https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93041
--- Comment #4 from WHR <msl0000023508 at gmail dot com> --- OK, I'm now fully understood what's happens. If the loop breaks, 'p' must be 0, so the later '**p' will dereference a null pointer. Looks like this is actually a feature...