The problem is that when you write to ary_d, you must start from index 0, whereas when you read from ary_s, you must start from index cnt. Unfortunately, you start from index cnt in both cases, hence when cnt is greater than 0, you end up writing to the destination array out of bounds.
I suggest that you have 5 parameters:
- const int source[]
- int dest[]
- int source_start
- int source_end (or source_count)
- int dest_size
This will allow you to write a "copy from source array starting at some index to fill destination array" function while avoiding array out of bounds accesses.