https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96798
--- Comment #3 from David Malcolm <dmalcolm at gcc dot gnu.org> --- Thanks. Unfortunately that didn't trigger the issue for me, sorry. I'm wondering how best to debug this. Could you attach the preprocessed source from the testcase(s) please? Also, if you hack in a call to: __analyzer_dump (); immediately *after* the call to memset in memset-1.c's test_5, what do you get? I'm seeing: rmodel: stack depth: 1 frame (index 0): frame: 'test_5'@1 clusters within frame: 'test_5'@1 cluster for: buf key: {kind: default, start: 0, size: 2048, next: 2048} value: 'char[256]' {UNKNOWN(char[256])} m_called_unknown_fn: FALSE constraint_manager: equiv classes: ec0: {(void *)0B == [m_constant]'0B'} constraints: (signifying among other things that "buf" now has unknown content, that the memset could have overwritten the earlier write to buf[42], given that "n" isn't known). Alternatively, is there a public test box available somewhere? I didn't see one in the GCC compile farm.