Newly introduced findings

List of Findings

Error: GCC_ANALYZER_WARNING (CWE-476): [#def1]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:29:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘args’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:16:1: enter_function: entry to ‘pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:23:21: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:27:35: call_function: inlined call to ‘nir_src_as_deref’ from ‘pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:28:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:29:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_printf.c:29:7: danger: ‘args + (long unsigned int)i * 8’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#   27|      nir_deref_instr *packed_args = nir_src_as_deref(instr->src[0]);
#   28|      for (uint32_t i = 0; i < info->num_args; i++)
#   29|->       args[i] = nir_load_deref(b, nir_build_deref_struct(b, packed_args, i));
#   30|   
#   31|      radv_build_printf_args(b, NULL, info->strings, info->num_args, args);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def2]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:261:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:571:1: enter_function: entry to ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: return_function: returning to ‘radv_nir_lower_ray_queries’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:590:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: call_function: inlined call to ‘nir_start_block’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: call_function: inlined call to ‘nir_intrinsic_is_ray_query’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:609:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:629:16: call_function: calling ‘lower_rq_initialize’ from ‘radv_nir_lower_ray_queries’
#  259|   
#  260|      isec_store(b, closest, t, instr->src[7].ssa);
#  261|->    isec_store(b, closest, intersection_type, nir_imm_int(b, intersection_type_none));
#  262|   
#  263|      nir_def *accel_struct = instr->src[1].ssa;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def3]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:284:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:571:1: enter_function: entry to ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: return_function: returning to ‘radv_nir_lower_ray_queries’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:590:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: call_function: inlined call to ‘nir_start_block’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: call_function: inlined call to ‘nir_intrinsic_is_ray_query’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:609:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:629:16: call_function: calling ‘lower_rq_initialize’ from ‘radv_nir_lower_ray_queries’
#  282|         rq_store(b, rq, trav_stack_low_watermark, base_offset);
#  283|      } else {
#  284|->       rq_store(b, rq, trav_stack, nir_imm_int(b, 0));
#  285|         rq_store(b, rq, trav_stack_low_watermark, nir_imm_int(b, 0));
#  286|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def4]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:285:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:571:1: enter_function: entry to ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: return_function: returning to ‘radv_nir_lower_ray_queries’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:590:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: call_function: inlined call to ‘nir_start_block’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: call_function: inlined call to ‘nir_intrinsic_is_ray_query’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:609:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:629:16: call_function: calling ‘lower_rq_initialize’ from ‘radv_nir_lower_ray_queries’
#  283|      } else {
#  284|         rq_store(b, rq, trav_stack, nir_imm_int(b, 0));
#  285|->       rq_store(b, rq, trav_stack_low_watermark, nir_imm_int(b, 0));
#  286|      }
#  287|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def5]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:563:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘opaque_deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:571:1: enter_function: entry to ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:578:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:579:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: return_function: returning to ‘radv_nir_lower_ray_queries’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:587:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:590:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: call_function: inlined call to ‘nir_start_block’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:599:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:600:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:601:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:606:18: call_function: inlined call to ‘nir_intrinsic_is_ray_query’ from ‘radv_nir_lower_ray_queries’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:609:67: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/nir/radv_nir_lower_ray_queries.c:617:35: call_function: calling ‘radv_lower_opaque_ray_query_deref’ from ‘radv_nir_lower_ray_queries’
#  561|   radv_lower_opaque_ray_query_deref(nir_builder *b, nir_deref_instr *opaque_deref, nir_variable *var)
#  562|   {
#  563|->    if (opaque_deref->deref_type != nir_deref_type_array)
#  564|         return nir_build_deref_var(b, var);
#  565|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def6]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:213:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:217:1: enter_function: entry to ‘radv_build_printf’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:223:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_false: following ‘false’ branch (when ‘num_args <= i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:235:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:237:4: call_function: calling ‘radv_build_printf_args’ from ‘radv_build_printf’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  211|      free(strides);
#  212|   
#  213|->    util_dynarray_append(&device->printf.formats, struct radv_printf_format, format);
#  214|   }
#  215|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def7]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:214:1: warning[-Wanalyzer-malloc-leak]: leak of ‘format.string’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:217:1: enter_function: entry to ‘radv_build_printf’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:223:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_false: following ‘false’ branch (when ‘num_args <= i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:235:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:237:4: call_function: calling ‘radv_build_printf_args’ from ‘radv_build_printf’
#  212|   
#  213|      util_dynarray_append(&device->printf.formats, struct radv_printf_format, format);
#  214|-> }
#  215|   
#  216|   void

Error: GCC_ANALYZER_WARNING (CWE-476): [#def8]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘args’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:219:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:223:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:230:21: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:232:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_printf.c:233:7: danger: ‘args + (long unsigned int)i * 8’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/2)
#  231|   
#  232|      for (uint32_t i = 0; i < num_args; i++)
#  233|->       args[i] = va_arg(arg_list, nir_def *);
#  234|   
#  235|      va_end(arg_list);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def9]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_radeon_winsys.h:324:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘it_probs_bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2624:1: enter_function: entry to ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2639:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2644:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2648:4: call_function: calling ‘ruvd_dec_message_decode’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2648:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘ruvd_dec_message_decode’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2653:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2653:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2666:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2666:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2671:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2671:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2672:4: call_function: calling ‘send_cmd’ from ‘radv_uvd_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2672:4: return_function: returning to ‘radv_uvd_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2673:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2675:16: call_function: inlined call to ‘radv_buffer_get_va’ from ‘radv_uvd_decode_video’
#  322|   radv_buffer_get_va(const struct radeon_winsys_bo *bo)
#  323|   {
#  324|->    return bo->va;
#  325|   }
#  326|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def10]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:1373:9: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2690:25: release_memory: ‘it_probs_ptr’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
# 1371|         result.sps_info_flags |= 1 << 9;
# 1372|   
# 1373|->    if (!h265_pic_info->pStdPictureInfo->flags.short_term_ref_pic_set_sps_flag) {
# 1374|         result.sps_info_flags |= 1 << 11;
# 1375|      }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def11]
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2750:13: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘slice_offset’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2682:1: enter_function: entry to ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2717:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2720:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2720:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2725:4: call_function: inlined call to ‘radv_vid_buffer_upload_alloc’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: call_function: calling ‘rvcn_dec_message_decode’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2732:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘rvcn_dec_message_decode’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2734:4: call_function: calling ‘send_cmd’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2734:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2736:4: call_function: calling ‘send_cmd’ from ‘radv_vcn_decode_video’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2736:4: return_function: returning to ‘radv_vcn_decode_video’ from ‘send_cmd’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/vulkan/radv_video.c:2750:13: danger: use of uninitialized value ‘slice_offset’ here
# 2748|   
# 2749|      send_cmd(cmd_buffer, RDECODE_CMD_BITSTREAM_BUFFER, src_buffer->bo,
# 2750|->             vk_buffer_address(&src_buffer->vk, frame_info->srcBufferOffset + slice_offset));
# 2751|   
# 2752|      struct radv_image_view *dst_iv = radv_image_view_from_handle(frame_info->dstPictureResource.imageViewBinding);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def12]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:193:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:243:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:245:7: branch_false: following ‘false’ branch (when ‘argc == 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:251:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:258:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:264:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:267:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:274:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:278:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:278:4: return_function: returning to ‘main’ from ‘nir_precomp_print_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:286:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:286:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:294:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:295:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:333:10: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:333:10: return_function: returning to ‘main’ from ‘nir_shader_intrinsics_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:335:13: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:339:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:342:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:342:16: branch_false: following ‘false’ branch (when the strings are equal)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:346:31: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:353:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:358:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:360:13: call_function: calling ‘print_shader’ from ‘main’
#  191|      uint32_t *mem = calloc(sz_el, 4);
#  192|   
#  193|->    memcpy(mem, &info, sizeof(info));
#  194|      memcpy((uint8_t *)mem + sizeof(info), p->binary, p->info.binary_size);
#  195|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def13]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:463:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:446:1: enter_function: entry to ‘agx_block_add_successor’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:454:25: branch_true: following ‘true’ branch (when ‘i != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:455:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:463:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_block_add_successor’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:463:7: return_function: returning to ‘agx_block_add_successor’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:463:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*successor.predecessors, 1, 8)’
#  461|   
#  462|         block->successors[i] = successor;
#  463|->       util_dynarray_append(&successor->predecessors, agx_block *, block);
#  464|         return;
#  465|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def14]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:590:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3762:1: enter_function: entry to ‘agx_compile_shader_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3823:4: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_compile_shader_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3823:4: return_function: returning to ‘agx_compile_shader_nir’ from ‘nir_shader_intrinsics_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3827:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3827:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3827:4: call_function: calling ‘agx_optimize_nir’ from ‘agx_compile_shader_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3827:4: return_function: returning to ‘agx_compile_shader_nir’ from ‘agx_optimize_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3840:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘agx_compile_shader_nir’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3840:4: return_function: returning to ‘agx_compile_shader_nir’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3840:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_compile.c:3842:10: call_function: calling ‘agx_compile_function_nir’ from ‘agx_compile_shader_nir’
#  588|   agx_interp_for_bary(nir_intrinsic_instr *bary, agx_index *sample_index)
#  589|   {
#  590|->    switch (bary->intrinsic) {
#  591|      case nir_intrinsic_load_barycentric_pixel:
#  592|         return AGX_INTERPOLATION_CENTER;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def15]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:170:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘copies2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:394:1: enter_function: entry to ‘agx_emit_parallel_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:400:4: call_function: calling ‘agx_emit_parallel_copies_for_class’ from ‘agx_emit_parallel_copies’
#  168|         if (copy.src.size == AGX_SIZE_64) {
#  169|            copy.src.size = AGX_SIZE_32;
#  170|->          copies2[num_copies2++] = copy;
#  171|   
#  172|            if (copy.src.type == AGX_INDEX_IMMEDIATE) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def16]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:185:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘copies2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:394:1: enter_function: entry to ‘agx_emit_parallel_copies’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_lower_parallel_copy.c:400:4: call_function: calling ‘agx_emit_parallel_copies_for_class’ from ‘agx_emit_parallel_copies’
#  183|            copies2[num_copies2++] = copy;
#  184|         } else {
#  185|->          copies2[num_copies2++] = copy;
#  186|         }
#  187|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def17]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:114:15: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:105:1: enter_function: entry to ‘needs_lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:114:15: call_function: inlined call to ‘nir_src_as_intrinsic’ from ‘needs_lower’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:114:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_nir_lower_interpolation.c:114:15: danger: dereference of NULL ‘<unknown>’
#  112|      /* at_offset barycentrics need to be lowered */
#  113|      if (load->intrinsic == nir_intrinsic_load_interpolated_input) {
#  114|->       return (nir_src_as_intrinsic(load->src[0])->intrinsic ==
#  115|                 nir_intrinsic_load_barycentric_at_offset);
#  116|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def18]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:551:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  549|         unsigned hi = ((uint64_t)extend) << extend_offset;
#  550|   
#  551|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  552|         memcpy(util_dynarray_grow_bytes(emission, 1, length - 8), &hi,
#  553|                length - 8);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def19]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:595:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  593|   
#  594|         unsigned size = 8;
#  595|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  596|         break;
#  597|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def20]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:609:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  607|   
#  608|         unsigned size = 4;
#  609|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  610|         break;
#  611|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def21]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:618:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  616|   
#  617|         unsigned size = 2;
#  618|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  619|         break;
#  620|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def22]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:674:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  672|   
#  673|         unsigned size = 8;
#  674|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  675|         break;
#  676|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def23]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:696:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  694|   
#  695|         unsigned size = 4;
#  696|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  697|         break;
#  698|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def24]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:762:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  760|   
#  761|         unsigned size = L ? 8 : 6;
#  762|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  763|         break;
#  764|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def25]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:788:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  786|   
#  787|         unsigned size = L ? 8 : 6;
#  788|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
#  789|         break;
#  790|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def26]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:822:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  820|            (((uint64_t)(O >> 8)) << 56);
#  821|   
#  822|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  823|         break;
#  824|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def27]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:849:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  847|         uint64_t raw2 = S;
#  848|   
#  849|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  850|         memcpy(util_dynarray_grow_bytes(emission, 1, 2), &raw2, 2);
#  851|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def28]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:850:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  848|   
#  849|         memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  850|->       memcpy(util_dynarray_grow_bytes(emission, 1, 2), &raw2, 2);
#  851|         break;
#  852|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def29]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:917:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  915|            (((uint64_t)I->scoreboard) << 63);
#  916|   
#  917|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  918|         if (L)
#  919|            memcpy(util_dynarray_grow_bytes(emission, 1, 4), &extend, 4);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def30]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:919:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  917|         memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  918|         if (L)
#  919|->          memcpy(util_dynarray_grow_bytes(emission, 1, 4), &extend, 4);
#  920|   
#  921|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def31]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:959:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#  957|         if (raw >> 48) {
#  958|            raw |= BITFIELD_BIT(15);
#  959|->          memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  960|         } else {
#  961|            memcpy(util_dynarray_grow_bytes(emission, 1, 6), &raw, 6);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def32]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:961:10: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  959|            memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
#  960|         } else {
#  961|->          memcpy(util_dynarray_grow_bytes(emission, 1, 6), &raw, 6);
#  962|         }
#  963|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def33]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1010:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1008|         uint32_t word2 = (F >> 1) | (unk3 ? (1 << 3) : 0) | ((T >> 6) << 14);
# 1009|   
# 1010|->       memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word0, 4);
# 1011|         memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word1, 4);
# 1012|         memcpy(util_dynarray_grow_bytes(emission, 1, 2), &word2, 2);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def34]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1011:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1009|   
# 1010|         memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word0, 4);
# 1011|->       memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word1, 4);
# 1012|         memcpy(util_dynarray_grow_bytes(emission, 1, 2), &word2, 2);
# 1013|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def35]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1012:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1010|         memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word0, 4);
# 1011|         memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word1, 4);
# 1012|->       memcpy(util_dynarray_grow_bytes(emission, 1, 2), &word2, 2);
# 1013|         break;
# 1014|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def36]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1035:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1033|                          (I->zs << 29);
# 1034|   
# 1035|->       memcpy(util_dynarray_grow_bytes(emission, 1, 4), &word0, 4);
# 1036|         break;
# 1037|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def37]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1052:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 1050|         };
# 1051|   
# 1052|->       util_dynarray_append(fixups, struct agx_branch_fixup, fixup);
# 1053|   
# 1054|         /* The rest of the instruction is fixed */

Error: GCC_ANALYZER_WARNING (CWE-688): [#def38]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1057:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 1055|         struct agx_opcode_info info = agx_opcodes_info[I->op];
# 1056|         uint64_t raw = info.encoding.exact;
# 1057|->       memcpy(util_dynarray_grow_bytes(emission, 1, 6), &raw, 6);
# 1058|         break;
# 1059|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def39]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1065:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
#argument 1 of ‘__builtin_memcpy’ must be non-null
# 1063|         struct agx_opcode_info info = agx_opcodes_info[I->op];
# 1064|         uint64_t raw = info.encoding.exact | (I->imm << 40);
# 1065|->       memcpy(util_dynarray_grow_bytes(emission, 1, 6), &raw, 6);
# 1066|         break;
# 1067|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def40]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1093:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1091|            ((uint64_t)q5 << 48) | ((uint64_t)(I->imm >> 8) << 56);
# 1092|   
# 1093|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
# 1094|         break;
# 1095|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def41]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1131:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1129|   
# 1130|         unsigned size = L ? 8 : 6;
# 1131|->       memcpy(util_dynarray_grow_bytes(emission, 1, size), &raw, size);
# 1132|         break;
# 1133|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def42]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1150:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1179:1: enter_function: entry to ‘agx_pack_binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1184:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1187:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1189:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1190:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/compiler/agx_pack.c:1191:10: call_function: calling ‘agx_pack_instr’ from ‘agx_pack_binary’
# 1148|            ((uint64_t)(I->stack_size >> 8) << 56);
# 1149|   
# 1150|->       memcpy(util_dynarray_grow_bytes(emission, 1, 8), &raw, 8);
# 1151|         break;
# 1152|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def43]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:125:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘req’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:123:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:125:4: danger: ‘req’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  123|      struct asahi_ccmd_vm_bind_req *req = calloc(1, req_len);
#  124|   
#  125|->    *req = (struct asahi_ccmd_vm_bind_req){
#  126|         .hdr.cmd = ASAHI_CCMD_VM_BIND,
#  127|         .hdr.len = sizeof(struct asahi_ccmd_vm_bind_req),

Error: GCC_ANALYZER_WARNING (CWE-476): [#def44]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:244:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘req’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:242:39: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:244:4: danger: ‘req’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  242|         (struct asahi_ccmd_submit_req *)calloc(1, req_len);
#  243|   
#  244|->    req->queue_id = submit->queue_id;
#  245|      req->extres_count = virt->extres_count;
#  246|      req->cmdbuf_size = submit->cmdbuf_size;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def45]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:263:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘vdrm_syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:261:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:262:20: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:263:35: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_device_virtio.c:263:7: danger: ‘vdrm_syncs + (long unsigned int)i * 16’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
#  261|         calloc(total_syncs, sizeof(struct drm_virtgpu_execbuffer_syncobj));
#  262|      for (int i = 0; i < total_syncs; i++) {
#  263|->       vdrm_syncs[i].handle = syncs[i].handle;
#  264|         vdrm_syncs[i].point = syncs[i].timeline_value;
#  265|      }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def46]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:67:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘xy[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:204:1: enter_function: entry to ‘agx_nir_lower_sample_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:207:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_lower_sample_intrinsics’
#   65|   
#   66|         /* Collect and rewrite */
#   67|->       nir_def_replace(&intr->def, nir_vec2(b, xy[0], xy[1]));
#   68|         return true;
#   69|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def47]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_prolog_epilog.c:120:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘data’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_prolog_epilog.c:691:1: enter_function: entry to ‘agx_nir_fs_prolog’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_prolog_epilog.c:720:4: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_fs_prolog’
#  118|      if (b->shader->info.stage == MESA_SHADER_VERTEX) {
#  119|         unsigned *nr_attribs = data;
#  120|->       unif = map_vs_part_uniform(intr, *nr_attribs);
#  121|      } else {
#  122|         unif = map_fs_part_uniform(intr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def48]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:44:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘va’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:16:1: enter_function: entry to ‘agx_va_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:38:4: call_function: calling ‘simple_mtx_unlock’ from ‘agx_va_alloc’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:38:4: return_function: returning to ‘agx_va_alloc’ from ‘simple_mtx_unlock’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:40:7: branch_false: following ‘false’ branch (when ‘addr != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:43:24: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:43:24: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_va.c:44:4: danger: ‘va’ could be NULL: unchecked value from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8)
#   42|   
#   43|      struct agx_va *va = malloc(sizeof(struct agx_va));
#   44|->    *va = (struct agx_va){
#   45|         .flags = flags,
#   46|         .size_B = size_B,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def49]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:100:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:88:7: branch_true: following ‘true’ branch (when ‘mem’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:89:13: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:91:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:92:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:100:25: danger: dereference of NULL ‘mem’
#   98|      assert(mem);
#   99|   
#  100|->    if (size + (gpu_va - mem->va->addr) > mem->size) {
#  101|         fprintf(stderr,
#  102|                 "Overflowing to unknown memory %" PRIx64

Error: GCC_ANALYZER_WARNING (CWE-476): [#def50]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:168:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:1104:1: enter_function: entry to ‘libagxdecode_usc’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/decode.c:1107:4: call_function: calling ‘agxdecode_stateful’ from ‘libagxdecode_usc’
#  166|         struct agx_bo *alloc = agxdecode_find_mapped_gpu_mem_containing(ctx, va);
#  167|         assert(alloc != NULL && "nonexistent object");
#  168|->       fprintf(agxdecode_dump_stream, "%s (%" PRIx64 ", handle %u)\n", label, va,
#  169|                 alloc->handle);
#  170|         size = MIN2(size, alloc->size - (va - alloc->va->addr));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def51]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/pool.c:24:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/pool.c:56:1: enter_function: entry to ‘agx_pool_alloc_aligned_with_bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/pool.c:67:12: call_function: calling ‘agx_pool_alloc_backing’ from ‘agx_pool_alloc_aligned_with_bo’
#   22|         agx_bo_create(pool->dev, bo_sz, 0, pool->create_flags, pool->label);
#   23|   
#   24|->    util_dynarray_append(&pool->bos, struct agx_bo *, bo);
#   25|      pool->transient_bo = bo;
#   26|      pool->transient_offset = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def52]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.c:187:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.c:631:1: enter_function: entry to ‘hk_upload_usc_words’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.c:644:23: call_function: inlined call to ‘hk_pool_usc_alloc’ from ‘hk_upload_usc_words’
#  185|            agx_bo_create(&dev->dev, size, flags, 0, "Large pool allocation");
#  186|   
#  187|->       util_dynarray_append(&cmd->large_bos, struct agx_bo *, bo);
#  188|         return (struct agx_ptr){
#  189|            .gpu = bo->va->addr,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def53]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.h:559:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cs’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_draw.c:3785:1: enter_function: entry to ‘hk_CmdDrawIndexedIndirectCount’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_draw.c:3790:4: call_function: calling ‘hk_draw_indirect_count’ from ‘hk_CmdDrawIndexedIndirectCount’
#  557|         /* Allocate hk_cs for the new stream */
#  558|         struct hk_cs *cs = malloc(sizeof(*cs));
#  559|->       *cs = (struct hk_cs){
#  560|            .cmd = cmd,
#  561|            .type = compute ? HK_CS_CDM : HK_CS_VDM,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def54]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_buffer.h:797:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘s’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:87:1: enter_function: entry to ‘dispatch’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:89:26: call_function: inlined call to ‘hk_only_variant’ from ‘dispatch’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:90:23: call_function: inlined call to ‘hk_cmd_buffer_get_cs’ from ‘dispatch’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:90:23: call_function: inlined call to ‘hk_cmd_buffer_get_cs’ from ‘dispatch’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:91:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:96:21: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_cmd_dispatch.c:115:4: call_function: calling ‘hk_dispatch_with_local_size’ from ‘dispatch’
#  795|   {
#  796|      struct hk_device *dev = hk_cmd_buffer_device(cmd);
#  797|->    uint32_t usc = hk_upload_usc_words(cmd, s, s->only_linked);
#  798|   
#  799|      hk_reserve_scratch(cmd, cs, s);

Error: GCC_ANALYZER_WARNING (CWE-121): [#def55]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:113:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:707:1: enter_function: entry to ‘hk_descriptor_set_write_template’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:711:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:714:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:719:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:721:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:723:13: call_function: calling ‘write_sampled_image_view_desc’ from ‘hk_descriptor_set_write_template’
#  111|             * we don't have to care in the shader.
#  112|             */
#  113|->          desc[plane].sampler_index =
#  114|               sampler->planes[sampler_plane].hw->index + 28;
#  115|            desc[plane].lod_bias_fp16 = sampler->lod_bias_fp16;

Error: GCC_ANALYZER_WARNING (CWE-121): [#def56]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:115:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:707:1: enter_function: entry to ‘hk_descriptor_set_write_template’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:711:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:714:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:719:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:721:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:723:13: call_function: calling ‘write_sampled_image_view_desc’ from ‘hk_descriptor_set_write_template’
#  113|            desc[plane].sampler_index =
#  114|               sampler->planes[sampler_plane].hw->index + 28;
#  115|->          desc[plane].lod_bias_fp16 = sampler->lod_bias_fp16;
#  116|            desc[plane].clamp_0_sampler_index_or_negative = -1;
#  117|         }

Error: GCC_ANALYZER_WARNING (CWE-121): [#def57]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:116:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:707:1: enter_function: entry to ‘hk_descriptor_set_write_template’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:711:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:714:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:719:31: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:721:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set.c:723:13: call_function: calling ‘write_sampled_image_view_desc’ from ‘hk_descriptor_set_write_template’
#  114|               sampler->planes[sampler_plane].hw->index + 28;
#  115|            desc[plane].lod_bias_fp16 = sampler->lod_bias_fp16;
#  116|->          desc[plane].clamp_0_sampler_index_or_negative = -1;
#  117|         }
#  118|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def58]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:104:20: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:302:1: enter_function: entry to ‘hk_GetDescriptorSetLayoutSupport’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:310:7: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_GetDescriptorSetLayoutSupport’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:310:7: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_GetDescriptorSetLayoutSupport’
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:313:7: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_GetDescriptorSetLayoutSupport’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:313:7: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_GetDescriptorSetLayoutSupport’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:321:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:321:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:322:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:324:10: call_function: inlined call to ‘hk_descriptor_get_type_list’ from ‘hk_GetDescriptorSetLayoutSupport’
#  102|         assert(info != NULL);
#  103|         assert(info_idx < info->mutableDescriptorTypeListCount);
#  104|->       type_list = &info->pMutableDescriptorTypeLists[info_idx];
#  105|      }
#  106|      return type_list;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def59]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:149:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:110:1: enter_function: entry to ‘hk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:140:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘hk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:141:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘hk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:143:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘hk_CreateDescriptorSetLayout’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:146:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:149:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:149:10: release_memory: ‘layout’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_descriptor_set_layout.c:149:4: danger: dereference of NULL ‘layout’
#  147|         return vk_error(dev, VK_ERROR_OUT_OF_HOST_MEMORY);
#  148|   
#  149|->    layout->binding_count = num_bindings;
#  150|   
#  151|      for (uint32_t j = 0; j < pCreateInfo->bindingCount; j++) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def60]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:74:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:53:1: enter_function: entry to ‘hk_add_ext_bo_locked’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:74:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘hk_add_ext_bo_locked’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:74:4: return_function: returning to ‘hk_add_ext_bo_locked’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:74:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*dev.external_bos.list, 1, 8)’
#   72|         .flags = ASAHI_EXTRES_READ | ASAHI_EXTRES_WRITE,
#   73|      };
#   74|->    util_dynarray_append(&dev->external_bos.list, struct asahi_ccmd_submit_res,
#   75|                           res);
#   76|      util_dynarray_append(&dev->external_bos.counts, unsigned, 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def61]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:76:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:80:1: enter_function: entry to ‘hk_add_ext_bo’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:82:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:83:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_device_memory.c:84:7: call_function: calling ‘hk_add_ext_bo_locked’ from ‘hk_add_ext_bo’
#   74|      util_dynarray_append(&dev->external_bos.list, struct asahi_ccmd_submit_res,
#   75|                           res);
#   76|->    util_dynarray_append(&dev->external_bos.counts, unsigned, 1);
#   77|   }
#   78|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def62]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:881:43: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1336:1: enter_function: entry to ‘hk_GetDeviceImageSubresourceLayoutKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1344:13: call_function: calling ‘hk_image_init’ from ‘hk_GetDeviceImageSubresourceLayoutKHR’
#  879|            modifier = choose_drm_format_mod(dev, image->plane_count, pCreateInfo,
#  880|                                             mod_list_info->drmFormatModifierCount,
#  881|->                                           mod_list_info->pDrmFormatModifiers);
#  882|         }
#  883|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def63]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1416:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1378:1: enter_function: entry to ‘hk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1382:25: branch_true: following ‘true’ branch (when ‘i < bindInfoCount’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1383:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1390:10: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1390:10: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1393:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1393:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1411:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1412:10: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1413:57: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_BindImageMemory2’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1413:57: call_function: inlined call to ‘__vk_find_struct’ from ‘hk_BindImageMemory2’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1416:46: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_image.c:1416:46: danger: dereference of NULL ‘<unknown>’
# 1414|               pBindInfos[i].pNext, BIND_IMAGE_PLANE_MEMORY_INFO);
# 1415|            uint8_t plane =
# 1416|->             hk_image_aspects_to_plane(image, plane_info->planeAspect);
# 1417|            hk_image_plane_bind(dev, &image->planes[plane], mem, &offset_B);
# 1418|         } else {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def64]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_query_pool.c:282:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_query_pool.c:519:1: enter_function: entry to ‘hk_CmdEndQueryIndexedEXT’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_query_pool.c:525:4: call_function: calling ‘hk_cmd_begin_end_query’ from ‘hk_CmdEndQueryIndexedEXT’
#  280|         }
#  281|   
#  282|->       util_dynarray_append(&cs->imm_writes, struct libagx_imm_write, imm);
#  283|         return;
#  284|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def65]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:404:1: enter_function: entry to ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: return_function: returning to ‘hk_flush_bind’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: danger: argument 1 (‘util_dynarray_grow_bytes(&*b.binds, 1, 32)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  480|      }
#  481|   
#  482|->    util_dynarray_append(&b->binds, struct drm_asahi_gem_bind_op, op);
#  483|   
#  484|      /* Shadow a read-only mapping to the upper half */

Error: GCC_ANALYZER_WARNING (CWE-688): [#def66]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:492:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:404:1: enter_function: entry to ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:482:4: return_function: returning to ‘hk_flush_bind’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:492:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘hk_flush_bind’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:492:4: return_function: returning to ‘hk_flush_bind’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_queue.c:492:4: danger: argument 1 (‘util_dynarray_grow_bytes(&*b.binds, 1, 32)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  490|      }
#  491|   
#  492|->    util_dynarray_append(&b->binds, struct drm_asahi_gem_bind_op, op);
#  493|   
#  494|      return VK_SUCCESS;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def67]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1346:23: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc((long unsigned int)blob_read_uint32(blob))’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1361:1: enter_function: entry to ‘hk_deserialize_api_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1373:45: call_function: inlined call to ‘hk_num_variants’ from ‘hk_deserialize_api_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1378:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1384:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: call_function: calling ‘hk_deserialize_shader’ from ‘hk_deserialize_api_shader’
# 1344|         return vk_error(dev, VK_ERROR_OUT_OF_HOST_MEMORY);
# 1345|   
# 1346|->    shader->data_ptr = malloc(data_size);
# 1347|      if (shader->data_ptr == NULL)
# 1348|         return vk_error(dev, VK_ERROR_OUT_OF_HOST_MEMORY);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def68]
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1347:7: warning[-Wanalyzer-malloc-leak]: leak of ‘malloc((long unsigned int)blob_read_uint32(blob))’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1361:1: enter_function: entry to ‘hk_deserialize_api_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1369:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1373:45: call_function: inlined call to ‘hk_num_variants’ from ‘hk_deserialize_api_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1378:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1384:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1381:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_shader.c:1382:25: call_function: calling ‘hk_deserialize_shader’ from ‘hk_deserialize_api_shader’
# 1345|   
# 1346|      shader->data_ptr = malloc(data_size);
# 1347|->    if (shader->data_ptr == NULL)
# 1348|         return vk_error(dev, VK_ERROR_OUT_OF_HOST_MEMORY);
# 1349|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def69]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3548:1: enter_function: entry to ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3562:7: call_function: inlined call to ‘pipeline_get_prog_data’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3566:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3571:7: branch_true: following ‘true’ branch (when ‘qpu_inst_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: call_function: calling ‘__vk_outarray_next’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: return_function: returning to ‘v3dv_GetPipelineExecutableStatisticsKHR’ from ‘__vk_outarray_next’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: danger: dereference of NULL ‘<unknown>’
# 3570|   
# 3571|      if (qpu_inst_count > 0) {
# 3572|->       vk_add_exec_statistic_u64(out, "Compile Strategy",
# 3573|                                   "Chosen compile strategy index",
# 3574|                                   prog_data->compile_strategy_idx);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def70]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3578:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3548:1: enter_function: entry to ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3562:7: call_function: inlined call to ‘pipeline_get_prog_data’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3566:30: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3571:7: branch_true: following ‘true’ branch (when ‘qpu_inst_count != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: call_function: calling ‘__vk_outarray_next’ from ‘v3dv_GetPipelineExecutableStatisticsKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: return_function: returning to ‘v3dv_GetPipelineExecutableStatisticsKHR’ from ‘__vk_outarray_next’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3572:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3578:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_pipeline.c:3578:26: danger: dereference of NULL ‘<unknown>’
# 3576|         struct videocore_vi_stats stats = {
# 3577|            .instrs = qpu_inst_count,
# 3578|->          .thread_count = prog_data->threads,
# 3579|            .spill_size = prog_data->spill_size,
# 3580|            .spills = prog_data->spill_size,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def71]
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:179:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1269:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1283:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1284:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1289:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1291:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1292:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1294:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1316:13: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1320:43: branch_false: following ‘false’ branch (when ‘first_suspend_job’ is NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/broadcom/vulkan/v3dv_queue.c:1323:16: call_function: calling ‘queue_handle_job’ from ‘v3dv_queue_driver_submit’
#  177|      for (int i = 0; i < wait_count; i++) {
#  178|         syncs[n_syncs++].handle =
#  179|->          vk_sync_as_drm_syncobj(waits[i].sync)->syncobj;
#  180|      }
#  181|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def72]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:121:10: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(*infile, "rb")’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:37:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:65:11: branch_true: following ‘true’ branch (when ‘ch != -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:67:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:84:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:85:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: return_function: returning to ‘main’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:91:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:97:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:97:7: branch_false: following ‘false’ branch (when ‘outfile’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:103:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:108:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:109:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:109:18: acquire_resource: opened here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:110:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:116:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:121:10: danger: ‘fopen(*infile, "rb")’ leaks here; was opened at [(26)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/25)
#  119|   
#  120|         char *map = ralloc_array_size(mem_ctx, 1, len + 1);
#  121|->       if (!map) {
#  122|            fprintf(stderr, "Failed to allocate");
#  123|            ralloc_free(mem_ctx);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def73]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:121:10: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(*infile, "rb")’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:37:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:65:11: branch_true: following ‘true’ branch (when ‘ch != -1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:67:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:84:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:85:23: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:88:7: return_function: returning to ‘main’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:91:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:97:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:97:7: branch_false: following ‘false’ branch (when ‘outfile’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:103:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:108:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:109:18: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:109:18: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:110:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:116:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/clc/mesa_clc.c:121:10: danger: ‘fopen(*infile, "rb")’ leaks here; was allocated at [(26)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/25)
#  119|   
#  120|         char *map = ralloc_array_size(mem_ctx, 1, len + 1);
#  121|->       if (!map) {
#  122|            fprintf(stderr, "Failed to allocate");
#  123|            ralloc_free(mem_ctx);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def74]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:99:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘consumer_info.texcoord_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:449:1: enter_function: entry to ‘gl_nir_opt_dead_builtin_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:459:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: call_function: calling ‘initialise_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:467:4: return_function: returning to ‘gl_nir_opt_dead_builtin_varyings’ from ‘initialise_varying_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:468:4: call_function: calling ‘initialise_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:468:4: return_function: returning to ‘gl_nir_opt_dead_builtin_varyings’ from ‘initialise_varying_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:470:7: branch_true: following ‘true’ branch (when ‘producer’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:471:40: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_opt_dead_builtin_varyings.c:471:7: call_function: calling ‘get_varying_info’ from ‘gl_nir_opt_dead_builtin_varyings’
#   97|      nir_variable *var = nir_deref_instr_get_variable(deref);
#   98|   
#   99|->    if (!glsl_type_is_array(var->type) || !is_gl_identifier(var->name))
#  100|         return;
#  101|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def75]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/list.h:145:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘cursor.<U  a0>.block’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1187:1: enter_function: entry to ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_loop_unroll’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: return_function: returning to ‘nir_opt_loop_unroll’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1193:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_loop_unroll.c:1194:19: call_function: calling ‘nir_opt_loop_unroll_impl’ from ‘nir_opt_loop_unroll’
#  143|   exec_node_get_prev(struct exec_node *n)
#  144|   {
#  145|->    return n->prev;
#  146|   }
#  147|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def76]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1665:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:318:1: enter_function: entry to ‘gl_nir_lower_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:323:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:323:4: branch_true: following ‘true’ branch (when ‘var’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:323:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘gl_nir_lower_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:332:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘gl_nir_lower_buffers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:332:4: return_function: returning to ‘gl_nir_lower_buffers’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:332:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_buffers.c:333:11: call_function: calling ‘lower_buffer_interface_derefs_impl’ from ‘gl_nir_lower_buffers’
# 1663|      assert(!(modes & ~nir_var_all));
# 1664|      assert(deref->modes != 0);
# 1665|->    return (deref->modes & modes) != 0;
# 1666|   }
# 1667|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def77]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir.h:1665:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:363:1: enter_function: entry to ‘gl_nir_lower_named_interface_blocks’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:365:29: branch_true: following ‘true’ branch (when ‘i != 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:366:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:366:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:367:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/glsl/gl_nir_lower_named_interface_blocks.c:368:10: call_function: calling ‘lower_named_interface_blocks’ from ‘gl_nir_lower_named_interface_blocks’
# 1663|      assert(!(modes & ~nir_var_all));
# 1664|      assert(deref->modes != 0);
# 1665|->    return (deref->modes & modes) != 0;
# 1666|   }
# 1667|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def78]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_inline_helpers.h:61:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘instr’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:65:21: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:65:21: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:70:4: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:152:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:153:29: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:155:10: call_function: calling ‘nir_foreach_src’ from ‘nir_opt_tex_skip_helpers’
#   59|   nir_foreach_src(nir_instr *instr, nir_foreach_src_cb cb, void *state)
#   60|   {
#   61|->    switch (instr->type) {
#   62|      case nir_instr_type_alu: {
#   63|         nir_alu_instr *alu = nir_instr_as_alu(instr);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def79]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1175:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘uniform’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1236:1: enter_function: entry to ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1240:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1240:30: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1244:28: call_function: calling ‘nir_intrinsic_get_var’ from ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1244:28: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_intrinsic_get_var’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1247:29: call_function: inlined call to ‘nir_src_as_deref’ from ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1248:28: call_function: calling ‘nir_deref_instr_get_variable’ from ‘replace_varying_input_by_uniform_load’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1248:28: return_function: returning to ‘replace_varying_input_by_uniform_load’ from ‘nir_deref_instr_get_variable’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_linking_helpers.c:1249:14: call_function: calling ‘nir_clone_uniform_variable’ from ‘replace_varying_input_by_uniform_load’
# 1173|              v->data.binding == uniform->data.binding) ||
# 1174|             (!spirv &&
# 1175|->            (!strcmp(uniform->name, v->name) &&
# 1176|               uniform->data.explicit_binding == v->data.explicit_binding &&
# 1177|               uniform->data.binding == v->data.binding))) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def80]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:38:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:65:21: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:65:21: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:70:4: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:7: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:158:14: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:159:29: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:178:15: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:181:15: call_function: inlined call to ‘def_needs_helpers’ from ‘nir_opt_tex_skip_helpers’
#   36|   {
#   37|      struct helper_state *hs = _data;
#   38|->    return BITSET_TEST(hs->needs_helpers, def->index);
#   39|   }
#   40|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def81]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:62:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:62:24: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#   60|   
#   61|      struct helper_state hs = {
#   62|->       .needs_helpers = rzalloc_array(NULL, BITSET_WORD,
#   63|                                        BITSET_WORDS(impl->ssa_alloc)),
#   64|         .worklist = nir_instr_worklist_create(),

Error: GCC_ANALYZER_WARNING (CWE-688): [#def82]
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_precompiled.h:669:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘fp’ where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:243:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:245:7: branch_false: following ‘false’ branch (when ‘argc == 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:251:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:258:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:264:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:267:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:274:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:274:17: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/clc/asahi_clc.c:278:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
#argument 4 of ‘__builtin_fwrite’ must be non-null
#  667|      for (unsigned i = 0; i < 2; ++i) {
#  668|         FILE *fp = i ? fp_c : fp_h;
#  669|->       fprintf(fp, "/*\n");
#  670|         fprintf(fp, " * Copyright %s\n", copyright);
#  671|         fprintf(fp, " * SPDX-License-Identifier: MIT\n");

Error: GCC_ANALYZER_WARNING (CWE-401): [#def83]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:635:9: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup(*_64->gbm_dri.driver_name)’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:613:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:618:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:628:7: branch_false: following ‘false’ branch (when the strings are equal)...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:633:35: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:633:28: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_drm.c:635:9: danger: ‘strdup(*_64->gbm_dri.driver_name)’ leaks here; was allocated at [(5)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/4)
#  633|      dri2_dpy->driver_name = strdup(dri2_dpy->gbm_dri->driver_name);
#  634|   
#  635|->    if (!dri2_load_driver(disp)) {
#  636|         err = "DRI3: failed to load driver";
#  637|         goto cleanup;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def84]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1785:10: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup("zink")’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1769:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1772:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1772:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1775:33: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1775:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1780:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1782:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1784:11: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1784:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1785:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1785:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1785:10: danger: ‘strdup("zink")’ leaks here; was allocated at [(11)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/10)
# 1783|   #ifdef HAVE_WAYLAND_PLATFORM
# 1784|         if (dri2_dpy->kopper)
# 1785|->          dri2_dpy->device_name = strdup("zink");
# 1786|   #endif
# 1787|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def85]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1975:7: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup("zink")’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1974:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1975:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1975:31: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1975:7: danger: ‘strdup("zink")’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
# 1973|       */
# 1974|      if (dri2_dpy->kopper)
# 1975|->       dri2_dpy->driver_name = strdup("zink");
# 1976|      else if (disp->Options.ForceSoftware)
# 1977|         dri2_dpy->driver_name = strdup("swrast");

Error: GCC_ANALYZER_WARNING (CWE-401): [#def86]
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1977:7: warning[-Wanalyzer-malloc-leak]: leak of ‘strdup("swrast")’
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1974:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1976:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1976:12: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1977:31: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1977:31: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/egl/drivers/dri2/platform_x11.c:1977:7: danger: ‘strdup("swrast")’ leaks here; was allocated at [(5)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/4)
# 1975|         dri2_dpy->driver_name = strdup("zink");
# 1976|      else if (disp->Options.ForceSoftware)
# 1977|->       dri2_dpy->driver_name = strdup("swrast");
# 1978|   
# 1979|      if (!dri2_get_xcb_connection(disp, dri2_dpy))

Error: GCC_ANALYZER_WARNING (CWE-457): [#def87]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:272:24: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘shuffles[<unknown>]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:867:1: enter_function: entry to ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:883:28: branch_true: following ‘true’ branch (when ‘chan != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:884:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: branch_true: following ‘true’ branch (when ‘variable’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:925:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:925:30: return_function: returning to ‘lp_build_nir_aos’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: call_function: calling ‘nir_next_decl_reg’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: return_function: returning to ‘lp_build_nir_aos’ from ‘nir_next_decl_reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: branch_false: following ‘false’ branch (when ‘reg’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:931:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:934:4: call_function: calling ‘visit_cf_list’ from ‘lp_build_nir_aos’
#  270|   
#  271|         for (unsigned i = nc; i < type.length; ++i) {
#  272|->          shuffles[i] = shuffles[i % nc];
#  273|         }
#  274|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def88]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:933:26: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:867:1: enter_function: entry to ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:883:28: branch_true: following ‘true’ branch (when ‘chan != 4’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:884:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: branch_true: following ‘true’ branch (when ‘variable’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:901:4: call_function: inlined call to ‘_nir_shader_variable_has_mode’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:925:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:925:30: return_function: returning to ‘lp_build_nir_aos’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: call_function: calling ‘nir_next_decl_reg’ from ‘lp_build_nir_aos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: return_function: returning to ‘lp_build_nir_aos’ from ‘nir_next_decl_reg’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:926:4: branch_false: following ‘false’ branch (when ‘reg’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:931:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/gallivm/lp_bld_nir_aos.c:933:26: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#  931|      nir_index_ssa_defs(impl);
#  932|      nir_print_shader(shader, stdout);
#  933|->    bld.ssa_defs = calloc(impl->ssa_alloc, sizeof(LLVMValueRef));
#  934|      visit_cf_list(&bld, &impl->body);
#  935|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def89]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘t_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:84:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:117:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:125:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:134:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:140:16: branch_true: following ‘true’ branch (when ‘i <= median’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:141:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_true: following ‘true’ branch (when ‘i == median’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:78: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:10: danger: ‘t_array + (long unsigned int)(j + 4294967295) * 16’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  147|         }
#  148|         if (i == median)
#  149|->          ureg_MAX(shader, t_array[j], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  150|         else
#  151|            ureg_MIN(shader, t_array[j - 1], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));

Error: GCC_ANALYZER_WARNING (CWE-457): [#def90]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:117:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:125:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:134:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:140:16: branch_true: following ‘true’ branch (when ‘i <= median’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:141:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_true: following ‘true’ branch (when ‘i == median’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:78: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:149:10: danger: use of uninitialized value ‘*<unknown>’ here
#  147|         }
#  148|         if (i == median)
#  149|->          ureg_MAX(shader, t_array[j], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  150|         else
#  151|            ureg_MIN(shader, t_array[j - 1], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def91]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘t_array’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:84:31: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:117:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:125:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:134:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:140:16: branch_true: following ‘true’ branch (when ‘i <= median’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:141:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: following ‘false’ branch (when ‘i != median’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:82: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:10: danger: ‘t_array + (long unsigned int)(j + 4294967295) * 16’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/1)
#  149|            ureg_MAX(shader, t_array[j], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  150|         else
#  151|->          ureg_MIN(shader, t_array[j - 1], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  152|      }
#  153|      ureg_MOV(shader, o_fragment, ureg_src(t_array[median]));

Error: GCC_ANALYZER_WARNING (CWE-457): [#def92]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:76:1: enter_function: entry to ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:90:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:95:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:101:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:102:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:107:13: call_function: inlined call to ‘ureg_DECL_fs_input’ from ‘create_frag_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:115:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:117:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:125:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:134:16: branch_false: following ‘false’ branch (when ‘i >= num_offsets’)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:140:16: branch_true: following ‘true’ branch (when ‘i <= median’)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:141:19: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:148:10: branch_false: following ‘false’ branch (when ‘i != median’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:82: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/auxiliary/vl/vl_median_filter.c:151:10: danger: use of uninitialized value ‘*<unknown>’ here
#  149|            ureg_MAX(shader, t_array[j], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  150|         else
#  151|->          ureg_MIN(shader, t_array[j - 1], ureg_src(t_array[j]), ureg_src(t_array[j - 1]));
#  152|      }
#  153|      ureg_MOV(shader, o_fragment, ureg_src(t_array[median]));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def93]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:618:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:657:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:703:27: call_function: inlined call to ‘agx_lookup_bo’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:724:10: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:724:10: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
#  616|         return;
#  617|   
#  618|->    syncs[(*count)++] = (struct drm_asahi_sync){
#  619|         .sync_type = DRM_ASAHI_SYNC_SYNCOBJ,
#  620|         .handle = handle,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def94]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:727:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘shared_bos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:658:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:703:27: call_function: inlined call to ‘agx_lookup_bo’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:724:10: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:727:21: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:727:10: danger: ‘shared_bos + (long unsigned int)shared_bo_count * 8’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/1)
#  725|   
#  726|            /* And keep track of the BO for cloning the out_sync */
#  727|->          shared_bos[shared_bo_count++] = bo;
#  728|            if (dev->is_virtio)
#  729|               virt.extres_count++;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def95]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:743:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘shared_bos’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:658:33: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:703:27: call_function: inlined call to ‘agx_lookup_bo’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:705:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:735:28: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:742:13: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:743:24: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:743:13: danger: ‘shared_bos + (long unsigned int)shared_bo_count * 8’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/1)
#  741|   
#  742|               agx_add_sync(syncs, &in_sync_count, agx_bo_writer_syncobj(writer));
#  743|->             shared_bos[shared_bo_count++] = NULL;
#  744|            }
#  745|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def96]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:778:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:657:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_false: following ‘false’ branch (when ‘__foo’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:748:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: call_function: calling ‘agx_get_in_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: return_function: returning to ‘agx_batch_submit’ from ‘agx_get_in_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:4: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: following ‘true’ branch (when ‘wait_seqid != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:776:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:778:7: danger: ‘syncs + (long unsigned int)in_sync_count * 16’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/1)
#  776|         batch_debug(batch, "Waits on inter-context sync point %" PRIu64,
#  777|                     wait_seqid);
#  778|->       syncs[in_sync_count++] = (struct drm_asahi_sync){
#  779|            .sync_type = DRM_ASAHI_SYNC_TIMELINE_SYNCOBJ,
#  780|            .handle = screen->flush_syncobj,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def97]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:806:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘out_syncs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:657:7: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_false: following ‘false’ branch (when ‘__foo’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:748:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: call_function: calling ‘agx_get_in_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: return_function: returning to ‘agx_batch_submit’ from ‘agx_get_in_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:4: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_false: following ‘false’ branch (when ‘wait_seqid == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:804:45: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:806:4: danger: ‘out_syncs’ could be NULL: unchecked value from [(2)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/1)
#  804|      struct drm_asahi_sync *out_syncs = syncs + in_sync_count;
#  805|   
#  806|->    out_syncs[0] = (struct drm_asahi_sync){
#  807|         .sync_type = DRM_ASAHI_SYNC_SYNCOBJ,
#  808|         .handle = batch->syncobj,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def98]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_false: following ‘false’ branch (when ‘__foo’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:748:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: call_function: calling ‘agx_get_in_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: return_function: returning to ‘agx_batch_submit’ from ‘agx_get_in_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:4: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_false: following ‘false’ branch (when ‘wait_seqid == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:804:45: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:819:4: call_function: inlined call to ‘util_dynarray_init’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:821:7: branch_true: following ‘true’ branch (when ‘compute’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: return_function: returning to ‘agx_batch_submit’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&cmdbuf, 1, 8)’
#  823|         struct drm_asahi_cmd_header header = agx_cmd_header(true, 0, 0);
#  824|   
#  825|->       util_dynarray_append(&cmdbuf, struct drm_asahi_cmd_header, header);
#  826|         util_dynarray_append(&cmdbuf, struct drm_asahi_cmd_compute, *compute);
#  827|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def99]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:826:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:643:1: enter_function: entry to ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_true: following ‘true’ branch (when ‘__foo’ is non-NULL)...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:702:4: branch_false: following ‘false’ branch (when ‘__foo’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:748:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: call_function: calling ‘agx_get_in_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:40: return_function: returning to ‘agx_batch_submit’ from ‘agx_get_in_sync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:772:4: call_function: inlined call to ‘agx_add_sync’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:775:7: branch_false: following ‘false’ branch (when ‘wait_seqid == 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:804:45: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:819:4: call_function: inlined call to ‘util_dynarray_init’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:821:7: branch_true: following ‘true’ branch (when ‘compute’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:825:7: return_function: returning to ‘agx_batch_submit’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:826:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_batch_submit’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:826:7: return_function: returning to ‘agx_batch_submit’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_batch.c:826:7: danger: argument 1 (‘util_dynarray_grow_bytes(&cmdbuf, 1, 64)’) NULL where non-null expected
#argument 1 of ‘__builtin_memcpy’ must be non-null
#  824|   
#  825|         util_dynarray_append(&cmdbuf, struct drm_asahi_cmd_header, header);
#  826|->       util_dynarray_append(&cmdbuf, struct drm_asahi_cmd_compute, *compute);
#  827|      }
#  828|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def100]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_disk_cache.c:95:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘binary’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_disk_cache.c:94:41: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_disk_cache.c:95:4: danger: ‘binary’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#   93|   {
#   94|      struct agx_compiled_shader *binary = CALLOC_STRUCT(agx_compiled_shader);
#   95|->    binary->stage = uncompiled->type;
#   96|      binary->so = uncompiled;
#   97|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def101]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_bindings.c:148:62: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_bindings.c:158:1: enter_function: entry to ‘agx_nir_lower_bindings’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_bindings.c:169:16: call_function: calling ‘nir_shader_instructions_pass’ from ‘agx_nir_lower_bindings’
#  146|         index = nir_umin(
#  147|            b, index,
#  148|->          nir_imm_intN_t(b, b->shader->info.num_textures - 1, index->bit_size));
#  149|   
#  150|         nir_tex_instr_add_src(tex, nir_tex_src_texture_handle,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def102]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:305:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:281:1: enter_function: entry to ‘record_loads’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:305:4: call_function: calling ‘util_dynarray_grow_bytes’ from ‘record_loads’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:305:4: return_function: returning to ‘record_loads’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_nir_lower_sysvals.c:305:4: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct state *)data.loads, 1, 8)’
#  303|      }
#  304|   
#  305|->    util_dynarray_append(&state->loads, nir_intrinsic_instr *, intr);
#  306|      return false;
#  307|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def103]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:987:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘transfer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:903:1: enter_function: entry to ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:926:4: call_function: calling ‘agx_prepare_for_map’ from ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:926:4: return_function: returning to ‘agx_transfer_map’ from ‘agx_prepare_for_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:939:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:944:4: call_function: calling ‘pipe_resource_reference’ from ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:944:4: return_function: returning to ‘agx_transfer_map’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:947:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:977:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:977:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:982:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:987:7: danger: ‘transfer’ could be NULL: unchecked value from [(35)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/34)
#  985|            rsrc->layout.format, transfer->base.stride, box->height);
#  986|   
#  987|->       transfer->map = calloc(transfer->base.layer_stride, box->depth);
#  988|   
#  989|         if ((usage & PIPE_MAP_READ) && agx_resource_valid(rsrc, level)) {

Error: GCC_ANALYZER_WARNING (CWE-401): [#def104]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:1000:14: warning[-Wanalyzer-malloc-leak]: leak of ‘transfer’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:903:1: enter_function: entry to ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:926:4: call_function: calling ‘agx_prepare_for_map’ from ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:926:4: return_function: returning to ‘agx_transfer_map’ from ‘agx_prepare_for_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:939:36: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:944:4: call_function: calling ‘pipe_resource_reference’ from ‘agx_transfer_map’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:944:4: return_function: returning to ‘agx_transfer_map’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:947:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:977:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:977:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:982:54: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_pipe.c:1000:14: danger: ‘transfer’ leaks here; was allocated at [(35)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/34)
#  998|         }
#  999|   
# 1000|->       return transfer->map;
# 1001|      } else {
# 1002|         assert(rsrc->modifier == DRM_FORMAT_MOD_LINEAR);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def105]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:149:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:147:30: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:149:4: danger: ‘query’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  147|      struct agx_query *query = calloc(1, sizeof(struct agx_query));
#  148|   
#  149|->    query->type = query_type;
#  150|      query->index = index;
#  151|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def106]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:552:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:548:1: enter_function: entry to ‘agx_batch_add_timestamp_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:550:7: branch_true: following ‘true’ branch (when ‘q’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:551:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:552:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘agx_batch_add_timestamp_query’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:552:7: return_function: returning to ‘agx_batch_add_timestamp_query’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_query.c:552:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*batch.timestamps, 1, 16)’
#  550|      if (q) {
#  551|         agx_add_query_to_batch(batch, q);
#  552|->       util_dynarray_append(&batch->timestamps, struct agx_ptr, q->ptr);
#  553|      }
#  554|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def107]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:1516:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘compiled’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2155:1: enter_function: entry to ‘asahi_fast_link’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2166:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2175:14: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2175:14: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2181:34: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/asahi/agx_state.c:2180:16: call_function: calling ‘agx_build_meta_shader_internal’ from ‘asahi_fast_link’
# 1514|   {
# 1515|      struct agx_compiled_shader *compiled = CALLOC_STRUCT(agx_compiled_shader);
# 1516|->    compiled->stage = stage;
# 1517|      if (attrib_components_read)
# 1518|         BITSET_COPY(compiled->attrib_components_read, attrib_components_read);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def108]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:35:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘ptex’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:17:1: enter_function: entry to ‘fd_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:22:7: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:26:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:29:4: call_function: calling ‘pipe_resource_reference’ from ‘fd_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:29:4: return_function: returning to ‘fd_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/freedreno/freedreno_surface.c:35:8: danger: dereference of NULL ‘ptex’
#   33|      psurf->nr_samples = surf_tmpl->nr_samples;
#   34|   
#   35|->    if (ptex->target == PIPE_BUFFER) {
#   36|         psurf->u.buf.first_element = surf_tmpl->u.buf.first_element;
#   37|         psurf->u.buf.last_element = surf_tmpl->u.buf.last_element;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def109]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:172:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cso_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:155:40: acquire_memory: this call could return NULL
 branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:177:27: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:172:10: danger: ‘cso_data’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  170|         if (srcA != srcRGB || dstA != dstRGB || eqA != eqRGB) {
#  171|   
#  172|->          cso_data->iab = (_3DSTATE_INDEPENDENT_ALPHA_BLEND_CMD |
#  173|                             IAB_MODIFY_ENABLE | IAB_ENABLE | IAB_MODIFY_FUNC |
#  174|                             IAB_MODIFY_SRC_FACTOR | IAB_MODIFY_DST_FACTOR |

Error: GCC_ANALYZER_WARNING (CWE-476): [#def110]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:179:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘cso_data’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:155:40: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:170:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/i915/i915_state.c:179:10: danger: ‘cso_data’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  177|                             (i915_translate_blend_func(eqA) << IAB_FUNC_SHIFT));
#  178|         } else {
#  179|->          cso_data->iab =
#  180|               (_3DSTATE_INDEPENDENT_ALPHA_BLEND_CMD | IAB_MODIFY_ENABLE | 0);
#  181|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def111]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:138:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:132:13: enter_function: entry to ‘ppir_node_is_identity_reg_mov’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:137:20: call_function: calling ‘ppir_node_get_src’ from ‘ppir_node_is_identity_reg_mov’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:137:20: return_function: returning to ‘ppir_node_is_identity_reg_mov’ from ‘ppir_node_get_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/ir/pp/opt.c:138:8: danger: dereference of NULL ‘ppir_node_get_src(node, 0)’
#  136|   
#  137|      ppir_src *src = ppir_node_get_src(node, 0);
#  138|->    if (src->type != ppir_target_register)
#  139|         return false;
#  140|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def112]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:588:35: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘pres’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:564:1: enter_function: entry to ‘lima_surface_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:570:7: branch_false: following ‘false’ branch (when ‘surf’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:576:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:579:4: call_function: calling ‘pipe_resource_reference’ from ‘lima_surface_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:579:4: return_function: returning to ‘lima_surface_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/lima/lima_resource.c:588:35: danger: dereference of NULL ‘pres’
#  586|      psurf->u.tex.last_layer = surf_tmpl->u.tex.last_layer;
#  587|   
#  588|->    surf->tiled_w = align(u_minify(pres->width0, level), 16) >> 4;
#  589|      surf->tiled_h = align(u_minify(pres->height0, level), 16) >> 4;
#  590|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def113]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:52:11: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘((unsigned char*)&*<unknown>)[1]’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:46:1: enter_function: entry to ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: return_function: returning to ‘llvmpipe_create_sampler_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:51:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:52:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:52:11: danger: use of uninitialized value ‘((unsigned char*)&*<unknown>)[1]’ here
#   50|   
#   51|      if (LP_PERF & PERF_NO_MIP_LINEAR) {
#   52|->       if (state->min_mip_filter == PIPE_TEX_MIPFILTER_LINEAR)
#   53|            state->min_mip_filter = PIPE_TEX_MIPFILTER_NEAREST;
#   54|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def114]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:57:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(sampler, 36)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:46:1: enter_function: entry to ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: return_function: returning to ‘llvmpipe_create_sampler_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:51:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:56:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:56:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:57:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:57:7: danger: dereference of NULL ‘mem_dup(sampler, 36)’
#   55|   
#   56|      if (LP_PERF & PERF_NO_MIPMAPS)
#   57|->       state->min_mip_filter = PIPE_TEX_MIPFILTER_NONE;
#   58|   
#   59|      if (LP_PERF & PERF_NO_LINEAR) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def115]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:60:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘mem_dup(sampler, 36)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:46:1: enter_function: entry to ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: call_function: calling ‘mem_dup’ from ‘llvmpipe_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:49:39: return_function: returning to ‘llvmpipe_create_sampler_state’ from ‘mem_dup’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:51:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:56:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:56:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:59:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:59:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:60:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/llvmpipe/lp_state_sampler.c:60:7: danger: dereference of NULL ‘mem_dup(sampler, 36)’
#   58|   
#   59|      if (LP_PERF & PERF_NO_LINEAR) {
#   60|->       state->mag_img_filter = PIPE_TEX_FILTER_NEAREST;
#   61|         state->min_img_filter = PIPE_TEX_FILTER_NEAREST;
#   62|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def116]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:574:7: warning[-Wanalyzer-malloc-leak]: leak of ‘ns’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:545:1: enter_function: entry to ‘nv30_miptree_surface_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:554:9: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:555:7: branch_false: following ‘false’ branch (when ‘ns’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:557:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:560:4: call_function: calling ‘pipe_resource_reference’ from ‘nv30_miptree_surface_new’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:560:4: return_function: returning to ‘nv30_miptree_surface_new’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nv30/nv30_miptree.c:574:7: danger: ‘ns’ leaks here; was allocated at [(2)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/1)
#  572|         ns->pitch = 4096; /* random, just something the hw won't reject.. */
#  573|      else
#  574|->       ns->pitch = lvl->pitch;
#  575|   
#  576|      return ps;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def117]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1104:11: warning[-Wanalyzer-malloc-leak]: leak of ‘targ’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1078:1: enter_function: entry to ‘nvc0_so_target_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1083:34: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1084:7: branch_false: following ‘false’ branch (when ‘targ’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1087:15: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1088:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1092:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1098:4: call_function: calling ‘pipe_resource_reference’ from ‘nvc0_so_target_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1098:4: return_function: returning to ‘nvc0_so_target_create’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/nouveau/nvc0/nvc0_state.c:1104:11: danger: ‘targ’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
# 1102|      util_range_add(&buf->base, &buf->valid_buffer_range, offset, offset + size);
# 1103|   
# 1104|->    return &targ->pipe;
# 1105|   }
# 1106|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def118]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_cmdstream.c:3952:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_cmdstream.c:3951:38: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_cmdstream.c:3952:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 3950|   {
# 3951|      struct panfrost_blend_state *so = CALLOC_STRUCT(panfrost_blend_state);
# 3952|->    so->base = *blend;
# 3953|   
# 3954|      so->pan.logicop_enable = blend->logicop_enable;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def119]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:281:19: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:227:1: enter_function: entry to ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:240:7: call_function: calling ‘panfrost_precomp_cache_get’ from ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:240:7: return_function: returning to ‘panfrost_launch_precomp_v4’ from ‘panfrost_precomp_cache_get’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:251:19: call_function: calling ‘emit_tls’ from ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:251:19: return_function: returning to ‘panfrost_launch_precomp_v4’ from ‘emit_tls’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:265:7: call_function: calling ‘pan_pool_alloc_descs’ from ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:265:7: return_function: returning to ‘panfrost_launch_precomp_v4’ from ‘pan_pool_alloc_descs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:269:4: call_function: calling ‘panfrost_pack_work_groups_compute’ from ‘panfrost_launch_precomp_v4’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:269:4: return_function: returning to ‘panfrost_launch_precomp_v4’ from ‘panfrost_pack_work_groups_compute’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:274:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:275:47: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:280:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:281:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:281:19: danger: dereference of NULL ‘panfrost_precomp_cache_get(((struct panfrost_device *)((char *)MEM[(struct pipe_context *)ctx_44].screen + 696))[1].precomp_cache,  idx)’
#  279|   
#  280|      pan_section_pack(job.cpu, COMPUTE_JOB, DRAW, cfg) {
#  281|->       cfg.state = shader->state_ptr;
#  282|         cfg.push_uniforms = push_uniforms.gpu;
#  283|         cfg.thread_storage = tsd;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def120]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:295:28: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:227:1: enter_function: entry to ‘panfrost_launch_precomp_v9’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:240:7: call_function: calling ‘panfrost_precomp_cache_get’ from ‘panfrost_launch_precomp_v9’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:240:7: return_function: returning to ‘panfrost_launch_precomp_v9’ from ‘panfrost_precomp_cache_get’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:251:19: call_function: calling ‘emit_tls’ from ‘panfrost_launch_precomp_v9’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:251:19: return_function: returning to ‘panfrost_launch_precomp_v9’ from ‘emit_tls’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:265:7: call_function: calling ‘pan_pool_alloc_descs’ from ‘panfrost_launch_precomp_v9’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:265:7: return_function: returning to ‘panfrost_launch_precomp_v9’ from ‘pan_pool_alloc_descs’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:286:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:287:30: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/panfrost/pan_precomp.c:295:28: danger: dereference of NULL ‘panfrost_precomp_cache_get(((struct panfrost_device *)((char *)MEM[(struct pipe_context *)ctx_42].screen + 696))[1].precomp_cache,  idx)’
#  293|         cfg.workgroup_count_z = grid.count[2];
#  294|   
#  295|->       cfg.compute.shader = shader->state_ptr;
#  296|   
#  297|         uint64_t fau_count =

Error: GCC_ANALYZER_WARNING (CWE-476): [#def121]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1193:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘malloc(32)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1226:28: enter_function: entry to ‘radeonsi_screen_create_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1233:7: branch_false: following ‘false’ branch (when ‘sscreen’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug_options.h:1:1: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1293:4: call_function: calling ‘si_setup_force_shader_use_aco’ from ‘radeonsi_screen_create_impl’
# 1191|      if (_mesa_blake3_from_printed_string(blake, option)) {
# 1192|         sscreen->use_aco_shader_blakes = MALLOC(sizeof(blake));
# 1193|->       memcpy(sscreen->use_aco_shader_blakes[0], blake, sizeof(blake));
# 1194|         sscreen->num_use_aco_shader_blakes = 1;
# 1195|         return;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def122]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1210:10: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1226:28: enter_function: entry to ‘radeonsi_screen_create_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1233:7: branch_false: following ‘false’ branch (when ‘sscreen’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug_options.h:1:1: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1293:4: call_function: calling ‘si_setup_force_shader_use_aco’ from ‘radeonsi_screen_create_impl’
# 1208|      while (fgets(line, sizeof(line), f)) {
# 1209|         if (sscreen->num_use_aco_shader_blakes * sizeof(blake3_hash) >= max_size) {
# 1210|->          sscreen->use_aco_shader_blakes = REALLOC(
# 1211|               sscreen->use_aco_shader_blakes, max_size, max_size * 2);
# 1212|            max_size *= 2;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def123]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1298:7: warning[-Wanalyzer-malloc-leak]: leak of ‘<unknown>’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1226:28: enter_function: entry to ‘radeonsi_screen_create_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1233:7: branch_false: following ‘false’ branch (when ‘sscreen’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_debug_options.h:1:1: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1293:4: call_function: calling ‘si_setup_force_shader_use_aco’ from ‘radeonsi_screen_create_impl’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1293:4: return_function: returning to ‘radeonsi_screen_create_impl’ from ‘si_setup_force_shader_use_aco’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1295:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1296:9: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1295:8: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1297:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/si_pipe.c:1298:7: danger: ‘<unknown>’ leaks here; was allocated at [(26)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/25)
# 1296|          !sscreen->info.has_tmz_support) {
# 1297|         fprintf(stderr, "radeonsi: requesting TMZ features but TMZ is not supported\n");
# 1298|->       FREE(sscreen);
# 1299|         return NULL;
# 1300|      }

Error: GCC_ANALYZER_WARNING (CWE-122): [#def124]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:188:7: warning[-Wanalyzer-out-of-bounds]: heap-based buffer overflow
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:211:1: enter_function: entry to ‘svga_create_sampler_state’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:217:7: branch_false: following ‘false’ branch (when ‘cso’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:220:42: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:260:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:261:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/svga/svga_pipe_sampler.c:261:7: call_function: calling ‘define_sampler_state_object’ from ‘svga_create_sampler_state’
#  186|      unsigned i;
#  187|      for (i = 0; i <= ss->compare_mode; i++) {
#  188|->       ss->id[i] = util_bitmask_add(svga->sampler_object_id_bm);
#  189|   
#  190|         SVGA_RETRY(svga, SVGA3D_vgpu10_DefineSamplerState

Error: GCC_ANALYZER_WARNING (CWE-476): [#def125]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:754:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prsc’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1076:1: enter_function: entry to ‘v3d_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1086:12: branch_false: following ‘false’ branch (when ‘surface’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1090:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1094:9: call_function: calling ‘pipe_resource_reference’ from ‘v3d_create_surface’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1094:9: return_function: returning to ‘v3d_create_surface’ from ‘pipe_resource_reference’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/v3d/v3d_resource.c:1102:27: call_function: calling ‘v3d_layer_offset’ from ‘v3d_create_surface’
#  752|           struct v3d_resource_slice *slice = &rsc->slices[level];
#  753|   
#  754|->         if (prsc->target == PIPE_TEXTURE_3D)
#  755|                   return slice->offset + layer * slice->size;
#  756|           else

Error: GCC_ANALYZER_WARNING (CWE-476): [#def126]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1101:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1088:1: enter_function: entry to ‘zink_batch_reference_resource_move_unsync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1093:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1094:37: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1101:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘zink_batch_reference_resource_move_unsync’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1101:7: return_function: returning to ‘zink_batch_reference_resource_move_unsync’ from ‘util_dynarray_grow_bytes’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_batch.c:1101:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*bs.swapchain_obj_unsync, 1, 8)’
# 1099|            }
# 1100|         }
# 1101|->       util_dynarray_append(&bs->swapchain_obj_unsync, struct zink_resource_object*, res->obj);
# 1102|         return false;
# 1103|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def127]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1061:13: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prog’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2210:1: enter_function: entry to ‘zink_link_gfx_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2226:25: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2227:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2240:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: call_function: calling ‘gfx_program_create’ from ‘zink_link_gfx_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: return_function: returning to ‘zink_link_gfx_shader’ from ‘gfx_program_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2250:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2251:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2252:7: call_function: calling ‘gfx_program_init’ from ‘zink_link_gfx_shader’
# 1059|   find_or_create_lib_cache(struct zink_screen *screen, struct zink_gfx_program *prog)
# 1060|   {
# 1061|->    unsigned stages_present = prog->stages_present;
# 1062|      bool generated_tcs = prog->shaders[MESA_SHADER_TESS_CTRL] && prog->shaders[MESA_SHADER_TESS_CTRL]->non_fs.is_generated;
# 1063|      if (generated_tcs)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def128]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1195:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘prog’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2210:1: enter_function: entry to ‘zink_link_gfx_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2226:25: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2227:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2240:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: call_function: calling ‘gfx_program_create’ from ‘zink_link_gfx_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2244:36: return_function: returning to ‘zink_link_gfx_shader’ from ‘gfx_program_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2250:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2251:36: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:2252:7: call_function: calling ‘gfx_program_init’ from ‘zink_link_gfx_shader’
# 1193|      if (screen->optimal_keys)
# 1194|         prog->libs = find_or_create_lib_cache(screen, prog);
# 1195|->    if (prog->libs)
# 1196|         p_atomic_inc(&prog->libs->refcount);
# 1197|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def129]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:215:13: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:411:1: enter_function: entry to ‘lvp_encode_as’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:487:7: branch_false: following ‘false’ branch (when ‘node_depth’ is non-NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:492:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:493:61: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:497:38: branch_true: following ‘true’ branch (when ‘child_index != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:498:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:497:38: branch_true: following ‘true’ branch (when ‘child_index != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:498:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:548:7: branch_true: following ‘true’ branch (when ‘max_node_depth > 23’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:549:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:549:7: call_function: calling ‘lvp_flatten_as’ from ‘lvp_encode_as’
#  213|      uint32_t available_depth = 23 - depth;
#  214|      uint32_t allowed_child_count = 1 << available_depth;
#  215|->    uint32_t child_count = child_counts[index];
#  216|      bool flatten = child_count > allowed_child_count;
#  217|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def130]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:239:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:411:1: enter_function: entry to ‘lvp_encode_as’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:487:7: branch_false: following ‘false’ branch (when ‘node_depth’ is non-NULL)...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:492:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:493:61: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:497:38: branch_true: following ‘true’ branch (when ‘child_index != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:498:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:497:38: branch_true: following ‘true’ branch (when ‘child_index != 2’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:498:14: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:548:7: branch_true: following ‘true’ branch (when ‘max_node_depth > 23’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:549:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/lvp_acceleration_structure.c:549:7: call_function: calling ‘lvp_flatten_as’ from ‘lvp_encode_as’
#  237|   
#  238|      if (flatten && has_internal_child) {
#  239|->       util_dynarray_append(subtrees, uint32_t, index);
#  240|         *max_subtree_size = MAX2(*max_subtree_size, child_count);
#  241|         return;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def131]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:55:59: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:78:1: enter_function: entry to ‘lvp_lower_input_attachments’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:83:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘lvp_lower_input_attachments’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:83:4: return_function: returning to ‘lvp_lower_input_attachments’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:83:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:84:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: call_function: inlined call to ‘exec_node_is_tail_sentinel’ from ‘lvp_lower_input_attachments’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:85:10: branch_true: following ‘true’ branch (when ‘instr’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:86:17: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:86:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:91:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:91:16: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:94:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/lavapipe/nir/lvp_nir_lower_input_attachments.c:94:25: call_function: calling ‘try_lower_input_load’ from ‘lvp_lower_input_attachments’
#   53|      assert(glsl_type_is_image(deref->type));
#   54|   
#   55|->    enum glsl_sampler_dim image_dim = glsl_get_sampler_dim(deref->type);
#   56|      if (image_dim != GLSL_SAMPLER_DIM_SUBPASS &&
#   57|          image_dim != GLSL_SAMPLER_DIM_SUBPASS_MS)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def132]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:246:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dev’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:170:1: enter_function: entry to ‘vlVdpPresentationQueueTargetCreateX11’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:176:7: branch_false: following ‘false’ branch (when ‘drawable != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:179:23: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:180:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:183:10: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:184:7: branch_false: following ‘false’ branch (when ‘pqt’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:187:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/frontends/vdpau/device.c:187:4: call_function: calling ‘DeviceReference’ from ‘vlVdpPresentationQueueTargetCreateX11’
#  244|      mtx_destroy(&dev->mutex);
#  245|      vl_compositor_cleanup(&dev->compositor);
#  246|->    dev->context->sampler_view_release(dev->context, dev->dummy_sv);
#  247|      dev->context->destroy(dev->context);
#  248|      dev->vscreen->destroy(dev->vscreen);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def133]
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/include/winsys/radeon_winsys.h:782:19: warning[-Wanalyzer-malloc-leak]: leak of ‘si_vce_encode_headers(encoder)’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:261:13: enter_function: entry to ‘rvce_encode_bitstream’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:271:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:25: call_function: calling ‘si_vce_encode_headers’ from ‘rvce_encode_bitstream’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:276:25: return_function: returning to ‘rvce_encode_bitstream’ from ‘si_vce_encode_headers’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/radeonsi/radeon_vce.c:278:9: call_function: inlined call to ‘radeon_emitted’ from ‘rvce_encode_bitstream’
#  780|   static inline bool radeon_emitted(struct radeon_cmdbuf *rcs, unsigned num_dw)
#  781|   {
#  782|->    return rcs && (rcs->prev_dw + rcs->current.cdw > num_dw);
#  783|   }
#  784|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def134]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2226:8: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2331:1: enter_function: entry to ‘brw_compact_instructions’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2334:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2337:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2361:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2404:21: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2406:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2414:10: call_function: calling ‘update_uip_jip’ from ‘brw_compact_instructions’
# 2224|   compacted_between(int old_ip, int old_target_ip, int *compacted_counts)
# 2225|   {
# 2226|->    int this_compacted_count = compacted_counts[old_ip];
# 2227|      int target_compacted_count = compacted_counts[old_target_ip];
# 2228|      return target_compacted_count - this_compacted_count;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def135]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘old_ip’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2334:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2337:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2354:18: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2361:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: danger: ‘old_ip + ((long unsigned int)offset >> 3) * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/2)
# 2397|       * simplifies the linked list walk at the end of the function.
# 2398|       */
# 2399|->    old_ip[offset / sizeof(brw_eu_compact_inst)] =
# 2400|         (p->next_insn_offset - start_offset) / sizeof(brw_eu_inst);
# 2401|   

Error: GCC_ANALYZER_WARNING (CWE-122): [#def136]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2408:11: warning[-Wanalyzer-out-of-bounds]: heap-based buffer over-read
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2334:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2337:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2361:29: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2399:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2404:21: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2406:27: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/compiler/brw_eu_compact.c:2408:11: danger: read of 4 bytes at offset ‘(long unsigned int)(int)(*p.next_insn_offset - (unsigned int)start_offset >> 4) * 4’ exceeds the buffer
# 2406|         brw_eu_inst *insn = store + offset;
# 2407|         int this_old_ip = old_ip[offset / sizeof(brw_eu_compact_inst)];
# 2408|->       int this_compacted_count = compacted_counts[this_old_ip];
# 2409|   
# 2410|         switch (brw_eu_inst_opcode(p->isa, insn)) {

Error: GCC_ANALYZER_WARNING (CWE-457): [#def137]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:1516:18: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘logical_el.<Ub000>.w’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:4638:1: enter_function: entry to ‘isl_tiling_get_intratile_offset_el’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:4655:7: branch_false: following ‘false’ branch (when ‘tiling != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:4669:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/isl/isl.c:4669:4: call_function: calling ‘isl_tiling_get_info’ from ‘isl_tiling_get_intratile_offset_el’
# 1514|         }
# 1515|   
# 1516|->       phys_B.w = logical_el.w * bs;
# 1517|         phys_B.h = 64 * 1024 / phys_B.w;
# 1518|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def138]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:509:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘stall_result’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:498:25: branch_true: following ‘true’ branch (when ‘offset < end’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:502:26: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:505:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:508:25: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:508:25: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/perf/xe/intel_perf.c:509:10: danger: ‘stall_result’ could be NULL: unchecked value from [(5)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/4)
#  507|         } else {
#  508|            stall_result = calloc(1, sizeof(struct intel_perf_query_eustall_event));
#  509|->          stall_result->ip_addr = ip_addr;
#  510|            _mesa_hash_table_insert(result->accumulator,
#  511|                                    (const void*)&stall_result->ip_addr,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def139]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:382:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bbo’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:595:1: enter_function: entry to ‘anv_cmd_buffer_chain_generation_batch’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:603:25: release_memory: ‘new_bbo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:610:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:613:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:616:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:617:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:617:7: release_memory: ‘new_bbo’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/anv_batch_chain.c:617:7: call_function: calling ‘anv_batch_bo_destroy’ from ‘anv_cmd_buffer_chain_generation_batch’
#  380|   {
#  381|      anv_reloc_list_finish(&bbo->relocs);
#  382|->    ANV_DMR_BO_FREE(&cmd_buffer->vk.base, bbo->bo);
#  383|      anv_bo_pool_free(&cmd_buffer->device->batch_bo_pool, bbo->bo);
#  384|      vk_free(&cmd_buffer->vk.pool->alloc, bbo);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def140]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:1088:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2590:1: enter_function: entry to ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2595:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2603:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx12_CmdDecodeVideoKHR’
# 1086|         avc_img.FrameSize = (sps->pic_width_in_mbs_minus1 + 1) * pic_height;
# 1087|   
# 1088|->       if (!h264_pic_info->pStdPictureInfo->flags.field_pic_flag)
# 1089|            avc_img.ImageStructure = FramePicture;
# 1090|         else if (h264_pic_info->pStdPictureInfo->flags.bottom_field_flag)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def141]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:1185:36: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2590:1: enter_function: entry to ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2595:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2603:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx12_CmdDecodeVideoKHR’
# 1183|            .MOCS = anv_mocs(cmd_buffer->device, img->bindings[0].address.bo, 0),
# 1184|         };
# 1185|->       avc_directmode.POCList[32] = h264_pic_info->pStdPictureInfo->PicOrderCnt[0];
# 1186|         avc_directmode.POCList[33] = h264_pic_info->pStdPictureInfo->PicOrderCnt[1];
# 1187|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def142]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:1191:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2590:1: enter_function: entry to ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2595:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2599:7: call_function: inlined call to ‘__vk_find_struct’ from ‘gfx12_CmdDecodeVideoKHR’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/genX_cmd_video.c:2603:7: call_function: calling ‘anv_h264_decode_video’ from ‘gfx12_CmdDecodeVideoKHR’
# 1189|      uint32_t buffer_offset = frame_info->srcBufferOffset & 4095;
# 1190|   #define HEADER_OFFSET 3
# 1191|->    for (unsigned s = 0; s < h264_pic_info->sliceCount; s++) {
# 1192|         bool last_slice = s == (h264_pic_info->sliceCount - 1);
# 1193|         uint32_t current_offset = h264_pic_info->pSliceOffsets[s];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def143]
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:49:22: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:257:1: enter_function: entry to ‘xe_queue_exec_locked’
mesa-25.1.0-rc2/redhat-linux-build/../src/intel/vulkan/xe/anv_batch_chain.c:273:13: call_function: calling ‘xe_exec_process_syncs’ from ‘xe_queue_exec_locked’
#   47|         .timeline_value = value,
#   48|      };
#   49|->    drm_sync.handle = syncobj->syncobj;
#   50|   
#   51|      return drm_sync;

Error: GCC_ANALYZER_WARNING (CWE-775): [#def144]
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:234:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘loader_open_device(device_41->nodes[2])’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:207:1: enter_function: entry to ‘loader_open_render_node_platform_devices’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:218:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:223:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:226:16: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:227:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:229:10: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:230:12: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:229:11: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:233:34: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:233:15: call_function: calling ‘loader_open_device’ from ‘loader_open_render_node_platform_devices’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:233:15: return_function: returning to ‘loader_open_render_node_platform_devices’ from ‘loader_open_device’
mesa-25.1.0-rc2/redhat-linux-build/../src/loader/loader.c:234:13: danger: ‘loader_open_device(device_41->nodes[2])’ leaks here; was opened at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11)
#  232|   
#  233|            fd = loader_open_device(device->nodes[DRM_NODE_RENDER]);
#  234|->          if (fd < 0)
#  235|               continue;
#  236|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def145]
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:15:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘tex_h’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:761:1: enter_function: entry to ‘nak_nir_lower_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:763:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nak_nir_lower_tex’
#   13|   tex_handle_as_cbuf(nir_def *tex_h, uint32_t *cbuf_out)
#   14|   {
#   15|->    if (tex_h->parent_instr->type != nir_instr_type_intrinsic)
#   16|         return false;
#   17|   

Error: GCC_ANALYZER_WARNING (CWE-775): [#def146]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:101:7: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(output_c_path, "w")’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:346:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:348:7: branch_false: following ‘false’ branch (when ‘argc == 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:356:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:364:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:369:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:370:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:375:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:376:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:381:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:385:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:391:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:392:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: acquire_resource: opened here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:398:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:403:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: return_function: returning to ‘main’ from ‘nir_precomp_print_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:101:7: danger: ‘fopen(output_c_path, "w")’ leaks here; was opened at [(14)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/13)
#   99|   
#  100|      nir_shader *nir =
#  101|->       spirv_to_nir(spirv, spirv_size / 4, NULL, 0, MESA_SHADER_KERNEL,
#  102|                      "library", &spirv_options, nir_options);
#  103|      nir_validate_shader(nir, "after spirv_to_nir");

Error: GCC_ANALYZER_WARNING (CWE-401): [#def147]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:101:7: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(output_c_path, "w")’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:346:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:348:7: branch_false: following ‘false’ branch (when ‘argc == 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:356:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:364:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:369:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:370:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:375:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:376:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:381:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:385:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:391:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:392:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:398:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:403:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: return_function: returning to ‘main’ from ‘nir_precomp_print_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:101:7: danger: ‘fopen(output_c_path, "w")’ leaks here; was allocated at [(14)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/13)
#   99|   
#  100|      nir_shader *nir =
#  101|->       spirv_to_nir(spirv, spirv_size / 4, NULL, 0, MESA_SHADER_KERNEL,
#  102|                      "library", &spirv_options, nir_options);
#  103|      nir_validate_shader(nir, "after spirv_to_nir");

Error: GCC_ANALYZER_WARNING (CWE-476): [#def148]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:263:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘mem’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:346:1: enter_function: entry to ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:348:7: branch_false: following ‘false’ branch (when ‘argc == 6’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:356:16: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:364:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:369:20: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:370:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:375:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:376:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:381:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:385:7: branch_false: following ‘false’ branch (when ‘spirv_map != 18446744073709551615’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:391:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:392:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:397:17: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:398:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:403:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: call_function: calling ‘nir_precomp_print_header’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:408:4: return_function: returning to ‘main’ from ‘nir_precomp_print_header’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
 branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:416:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:417:10: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:425:26: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:429:28: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:430:26: call_function: inlined call to ‘get_compiler_options’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:474:10: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘main’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:474:10: return_function: returning to ‘main’ from ‘nir_shader_intrinsics_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/clc/panfrost_compile.c:489:10: call_function: calling ‘print_shader’ from ‘main’
#  261|      uint32_t *mem = calloc(sz_el, 4);
#  262|   
#  263|->    memcpy(mem, &info, sizeof(info));
#  264|      memcpy((uint8_t *)mem + sizeof(info), binary->data, binary->size);
#  265|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def149]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:846:59: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1447:1: enter_function: entry to ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1481:4: call_function: calling ‘nir_shader_instructions_pass’ from ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1481:4: return_function: returning to ‘panvk_v6_nir_lower_descriptors’ from ‘nir_shader_instructions_pass’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1481:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1495:4: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1495:4: call_function: calling ‘create_copy_table’ from ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1495:4: return_function: returning to ‘panvk_v6_nir_lower_descriptors’ from ‘create_copy_table’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1496:4: call_function: calling ‘upload_shader_desc_info’ from ‘panvk_v6_nir_lower_descriptors’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1496:4: return_function: returning to ‘panvk_v6_nir_lower_descriptors’ from ‘upload_shader_desc_info’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1498:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1499:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1499:7: call_function: calling ‘lower_input_attachment_loads’ from ‘panvk_v6_nir_lower_descriptors’
#  844|   
#  845|      nir_deref_instr *deref = nir_src_as_deref(intr->src[0]);
#  846|->    enum glsl_sampler_dim image_dim = glsl_get_sampler_dim(deref->type);
#  847|      if (image_dim != GLSL_SAMPLER_DIM_SUBPASS &&
#  848|          image_dim != GLSL_SAMPLER_DIM_SUBPASS_MS)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def150]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:974:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:967:1: enter_function: entry to ‘collect_frag_writes’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:972:29: call_function: inlined call to ‘nir_src_as_deref’ from ‘collect_frag_writes’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:974:8: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:974:8: danger: dereference of NULL ‘<unknown>’
#  972|      nir_deref_instr *deref = nir_src_as_deref(intr->src[0]);
#  973|   
#  974|->    if (deref->modes != nir_var_shader_out)
#  975|         return false;
#  976|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def151]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1071:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1069|            return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1070|   
# 1071|->       pan_cast_and_pack(panvk_priv_mem_host_addr(shader->spds.all_points),
# 1072|                           SHADER_PROGRAM, cfg) {
# 1073|            cfg.stage = pan_shader_stage(&shader->info);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def152]
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1086:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1403:1: enter_function: entry to ‘panvk_deserialize_shader’
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1414:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1417:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1419:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1422:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1444:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1449:22: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1450:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1455:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1464:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/panfrost/vulkan/panvk_vX_shader.c:1469:13: call_function: calling ‘panvk_shader_upload’ from ‘panvk_deserialize_shader’
# 1084|            return panvk_error(dev, VK_ERROR_OUT_OF_DEVICE_MEMORY);
# 1085|   
# 1086|->       pan_cast_and_pack(panvk_priv_mem_host_addr(shader->spds.all_triangles),
# 1087|                           SHADER_PROGRAM, cfg) {
# 1088|            cfg.stage = pan_shader_stage(&shader->info);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def153]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:302:33: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘entry’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:486:1: enter_function: entry to ‘disk_cache_evict_lru_item’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:496:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:499:18: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/disk_cache_os.c:499:18: call_function: calling ‘unlink_lru_file_from_directory’ from ‘disk_cache_evict_lru_item’
#  300|               processed_files++;
#  301|   
#  302|->             char *tmp = realloc(entry->lru_name, len + 1);
#  303|               if (tmp) {
#  304|                  /* Find location to insert new lru item. We want to keep the

Error: GCC_ANALYZER_WARNING (CWE-476): [#def154]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘sample’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:204:1: enter_function: entry to ‘agx_nir_lower_sample_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:207:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_lower_sample_intrinsics’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def155]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:201:1: enter_function: entry to ‘nir_opt_phi_to_bool’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:203:35: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_phi_to_bool’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:203:35: return_function: returning to ‘nir_opt_phi_to_bool’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘nir_opt_phi_to_bool’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: return_function: returning to ‘nir_opt_phi_to_bool’ from ‘nir_foreach_function_with_impl_first’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:206:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:207:33: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:208:10: branch_false: following ‘false’ branch...
 branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:208:10: branch_false: following ‘false’ branch (when ‘instr’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:206:7: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: call_function: calling ‘nir_foreach_function_with_impl_next’ from ‘nir_opt_phi_to_bool’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: return_function: returning to ‘nir_opt_phi_to_bool’ from ‘nir_foreach_function_with_impl_next’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:205:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_phi_to_bool.c:235:11: call_function: calling ‘nir_shader_phi_pass’ from ‘nir_opt_phi_to_bool’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def156]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/list.h:82:18: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘txq_src’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:761:1: enter_function: entry to ‘nak_nir_lower_tex’
mesa-25.1.0-rc2/redhat-linux-build/../src/nouveau/compiler/nak_nir_lower_tex.c:763:11: call_function: calling ‘nir_shader_instructions_pass’ from ‘nak_nir_lower_tex’
#   80|   {
#   81|       item->next = list;
#   82|->     item->prev = list->prev;
#   83|       list->prev->next = item;
#   84|       list->prev = item;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def157]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_queue.h:108:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1233:1: enter_function: entry to ‘create_linked_separable_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1239:22: call_function: calling ‘gfx_program_create’ from ‘create_linked_separable_job’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1239:22: return_function: returning to ‘create_linked_separable_job’ from ‘gfx_program_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1239:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/gallium/drivers/zink/zink_program.c:1241:4: call_function: inlined call to ‘util_queue_fence_reset’ from ‘create_linked_separable_job’
#  106|   {
#  107|   #ifdef NDEBUG
#  108|->    fence->val = 1;
#  109|   #else
#  110|      uint32_t v = (uint32_t)p_atomic_xchg(&fence->val, 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def158]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:118:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘d’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:116:39: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:118:4: danger: ‘d’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
#  116|      struct util_sync_provider_drm *d = CALLOC_STRUCT(util_sync_provider_drm);
#  117|   
#  118|->    d->drm_fd = drm_fd;
#  119|      d->base = (struct util_sync_provider) {
#  120|         .create = drm_syncobj_create,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def159]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:141:11: warning[-Wanalyzer-malloc-leak]: leak of ‘d’
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:116:39: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_sync_provider.c:141:11: danger: ‘d’ leaks here; was allocated at [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  139|      }
#  140|   
#  141|->    return &d->base;
#  142|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def160]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_vector.h:69:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘hs.tex_instrs’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: call_function: calling ‘nir_instr_worklist_create’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:64:19: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_instr_worklist_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:61:24: release_memory: ‘hs.tex_instrs’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:70:4: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: release_memory: ‘hs.tex_instrs’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: call_function: inlined call to ‘nir_instr_worklist_is_empty’ from ‘nir_opt_tex_skip_helpers’
#   67|   u_vector_length(struct u_vector *queue)
#   68|   {
#   69|->    return (queue->head - queue->tail) / queue->element_size;
#   70|   }
#   71|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def161]
mesa-25.1.0-rc2/redhat-linux-build/../src/util/u_vector.h:69:12: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘hs.worklist’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:53:1: enter_function: entry to ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘nir_opt_tex_skip_helpers’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:59:30: return_function: returning to ‘nir_opt_tex_skip_helpers’ from ‘nir_shader_get_entrypoint’
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:61:24: release_memory: ‘hs.worklist’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:61:24: release_memory: ‘hs.worklist’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: release_memory: ‘hs.worklist’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/compiler/nir/nir_opt_tex_skip_helpers.c:151:9: call_function: inlined call to ‘nir_instr_worklist_is_empty’ from ‘nir_opt_tex_skip_helpers’
#   67|   u_vector_length(struct u_vector *queue)
#   68|   {
#   69|->    return (queue->head - queue->tail) / queue->element_size;
#   70|   }
#   71|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def162]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1332:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘s’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1306:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1310:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1310:36: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1327:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1332:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1332:4: danger: ‘s’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
# 1330|      }
# 1331|   
# 1332|->    s->vtdev = to_vpipe_device(vdrm);
# 1333|   
# 1334|      return &s->base;

Error: GCC_ANALYZER_WARNING (CWE-401): [#def163]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1334:11: warning[-Wanalyzer-malloc-leak]: leak of ‘s’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1306:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1310:36: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1310:36: acquire_memory: allocated here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1327:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1332:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vdrm/vdrm_vpipe.c:1334:11: danger: ‘s’ leaks here; was allocated at [(3)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/2)
# 1332|      s->vtdev = to_vpipe_device(vdrm);
# 1333|   
# 1334|->    return &s->base;
# 1335|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def164]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:188:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘local_regions’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:176:4: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:176:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:176:4: acquire_memory: this call could return NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:178:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:180:11: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_host_copy.c:188:7: danger: ‘local_regions + (long unsigned int)i * 80’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/2)
#  186|                                  regions[i].imageExtent);
#  187|   
#  188|->       local_regions[i] = (VkMemoryToImageCopyMESA){
#  189|            .sType = VK_STRUCTURE_TYPE_MEMORY_TO_IMAGE_COPY_MESA,
#  190|            .dataSize = data_size,

Error: GCC_ANALYZER_WARNING (CWE-401): [#def165]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1653:1: warning[-Wanalyzer-malloc-leak]: leak of ‘submit.command.cur’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1669:1: enter_function: entry to ‘vn_remove_signaled_fences’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1672:25: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1673:57: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:1673:25: call_function: calling ‘vn_GetFenceStatus’ from ‘vn_remove_signaled_fences’
# 1651|   
# 1652|      return vn_result(dev->instance, result);
# 1653|-> }
# 1654|   
# 1655|   static VkResult

Error: GCC_ANALYZER_WARNING (CWE-401): [#def166]
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2157:1: warning[-Wanalyzer-malloc-leak]: leak of ‘submit.command.cur’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2222:1: enter_function: entry to ‘vn_WaitSemaphores’
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2231:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2232:10: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2231:8: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2233:16: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2234:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2235:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2235:7: branch_true: following ‘true’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2236:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2236:7: branch_true: following ‘true’ branch (when ‘semaphores’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2236:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2237:7: branch_true: following ‘true’ branch (when ‘values’ is non-NULL)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2237:7: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2241:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2242:19: branch_true: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/virtio/vulkan/vn_queue.c:2242:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’
# 2155|                                                   semaphore, pValue);
# 2156|      }
# 2157|-> }
# 2158|   
# 2159|   VkResult

Error: GCC_ANALYZER_WARNING (CWE-688): [#def167]
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:170:4: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:45:1: enter_function: entry to ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:68:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:69:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:70:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:71:14: call_function: inlined call to ‘vk_multialloc_zalloc2’ from ‘vk_indirect_command_layout_create’
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:73:7: branch_false: following ‘false’ branch...
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:76:4: branch_false: ...to here
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:78:4: release_memory: ‘pc_layouts’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:78:4: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:170:10: release_memory: ‘0’ is NULL
mesa-25.1.0-rc2/redhat-linux-build/../src/vulkan/runtime/vk_device_generated_commands.c:170:4: danger: argument 1 (‘*(struct vk_indirect_command_layout *)<unknown>.pc_layouts’) NULL where non-null expected
#  168|      }
#  169|   
#  170|->    qsort(elayout->pc_layouts, elayout->n_pc_layouts,
#  171|            sizeof(elayout->pc_layouts[0]), compare_pc_layout);
#  172|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def168]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2018:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:204:1: enter_function: entry to ‘agx_nir_lower_sample_intrinsics’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/lib/agx_nir_lower_sample_intrinsics.c:207:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘agx_nir_lower_sample_intrinsics’
# 2016|   nir_u2u32(nir_builder *build, nir_def *src0)
# 2017|   {
# 2018|->    if (src0->bit_size == 32)
# 2019|         return src0;
# 2020|      return nir_build_alu1(build, nir_op_u2u32, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def169]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2025:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘offset’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_nir_lower_descriptors.c:100:1: enter_function: entry to ‘load_dynamic_buffer_start’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_nir_lower_descriptors.c:119:14: call_function: inlined call to ‘nir_imm_int’ from ‘load_dynamic_buffer_start’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_nir_lower_descriptors.c:119:14: call_function: inlined call to ‘nir_imm_int’ from ‘load_dynamic_buffer_start’
mesa-25.1.0-rc2/redhat-linux-build/../src/asahi/vulkan/hk_nir_lower_descriptors.c:119:14: call_function: calling ‘load_root’ from ‘load_dynamic_buffer_start’
# 2023|   nir_u2u64(nir_builder *build, nir_def *src0)
# 2024|   {
# 2025|->    if (src0->bit_size == 64)
# 2026|         return src0;
# 2027|      return nir_build_alu1(build, nir_op_u2u64, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def170]
mesa-25.1.0-rc2/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:13726:29: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:949:1: enter_function: entry to ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:951:21: call_function: inlined call to ‘nir_imm_int’ from ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:951:21: call_function: inlined call to ‘nir_imm_int’ from ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:953:4: branch_true: following ‘true’ branch (when ‘__dword != 0’)...
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:954:15: call_function: inlined call to ‘nir_imm_int’ from ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:954:15: call_function: inlined call to ‘nir_imm_int’ from ‘write_values_to_lanes’
mesa-25.1.0-rc2/redhat-linux-build/../src/amd/common/nir/ac_nir_prerast_utils.c:954:15: call_function: calling ‘_nir_build_write_invocation_amd’ from ‘write_values_to_lanes’
#13724|         build->shader, nir_intrinsic_write_invocation_amd);
#13725|   
#13726|->    intrin->num_components = src0->num_components;
#13727|         nir_def_init(&intrin->instr, &intrin->def, intrin->num_components, src0->bit_size);
#13728|      intrin->src[0] = nir_src_for_ssa(src0);

Error: COMPILER_WARNING (CWE-563): [#def171]
mesa-25.1.0-rc2/src/asahi/compiler/agx_compile.c: scope_hint: In function ‘agx_emit_intrinsic’
mesa-25.1.0-rc2/src/asahi/compiler/agx_compile.c:1302:20: warning[-Wunused-variable]: unused variable ‘stage’
# 1302 |    gl_shader_stage stage = b->shader->stage;
#      |                    ^~~~~
# 1300|                         ? agx_def_index(&instr->def)
# 1301|                         : agx_null();
# 1302|->    gl_shader_stage stage = b->shader->stage;
# 1303|   
# 1304|      switch (instr->intrinsic) {

Error: COMPILER_WARNING (CWE-563): [#def172]
mesa-25.1.0-rc2/src/asahi/compiler/agx_compile.c: scope_hint: In function ‘agx_alu_src_index’
mesa-25.1.0-rc2/src/asahi/compiler/agx_compile.c:1729:13: warning[-Wunused-variable]: unused variable ‘comps’
# 1729 |    unsigned comps = nir_src_num_components(src.src);
#      |             ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1727|      /* Check well-formedness of the input NIR */
# 1728|      ASSERTED unsigned bitsize = nir_src_bit_size(src.src);
# 1729|->    unsigned comps = nir_src_num_components(src.src);
# 1730|      unsigned channel = src.swizzle[0];
# 1731|   

Error: COMPILER_WARNING (CWE-563): [#def173]
mesa-25.1.0-rc2/src/asahi/compiler/agx_lower_spill.c: scope_hint: In function ‘spill_fill’
mesa-25.1.0-rc2/src/asahi/compiler/agx_lower_spill.c:44:13: warning[-Wunused-variable]: unused variable ‘stack_offs_end_B’
#   44 |    unsigned stack_offs_end_B = stack_offs_B + (effective_chans * format_size_B);
#      |             ^~~~~~~~~~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#   42|      /* Calculate stack offset in bytes. IR registers are 2-bytes each. */
#   43|      unsigned stack_offs_B = b->shader->spill_base_B + (mem.value * 2) + offset_B;
#   44|->    unsigned stack_offs_end_B = stack_offs_B + (effective_chans * format_size_B);
#   45|   
#   46|      assert(stack_offs_end_B <= b->shader->scratch_size_B &&

Error: COMPILER_WARNING (CWE-563): [#def174]
mesa-25.1.0-rc2/src/asahi/compiler/agx_register_allocate.c: scope_hint: In function ‘agx_insert_parallel_copies’
mesa-25.1.0-rc2/src/asahi/compiler/agx_register_allocate.c:1229:9: warning[-Wunused-but-set-variable]: variable ‘any_succ’ set but not used
# 1229 |    bool any_succ = false;
#      |         ^~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1227|   agx_insert_parallel_copies(agx_context *ctx, agx_block *block)
# 1228|   {
# 1229|->    bool any_succ = false;
# 1230|      unsigned nr_phi = 0;
# 1231|   

Error: COMPILER_WARNING (CWE-563): [#def175]
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc: scope_hint: In function ‘void ail_detile(void*, void*, const ail_layout*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)’
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc:146:13: warning[-Wunused-variable]: unused variable ‘width_px’
#  146 |    unsigned width_px = u_minify(tiled_layout->width_px, level);
#      |             ^~~~~~~~
#  144|              unsigned sy_px, unsigned swidth_px, unsigned sheight_px)
#  145|   {
#  146|->    unsigned width_px = u_minify(tiled_layout->width_px, level);
#  147|      unsigned height_px = u_minify(tiled_layout->height_px, level);
#  148|      unsigned blocksize_B = util_format_get_blocksize(tiled_layout->format);

Error: COMPILER_WARNING (CWE-563): [#def176]
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc:147:13: warning[-Wunused-variable]: unused variable ‘height_px’
#  147 |    unsigned height_px = u_minify(tiled_layout->height_px, level);
#      |             ^~~~~~~~~
#  145|   {
#  146|      unsigned width_px = u_minify(tiled_layout->width_px, level);
#  147|->    unsigned height_px = u_minify(tiled_layout->height_px, level);
#  148|      unsigned blocksize_B = util_format_get_blocksize(tiled_layout->format);
#  149|   

Error: COMPILER_WARNING (CWE-563): [#def177]
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc: scope_hint: In function ‘void ail_tile(void*, void*, const ail_layout*, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int, unsigned int)’
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc:164:13: warning[-Wunused-variable]: unused variable ‘width_px’
#  164 |    unsigned width_px = u_minify(tiled_layout->width_px, level);
#      |             ^~~~~~~~
#  162|            unsigned sy_px, unsigned swidth_px, unsigned sheight_px)
#  163|   {
#  164|->    unsigned width_px = u_minify(tiled_layout->width_px, level);
#  165|      unsigned height_px = u_minify(tiled_layout->height_px, level);
#  166|      unsigned blocksize_B = ail_get_blocksize_B(tiled_layout);

Error: COMPILER_WARNING (CWE-563): [#def178]
mesa-25.1.0-rc2/src/asahi/layout/tiling.cc:165:13: warning[-Wunused-variable]: unused variable ‘height_px’
#  165 |    unsigned height_px = u_minify(tiled_layout->height_px, level);
#      |             ^~~~~~~~~
#  163|   {
#  164|      unsigned width_px = u_minify(tiled_layout->width_px, level);
#  165|->    unsigned height_px = u_minify(tiled_layout->height_px, level);
#  166|      unsigned blocksize_B = ail_get_blocksize_B(tiled_layout);
#  167|   

Error: COMPILER_WARNING (CWE-563): [#def179]
mesa-25.1.0-rc2/src/asahi/lib/agx_device.c: scope_hint: In function ‘agx_bo_export’
mesa-25.1.0-rc2/src/asahi/lib/agx_device.c:379:14: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  379 |          int ret = drmSyncobjExportSyncFile(
#      |              ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  377|         if (writer) {
#  378|            int out_sync_fd = -1;
#  379|->          int ret = drmSyncobjExportSyncFile(
#  380|               dev->fd, agx_bo_writer_syncobj(writer), &out_sync_fd);
#  381|            assert(ret >= 0);

Error: COMPILER_WARNING (CWE-563): [#def180]
mesa-25.1.0-rc2/src/asahi/lib/agx_nir_lower_vbo.c: scope_hint: In function ‘pass’
mesa-25.1.0-rc2/src/asahi/lib/agx_nir_lower_vbo.c:134:9: warning[-Wunused-variable]: unused variable ‘is_float’
#  134 |    bool is_float = desc->channel[chan].type == UTIL_FORMAT_TYPE_FLOAT;
#      |         ^~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  132|      assert(chan >= 0);
#  133|   
#  134|->    bool is_float = desc->channel[chan].type == UTIL_FORMAT_TYPE_FLOAT;
#  135|      bool is_unsigned = desc->channel[chan].type == UTIL_FORMAT_TYPE_UNSIGNED;
#  136|      bool is_signed = desc->channel[chan].type == UTIL_FORMAT_TYPE_SIGNED;

Error: COMPILER_WARNING (CWE-563): [#def181]
mesa-25.1.0-rc2/src/asahi/lib/decode.c: scope_hint: In function ‘agxdecode_track_alloc’
mesa-25.1.0-rc2/src/asahi/lib/decode.c:987:12: warning[-Wunused-variable]: unused variable ‘match’
#  987 |       bool match = (it->handle == alloc->handle);
#      |            ^~~~~
#  985|   {
#  986|      util_dynarray_foreach(&ctx->mmap_array, struct agx_bo, it) {
#  987|->       bool match = (it->handle == alloc->handle);
#  988|         assert(!match && "tried to alloc already allocated BO");
#  989|      }

Error: COMPILER_WARNING (CWE-563): [#def182]
mesa-25.1.0-rc2/src/asahi/lib/decode.c: scope_hint: In function ‘agxdecode_track_free’
mesa-25.1.0-rc2/src/asahi/lib/decode.c:997:9: warning[-Wunused-but-set-variable]: variable ‘found’ set but not used
#  997 |    bool found = false;
#      |         ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  995|   agxdecode_track_free(struct agxdecode_ctx *ctx, struct agx_bo *bo)
#  996|   {
#  997|->    bool found = false;
#  998|   
#  999|      util_dynarray_foreach(&ctx->mmap_array, struct agx_bo, it) {

Error: COMPILER_WARNING (CWE-563): [#def183]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_draw.c: scope_hint: In function ‘hk_CmdBeginRendering’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_draw.c:695:45: warning[-Wunused-variable]: unused variable ‘desc’
#  695 |       const struct util_format_description *desc =
#      |                                             ^~~~
#  693|         unsigned first_layer = view->vk.base_array_layer;
#  694|   
#  695|->       const struct util_format_description *desc =
#  696|            util_format_description(hk_format_to_pipe_format(view->vk.format));
#  697|   

Error: COMPILER_WARNING (CWE-563): [#def184]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_draw.c: scope_hint: In function ‘hk_flush_gfx_state’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_draw.c:3200:22: warning[-Wunused-variable]: unused variable ‘dev’
# 3200 |    struct hk_device *dev = hk_cmd_buffer_device(cmd);
#      |                      ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 3198|                      struct agx_draw draw)
# 3199|   {
# 3200|->    struct hk_device *dev = hk_cmd_buffer_device(cmd);
# 3201|      struct hk_graphics_state *gfx = &cmd->state.gfx;
# 3202|      struct hk_descriptor_state *desc = &gfx->descriptors;

Error: COMPILER_WARNING (CWE-563): [#def185]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_meta.c: scope_hint: In function ‘aspect_format’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_cmd_meta.c:211:9: warning[-Wunused-variable]: unused variable ‘depth’
#  211 |    bool depth = (aspect & VK_IMAGE_ASPECT_DEPTH_BIT);
#      |         ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  209|   aspect_format(VkFormat fmt, VkImageAspectFlags aspect)
#  210|   {
#  211|->    bool depth = (aspect & VK_IMAGE_ASPECT_DEPTH_BIT);
#  212|      bool stencil = (aspect & VK_IMAGE_ASPECT_STENCIL_BIT);
#  213|   

Error: COMPILER_WARNING (CWE-563): [#def186]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_device_memory.c: scope_hint: In function ‘hk_AllocateMemory’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_device_memory.c:182:19: warning[-Wunused-variable]: unused variable ‘flags’
#  182 |    const unsigned flags = hk_memory_type_flags(type, handle_types);
#      |                   ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  180|         handle_types |= fd_info->handleType;
#  181|   
#  182|->    const unsigned flags = hk_memory_type_flags(type, handle_types);
#  183|   
#  184|      uint32_t alignment = 16384; /* Apple page size */

Error: COMPILER_WARNING (CWE-563): [#def187]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_image.c: scope_hint: In function ‘hk_copy_image_to_image_cpu’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_image.c:1651:19: warning[-Wunused-variable]: unused variable ‘dst_size’
# 1651 |          uint32_t dst_size =
#      |                   ^~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1649|            uint32_t src_size =
# 1650|               ail_get_level_size_B(src_layout, info->srcSubresource.mipLevel);
# 1651|->          uint32_t dst_size =
# 1652|               ail_get_level_size_B(dst_layout, info->dstSubresource.mipLevel);
# 1653|   

Error: COMPILER_WARNING (CWE-563): [#def188]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_queue.c: scope_hint: In function ‘hk_sparse_image_bind_memory’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_queue.c:671:16: warning[-Wunused-variable]: unused variable ‘size_B’
#  671 |       unsigned size_B = tilesize_el.width_el * tilesize_el.height_el *
#      |                ^~~~~~
#  669|         /* Hardware tiles are exactly one page (16K) */
#  670|         struct ail_tile tilesize_el = layout->tilesize_el[level];
#  671|->       unsigned size_B = tilesize_el.width_el * tilesize_el.height_el *
#  672|                           ail_get_blocksize_B(layout);
#  673|   

Error: COMPILER_WARNING (CWE-563): [#def189]
mesa-25.1.0-rc2/src/asahi/vulkan/hk_queue.c: scope_hint: In function ‘hk_queue_init’
mesa-25.1.0-rc2/src/asahi/vulkan/hk_queue.c:940:31: warning[-Wunused-variable]: unused variable ‘pdev’
#  940 |    struct hk_physical_device *pdev = hk_device_physical(dev);
#      |                               ^~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  938|                 uint32_t index_in_family)
#  939|   {
#  940|->    struct hk_physical_device *pdev = hk_device_physical(dev);
#  941|      VkResult result;
#  942|   

Error: COMPILER_WARNING (CWE-252): [#def190]
mesa-25.1.0-rc2/src/compiler/spirv/vtn_bindgen2.c: scope_hint: In function ‘main’
mesa-25.1.0-rc2/src/compiler/spirv/vtn_bindgen2.c:313:4: warning[-Wunused-result]: ignoring return value of ‘fread’ declared with attribute ‘warn_unused_result’
#  313 |    fread(map, 1, len, fin);
#      |    ^~~~~~~~~~~~~~~~~~~~~~~
#  311|      }
#  312|   
#  313|->    fread(map, 1, len, fin);
#  314|      fclose(fin);
#  315|   

Error: COMPILER_WARNING (CWE-252): [#def191]
mesa-25.1.0-rc2/src/gallium/auxiliary/gallivm/lp_bld_debug.cpp: scope_hint: In function ‘void lp_function_add_debug_info(gallivm_state*, LLVMValueRef, LLVMTypeRef)’
mesa-25.1.0-rc2/src/gallium/auxiliary/gallivm/lp_bld_debug.cpp:381:15: warning[-Wunused-result]: ignoring return value of ‘int asprintf(char**, const char*, ...)’ declared with attribute ‘warn_unused_result’
#  381 |       asprintf(&gallivm->file_name, "%s/%u.nir", LP_NIR_SHADER_DUMP_DIR, shader_index);
#      |       ~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#  379|         std::filesystem::create_directory(LP_NIR_SHADER_DUMP_DIR);
#  380|   
#  381|->       asprintf(&gallivm->file_name, "%s/%u.nir", LP_NIR_SHADER_DUMP_DIR, shader_index);
#  382|   
#  383|         gallivm->file = LLVMDIBuilderCreateFile(gallivm->di_builder, gallivm->file_name, strlen(gallivm->file_name), ".", 1);

Error: COMPILER_WARNING (CWE-563): [#def192]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c: scope_hint: In function ‘agx_batch_init’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:159:11: warning[-Wunused-variable]: unused variable ‘ret’
#  159 |       int ret = drmSyncobjCreate(dev->fd, 0, &batch->syncobj);
#      |           ^~~
#  157|   
#  158|      if (!batch->syncobj) {
#  159|->       int ret = drmSyncobjCreate(dev->fd, 0, &batch->syncobj);
#  160|         assert(!ret && batch->syncobj);
#  161|      }

Error: COMPILER_WARNING (CWE-563): [#def193]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c: scope_hint: In function ‘agx_get_in_sync’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:599:11: warning[-Wunused-variable]: unused variable ‘ret’
#  599 |       int ret =
#      |           ^~~
#  597|   
#  598|      if (ctx->in_sync_fd >= 0) {
#  599|->       int ret =
#  600|            drmSyncobjImportSyncFile(dev->fd, ctx->in_sync_obj, ctx->in_sync_fd);
#  601|         assert(!ret);

Error: COMPILER_WARNING (CWE-563): [#def194]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c: scope_hint: In function ‘agx_batch_submit’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:714:14: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  714 |          int ret = drmSyncobjCreate(dev->fd, 0, &sync_handle);
#      |              ^~~
#  712|            /* Create a new syncobj */
#  713|            uint32_t sync_handle;
#  714|->          int ret = drmSyncobjCreate(dev->fd, 0, &sync_handle);
#  715|            assert(ret >= 0);
#  716|   

Error: COMPILER_WARNING (CWE-563): [#def195]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:905:11: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  905 |       int ret = drmSyncobjExportSyncFile(dev->fd, batch->syncobj, &out_sync_fd);
#      |           ^~~
#  903|         /* Convert our handle to a sync file */
#  904|         int out_sync_fd = -1;
#  905|->       int ret = drmSyncobjExportSyncFile(dev->fd, batch->syncobj, &out_sync_fd);
#  906|         assert(ret >= 0);
#  907|         assert(out_sync_fd >= 0);

Error: COMPILER_WARNING (CWE-563): [#def196]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:957:11: warning[-Wunused-variable]: unused variable ‘ret’
#  957 |       int ret = drmSyncobjWait(dev->fd, &batch->syncobj, 1, INT64_MAX, 0, NULL);
#      |           ^~~
#  955|   
#  956|         /* Wait so we can get errors reported back */
#  957|->       int ret = drmSyncobjWait(dev->fd, &batch->syncobj, 1, INT64_MAX, 0, NULL);
#  958|         assert(!ret);
#  959|   

Error: COMPILER_WARNING (CWE-563): [#def197]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c: scope_hint: In function ‘agx_sync_batch’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_batch.c:1011:8: warning[-Wunused-variable]: unused variable ‘ret’
# 1011 |    int ret = drmSyncobjWait(dev->fd, &batch->syncobj, 1, INT64_MAX, 0, NULL);
#      |        ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1009|   
# 1010|      assert(batch->syncobj);
# 1011|->    int ret = drmSyncobjWait(dev->fd, &batch->syncobj, 1, INT64_MAX, 0, NULL);
# 1012|      assert(!ret);
# 1013|      agx_batch_cleanup(ctx, batch, false);

Error: COMPILER_WARNING (CWE-563): [#def198]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_fence.c: scope_hint: In function ‘agx_fence_get_fd’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_fence.c:66:8: warning[-Wunused-variable]: unused variable ‘ret’
#   66 |    int ret = drmSyncobjExportSyncFile(dev->fd, f->syncobj, &fd);
#      |        ^~~
#   64|      int fd = -1;
#   65|   
#   66|->    int ret = drmSyncobjExportSyncFile(dev->fd, f->syncobj, &fd);
#   67|      assert(ret >= 0);
#   68|      assert(fd >= 0);

Error: COMPILER_WARNING (CWE-563): [#def199]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_fence.c: scope_hint: In function ‘agx_fence_server_sync’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_fence.c:154:17: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
#  154 |    int fd = -1, ret;
#      |                 ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  152|      struct agx_device *dev = agx_device(pctx->screen);
#  153|      struct agx_context *ctx = agx_context(pctx);
#  154|->    int fd = -1, ret;
#  155|   
#  156|      ret = drmSyncobjExportSyncFile(dev->fd, f->syncobj, &fd);

Error: COMPILER_WARNING (CWE-563): [#def200]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_pipe.c: scope_hint: In function ‘agx_create_context’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_pipe.c:1735:8: warning[-Wunused-but-set-variable]: variable ‘ret’ set but not used
# 1735 |    int ret;
#      |        ^~~
# 1733|      struct agx_context *ctx = rzalloc(NULL, struct agx_context);
# 1734|      struct pipe_context *pctx = &ctx->base;
# 1735|->    int ret;
# 1736|   
# 1737|      if (!ctx)

Error: COMPILER_WARNING (CWE-563): [#def201]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_pipe.c: scope_hint: In function ‘agx_screen_create’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_pipe.c:2426:8: warning[-Wunused-variable]: unused variable ‘ret’
# 2426 |    int ret =
#      |        ^~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 2424|         agx_screen->dev.debug |= AGX_DBG_NO16;
# 2425|   
# 2426|->    int ret =
# 2427|         drmSyncobjCreate(agx_device(screen)->fd, 0, &agx_screen->flush_syncobj);
# 2428|      assert(!ret);

Error: COMPILER_WARNING (CWE-563): [#def202]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_query.c: scope_hint: In function ‘agx_get_query_result_resource_cpu’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_query.c:443:12: warning[-Wunused-variable]: unused variable ‘ready’
#  443 |       bool ready =
#      |            ^~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
#  441|         result.u64 = !is_query_busy(ctx, query);
#  442|      } else {
#  443|->       bool ready =
#  444|            agx_get_query_result(&ctx->base, (void *)query, true, &result);
#  445|   

Error: COMPILER_WARNING (CWE-563): [#def203]
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_state.c: scope_hint: In function ‘agx_create_vertex_elements’
mesa-25.1.0-rc2/src/gallium/drivers/asahi/agx_state.c:1396:16: warning[-Wunused-variable]: unused variable ‘chan_size’
# 1396 |       unsigned chan_size = desc->channel[0].size / 8;
#      |                ^~~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c2x-extensions’ may have been intended to silence earlier diagnostics
# 1394|         const struct util_format_description *desc =
# 1395|            util_format_description(ve.src_format);
# 1396|->       unsigned chan_size = desc->channel[0].size / 8;
# 1397|         assert((ve.src_offset & (chan_size - 1)) == 0);
# 1398|   

Error: COMPILER_WARNING (CWE-563): [#def204]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:129:12: warning[-Wunused-variable]: unused variable ‘has_attribute_ring_address’
#  129 |       bool has_attribute_ring_address = s->shader->selector->screen->info.gfx_level >= GFX11;
#      |            ^~~~~~~~~~~~~~~~~~~~~~~~~~
#  127|         out[3] = nir_imm_float(b, 1);
#  128|      } else {
#  129|->       bool has_attribute_ring_address = s->shader->selector->screen->info.gfx_level >= GFX11;
#  130|   
#  131|         /* Color or texture coordinates: */

Error: COMPILER_WARNING (CWE-563): [#def205]
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c: scope_hint: In function ‘load_vs_input_from_blit_sgpr’
mesa-25.1.0-rc2/src/gallium/drivers/radeonsi/si_nir_lower_vs_inputs.c:134:16: warning[-Wunused-variable]: unused variable ‘vs_blit_property’
#  134 |       unsigned vs_blit_property = b->shader->info.vs.blit_sgprs_amd;
#      |                ^~~~~~~~~~~~~~~~
#  132|         assert(input_index == 1);
#  133|   
#  134|->       unsigned vs_blit_property = b->shader->info.vs.blit_sgprs_amd;
#  135|         assert(vs_blit_property == SI_VS_BLIT_SGPRS_POS_TEXCOORD + has_attribute_ring_address);
#  136|   

Error: COMPILER_WARNING (CWE-563): [#def206]
mesa-25.1.0-rc2/src/intel/compiler/brw_eu_compact.c: scope_hint: In function ‘brw_compact_instructions’
mesa-25.1.0-rc2/src/intel/compiler/brw_eu_compact.c:2370:19: warning[-Wunused-variable]: unused variable ‘saved’
# 2370 |       brw_eu_inst saved = inst;
#      |                   ^~~~~
# 2368|   
# 2369|         brw_eu_inst inst = precompact(p->isa, *src);
# 2370|->       brw_eu_inst saved = inst;
# 2371|   
# 2372|         if (try_compact_instruction(&c, dst, &inst)) {

Error: COMPILER_WARNING (CWE-563): [#def207]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘brw_reg emit_work_group_id_setup(nir_to_brw_state&)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:174:16: warning[-Wunused-variable]: unused variable ‘s’
#  174 |    brw_shader &s = ntb.s;
#      |                ^
#  172|   emit_work_group_id_setup(nir_to_brw_state &ntb)
#  173|   {
#  174|->    brw_shader &s = ntb.s;
#  175|      const brw_builder &bld = ntb.bld.scalar_group();
#  176|   

Error: COMPILER_WARNING (CWE-563): [#def208]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_offset(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:2148:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’
# 2148 |    const struct brw_wm_prog_data *wm_prog_data =
#      |                                   ^~~~~~~~~~~~
# 2146|   
# 2147|      const brw_fs_thread_payload &payload = shader->fs_payload();
# 2148|->    const struct brw_wm_prog_data *wm_prog_data =
# 2149|         brw_wm_prog_data(shader->prog_data);
# 2150|   

Error: COMPILER_WARNING (CWE-563): [#def209]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_sample(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:2278:35: warning[-Wunused-variable]: unused variable ‘wm_prog_data’
# 2278 |    const struct brw_wm_prog_data *wm_prog_data =
#      |                                   ^~~~~~~~~~~~
# 2276|   {
# 2277|      const brw_fs_thread_payload &payload = bld.shader->fs_payload();
# 2278|->    const struct brw_wm_prog_data *wm_prog_data =
# 2279|         brw_wm_prog_data(bld.shader->prog_data);
# 2280|      const brw_builder ubld = bld.exec_all().group(16, 0);

Error: COMPILER_WARNING (CWE-563): [#def210]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘void brw_from_nir_emit_vs_intrinsic(nir_to_brw_state&, nir_intrinsic_instr*)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:2869:16: warning[-Wunused-variable]: unused variable ‘s’
# 2869 |    brw_shader &s = ntb.s;
#      |                ^
# 2867|   {
# 2868|      const brw_builder &bld = ntb.bld;
# 2869|->    brw_shader &s = ntb.s;
# 2870|      assert(s.stage == MESA_SHADER_VERTEX);
# 2871|   

Error: COMPILER_WARNING (CWE-563): [#def211]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘void emit_barrier(nir_to_brw_state&)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:3031:16: warning[-Wunused-variable]: unused variable ‘s’
# 3031 |    brw_shader &s = ntb.s;
#      |                ^
# 3029|      const brw_builder ubld = bld.exec_all();
# 3030|      const brw_builder hbld = ubld.group(8 * reg_unit(devinfo), 0);
# 3031|->    brw_shader &s = ntb.s;
# 3032|   
# 3033|      /* We are getting the barrier ID from the compute shader header */

Error: COMPILER_WARNING (CWE-563): [#def212]
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp: scope_hint: In function ‘brw_reg emit_shading_rate_setup(nir_to_brw_state&)’
mesa-25.1.0-rc2/src/intel/compiler/brw_from_nir.cpp:4074:29: warning[-Wunused-variable]: unused variable ‘devinfo’
# 4074 |    const intel_device_info *devinfo = ntb.devinfo;
#      |                             ^~~~~~~
# 4072|   emit_shading_rate_setup(nir_to_brw_state &ntb)
# 4073|   {
# 4074|->    const intel_device_info *devinfo = ntb.devinfo;
# 4075|      const brw_builder &bld = ntb.bld;
# 4076|   

Error: COMPILER_WARNING (CWE-563): [#def213]
mesa-25.1.0-rc2/src/intel/compiler/brw_lower_logical_sends.cpp: scope_hint: In function ‘void lower_lsc_memory_fence_and_interlock(const brw_builder&, brw_inst*)’
mesa-25.1.0-rc2/src/intel/compiler/brw_lower_logical_sends.cpp:2441:15: warning[-Wunused-variable]: unused variable ‘commit_enable’
# 2441 |    const bool commit_enable = inst->src[1].ud;
#      |               ^~~~~~~~~~~~~
# 2439|   
# 2440|      assert(inst->src[1].file == IMM);
# 2441|->    const bool commit_enable = inst->src[1].ud;
# 2442|      assert(commit_enable); /* always used */
# 2443|   

Error: COMPILER_WARNING (CWE-563): [#def214]
mesa-25.1.0-rc2/src/intel/compiler/brw_lower_regioning.cpp:741:17: warning[-Wunused-variable]: unused variable ‘mov’
#  741 |       brw_inst *mov = ibld.MOV(tmp, inst->src[0]);
#      |                 ^~~
#  739|   
#  740|         brw_reg tmp = ibld.vgrf(brw_type_with_size(inst->src[0].type, 32));
#  741|->       brw_inst *mov = ibld.MOV(tmp, inst->src[0]);
#  742|   
#  743|         inst->src[0] = component(tmp, 0);

Error: COMPILER_WARNING (CWE-563): [#def215]
mesa-25.1.0-rc2/src/intel/vulkan/anv_image.c: scope_hint: In function ‘add_aux_surface_if_supported’
mesa-25.1.0-rc2/src/intel/vulkan/anv_image.c:715:23: warning[-Wunused-variable]: unused variable ‘aspect’
#  715 |    VkImageAspectFlags aspect = plane_format.aspect;
#      |                       ^~~~~~
#  713|                                uint64_t aux_state_offset)
#  714|   {
#  715|->    VkImageAspectFlags aspect = plane_format.aspect;
#  716|      VkResult result;
#  717|      bool ok;

Error: COMPILER_WARNING (CWE-563): [#def216]
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c: scope_hint: In function ‘panvk_signal_event_syncobjs’
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c:200:14: warning[-Wunused-variable]: unused variable ‘ret’
#  200 |          int ret = pan_kmod_ioctl(dev->drm_fd, DRM_IOCTL_SYNCOBJ_RESET,
#      |              ^~~
#  198|               .count_handles = 1};
#  199|   
#  200|->          int ret = pan_kmod_ioctl(dev->drm_fd, DRM_IOCTL_SYNCOBJ_RESET,
#  201|                                     &objs);
#  202|            assert(!ret);

Error: COMPILER_WARNING (CWE-563): [#def217]
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c: scope_hint: In function ‘panvk_v6_QueueWaitIdle’
mesa-25.1.0-rc2/src/panfrost/vulkan/jm/panvk_vX_queue.c:351:8: warning[-Wunused-variable]: unused variable ‘ret’
#  351 |    int ret = drmSyncobjWait(dev->drm_fd, &queue->sync, 1,
#      |        ^~~
#  349|         return VK_ERROR_DEVICE_LOST;
#  350|   
#  351|->    int ret = drmSyncobjWait(dev->drm_fd, &queue->sync, 1,
#  352|                               INT64_MAX, DRM_SYNCOBJ_WAIT_FLAGS_WAIT_ALL, NULL);
#  353|      assert(!ret);

Error: COMPILER_WARNING (CWE-563): [#def218]
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘get_img_index’
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:816:54: warning[-Wunused-variable]: unused variable ‘bind_layout’
#  816 |    const struct panvk_descriptor_set_binding_layout *bind_layout =
#      |                                                      ^~~~~~~~~~~
#  814|                                 &max_idx);
#  815|   
#  816|->    const struct panvk_descriptor_set_binding_layout *bind_layout =
#  817|         get_binding_layout(set, binding, ctx);
#  818|      assert(bind_layout->type == VK_DESCRIPTOR_TYPE_STORAGE_IMAGE ||

Error: COMPILER_WARNING (CWE-563): [#def219]
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1121:13: warning[-Wunused-variable]: unused variable ‘desc_stride’
# 1121 |    uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
#      |             ^~~~~~~~~~~
# 1119|         &set_layout->bindings[binding];
# 1120|      uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc);
# 1121|->    uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
# 1122|      uint32_t max_desc_stride = MAX2(
# 1123|         binding_layout->samplers_per_desc + binding_layout->textures_per_desc, 1);

Error: COMPILER_WARNING (CWE-563): [#def220]
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c: scope_hint: In function ‘record_binding’
mesa-25.1.0-rc2/src/panfrost/vulkan/panvk_vX_nir_lower_descriptors.c:1122:13: warning[-Wunused-variable]: unused variable ‘max_desc_stride’
# 1122 |    uint32_t max_desc_stride = MAX2(
#      |             ^~~~~~~~~~~~~~~
# 1120|      uint32_t subdesc_idx = get_subdesc_idx(binding_layout, subdesc);
# 1121|      uint32_t desc_stride = panvk_get_desc_stride(binding_layout);
# 1122|->    uint32_t max_desc_stride = MAX2(
# 1123|         binding_layout->samplers_per_desc + binding_layout->textures_per_desc, 1);
# 1124|   

Error: CPPCHECK_WARNING (CWE-476): [#def221]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:76: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#   74|      left = size;
#   75|      do {
#   76|->       ret = write(vtdev->sock_fd, ptr, left);
#   77|         if (ret < 0)
#   78|            return -errno;

Error: CPPCHECK_WARNING (CWE-476): [#def222]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:796: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#  794|      vtdev = calloc(1, sizeof(*vtdev));
#  795|   
#  796|->    vtdev->sock_fd = sock_fd;
#  797|      simple_mtx_init(&vtdev->lock, mtx_plain);
#  798|   

Error: CPPCHECK_WARNING (CWE-476): [#def223]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:804: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#  802|      simple_mtx_lock(&vtdev->lock);
#  803|      send_init(vtdev);
#  804|->    vtdev->protocol_version = negotiate_version(vtdev);
#  805|   
#  806|      /* Version 1 is deprecated. */

Error: CPPCHECK_WARNING (CWE-476): [#def224]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:807: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#  805|   
#  806|      /* Version 1 is deprecated. */
#  807|->    if (vtdev->protocol_version == 1)
#  808|         vtdev->protocol_version = 0;
#  809|   

Error: CPPCHECK_WARNING (CWE-476): [#def225]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:812: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: vtdev
#  810|      // TODO minimum protocol version?
#  811|   
#  812|->    mesa_logd("vpipe connected, protocol version %d", vtdev->protocol_version);
#  813|   
#  814|      vdev = &vtdev->base;

Error: CPPCHECK_WARNING (CWE-758): [#def226]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1052: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1050|   
# 1051|      if (timeout_nsec > os_time_get_nano())
# 1052|->       flags |= DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD;
# 1053|   
# 1054|      vpipe_hdr[VTEST_CMD_LEN] = VCMD_DRM_SYNC_WAIT_SIZE;

Error: CPPCHECK_WARNING (CWE-758): [#def227]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1070: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1068|      assert(vpipe_hdr[VTEST_CMD_ID] == VCMD_DRM_SYNC_WAIT);
# 1069|   
# 1070|->    if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD) {
# 1071|         assert(vpipe_hdr[VTEST_CMD_LEN] == 0);
# 1072|         wait_fd = vpipe_receive_fd(vp->vtdev);

Error: CPPCHECK_WARNING (CWE-758): [#def228]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1084: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1082|      simple_mtx_unlock(&vp->vtdev->lock);
# 1083|   
# 1084|->    if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD) {
# 1085|         vpipe_read_fd(wait_fd, &ret, sizeof(ret));
# 1086|         if (first_signaled)

Error: CPPCHECK_WARNING (CWE-758): [#def229]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1187: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1185|   
# 1186|      if (timeout_nsec > os_time_get_nano())
# 1187|->       flags |= DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD;
# 1188|   
# 1189|      vpipe_hdr[VTEST_CMD_LEN] = VCMD_DRM_SYNC_TIMELINE_WAIT_SIZE;

Error: CPPCHECK_WARNING (CWE-758): [#def230]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1206: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1204|      assert(vpipe_hdr[VTEST_CMD_ID] == VCMD_DRM_SYNC_WAIT);
# 1205|   
# 1206|->    if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD) {
# 1207|         assert(vpipe_hdr[VTEST_CMD_LEN] == 0);
# 1208|         wait_fd = vpipe_receive_fd(vp->vtdev);

Error: CPPCHECK_WARNING (CWE-758): [#def231]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1220: error[shiftTooManyBitsSigned]: Shifting signed 32-bit value by 31 bits is undefined behaviour
# 1218|      simple_mtx_unlock(&vp->vtdev->lock);
# 1219|   
# 1220|->    if (flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FD) {
# 1221|         vpipe_read_fd(wait_fd, &ret, sizeof(ret));
# 1222|         if (first_signaled)

Error: CPPCHECK_WARNING (CWE-476): [#def232]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1312: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: s
# 1310|      struct vpipe_sync_provider *s = calloc(1, sizeof(*s));
# 1311|   
# 1312|->    s->base = (struct util_sync_provider){
# 1313|         .create = vpipe_drm_sync_create,
# 1314|         .destroy = vpipe_drm_sync_destroy,

Error: CPPCHECK_WARNING (CWE-476): [#def233]
mesa-25.1.0-rc2/src/virtio/vdrm/vdrm_vpipe.c:1332: warning[nullPointerOutOfMemory]: If memory allocation fails, then there is a possible null pointer dereference: s
# 1330|      }
# 1331|   
# 1332|->    s->vtdev = to_vpipe_device(vdrm);
# 1333|   
# 1334|      return &s->base;

Scan Properties