Index: libcfa/src/iostream.cfa
===================================================================
--- libcfa/src/iostream.cfa	(revision 3ee8853bf00923143074b5713a8122bbb0da519d)
+++ libcfa/src/iostream.cfa	(revision 2fa0237f52bd8db42015c83dee0d38191a902db4)
@@ -1,2 +1,3 @@
+
 //
 // Cforall Version 1.0.0 Copyright (C) 2015 University of Waterloo
@@ -976,5 +977,10 @@
 		if ( f.flags.ignore ) { fmtstr[1] = '*'; start += 1; }
 		// no maximum width necessary because text ignored => width is read width
-		if ( f.wd != -1 ) { start += sprintf( &fmtstr[start], "%d", f.wd ); }
+		if ( f.wd != -1 ) {
+			// wd is buffer bytes available (for input chars + null terminator)
+			// rwd is count of input chars
+			int rwd = f.flags.rwd ? f.wd : (f.wd - 1);
+			start += sprintf( &fmtstr[start], "%d", rwd );
+		}
 
 		if ( ! scanset ) {
@@ -993,5 +999,5 @@
 		} // if
 
-		int check = f.wd - 1;
+		int check = f.wd - 2;
 		if ( ! f.flags.rwd ) f.s[check] = '\0';			// insert sentinel
 		len = fmt( is, fmtstr, f.s );
Index: tests/io/.expect/manipulatorsInput.arm64.txt
===================================================================
--- tests/io/.expect/manipulatorsInput.arm64.txt	(revision 3ee8853bf00923143074b5713a8122bbb0da519d)
+++ tests/io/.expect/manipulatorsInput.arm64.txt	(revision 2fa0237f52bd8db42015c83dee0d38191a902db4)
@@ -1,2 +1,5 @@
+pre1 "123456", canary ok
+pre2a "1234567", exception occurred, canary ok
+pre2b "89", canary ok
 1 yyyyyyyyyyyyyyyyyyyy
 2 abcxxx
Index: tests/io/.expect/manipulatorsInput.x64.txt
===================================================================
--- tests/io/.expect/manipulatorsInput.x64.txt	(revision 3ee8853bf00923143074b5713a8122bbb0da519d)
+++ tests/io/.expect/manipulatorsInput.x64.txt	(revision 2fa0237f52bd8db42015c83dee0d38191a902db4)
@@ -1,2 +1,5 @@
+pre1 "123456", canary ok
+pre2a "1234567", exception occurred, canary ok
+pre2b "89", canary ok
 1 yyyyyyyyyyyyyyyyyyyy
 2 abcxxx
Index: tests/io/.expect/manipulatorsInput.x86.txt
===================================================================
--- tests/io/.expect/manipulatorsInput.x86.txt	(revision 3ee8853bf00923143074b5713a8122bbb0da519d)
+++ tests/io/.expect/manipulatorsInput.x86.txt	(revision 2fa0237f52bd8db42015c83dee0d38191a902db4)
@@ -1,2 +1,5 @@
+pre1 "123456", canary ok
+pre2a "1234567", exception occurred, canary ok
+pre2b "89", canary ok
 1 yyyyyyyyyyyyyyyyyyyy
 2 abcxxx
Index: tests/io/.in/manipulatorsInput.txt
===================================================================
--- tests/io/.in/manipulatorsInput.txt	(revision 3ee8853bf00923143074b5713a8122bbb0da519d)
+++ tests/io/.in/manipulatorsInput.txt	(revision 2fa0237f52bd8db42015c83dee0d38191a902db4)
@@ -1,2 +1,4 @@
+123456
+123456789
 abc 
 abc 
Index: tests/io/manipulatorsInput.cfa
===================================================================
--- tests/io/manipulatorsInput.cfa	(revision 3ee8853bf00923143074b5713a8122bbb0da519d)
+++ tests/io/manipulatorsInput.cfa	(revision 2fa0237f52bd8db42015c83dee0d38191a902db4)
@@ -15,4 +15,39 @@
 
 int main() {
+	{
+		// Upfront checks to ensure buffer safety.  Once these pass, the simpler `wdi(sizeof(s),s)`
+		// usage, as in the scanf alignment cases below, is justified.
+		struct {
+			char buf[8];
+			char canary;
+		} data;
+		static_assert( sizeof(data.buf) == 8 );
+		static_assert( &data.buf[8] == &data.canary );  // canary comes right after buf
+
+		void rep(const char* casename) {
+			data.canary = 42;
+			bool caught = false;
+			try {
+				sin | wdi( sizeof(data.buf), data.buf );
+			} catch (cstring_length*) {
+				caught = true;
+			}
+			printf( "%s \"%s\"", casename, data.buf );
+			if ( caught ) {
+				printf(", exception occurred");
+			}
+			if ( data.canary == 42 ) {
+				printf(", canary ok");
+			} else {
+				printf(", canary overwritten to %d", data.canary);
+			}
+			printf("\n");
+		}
+
+		rep("pre1");
+		rep("pre2a");
+		rep("pre2b");
+		scanf("\n");  // next test does not start with %s so does not tolerate leading whitespace
+	}
 	{
 		char s[] = "yyyyyyyyyyyyyyyyyyyy";