https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103939
--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> --- memset (whatever, sizeof(whatever), 0); is a common mistake, that is why gcc has a warning for it too. But your report is the first one to suggest that even other variants happen in real-world. The thing is, memset (whatver, sizeof (...), 0) is clearly a bug, memset with literal 0 as last argument just shouldn't be added because it doesn't do anything. memset (whatever, sizeof (...), 0xff); could be valid thing to do if you want to initialize buf[0xff] to size of something, so there is bigger chance of false positives.
