https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84859
--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> --- Note, even teaching VRP to look through stores and loads from memory wouldn't help here, not even for the first function, because it uses *a as the length, but also overwrites it (potentially or for real) with the memcpy, so the compiler can't really know anything about *a in the second and following iterations, except that it is unsigned char and thus [0, 255]. n can wrap around.