Re: Err...
I'm happy to be quoted the relevant text to show otherwise but IIRC I've made no assumption about the implementation of ZeroMemory/SecureZeroMemory today or language support.
Bluntly, a compiler which removes calls to 'memset' regardless of how you spell it is broken.
void test_case()
{
char buf[100];
size_t nbytes = (sizeof(buf) / sizeof(buf[0]));
// MSCV has no business removing this memset
memset(&buf[0], 0, nbytes);
fgets(buf,nbytes-1,stdin)
...
}