https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66865
--- Comment #8 from marcus at jet dot franken.de --- FWIW, it seems it is thinking that %rsi stays alive over sprintfW calls. leaq formatW.23952(%rip), %rsi #, movzbl (%r14), %edx # MEM[(const struct SID *)pSid_9(D)].Revision, D.26187 leaq 2(%r13), %rbx #, tmp159 .loc 1 1767 0 movw %ax, 48(%rsp) #, MEM[(WCHAR *)&buffer] .loc 1 1768 0 xorl %eax, %eax # movq %rbx, %rdi # tmp159, call sprintfW@PLT # .LVL800: .loc 1 1769 0 movzbl 4(%r14), %edx # MEM[(const struct SID *)pSid_9(D)].IdentifierAuthority.Value, D.26187 .loc 1 1768 0 cltq .loc 1 1769 0 movzbl 7(%r14), %ecx # MEM[(const struct SID *)pSid_9(D)].IdentifierAuthority.Value, D.26189 .loc 1 1768 0 leaq (%rbx,%rax,2), %rbx #, p .LVL801: .loc 1 1769 0 movzbl 5(%r14), %eax # MEM[(const struct SID *)pSid_9(D)].IdentifierAuthority.Value, D.26189 movq %rbx, %rdi # p, sall $8, %edx #, D.26187 orl %eax, %edx # D.26189, D.26189 movzbl 6(%r14), %eax # MEM[(const struct SID *)pSid_9(D)].IdentifierAuthority.Value, D.26187 sall $16, %edx #, D.26191 sall $8, %eax #, D.26187 orl %ecx, %eax # D.26189, D.26189 movzwl %ax, %eax # D.26189, D.26191 orl %eax, %edx # D.26191, D.26191 xorl %eax, %eax # call sprintfW@PLT # %rsi seems expected at this last sprintfW, but is already clobbered by the previous one. We had two of these bugs already.