wti_rec_kv_copy takes a bare pointer to a value we fill in on behalf of the caller. Unfortunately, we also don't pass a maximum size to the function, so there's no way to protect against a buffer overrun. It works at the moment because wti_rec_kv_copy only deals with very specific data types, but this is a footgun waiting to happen.