https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105346
Richard Biener <rguenth at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |WAITING Ever confirmed|0 |1 Last reconfirmed| |2022-04-22 --- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> --- It doesn't diagnose a simple testcase like #include <stdlib.h> void bar (void *); void foo (int n) { int a[100]; int *p = a; if (n > 100) p = malloc (n*sizeof(int)); bar (p); if (p != a) free (p); } so maybe you can provide preprocessed source of the TU that diagnoses such a case in a more complicated setting?