Comment fix
Append to CFLAGS, don't overwrite
Custom, safer, copy to strbuf

This also avoids format-security warnings.