After trying out different inputs, I found that length is changed to the first input integer, here 4.
What likely happens is that length happens to be zero (keep in mind that reading it is UB due to it being uninitialized, and that's not counting variable-length arrays not being a part of standard C++).
ar then becomes a zero-length array, and accessing a[0] is out of bounds (which is again UB). Apparently length happens to be right after the array in the stack, so it gets overwritten.