> ... but it's just reading through a static array, looking for the end marker.
Looking for an end marker, which is not guaranteed to exist. At least not until you do inter function dependency analysis and have all potential callers' code and make sure there is no path your array data origins from some not to be trusted hardware or user input. Could be easy or impossible.
Of course it would not be an endless loop, but still a potentially dangerous construct overreading the allocated array.