *r,const small *s)
 
     /* u has degree <=loop (so it fits in loop+1 coefficients) */
     /* u[i]==0 for i < p-d */
-    /* if invertible: u[i]==0 for i < loop-p (so can look at just p+1 coefficients) */
+    /* if invertible: u[i]==0 for i < loop-p (so can look at just p+1
+     * coefficients) */
 
     /* v has degree <=loop (so it fits in loop+1 coefficients) */
     /* v[i]==0 for i < p-e */
     /* v[i]==0 for i < loop-p (so can look at just p+1 coefficients) */
 
-    if (loop >= loops) break;
+    if(loop >= LOOPS)
+      break;
 
-    c = mod3_quotient(g[p],f[p]);
+    c = mod3_quotient(g[p], f[p]);
 
-    vectormod3_minusproduct(g,p + 1,g,f,c);
-    vectormod3_shift(g,p + 1);
+    vectormod3_minusproduct(g, p + 1, g, f, c);
+    vectormod3_shift(g, p + 1);
 
 #ifdef SIMPLER
-    vectormod3_minusproduct(v,loops + 1,v,u,c);
-    vectormod3_shift(v,loops + 1);
+    vectormod3_minusproduct(v, loops + 1, v, u, c);
+    vectormod3_shift(v, loops + 1);
 #else
-    if (loop < p) {
-      vectormod3_minusproduct(v,loop + 1,v,u,c);
-      vectormod3_shift(v,loop + 2);
-    } else {
-      vectormod3_minusproduct(v + loop - p,p + 1,v + loop - p,u + loop - p,c);
-      vectormod3_shift(v + loop - p,p + 2);
+    if(loop < p)
+    {
+      vectormod3_minusproduct(v, loop + 1, v, u, c);
+      vectormod3_shift(v, loop + 2);
+    }
+    else
+    {
+      vectormod3_minusproduct(v + loop - p, p + 1, v + loop - p, u + loop - p,
+                              c);
+      vectormod3_shift(v + loop - p, p + 2);
     }
 #endif
 
@@ -110,22 +127,25 @@ int r3_recip(small *r,const small *s)
 
     ++loop;
 
-    swapmask = smaller_mask(e,d) & mod3_nonzero_mask(g[p]);
-    swap(&e,&d,sizeof e,swapmask);
-    swap(f,g,(p + 1) * sizeof(small),swapmask);
+    swapmask = smaller_mask(e, d) & mod3_nonzero_mask(g[p]);
+    swap(&e, &d, sizeof e, swapmask);
+    swap(f, g, (p + 1) * sizeof(small), swapmask);
 
 #ifdef SIMPLER
-    swap(u,v,(loops + 1) * sizeof(small),swapmask);
+    swap(u, v, (loops + 1) * sizeof(small), swapmask);
 #else
-    if (loop < p) {
-      swap(u,v,(loop + 1) * sizeof(small),swapmask);
-    } else {
-      swap(u + loop - p,v + loop - p,(p + 1) * sizeof(small),swapmask);
+    if(loop < p)
+    {
+      swap(u, v, (loop + 1) * sizeof(small), swapmask);
+    }
+    else
+    {
+      swap(u + loop - p, v + loop - p, (p + 1) * sizeof(small), swapmask);
     }
 #endif
   }
 
   c = mod3_reciprocal(f[p]);
-  vectormod3_product(r,p,u + p,c);
-  return smaller_mask(0,d);
+  vectormod3_product(r, p, u + p, c);
+  return smaller_mask(0, d);
 }
diff --git a/crypto/libntrup/src/ref/rq_recip3.c b/crypto/libntrup/src/ref/rq_recip3.c
index 54f048428..78e8c63d6 100644
--- a/crypto/libntrup/src/ref/rq_recip3.c
+++ b/crypto/libntrup/src/ref/rq_recip3.c
@@ -3,27 +3,35 @@
 #include "rq.h"
 
 /* caller must ensure that x-y does not overflow */
-static int smaller_mask(int x,int y)
+static int
+smaller_mask(int x, int y)
 {
   return (x - y) >> 31;
 }
 
-static void vectormodq_product(modq *z,int len,const modq *x,const modq c)
+static void
+vectormodq_product(modq *z, int len, const modq *x, const modq c)
 {
   int i;
-  for (i = 0;i < len;++i) z[i] = modq_product(x[i],c);
+  for(i = 0; i < len; ++i)
+    z[i] = modq_product(x[i], c);
 }
 
-static void vectormodq_minusproduct(modq *z,int len,const modq *x,const modq *y,const modq c)
+static void
+vectormodq_minusproduct(modq *z, int len, const modq *x, const modq *y,
+                        const modq c)
 {
   int i;
-  for (i = 0;i < len;++i) z[i] = modq_minusproduct(x[i],y[i],c);
+  for(i = 0; i < len; ++i)
+    z[i] = modq_minusproduct(x[i], y[i], c);
 }
 
-static void vectormodq_shift(modq *z,int len)
+static void
+vectormodq_shift(modq *z, int len)
 {
   int i;
-  for (i = len - 1;i > 0;--i) z[i] = z[i - 1];
+  for(i = len - 1; i > 0; --i)
+    z[i] = z[i - 1];
   z[0] = 0;
 }
 
@@ -33,42 +41,46 @@ or returning -1 if s is not invertible mod m
 r,s are polys of degree <p
 m is x^p-x-1
 */
-int rq_recip3(modq *r,const small *s)
+#define LOOPS (2 * p + 1)
+
+int
+rq_recip3(modq *r, const small *s)
 {
-  const int loops = 2*p + 1;
   int loop;
-  modq f[p + 1]; 
-  modq g[p + 1]; 
-#ifdef _MSC_VER
+  modq f[p + 1];
+  modq g[p + 1];
+
   modq u[LOOPS + 1];
   modq v[LOOPS + 1];
-#else
-  modq u[loops + 1];
-  modq v[loops + 1];
-#endif
+
   modq c;
   int i;
   int d = p;
   int e = p;
   int swapmask;
 
-  for (i = 2;i < p;++i) f[i] = 0;
+  for(i = 2; i < p; ++i)
+    f[i] = 0;
   f[0] = -1;
   f[1] = -1;
   f[p] = 1;
   /* generalization: can initialize f to any polynomial m */
   /* requirements: m has degree exactly p, nonzero constant coefficient */
 
-  for (i = 0;i < p;++i) g[i] = 3 * s[i];
+  for(i = 0; i < p; ++i)
+    g[i] = 3 * s[i];
   g[p] = 0;
 
-  for (i = 0;i <= loops;++i) u[i] = 0;
+  for(i = 0; i <= LOOPS; ++i)
+    u[i] = 0;
 
   v[0] = 1;
-  for (i = 1;i <= loops;++i) v[i] = 0;
+  for(i = 1; i <= LOOPS; ++i)
+    v[i] = 0;
 
   loop = 0;
-  for (;;) {
+  for(;;)
+  {
     /* e == -1 or d + e + loop <= 2*p */
 
     /* f has degree p: i.e., f[p]!=0 */
@@ -79,29 +91,35 @@ int rq_recip3(modq *r,const small *s)
 
     /* u has degree <=loop (so it fits in loop+1 coefficients) */
     /* u[i]==0 for i < p-d */
-    /* if invertible: u[i]==0 for i < loop-p (so can look at just p+1 coefficients) */
+    /* if invertible: u[i]==0 for i < loop-p (so can look at just p+1
+     * coefficients) */
 
     /* v has degree <=loop (so it fits in loop+1 coefficients) */
     /* v[i]==0 for i < p-e */
     /* v[i]==0 for i < loop-p (so can look at just p+1 coefficients) */
 
-    if (loop >= loops) break;
+    if(loop >= LOOPS)
+      break;
 
-    c = modq_quotient(g[p],f[p]);
+    c = modq_quotient(g[p], f[p]);
 
-    vectormodq_minusproduct(g,p + 1,g,f,c);
-    vectormodq_shift(g,p + 1);
+    vectormodq_minusproduct(g, p + 1, g, f, c);
+    vectormodq_shift(g, p + 1);
 
 #ifdef SIMPLER
-    vectormodq_minusproduct(v,loops + 1,v,u,c);
-    vectormodq_shift(v,loops + 1);
+    vectormodq_minusproduct(v, loops + 1, v, u, c);
+    vectormodq_shift(v, loops + 1);
 #else
-    if (loop < p) {
-      vectormodq_minusproduct(v,loop + 1,v,u,c);
-      vectormodq_shift(v,loop + 2);
-    } else {
-      vectormodq_minusproduct(v + loop - p,p + 1,v + loop - p,u + loop - p,c);
-      vectormodq_shift(v + loop - p,p + 2);
+    if(loop < p)
+    {
+      vectormodq_minusproduct(v, loop + 1, v, u, c);
+      vectormodq_shift(v, loop + 2);
+    }
+    else
+    {
+      vectormodq_minusproduct(v + loop - p, p + 1, v + loop - p, u + loop - p,
+                              c);
+      vectormodq_shift(v + loop - p, p + 2);
     }
 #endif
 
@@ -109,22 +127,25 @@ int rq_recip3(modq *r,const small *s)
 
     ++loop;
 
-    swapmask = smaller_mask(e,d) & modq_nonzero_mask(g[p]);
-    swap(&e,&d,sizeof e,swapmask);
-    swap(f,g,(p + 1) * sizeof(modq),swapmask);
+    swapmask = smaller_mask(e, d) & modq_nonzero_mask(g[p]);
+    swap(&e, &d, sizeof e, swapmask);
+    swap(f, g, (p + 1) * sizeof(modq), swapmask);
 
 #ifdef SIMPLER
-    swap(u,v,(loops + 1) * sizeof(modq),swapmask);
+    swap(u, v, (loops + 1) * sizeof(modq), swapmask);
 #else
-    if (loop < p) {
-      swap(u,v,(loop + 1) * sizeof(modq),swapmask);
-    } else {
-      swap(u + loop - p,v + loop - p,(p + 1) * sizeof(modq),swapmask);
+    if(loop < p)
+    {
+      swap(u, v, (loop + 1) * sizeof(modq), swapmask);
+    }
+    else
+    {
+      swap(u + loop - p, v + loop - p, (p + 1) * sizeof(modq), swapmask);
     }
 #endif
   }
 
   c = modq_reciprocal(f[p]);
-  vectormodq_product(r,p,u + p,c);
-  return smaller_mask(0,d);
+  vectormodq_product(r, p, u + p, c);
+  return smaller_mask(0, d);
 }
diff --git a/llarp/dns.cpp b/llarp/dns.cpp
index 8a177ab1b..ddd614739 100644
--- a/llarp/dns.cpp
+++ b/llarp/dns.cpp
@@ -5,23 +5,27 @@
 void
 hexDump(const char *buffer, uint16_t size)
 {
-  char hex_buffer[size * 3 + 1];
+  // would rather heap allocate than use VLA
+  char *hex_buffer     = new char[size * 3 + 1];
   hex_buffer[size * 3] = 0;
   for(unsigned int j = 0; j < size; j++)
     sprintf(&hex_buffer[3 * j], "%02X ", buffer[j]);
   std::string str(hex_buffer);
   llarp::LogInfo("First ", size, " bytes: ", str);
+  delete[] hex_buffer;
 }
 
 void
 hexDumpAt(const char *const buffer, uint32_t pos, uint16_t size)
 {
-  char hex_buffer[size * 3 + 1];
+  // would rather heap allocate than use VLA
+  char *hex_buffer     = new char[size * 3 + 1];
   hex_buffer[size * 3] = 0;
   for(unsigned int j = 0; j < size; j++)
     sprintf(&hex_buffer[3 * j], "%02X ", buffer[pos + j]);
   std::string str(hex_buffer);
   llarp::LogInfo(pos, " ", size, " bytes: ", str);
+  delete[] hex_buffer;
 }
 
 /*
diff --git a/test/test_dnsd_unit.cpp b/test/test_dnsd_unit.cpp
index c3681d1b4..7975de9d9 100644
--- a/test/test_dnsd_unit.cpp
+++ b/test/test_dnsd_unit.cpp
@@ -12,13 +12,14 @@ test_sendto_dns_hook(__attribute__((unused)) void *sock,
                      __attribute__((unused)) const struct sockaddr *from,
                      const void *buffer, size_t length)
 {
-  char hex_buffer[length * 3 + 1];
+  char *hex_buffer       = new char[length * 3 + 1];
   hex_buffer[length * 3] = 0;
   for(unsigned int j = 0; j < length; j++)
     sprintf(&hex_buffer[3 * j], "%02X ", ((const char *)buffer)[j]);
   // printf("Got [%zu] bytes: [%s]\n", length, hex_buffer);
   g_result = hex_buffer;
   g_length = length;
+  delete[] hex_buffer;
   return length;
 }