https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99751
--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> --- parm 0 flags: nodirectescape void e (int * d) { int * * c.0_1; int * _2; <bb 2> : c.0_1 = c; _2 = b (d_4(D)); *c.0_1 = _2; return; is wrong, it does escape through the *c store. I suppose b (d) is "wrong" somehow, the escape through the return is not mentioned: parm 0 flags: direct noclobber noescape nodirectescape int * b (int * d) { <bb 2> : return d_1(D);