exec.c, compat.c: fix count(), compat_count() bounds checking