https://gcc.gnu.org/bugzilla/show_bug.cgi?id=80797
--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> --- We don't instrument such expressions because v_3 = &s_2->i; is not gimple_assign_load_p: 1997 if (flag_sanitize & (SANITIZE_NULL | SANITIZE_ALIGNMENT)) 1998 { 1999 if (gimple_store_p (stmt)) 2000 instrument_null (gsi, true); 2001 if (gimple_assign_load_p (stmt)) 2002 instrument_null (gsi, false); 2003 } So I think we could use gimple_assign_single_p instead of gimple_assign_load_p and then strip the ADDR_EXPR in instrument_null before getting its base address. Untested.