https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103961
--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> --- Testcase with nicer formatting: extern inline __attribute__ ((__gnu_inline__)) int sprintf (char *restrict s, const char *restrict fmt, ...) { return __builtin___sprintf_chk (s, 1, __builtin_object_size (s, 2 > 1), fmt, __builtin_va_arg_pack ()); } void cap_to_text (int c) { char buf[1572]; char *p; int n, t; p = 20 + buf; for (t = 8; t--; ) { for (n = 0; n < c; n++) p += sprintf (p, "a,"); p--; sprintf (p, "+"); } } Indeed, early_objsz already inserts the bogus: p_16 = p_3 + 18446744073709551615; _17 = __builtin_object_size (p_16, 1); _24 = MIN_EXPR <_17, 0>; _25 = __builtin___sprintf_chk (p_16, 1, _24, "+");