diff --git a/CMakeLists.txt b/CMakeLists.txt
index ebcf7b55f28..d593a87f6d1 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -841,7 +841,7 @@ if (UNIX)
     set(ld_entry_flag "--entry")
   endif ()
   # there's no cmake warning control so we hardcode it
-  set(WARN "-Wall -Werror -Wwrite-strings")
+  set(WARN "-Wall -Werror -Wwrite-strings -Wvla")
   if (NOT CMAKE_COMPILER_IS_CLANG)
     # Old gcc's ignore unknown -W flags, but -Wall -Werror causes clang to
     # complain that it doesn't recognize it.
diff --git a/core/arch/aarch64/proc.c b/core/arch/aarch64/proc.c
index 9c4bb53855a..75f3314bfd9 100644
--- a/core/arch/aarch64/proc.c
+++ b/core/arch/aarch64/proc.c
@@ -41,11 +41,11 @@ static int num_opmask_registers;
 
 #ifndef DR_HOST_NOT_TARGET
 
-const static int num_feature_registers = sizeof(features_t) / sizeof(uint64);
+#    define NUM_FEATURE_REGISTERS (sizeof(features_t) / sizeof(uint64))
 
 #    define MRS(REG, IDX, FEATS)                                                     \
         do {                                                                         \
-            if (IDX > (num_feature_registers - 1))                                   \
+            if (IDX > (NUM_FEATURE_REGISTERS - 1))                                   \
                 CLIENT_ASSERT(false, "Reading undefined AArch64 feature register!"); \
             asm("mrs %0, " #REG : "=r"(FEATS[IDX]));                                 \
         } while (0);
@@ -61,7 +61,7 @@ read_feature_regs(uint64 isa_features[])
 static void
 get_processor_specific_info(void)
 {
-    uint64 isa_features[num_feature_registers];
+    uint64 isa_features[NUM_FEATURE_REGISTERS];
 
     /* FIXME i#5474: Catch and handle SIGILL if MRS not supported.
      * Placeholder for some older kernels on v8.0 systems which do not support
diff --git a/libutil/dr_frontend_unix.c b/libutil/dr_frontend_unix.c
index d1f5cabfa68..c2e30803799 100644
--- a/libutil/dr_frontend_unix.c
+++ b/libutil/dr_frontend_unix.c
@@ -135,7 +135,7 @@ drfront_searchenv(const char *fname, const char *env_var, OUT char *full_path,
     const char *cur;
     const char *next;
     const char *end;
-    char tmp[full_path_size];
+    char tmp[PATH_MAX];
     char realpath_buf[PATH_MAX]; /* realpath hardcodes its buffer length */
     drfront_status_t status_check = DRFRONT_ERROR;
     bool access_ret = false;
diff --git a/suite/tests/CMakeLists.txt b/suite/tests/CMakeLists.txt
index a386b584515..51434953e88 100644
--- a/suite/tests/CMakeLists.txt
+++ b/suite/tests/CMakeLists.txt
@@ -4948,6 +4948,10 @@ if (NOT ANDROID)
     set (TestMemProtChg "${TestMemProtChg}_FLAKY")
   endif (UNIX)
   tobuild("${TestMemProtChg}" security-common/TestMemProtChg.c)
+  if (UNIX)
+    append_property_string(SOURCE security-common/TestMemProtChg.c
+      COMPILE_FLAGS "-Wno-vla")
+  endif ()
   tochcon("${TestMemProtChg}" wine_exec_t)
   mark_execstack("${TestMemProtChg}")
 endif ()