Newly introduced findings

List of Findings

Error: COMPILER_WARNING (CWE-563): [#def1]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c: scope_hint: In function ‘amd_cp_print_packet_gfx11’
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:1900:19: warning[-Wunused-variable]: unused variable ‘dw2’
# 1900 |          uint32_t dw2 = ac_ib_get(ib);
#      |                   ^~~
# 1898|            if (pkt_count_field == 1) break;
# 1899|   
# 1900|->          uint32_t dw2 = ac_ib_get(ib);
# 1901|            assert(!dw2 && "reserved packet fields should be 0 for COND_EXEC, word 2");
# 1902|            if (pkt_count_field == 2) break;

Error: COMPILER_WARNING (CWE-563): [#def2]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:3069:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 3069 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 3067|            assert(0 && "packet PFP_SYNC_ME is not supported by MEC");
# 3068|         } else {
# 3069|->          uint32_t dw0 = ac_ib_get(ib);
# 3070|            assert(!dw0 && "reserved packet fields should be 0 for PFP_SYNC_ME, word 0");
# 3071|         }

Error: COMPILER_WARNING (CWE-563): [#def3]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:4603:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 4603 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 4601|      case 0x95: { /* PKT3_HDP_FLUSH */
# 4602|         if (ib->ip_type == AMD_IP_COMPUTE) {
# 4603|->          uint32_t dw0 = ac_ib_get(ib);
# 4604|            assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4605|         } else {

Error: COMPILER_WARNING (CWE-563): [#def4]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:4606:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 4606 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 4604|            assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4605|         } else {
# 4606|->          uint32_t dw0 = ac_ib_get(ib);
# 4607|            assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4608|         }

Error: COMPILER_WARNING (CWE-563): [#def5]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:5335:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5335 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 5333|      case 0xD0: { /* PKT3_PROTECTED_FENCE_SIGNAL */
# 5334|         if (ib->ip_type == AMD_IP_COMPUTE) {
# 5335|->          uint32_t dw0 = ac_ib_get(ib);
# 5336|            assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5337|         } else {

Error: COMPILER_WARNING (CWE-563): [#def6]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:5338:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5338 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 5336|            assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5337|         } else {
# 5338|->          uint32_t dw0 = ac_ib_get(ib);
# 5339|            assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5340|         }

Error: COMPILER_WARNING (CWE-563): [#def7]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:5350:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5350 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 5348|      case 0xD2: { /* PKT3_CLEANER_SHADER */
# 5349|         if (ib->ip_type == AMD_IP_COMPUTE) {
# 5350|->          uint32_t dw0 = ac_ib_get(ib);
# 5351|            assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5352|         } else {

Error: COMPILER_WARNING (CWE-563): [#def8]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx11.c:5353:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5353 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 5351|            assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5352|         } else {
# 5353|->          uint32_t dw0 = ac_ib_get(ib);
# 5354|            assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5355|         }

Error: COMPILER_WARNING (CWE-563): [#def9]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c: scope_hint: In function ‘amd_cp_print_packet_gfx12’
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:1757:19: warning[-Wunused-variable]: unused variable ‘dw2’
# 1757 |          uint32_t dw2 = ac_ib_get(ib);
#      |                   ^~~
# 1755|            if (pkt_count_field == 1) break;
# 1756|   
# 1757|->          uint32_t dw2 = ac_ib_get(ib);
# 1758|            assert(!dw2 && "reserved packet fields should be 0 for COND_EXEC, word 2");
# 1759|            if (pkt_count_field == 2) break;

Error: COMPILER_WARNING (CWE-563): [#def10]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:2923:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 2923 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 2921|            assert(0 && "packet PFP_SYNC_ME is not supported by MEC");
# 2922|         } else {
# 2923|->          uint32_t dw0 = ac_ib_get(ib);
# 2924|            assert(!dw0 && "reserved packet fields should be 0 for PFP_SYNC_ME, word 0");
# 2925|         }

Error: COMPILER_WARNING (CWE-563): [#def11]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:4453:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 4453 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 4451|      case 0x95: { /* PKT3_HDP_FLUSH */
# 4452|         if (ib->ip_type == AMD_IP_COMPUTE) {
# 4453|->          uint32_t dw0 = ac_ib_get(ib);
# 4454|            assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4455|         } else {

Error: COMPILER_WARNING (CWE-563): [#def12]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:4456:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 4456 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 4454|            assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4455|         } else {
# 4456|->          uint32_t dw0 = ac_ib_get(ib);
# 4457|            assert(!dw0 && "reserved packet fields should be 0 for HDP_FLUSH, word 0");
# 4458|         }

Error: COMPILER_WARNING (CWE-563): [#def13]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:5491:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5491 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 5489|      case 0xD0: { /* PKT3_PROTECTED_FENCE_SIGNAL */
# 5490|         if (ib->ip_type == AMD_IP_COMPUTE) {
# 5491|->          uint32_t dw0 = ac_ib_get(ib);
# 5492|            assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5493|         } else {

Error: COMPILER_WARNING (CWE-563): [#def14]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:5494:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5494 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 5492|            assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5493|         } else {
# 5494|->          uint32_t dw0 = ac_ib_get(ib);
# 5495|            assert(!dw0 && "reserved packet fields should be 0 for PROTECTED_FENCE_SIGNAL, word 0");
# 5496|         }

Error: COMPILER_WARNING (CWE-563): [#def15]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:5506:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5506 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 5504|      case 0xD2: { /* PKT3_CLEANER_SHADER */
# 5505|         if (ib->ip_type == AMD_IP_COMPUTE) {
# 5506|->          uint32_t dw0 = ac_ib_get(ib);
# 5507|            assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5508|         } else {

Error: COMPILER_WARNING (CWE-563): [#def16]
mesa-26.1.1/redhat-linux-build/src/amd/common/amd_cp_print_packet_gfx12.c:5509:19: warning[-Wunused-variable]: unused variable ‘dw0’
# 5509 |          uint32_t dw0 = ac_ib_get(ib);
#      |                   ^~~
# 5507|            assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5508|         } else {
# 5509|->          uint32_t dw0 = ac_ib_get(ib);
# 5510|            assert(!dw0 && "reserved packet fields should be 0 for CLEANER_SHADER, word 0");
# 5511|         }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def17]
mesa-26.1.1/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2161:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘rt’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:623:1: enter_function: entry to ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: calling ‘pan_nir_tile_default_coverage’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: return_function: returning to ‘bi_lower_load_output’ from ‘pan_nir_tile_default_coverage’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: inlined call to ‘nir_imm_int’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: inlined call to ‘nir_imm_int’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: calling ‘pan_nir_tile_location_sample’ from ‘bi_lower_load_output’
# 2159|   nir_u2u8(nir_builder *build, nir_def *src0)
# 2160|   {
# 2161|->    if (src0->bit_size == 8)
# 2162|         return src0;
# 2163|      return nir_build_alu1(build, nir_op_u2u8, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def18]
mesa-26.1.1/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:2161:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘sample’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:623:1: enter_function: entry to ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: calling ‘pan_nir_tile_default_coverage’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: return_function: returning to ‘bi_lower_load_output’ from ‘pan_nir_tile_default_coverage’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: inlined call to ‘nir_imm_int’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: inlined call to ‘nir_imm_int’ from ‘bi_lower_load_output’
mesa-26.1.1/src/panfrost/compiler/bifrost/bifrost_nir.c:638:23: call_function: calling ‘pan_nir_tile_location_sample’ from ‘bi_lower_load_output’
# 2159|   nir_u2u8(nir_builder *build, nir_def *src0)
# 2160|   {
# 2161|->    if (src0->bit_size == 8)
# 2162|         return src0;
# 2163|      return nir_build_alu1(build, nir_op_u2u8, src0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def19]
mesa-26.1.1/redhat-linux-build/src/compiler/nir/nir_builder_opcodes.h:14102:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src0’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:108:1: enter_function: entry to ‘pan_nir_lower_fs_inputs’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:117:11: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘pan_nir_lower_fs_inputs’
#14100|         indices.io_semantics.num_slots = 1;
#14101|      if (!indices.src_type)
#14102|->       indices.src_type = (nir_alu_type)(nir_type_float | src0->bit_size);
#14103|      nir_intrinsic_set_src_type(intrin, indices.src_type);
#14104|      nir_intrinsic_set_io_semantics(intrin, indices.io_semantics);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def20]
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:821:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:6969:28: enter_function: entry to ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers_ext’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:6976:7: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:6978:4: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:6981:4: call_function: calling ‘enqueue_pipeline_layout’ from ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers_ext’
#  819|      VK_FROM_HANDLE(vk_pipeline_layout, vklayout, layout);
#  820|      vk_pipeline_layout_ref(vklayout);
#  821|->    util_dynarray_append(&queue->pipeline_layouts, vklayout);
#  822|   }
#  823|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def21]
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:829:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7868:28: enter_function: entry to ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers2_ext’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7873:7: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7875:4: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7876:7: branch_true: following ‘true’ branch (when ‘pBindDescriptorBufferEmbeddedSamplersInfo’ is non-NULL)...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7877:108: branch_true: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7878:10: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7879:7: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7880:7: call_function: calling ‘enqueue_pipeline_layout’ from ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers2_ext’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7880:7: return_function: returning to ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers2_ext’ from ‘enqueue_pipeline_layout’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7885:14: branch_true: following ‘true’ branch (when ‘pnext’ is non-NULL)...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7886:27: branch_true: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7889:16: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7890:13: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7895:19: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7896:114: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7897:38: branch_true: following ‘true’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7898:52: branch_true: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7898:19: call_function: calling ‘enqueue_descriptor_layout’ from ‘vk_enqueue_cmd_bind_descriptor_buffer_embedded_samplers2_ext’
#  827|      VK_FROM_HANDLE(vk_descriptor_set_layout, vklayout, layout);
#  828|      vk_descriptor_set_layout_ref(vklayout);
#  829|->    util_dynarray_append(&queue->set_layouts, vklayout);
#  830|   }
#  831|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def22]
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:837:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7754:28: enter_function: entry to ‘vk_enqueue_cmd_push_descriptor_set_with_template2’
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7759:7: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7761:4: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7762:7: branch_true: following ‘true’ branch (when ‘pPushDescriptorSetWithTemplateInfo’ is non-NULL)...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7763:90: branch_true: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7764:10: branch_false: following ‘false’ branch...
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7765:7: branch_false: ...to here
mesa-26.1.1/redhat-linux-build/src/vulkan/runtime/vk_cmd_queue.c:7766:7: call_function: calling ‘enqueue_descriptor_template’ from ‘vk_enqueue_cmd_push_descriptor_set_with_template2’
#  835|      VK_FROM_HANDLE(vk_descriptor_update_template, vktempl, templ);
#  836|      vk_descriptor_update_template_ref(vktempl);
#  837|->    util_dynarray_append(&queue->update_templates, vktempl);
#  838|   }
#  839|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def23]
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:731:11: warning[-Wanalyzer-malloc-leak]: leak of ‘dec’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:672:1: enter_function: entry to ‘ac_uvd_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:674:33: acquire_memory: allocated here
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:675:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)...
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:678:18: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:722:29: call_function: calling ‘get_session_size’ from ‘ac_uvd_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:722:29: return_function: returning to ‘ac_uvd_create_video_decoder’ from ‘get_session_size’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:723:30: call_function: calling ‘get_embedded_size’ from ‘ac_uvd_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:723:30: return_function: returning to ‘ac_uvd_create_video_decoder’ from ‘get_embedded_size’
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:727:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:729:4: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_uvd_dec.c:731:11: danger: ‘dec’ leaks here; was allocated at [(2)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/1)
#  729|      dec->base.build_decode_cmd = uvd_build_decode_cmd;
#  730|   
#  731|->    return &dec->base;
#  732|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def24]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1003:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1060:1: enter_function: entry to ‘vcn_build_create_cmd’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1093:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1098:4: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1098:4: call_function: calling ‘send_cmd’ from ‘vcn_build_create_cmd’
# 1001|      case RDECODE_CMD_SESSION_CONTEXT_BUFFER:
# 1002|         cmd_buf->decode_buffer_flags |= RDECODE_CMDBUF_FLAGS_SESSION_CONTEXT_BUFFER;
# 1003|->       cmd_buf->decode_buffer->session_contex_buffer_address_hi = va >> 32;
# 1004|         cmd_buf->decode_buffer->session_contex_buffer_address_lo = va;
# 1005|         break;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def25]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1885:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_drm’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1885:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1885:7: danger: dereference of NULL ‘index_drm’
# 1883|   
# 1884|      if (cmd->protected_content.mode) {
# 1885|->       index_drm->message_id = RDECODE_MESSAGE_DRM;
# 1886|         index_drm->offset = offset_drm;
# 1887|         index_drm->size = sizeof(rvcn_dec_message_drm_t);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def26]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1899:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘index_dynamic_dpb’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1899:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1899:7: danger: dereference of NULL ‘index_dynamic_dpb’
# 1897|   
# 1898|      if (cmd->tier == AC_VIDEO_DEC_TIER1 || cmd->tier == AC_VIDEO_DEC_TIER2) {
# 1899|->       index_dynamic_dpb->message_id = RDECODE_MESSAGE_DYNAMIC_DPB;
# 1900|         index_dynamic_dpb->offset = offset_dynamic_dpb;
# 1901|         if (cmd->tier == AC_VIDEO_DEC_TIER1)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def27]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2020:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2012:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2015:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2015:14: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2016:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2020:7: danger: dereference of NULL ‘dynamic_dpb’
# 2018|            decode_flags |= RDECODE_FLAGS_DPB_RESIZE_MASK;
# 2019|   
# 2020|->       dynamic_dpb->dpbArraySize = decoder->param.max_num_ref;
# 2021|         dynamic_dpb->dpbLumaPitch = cmd->ref_surfaces[0].planes[0].surf->u.gfx9.surf_pitch;
# 2022|         dynamic_dpb->dpbLumaAlignedHeight = cmd->ref_surfaces[0].planes[0].surf->u.gfx9.surf_height;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def28]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2054:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dynamic_dpb_t2’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2012:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2015:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2015:14: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2028:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2028:14: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2028:14: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2031:28: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2048:10: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2048:10: branch_true: following ‘true’ branch (when ‘cur’ is NULL)...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2049:10: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2054:7: danger: dereference of NULL ‘dynamic_dpb_t2’
# 2052|         decode->db_swizzle_mode = cur->planes[0].surf->u.gfx9.swizzle_mode;
# 2053|   
# 2054|->       dynamic_dpb_t2->dpbArraySize = ref_id_size;
# 2055|         dynamic_dpb_t2->dpbCurrLo = cur->planes[0].va;
# 2056|         dynamic_dpb_t2->dpbCurrHi = cur->planes[0].va >> 32;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def29]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2107:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drm’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2013:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2105:27: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2107:7: danger: dereference of NULL ‘drm’
# 2105|         DECRYPT_PARAMETERS *decrypt = cmd->protected_content.key;
# 2106|   
# 2107|->       drm->drm_cntl = 1 << DRM_CNTL_BYPASS_SHIFT;
# 2108|         if (decrypt->u.s.cbc || decrypt->u.s.ctr) {
# 2109|            uint32_t drm_cmd = 0;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def30]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2133:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drm’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2013:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2129:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2129:14: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2130:33: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2133:7: danger: dereference of NULL ‘drm’
# 2131|         uint32_t drm_cmd = 0;
# 2132|   
# 2133|->       memcpy(drm->drm_wrapped_key, secure_buf->key_blob.wrapped_key, 16);
# 2134|         memcpy(drm->drm_key, secure_buf->key_blob.wrapped_key_iv, 16);
# 2135|         memcpy(drm->drm_counter, secure_buf->desc.iv, 16);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def31]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2148:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘drm_keyblob’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1826:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1827:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1831:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1836:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1842:42: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1845:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1847:39: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1851:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1857:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1869:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1884:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1891:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1898:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1908:26: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1922:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1925:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1958:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:1965:12: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2013:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2097:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:8: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2104:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2129:14: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2129:14: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2130:33: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2148:7: danger: dereference of NULL ‘drm_keyblob’
# 2146|         drm->drm_cmd = drm_cmd;
# 2147|   
# 2148|->       memcpy(drm_keyblob->contentKey, secure_buf->key_blob.local_policy.wrapped_key, 16);
# 2149|         memcpy(drm_keyblob->signature, secure_buf->key_blob.local_policy.signature, 16);
# 2150|         memcpy(&drm_keyblob->policyIndex, secure_buf->key_blob.local_policy.native_policy.enabled_policy_index, 4);

Error: GCC_ANALYZER_WARNING (CWE-401): [#def32]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2386:11: warning[-Wanalyzer-malloc-leak]: leak of ‘dec’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2291:1: enter_function: entry to ‘ac_vcn_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2293:33: acquire_memory: allocated here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2294:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2297:23: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2375:29: call_function: calling ‘get_session_size’ from ‘ac_vcn_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2375:29: return_function: returning to ‘ac_vcn_create_video_decoder’ from ‘get_session_size’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2376:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2378:30: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2378:30: call_function: calling ‘get_embedded_size’ from ‘ac_vcn_create_video_decoder’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2378:30: return_function: returning to ‘ac_vcn_create_video_decoder’ from ‘get_embedded_size’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2381:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2383:4: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2386:11: danger: ‘dec’ leaks here; was allocated at [(2)](sarif:/runs/0/results/8/codeFlows/0/threadFlows/0/locations/1)
# 2384|      dec->base.build_decode_cmd = vcn_build_decode_cmd;
# 2385|   
# 2386|->    return &dec->base;
# 2387|   }
# 2388|   

Error: GCC_ANALYZER_WARNING (CWE-401): [#def33]
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2819:11: warning[-Wanalyzer-malloc-leak]: leak of ‘dec’
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2730:38: acquire_memory: allocated here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2731:7: branch_false: following ‘false’ branch (when ‘dec’ is non-NULL)...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2734:21: branch_false: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2745:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2746:7: branch_true: ...to here
mesa-26.1.1/src/amd/common/ac_vcn_dec.c:2819:11: danger: ‘dec’ leaks here; was allocated at [(1)](sarif:/runs/0/results/9/codeFlows/0/threadFlows/0/locations/0)
# 2817|      dec->base.build_decode_cmd = vcn_jpeg_build_decode_cmd;
# 2818|   
# 2819|->    return &dec->base;
# 2820|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def34]
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:151:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:196:1: enter_function: entry to ‘ac_nir_opt_flip_if_for_mem_loads’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘ac_nir_opt_flip_if_for_mem_loads’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: return_function: returning to ‘ac_nir_opt_flip_if_for_mem_loads’ from ‘nir_foreach_function_with_impl_first’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:200:19: call_function: calling ‘opt_flip_if_for_mem_loads_impl’ from ‘ac_nir_opt_flip_if_for_mem_loads’
#  149|            continue;
#  150|   
#  151|->       uint32_t then_first = nir_if_first_then_block(nif)->index;
#  152|         uint32_t then_last = nir_if_last_then_block(nif)->index;
#  153|         uint32_t else_first = nir_if_first_else_block(nif)->index;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def35]
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:153:16: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:196:1: enter_function: entry to ‘ac_nir_opt_flip_if_for_mem_loads’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘ac_nir_opt_flip_if_for_mem_loads’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: return_function: returning to ‘ac_nir_opt_flip_if_for_mem_loads’ from ‘nir_foreach_function_with_impl_first’
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:199:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/common/nir/ac_nir_opt_flip_if_for_mem_loads.c:200:19: call_function: calling ‘opt_flip_if_for_mem_loads_impl’ from ‘ac_nir_opt_flip_if_for_mem_loads’
#  151|         uint32_t then_first = nir_if_first_then_block(nif)->index;
#  152|         uint32_t then_last = nir_if_last_then_block(nif)->index;
#  153|->       uint32_t else_first = nir_if_first_else_block(nif)->index;
#  154|         uint32_t else_last = nir_if_last_else_block(nif)->index;
#  155|   

Error: COMPILER_WARNING (CWE-563): [#def36]
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_copy.c: scope_hint: In function ‘radv_CmdCopyMemoryToImageIndirectKHR’
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_copy.c:930:37: warning[-Wunused-variable]: unused variable ‘format_layout’
#  930 |       const enum util_format_layout format_layout = radv_format_description(dst_image->vk.format)->layout;
#      |                                     ^~~~~~~~~~~~~
#  928|                                                               VK_ACCESS_TRANSFER_READ_BIT, 0, dst_image, NULL);
#  929|   
#  930|->       const enum util_format_layout format_layout = radv_format_description(dst_image->vk.format)->layout;
#  931|         assert(format_layout == UTIL_FORMAT_LAYOUT_ETC);
#  932|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def37]
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:293:55: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘dst_iview’
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:245:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:249:4: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:276:7: branch_true: following ‘true’ branch (when ‘has_ds_resolve != 0’)...
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:277:40: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:287:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:290:43: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:291:43: branch_false: following ‘false’ branch (when ‘d_res_iview’ is NULL)...
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:291:43: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/meta/radv_meta_resolve.c:293:55: danger: dereference of NULL ‘dst_iview’
#  291|         struct radv_image_view *dst_iview = d_res_iview ? d_res_iview : s_res_iview;
#  292|   
#  293|->       const enum radv_resolve_method resolve_method = radv_get_resolve_method(src_iview->image, dst_iview->image);
#  294|   
#  295|         VkImageResolve2 region = {

Error: COMPILER_WARNING: [#def38]
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c: scope_hint: In function ‘get_sampler_desc’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:248:9: warning[-Wunused-but-set-variable=]: variable ‘indirect’ set but not used
#  248 |    bool indirect = false;
#      |         ^~~~~~~~
#  246|      nir_def *desc_ptr = NULL;
#  247|      uint32_t offset = 0;
#  248|->    bool indirect = false;
#  249|      uint32_t plane_offset;
#  250|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def39]
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:266:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:679:1: enter_function: entry to ‘radv_nir_lower_descriptors’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:699:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘radv_nir_lower_descriptors’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:699:4: return_function: returning to ‘radv_nir_lower_descriptors’ from ‘nir_foreach_function_with_impl_first’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:699:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:707:7: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:708:10: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:708:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:708:10: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:709:16: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:710:33: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_lower_descriptors.c:710:33: call_function: calling ‘lower_descriptors_tex’ from ‘radv_nir_lower_descriptors’
#  264|         }
#  265|   
#  266|->       while (deref->deref_type != nir_deref_type_var) {
#  267|            assert(deref->deref_type == nir_deref_type_array);
#  268|            unsigned array_size = MAX2(glsl_get_aoa_size(deref->type), 1);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def40]
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:463:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:458:1: enter_function: entry to ‘radv_nir_lower_rt_abi_monolithic’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:462:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘radv_nir_lower_rt_abi_monolithic’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:462:30: return_function: returning to ‘radv_nir_lower_rt_abi_monolithic’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/amd/vulkan/nir/radv_nir_rt_stage_monolithic.c:463:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(shader)’
#  461|      const bool uses_descriptor_heap = pipeline->base.base.create_flags & VK_PIPELINE_CREATE_2_DESCRIPTOR_HEAP_BIT_EXT;
#  462|      nir_function_impl *impl = nir_shader_get_entrypoint(shader);
#  463|->    radv_nir_init_rt_function_params(impl->function, MESA_SHADER_RAYGEN, 0, 0, uses_descriptor_heap);
#  464|   
#  465|      nir_builder b = nir_builder_at(nir_before_impl(impl));

Error: GCC_ANALYZER_WARNING (CWE-476): [#def41]
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:131:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:98:1: enter_function: entry to ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:103:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:106:30: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:108:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:111:28: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:118:21: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:124:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:125:29: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:128:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:131:11: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:131:7: danger: ‘args + (long unsigned int)i * 8’ could be NULL: unchecked value from [(21)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/20)
#  129|            arg = nir_b2i32(b, arg);
#  130|   
#  131|->       args[i] = arg;
#  132|   
#  133|         uint32_t arg_size = arg->bit_size == 1 ? 32 : arg->bit_size / 8;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def42]
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘strides’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:98:1: enter_function: entry to ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:103:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:106:30: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:108:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:111:28: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:119:24: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:124:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:125:29: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:128:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:129:16: call_function: inlined call to ‘nir_b2i32’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:133:27: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:133:27: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:136:10: branch_true: following ‘true’ branch (when ‘divergent != 0’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:23: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:23: call_function: inlined call to ‘nir_imul_imm’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:23: call_function: inlined call to ‘nir_imul_imm’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:137:10: danger: ‘strides + (long unsigned int)i * 8’ could be NULL: unchecked value from [(21)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/20)
#  135|   
#  136|         if (divergent) {
#  137|->          strides[i] = nir_imul_imm(b, active_invocation_count, arg_size);
#  138|            format.divergence_mask |= BITFIELD_BIT(i);
#  139|         } else {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def43]
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘strides’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:98:1: enter_function: entry to ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:103:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:106:30: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:108:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:111:28: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:116:20: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:119:24: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:121:22: call_function: inlined call to ‘nir_imm_true’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:124:25: branch_true: following ‘true’ branch (when ‘i < argc’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:125:29: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:136:10: branch_false: following ‘false’ branch (when ‘divergent == 0’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:17: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:23: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:23: call_function: inlined call to ‘nir_imm_int’ from ‘radv_build_printf_args’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:140:10: danger: ‘strides + (long unsigned int)i * 8’ could be NULL: unchecked value from [(21)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/20)
#  138|            format.divergence_mask |= BITFIELD_BIT(i);
#  139|         } else {
#  140|->          strides[i] = nir_imm_int(b, arg_size);
#  141|         }
#  142|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def44]
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:241:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fields’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:200:1: enter_function: entry to ‘radv_build_printf’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:212:25: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:213:11: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:235:7: branch_true: following ‘true’ branch (when ‘num_args != 0’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:236:16: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:236:16: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:238:28: branch_true: following ‘true’ branch (when ‘num_args > i’)...
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:239:29: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:241:27: call_function: calling ‘glsl_intN_t_type’ from ‘radv_build_printf’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:241:27: return_function: returning to ‘radv_build_printf’ from ‘glsl_intN_t_type’
mesa-26.1.1/src/amd/vulkan/radv_debug_nir.c:241:10: danger: ‘fields + (long unsigned int)i * 48’ could be NULL: unchecked value from [(6)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/5)
#  239|            nir_def *arg = args[i];
#  240|   
#  241|->          fields[i].type = glsl_intN_t_type(arg->bit_size);
#  242|            fields[i].name = "";
#  243|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def45]
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:855:21: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:833:1: enter_function: entry to ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:840:7: call_function: calling ‘radv_get_shader_from_executable_index’ from ‘radv_GetPipelineExecutableStatisticsKHR’
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:840:7: return_function: returning to ‘radv_GetPipelineExecutableStatisticsKHR’ from ‘radv_get_shader_from_executable_index’
mesa-26.1.1/src/amd/vulkan/radv_pipeline.c:855:21: danger: dereference of NULL ‘radv_get_shader_from_executable_index(*pExecutableInfo.pipeline, (int)*pExecutableInfo.executableIndex, & stage)’
#  853|      stats.spillsgprs = shader->config.spilled_sgprs;
#  854|      stats.spillvgprs = shader->config.spilled_vgprs;
#  855|->    stats.codesize = shader->exec_size;
#  856|      stats.lds = align(shader->config.lds_size, ac_shader_get_lds_alloc_granularity(gfx_level));
#  857|      stats.scratch = shader->config.scratch_bytes_per_wave;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def46]
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:157:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘cs_dbg.spirv’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:324:1: enter_function: entry to ‘radv_create_compute_pipelines’
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:331:11: branch_true: following ‘true’ branch (when ‘i < count’)...
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:333:105: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_pipeline_compute.c:333:11: call_function: calling ‘radv_compute_pipeline_create’ from ‘radv_create_compute_pipelines’
#  155|      if (keep_executable_info && cs_stage->spirv.size) {
#  156|         dbg->spirv = malloc(cs_stage->spirv.size);
#  157|->       memcpy(dbg->spirv, cs_stage->spirv.data, cs_stage->spirv.size);
#  158|         dbg->spirv_size = cs_stage->spirv.size;
#  159|      }

Error: GCC_ANALYZER_WARNING (CWE-775): [#def47]
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: warning[-Wanalyzer-file-leak]: leak of FILE ‘fopen(os_get_option_secure("RADV_BVH_STATS_FILE"), "w")’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1401:1: enter_function: entry to ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1408:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1414:57: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: following ‘false’ branch (when ‘hash_entries’ is non-NULL)...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: call_function: calling ‘rra_copy_context_init’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_copy_context_init’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1437:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1440:15: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1442:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: call_function: calling ‘rra_map_accel_struct_data’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_map_accel_struct_data’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1444:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:72: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:7: call_function: calling ‘dump_bvh_stats’ from ‘radv_dump_bvh_stats’
# 1343|      if (!device->rra_trace.stats_file) {
# 1344|         device->rra_trace.stats_file = fopen(radv_bvh_stats_file(), "w");
# 1345|->       fprintf(device->rra_trace.stats_file, "app,name,type,allocated_size,compacted_size");
# 1346|         if (radv_use_bvh8(pdev)) {
# 1347|            fprintf(device->rra_trace.stats_file, ",max_depth,box_node_count,primitive_node_count,instance_node_count");

Error: GCC_ANALYZER_WARNING (CWE-401): [#def48]
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: warning[-Wanalyzer-malloc-leak]: leak of ‘fopen(os_get_option_secure("RADV_BVH_STATS_FILE"), "w")’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1401:1: enter_function: entry to ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1408:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1414:57: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: following ‘false’ branch (when ‘hash_entries’ is non-NULL)...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: call_function: calling ‘rra_copy_context_init’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_copy_context_init’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1437:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1440:15: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1442:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: call_function: calling ‘rra_map_accel_struct_data’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_map_accel_struct_data’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1444:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:72: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:7: call_function: calling ‘dump_bvh_stats’ from ‘radv_dump_bvh_stats’
# 1343|      if (!device->rra_trace.stats_file) {
# 1344|         device->rra_trace.stats_file = fopen(radv_bvh_stats_file(), "w");
# 1345|->       fprintf(device->rra_trace.stats_file, "app,name,type,allocated_size,compacted_size");
# 1346|         if (radv_use_bvh8(pdev)) {
# 1347|            fprintf(device->rra_trace.stats_file, ",max_depth,box_node_count,primitive_node_count,instance_node_count");

Error: GCC_ANALYZER_WARNING (CWE-688): [#def49]
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*device.rra_trace.stats_file’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1310:1: enter_function: entry to ‘dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1320:7: branch_false: following ‘false’ branch (when ‘is_tlas == tlas_pass’)...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1326:8: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1326:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1329:8: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1330:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1343:9: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1343:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1344:44: call_function: inlined call to ‘radv_bvh_stats_file’ from ‘dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1344:38: acquire_memory: this call could return NULL
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: danger: argument 4 (‘fopen(os_get_option_secure("RADV_BVH_STATS_FILE"), "w")’) from [(11)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/10) could be NULL where non-null expected
#argument 4 of ‘__builtin_fwrite’ must be non-null
# 1343|      if (!device->rra_trace.stats_file) {
# 1344|         device->rra_trace.stats_file = fopen(radv_bvh_stats_file(), "w");
# 1345|->       fprintf(device->rra_trace.stats_file, "app,name,type,allocated_size,compacted_size");
# 1346|         if (radv_use_bvh8(pdev)) {
# 1347|            fprintf(device->rra_trace.stats_file, ",max_depth,box_node_count,primitive_node_count,instance_node_count");

Error: GCC_ANALYZER_WARNING (CWE-688): [#def50]
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1345:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘fopen(os_get_option_secure("RADV_BVH_STATS_FILE"), "w")’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1401:1: enter_function: entry to ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1408:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1414:57: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: following ‘false’ branch (when ‘hash_entries’ is non-NULL)...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1417:7: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: call_function: calling ‘rra_copy_context_init’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1436:13: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_copy_context_init’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1437:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1440:15: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1442:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: call_function: calling ‘rra_map_accel_struct_data’ from ‘radv_dump_bvh_stats’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1443:27: return_function: returning to ‘radv_dump_bvh_stats’ from ‘rra_map_accel_struct_data’
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1444:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:72: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_rra.c:1447:7: call_function: calling ‘dump_bvh_stats’ from ‘radv_dump_bvh_stats’
#argument 4 of ‘__builtin_fwrite’ must be non-null
# 1343|      if (!device->rra_trace.stats_file) {
# 1344|         device->rra_trace.stats_file = fopen(radv_bvh_stats_file(), "w");
# 1345|->       fprintf(device->rra_trace.stats_file, "app,name,type,allocated_size,compacted_size");
# 1346|         if (radv_use_bvh8(pdev)) {
# 1347|            fprintf(device->rra_trace.stats_file, ",max_depth,box_node_count,primitive_node_count,instance_node_count");

Error: GCC_ANALYZER_WARNING (CWE-688): [#def51]
mesa-26.1.1/src/amd/vulkan/radv_shader.c:2944:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc(disasm_size + 1)’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3520:1: enter_function: entry to ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_fill_nir_compiler_options’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: call_function: calling ‘radv_shader_create_uncached’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_shader_create_uncached’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:19: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:19: call_function: calling ‘radv_parse_binary_debug_info’ from ‘radv_compile_rt_prolog’
# 2942|         dbg->ir_string = bin->llvm_ir_size ? strdup((const char *)(bin->data + bin->elf_size)) : NULL;
# 2943|         dbg->disasm_string = malloc(disasm_size + 1);
# 2944|->       memcpy(dbg->disasm_string, disasm_data, disasm_size);
# 2945|         dbg->disasm_string[disasm_size] = 0;
# 2946|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def52]
mesa-26.1.1/src/amd/vulkan/radv_shader.c:2958:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc((long unsigned int)*(struct radv_shader_binary_legacy *)binary.debug_info_size)’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3520:1: enter_function: entry to ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_fill_nir_compiler_options’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: call_function: calling ‘radv_shader_create_uncached’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_shader_create_uncached’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:19: branch_false: ...to here
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3556:19: call_function: calling ‘radv_parse_binary_debug_info’ from ‘radv_compile_rt_prolog’
# 2956|         if (bin->debug_info_size) {
# 2957|            dbg->debug_info = malloc(bin->debug_info_size);
# 2958|->          memcpy(dbg->debug_info, layout.debug_info, bin->debug_info_size);
# 2959|            dbg->debug_info_count = bin->debug_info_size / sizeof(struct ac_shader_debug_info);
# 2960|         }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def53]
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3011:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*(struct radv_shader_binary_legacy *)binary.stats_size, 1)’ where non-null expected
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3520:1: enter_function: entry to ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: call_function: calling ‘radv_fill_nir_compiler_options’ from ‘radv_compile_rt_prolog’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3529:4: return_function: returning to ‘radv_compile_rt_prolog’ from ‘radv_fill_nir_compiler_options’
mesa-26.1.1/src/amd/vulkan/radv_shader.c:3555:4: call_function: calling ‘radv_shader_create_uncached’ from ‘radv_compile_rt_prolog’
# 3009|         if (bin->stats_size) {
# 3010|            shader->dbg.statistics = calloc(bin->stats_size, 1);
# 3011|->          memcpy(shader->dbg.statistics, layout.stats, bin->stats_size);
# 3012|         }
# 3013|      }

Error: COMPILER_WARNING (CWE-563): [#def54]
mesa-26.1.1/src/amd/vulkan/radv_video.c: scope_hint: In function ‘radv_CmdControlVideoCodingKHR’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1335:8: warning[-Wunused-variable]: unused variable ‘ret’
# 1335 |    int ret = vid->dec->build_create_cmd(vid->dec, &cmd);
#      |        ^~~
# 1333|      }
# 1334|   
# 1335|->    int ret = vid->dec->build_create_cmd(vid->dec, &cmd);
# 1336|      cs->b->cdw += cmd.out.cmd_dw;
# 1337|      assert(ret == 0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def55]
mesa-26.1.1/src/amd/vulkan/radv_video.c:1357:25: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1346:1: enter_function: entry to ‘get_h264_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1351:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_h264_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1355:33: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1357:25: danger: dereference of NULL ‘<unknown>’
# 1355|      vk_video_get_h264_parameters(&vid->vk, params, frame_info, h264_pic_info, &sps, &pps);
# 1356|   
# 1357|->    cmd->bitstream_va += h264_pic_info->pSliceOffsets[0];
# 1358|   
# 1359|      avc->sps_flags.direct_8x8_inference_flag = sps->flags.direct_8x8_inference_flag;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def56]
mesa-26.1.1/src/amd/vulkan/radv_video.c:1481:36: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1436:1: enter_function: entry to ‘get_h265_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1441:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_h265_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1445:33: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1481:36: danger: dereference of NULL ‘<unknown>’
# 1479|      hevc->pps_flags.slice_segment_header_extension_present_flag = pps->flags.slice_segment_header_extension_present_flag;
# 1480|   
# 1481|->    hevc->pic_flags.irap_pic_flag = h265_pic_info->pStdPictureInfo->flags.IrapPicFlag;
# 1482|      hevc->pic_flags.idr_pic_flag = h265_pic_info->pStdPictureInfo->flags.IdrPicFlag;
# 1483|      hevc->pic_flags.is_ref_pic_flag = frame_info->pSetupReferenceSlot != NULL;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def57]
mesa-26.1.1/src/amd/vulkan/radv_video.c:1867:40: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1861:1: enter_function: entry to ‘get_vp9_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1866:7: call_function: inlined call to ‘__vk_find_struct’ from ‘get_vp9_param’
mesa-26.1.1/src/amd/vulkan/radv_video.c:1867:40: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1867:40: danger: dereference of NULL ‘<unknown>’
# 1865|      const struct VkVideoDecodeVP9PictureInfoKHR *vp9_pic_info =
# 1866|         vk_find_struct_const(frame_info->pNext, VIDEO_DECODE_VP9_PICTURE_INFO_KHR);
# 1867|->    const StdVideoDecodeVP9PictureInfo *std_pic_info = vp9_pic_info->pStdPictureInfo;
# 1868|   
# 1869|      vp9->pic_flags.error_resilient_mode = std_pic_info->flags.error_resilient_mode;

Error: GCC_ANALYZER_WARNING (CWE-121): [#def58]
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:10: warning[-Wanalyzer-out-of-bounds]: stack-based buffer overflow
mesa-26.1.1/src/amd/vulkan/radv_video.c:1987:7: branch_true: following ‘true’ branch (when ‘interleaved_planes != 0’)...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1989:16: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1990:28: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:39: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1990:28: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:39: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1990:28: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:39: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1990:28: branch_true: following ‘true’ branch...
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:39: branch_true: ...to here
mesa-26.1.1/src/amd/vulkan/radv_video.c:1991:10: danger: out-of-bounds write from byte 16 till byte 19 but ‘plane_sizes’ ends at byte 16
# 1989|         uint32_t plane_sizes[4] = {0};
# 1990|         for (uint32_t i = 1; i <= surf->num_planes; i++)
# 1991|->          plane_sizes[i] = plane_sizes[i - 1] + img->planes[i - 1].surface.u.gfx9.surf_slice_size;
# 1992|   
# 1993|         for (uint32_t i = 0; i < surf->num_planes; i++) {

Error: COMPILER_WARNING (CWE-563): [#def59]
mesa-26.1.1/src/amd/vulkan/radv_video.c: scope_hint: In function ‘radv_CmdDecodeVideoKHR’
mesa-26.1.1/src/amd/vulkan/radv_video.c:2153:8: warning[-Wunused-variable]: unused variable ‘ret’
# 2153 |    int ret = vid->dec->build_decode_cmd(vid->dec, &cmd);
#      |        ^~~
# 2151|      }
# 2152|   
# 2153|->    int ret = vid->dec->build_decode_cmd(vid->dec, &cmd);
# 2154|      cs->b->cdw += cmd.out.cmd_dw;
# 2155|      assert(ret == 0);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def60]
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:528:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3317:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3320:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
#  526|               const struct VkVideoEncodeH264PictureInfoKHR *h264_picture_info =
#  527|                  vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H264_PICTURE_INFO_KHR);
#  528|->             if (sps->seq_parameter_set_id != h264_picture_info->pStdPictureInfo->seq_parameter_set_id)
#  529|                  continue;
#  530|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def61]
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:541:50: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3317:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3320:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
#  539|               const struct VkVideoEncodeH265PictureInfoKHR *h265_picture_info =
#  540|                  vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_H265_PICTURE_INFO_KHR);
#  541|->             if (sps->sps_seq_parameter_set_id != h265_picture_info->pStdPictureInfo->pps_seq_parameter_set_id)
#  542|                  continue;
#  543|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def62]
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:555:14: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3317:1: enter_function: entry to ‘radv_CmdEncodeVideoKHR’
mesa-26.1.1/src/amd/vulkan/radv_video_enc.c:3320:4: call_function: calling ‘radv_vcn_encode_video’ from ‘radv_CmdEncodeVideoKHR’
#  553|            const struct VkVideoEncodeAV1PictureInfoKHR *av1_picture_info =
#  554|               vk_find_struct_const(enc_info->pNext, VIDEO_ENCODE_AV1_PICTURE_INFO_KHR);
#  555|->          if (av1_picture_info->pStdPictureInfo->flags.frame_size_override_flag)
#  556|               extent = enc_info->srcPictureResource.codedExtent;
#  557|         }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def63]
mesa-26.1.1/src/asahi/vulkan/hk_cmd_dispatch.c:88:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘grid.<U4500>.count[2]’
mesa-26.1.1/src/asahi/vulkan/hk_cmd_dispatch.c:154:1: enter_function: entry to ‘hk_CmdDispatchIndirect’
mesa-26.1.1/src/asahi/vulkan/hk_cmd_dispatch.c:171:4: call_function: calling ‘dispatch’ from ‘hk_CmdDispatchIndirect’
#   86|   
#   87|   static void
#   88|-> dispatch(struct hk_cmd_buffer *cmd, struct agx_grid grid)
#   89|   {
#   90|      struct hk_shader *s = hk_only_variant(cmd->state.cs.shader);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def64]
mesa-26.1.1/src/broadcom/vulkan/v3dv_cmd_buffer.h:762:11: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘job’
mesa-26.1.1/src/broadcom/vulkan/v3dv_cmd_buffer.c:1987:1: enter_function: entry to ‘v3dv_job_clone_in_cmd_buffer’
mesa-26.1.1/src/broadcom/vulkan/v3dv_cmd_buffer.c:1992:7: call_function: inlined call to ‘v3dv_flag_oom’ from ‘v3dv_job_clone_in_cmd_buffer’
#  760|      } else {
#  761|         assert(job);
#  762|->       if (job->cmd_buffer)
#  763|            job->cmd_buffer->state.oom = true;
#  764|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def65]
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:657:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘syncs’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1278:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1292:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1293:7: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1352:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: call_function: calling ‘queue_submit_noop_job’ from ‘v3dv_queue_driver_submit’
#  655|               struct v3dv_query *query = &info->pool->queries[info->first + i];
#  656|   
#  657|->             syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
#  658|               kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
#  659|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def66]
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:657:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1278:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1292:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1293:7: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1352:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: call_function: calling ‘queue_submit_noop_job’ from ‘v3dv_queue_driver_submit’
#  655|               struct v3dv_query *query = &info->pool->queries[info->first + i];
#  656|   
#  657|->             syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
#  658|               kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
#  659|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def67]
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:658:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘kperfmon_ids’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1278:1: enter_function: entry to ‘v3dv_queue_driver_submit’
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1292:20: branch_true: following ‘true’ branch (when ‘i != 5’)...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1293:7: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1352:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: branch_true: ...to here
mesa-26.1.1/src/broadcom/vulkan/v3dv_queue.c:1358:14: call_function: calling ‘queue_submit_noop_job’ from ‘v3dv_queue_driver_submit’
#  656|   
#  657|               syncs[i] = vk_sync_as_drm_syncobj(query->perf.last_job_sync)->syncobj;
#  658|->             kperfmon_ids[i] = (uintptr_t)(void *)query->perf.kperfmon_ids;
#  659|   
#  660|               if (info->flags & VK_QUERY_RESULT_WAIT_BIT) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def68]
mesa-26.1.1/src/compiler/nir/nir.h:3424:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/compiler/nir/nir_control_flow.c:49:1: enter_function: entry to ‘link_blocks’
mesa-26.1.1/src/compiler/nir/nir_control_flow.c:57:7: call_function: inlined call to ‘nir_block_add_pred’ from ‘link_blocks’
mesa-26.1.1/src/compiler/nir/nir_control_flow.c:57:7: call_function: inlined call to ‘nir_block_add_pred’ from ‘link_blocks’
# 3422|   nir_block_add_pred(nir_block *block, nir_block *pred)
# 3423|   {
# 3424|->    util_dynarray_append(&block->predecessors, pred);
# 3425|   }
# 3426|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def69]
mesa-26.1.1/src/compiler/nir/nir_builder.h:1587:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘src’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:291:1: enter_function: entry to ‘jay_process_nir’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:321:7: branch_false: following ‘false’ branch (when ‘stage != 0’)...
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:365:14: branch_false: ...to here
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:365:14: branch_true: following ‘true’ branch (when ‘stage == 4’)...
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:368:7: branch_true: ...to here
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:377:7: call_function: calling ‘nir_shader_intrinsics_pass’ from ‘jay_process_nir’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:377:7: return_function: returning to ‘jay_process_nir’ from ‘nir_shader_intrinsics_pass’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:381:7: call_function: calling ‘nir_shader_get_entrypoint’ from ‘jay_process_nir’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:381:7: return_function: returning to ‘jay_process_nir’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:381:7: call_function: calling ‘lower_fragment_outputs’ from ‘jay_process_nir’
# 1585|   {
# 1586|      assert(src->num_components <= num_components);
# 1587|->    if (src->num_components == num_components)
# 1588|         return src;
# 1589|   

Error: COMPILER_WARNING (CWE-563): [#def70]
mesa-26.1.1/src/compiler/nir/nir_lower_non_uniform_access.c: scope_hint: In function ‘nu_handle_init’
mesa-26.1.1/src/compiler/nir/nir_lower_non_uniform_access.c:75:24: warning[-Wunused-variable]: unused variable ‘parent’
#   75 |       nir_deref_instr *parent = nir_deref_instr_parent(deref);
#      |                        ^~~~~~
#   73|            return false;
#   74|   
#   75|->       nir_deref_instr *parent = nir_deref_instr_parent(deref);
#   76|         assert(parent->deref_type == nir_deref_type_var);
#   77|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def71]
mesa-26.1.1/src/compiler/nir/nir_search.c:252:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘&new_swizzle’
mesa-26.1.1/src/compiler/nir/nir_search.c:833:1: enter_function: entry to ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: return_function: returning to ‘nir_algebraic_impl’ from ‘util_dynarray_resize_bytes’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:849:27: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:877:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:878:13: call_function: inlined call to ‘nir_instr_worklist_push_tail’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:886:20: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:886:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:891:11: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:891:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: call_function: calling ‘nir_algebraic_instr’ from ‘nir_algebraic_impl’
#  250|            dst->src = instr->src[src].src;
#  251|   
#  252|->          memcpy(dst->swizzle, new_swizzle, num_components);
#  253|            memset(dst->swizzle + num_components, 0, NIR_MAX_VEC_COMPONENTS - num_components);
#  254|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def72]
mesa-26.1.1/src/compiler/nir/nir_search.c:279:48: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘new_swizzle[i]’
mesa-26.1.1/src/compiler/nir/nir_search.c:833:1: enter_function: entry to ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: return_function: returning to ‘nir_algebraic_impl’ from ‘util_dynarray_resize_bytes’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:849:27: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:877:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:878:13: call_function: inlined call to ‘nir_instr_worklist_push_tail’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:886:20: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:886:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:891:11: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:891:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: call_function: calling ‘nir_algebraic_instr’ from ‘nir_algebraic_impl’
#  277|            for (unsigned i = 0; i < num_components; ++i) {
#  278|               double val = nir_src_comp_as_float(instr->src[src].src,
#  279|->                                                new_swizzle[i]);
#  280|               if (val != const_val->data.d)
#  281|                  return false;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def73]
mesa-26.1.1/src/compiler/nir/nir_search.c:299:49: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘new_swizzle[i]’
mesa-26.1.1/src/compiler/nir/nir_search.c:833:1: enter_function: entry to ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: call_function: calling ‘util_dynarray_resize_bytes’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:9: return_function: returning to ‘nir_algebraic_impl’ from ‘util_dynarray_resize_bytes’
mesa-26.1.1/src/compiler/nir/nir_search.c:846:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:849:27: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_true: following ‘true’ branch (when ‘block’ is non-NULL)...
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:877:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:878:13: call_function: inlined call to ‘nir_instr_worklist_push_tail’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:875:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:874:4: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:886:20: call_function: inlined call to ‘nir_instr_worklist_pop_head’ from ‘nir_algebraic_impl’
mesa-26.1.1/src/compiler/nir/nir_search.c:886:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:891:11: branch_true: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:891:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: branch_false: ...to here
mesa-26.1.1/src/compiler/nir/nir_search.c:894:19: call_function: calling ‘nir_algebraic_instr’ from ‘nir_algebraic_impl’
#  297|            for (unsigned i = 0; i < num_components; ++i) {
#  298|               uint64_t val = nir_src_comp_as_uint(instr->src[src].src,
#  299|->                                                 new_swizzle[i]);
#  300|               if ((val & mask) != (const_val->data.u & mask))
#  301|                  return false;

Error: GCC_ANALYZER_WARNING (CWE-787): [#def74]
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:236:4: warning[-Wanalyzer-out-of-bounds]: buffer over-read
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:53:1: enter_function: entry to ‘vtn_handle_subgroup’
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:56:33: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_subgroup’
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:56:33: call_function: inlined call to ‘vtn_get_type’ from ‘vtn_handle_subgroup’
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:236:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:236:4: branch_true: ...to here
mesa-26.1.1/src/compiler/spirv/vtn_subgroup.c:236:4: danger: read of 4 bytes at offset ‘opcode * 4 + 17179867800’ exceeds ‘CSWTCH’
#  234|      }
#  235|   
#  236|->    case SpvOpGroupNonUniformShuffle:
#  237|      case SpvOpGroupNonUniformShuffleXor:
#  238|      case SpvOpGroupNonUniformShuffleUp:

Error: GCC_ANALYZER_WARNING (CWE-457): [#def75]
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:175:8: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*prim_info.linear’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:452:1: enter_function: entry to ‘fetch_pipeline_linear_run_elts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:477:4: call_function: calling ‘fetch_pipeline_generic’ from ‘fetch_pipeline_linear_run_elts’
#  173|            const struct draw_prim_info *prim_info)
#  174|   {
#  175|->    if (prim_info->linear)
#  176|         draw_pipeline_run_linear(fpme->draw, vert_info, prim_info);
#  177|      else

Error: GCC_ANALYZER_WARNING (CWE-457): [#def76]
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:187:8: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*prim_info.linear’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:452:1: enter_function: entry to ‘fetch_pipeline_linear_run_elts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:477:4: call_function: calling ‘fetch_pipeline_generic’ from ‘fetch_pipeline_linear_run_elts’
#  185|        const struct draw_prim_info *prim_info)
#  186|   {
#  187|->    if (prim_info->linear) {
#  188|         draw_pt_emit_linear(emit, vert_info, prim_info);
#  189|      }

Error: GCC_ANALYZER_WARNING (CWE-457): [#def77]
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:372:10: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘gs_vert_info[i].verts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:452:1: enter_function: entry to ‘fetch_pipeline_linear_run_elts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:477:4: call_function: calling ‘fetch_pipeline_generic’ from ‘fetch_pipeline_linear_run_elts’
#  370|      if ((fpme->opt & PT_SHADE) && gshader) {
#  371|         for (unsigned i = 0; i < gshader->num_vertex_streams; i++)
#  372|->          FREE(gs_vert_info[i].verts);
#  373|      } else {
#  374|         FREE(vert_info->verts);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def78]
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:374:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*vert_info.verts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:452:1: enter_function: entry to ‘fetch_pipeline_linear_run_elts’
mesa-26.1.1/src/gallium/auxiliary/draw/draw_pt_fetch_shade_pipeline.c:477:4: call_function: calling ‘fetch_pipeline_generic’ from ‘fetch_pipeline_linear_run_elts’
#  372|            FREE(gs_vert_info[i].verts);
#  373|      } else {
#  374|->       FREE(vert_info->verts);
#  375|      }
#  376|      if (free_prim_info) {

Error: GCC_ANALYZER_WARNING (CWE-688): [#def79]
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:161:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘operation.kernel.scales’ where non-null expected
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:442:1: enter_function: entry to ‘ethosu_lower_graph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:448:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:449:31: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:455:53: call_function: calling ‘ethosu_find_first_producer’ from ‘ethosu_lower_graph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:455:53: return_function: returning to ‘ethosu_lower_graph’ from ‘ethosu_find_first_producer’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:456:30: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:462:10: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:462:10: call_function: calling ‘ethosu_lower_convolution’ from ‘ethosu_lower_graph’
#  159|      if (weight->scales != NULL) {
#  160|         operation->kernel.scales = malloc(num_channels * sizeof(float));
#  161|->       memcpy(operation->kernel.scales, weight->scales, num_channels * sizeof(float));
#  162|      } else {
#  163|         operation->kernel.scales = NULL;

Error: GCC_ANALYZER_WARNING (CWE-688): [#def80]
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:168:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘operation.kernel.zero_points’ where non-null expected
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:442:1: enter_function: entry to ‘ethosu_lower_graph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:448:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:449:31: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:455:53: call_function: calling ‘ethosu_find_first_producer’ from ‘ethosu_lower_graph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:455:53: return_function: returning to ‘ethosu_lower_graph’ from ‘ethosu_find_first_producer’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:456:30: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:462:10: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_lower.c:462:10: call_function: calling ‘ethosu_lower_convolution’ from ‘ethosu_lower_graph’
#  166|      if (weight->zero_points != NULL) {
#  167|         operation->kernel.zero_points = malloc(num_channels * sizeof(int));
#  168|->       memcpy(operation->kernel.zero_points, weight->zero_points, num_channels * sizeof(int));
#  169|      } else {
#  170|         operation->kernel.zero_points = NULL;

Error: COMPILER_WARNING (CWE-563): [#def81]
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c: scope_hint: In function ‘prepare_for_submission’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:270:8: warning[-Wunused-variable]: unused variable ‘ret’
#  270 |    int ret = drmIoctl(screen->fd, DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE,
#      |        ^~~
#  268|      };
#  269|   
#  270|->    int ret = drmIoctl(screen->fd, DRM_IOCTL_ETHOSU_CMDSTREAM_BO_CREATE,
#  271|                         &cmd_bo_create);
#  272|      assert(ret == 0);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def82]
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:344:7: warning[-Wanalyzer-null-argument]: use of NULL where non-null expected
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:307:1: enter_function: entry to ‘ethosu_ml_subgraph_deserialize’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:313:7: branch_false: following ‘false’ branch (when ‘size > 31’)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:316:15: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:317:7: branch_false: following ‘false’ branch (when ‘subgraph’ is non-NULL)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:320:28: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:332:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:332:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:338:9: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:341:22: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:344:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘ethosu_ml_subgraph_deserialize’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:344:7: return_function: returning to ‘ethosu_ml_subgraph_deserialize’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:344:7: danger: argument 1 (‘util_dynarray_grow_bytes(&*subgraph.tensors, 1, 32)’) NULL where non-null expected
#  342|         tensor.offset = tdata[1];
#  343|         tensor.size = tdata[2];
#  344|->       util_dynarray_append(&subgraph->tensors, tensor);
#  345|         data += NUM_TENSOR_FIELDS * sizeof(uint32_t);
#  346|      }

Error: GCC_ANALYZER_WARNING (CWE-401): [#def83]
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:373:11: warning[-Wanalyzer-malloc-leak]: leak of ‘subgraph’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:313:7: branch_false: following ‘false’ branch (when ‘size > 31’)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:316:15: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:316:15: acquire_memory: allocated here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:317:7: branch_false: following ‘false’ branch (when ‘subgraph’ is non-NULL)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:320:28: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:332:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:332:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:338:9: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:348:31: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:350:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:355:4: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:360:7: branch_false: following ‘false’ branch (when ‘coefs_size == 0’)...
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:371:4: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_ml.c:373:11: danger: ‘subgraph’ leaks here; was allocated at [(3)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/2)
#  371|      subgraph->io_used = io_size;
#  372|   
#  373|->    return &subgraph->base;
#  374|   }
#  375|   

Error: COMPILER_WARNING (CWE-563): [#def84]
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_sched_u85.c: scope_hint: In function ‘find_depthwise_config_u85’
mesa-26.1.1/src/gallium/drivers/ethosu/ethosu_sched_u85.c:402:14: warning[-Wunused-variable]: unused variable ‘acc_elements’
#  402 |    const int acc_elements = (acc_ram_size * 8) / common.acc_bits;
#      |              ^~~~~~~~~~~~
#  400|      ofm_block_limit.depth = MIN2(ofm_shape.depth, common.ofm_block_max.depth);
#  401|   
#  402|->    const int acc_elements = (acc_ram_size * 8) / common.acc_bits;
#  403|      const int ib_elements = ifm_ram_size;
#  404|   

Error: COMPILER_WARNING (CWE-563): [#def85]
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_ethosu_encode.cpp:21: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_bit_buffer.hpp: scope_hint: In constructor ‘bitbuf_t::bitbuf_t(bitbuf_t&, int, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_bit_buffer.hpp:64:13: warning[-Wunused-variable]: unused variable ‘required’
#   64 |         int required = (_substream_end + 7 ) / 8;
#      |             ^~~~~~~~
#   62|           bitlen = (bitlen <= 0) ? (_limit * 8) - bitpos : bitlen; // Default to rest of buffer
#   63|           _substream_end = bitpos + bitlen;
#   64|->         int required = (_substream_end + 7 ) / 8;
#   65|           assert( required <= _limit );
#   66|           _enabled = dest._enabled;

Error: CPPCHECK_WARNING (CWE-190): [#def86]
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_bit_buffer.hpp:74: error[integerOverflow]: Signed integer overflow for expression '1<<len'.
#   72|       {
#   73|           assert( _buf == reinterpret_cast<uint32_t *>(_buffer->begin()) && "Buffer resized externally" );
#   74|->         assert( (data & ((1 << len)-1)) == data && "Data must be pre-masked" );
#   75|           assert( ((_substream_end == 0)  || (_pos + len <= _substream_end)) && "Write past end of substream section" );
#   76|           if ( len > 0 && _enabled )

Error: CPPCHECK_WARNING (CWE-758): [#def87]
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/ml_bit_buffer.hpp:74: error[shiftTooManyBits]: Shifting 32-bit value by 32 bits is undefined behaviour
#   72|       {
#   73|           assert( _buf == reinterpret_cast<uint32_t *>(_buffer->begin()) && "Buffer resized externally" );
#   74|->         assert( (data & ((1 << len)-1)) == data && "Data must be pre-masked" );
#   75|           assert( ((_substream_end == 0)  || (_pos + len <= _substream_end)) && "Write past end of substream section" );
#   76|           if ( len > 0 && _enabled )

Error: COMPILER_WARNING (CWE-563): [#def88]
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp: scope_hint: In function ‘int ml_decode_internal(raw_buffer_t<short int>&, bitbuf_t&, palette_t&, int, bool, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:77:17: warning[-Wunused-variable]: unused variable ‘ones’
#   77 |             int ones = bb.get(bits_avail);
#      |                 ^~~~
#   75|           {
#   76|               z_grc_div = ZDIV_EOS;
#   77|->             int ones = bb.get(bits_avail);
#   78|               assert( ones == (1 << bits_avail) - 1 );
#   79|           }

Error: COMPILER_WARNING (CWE-457): [#def89]
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:133:13: warning[-Wmaybe-uninitialized]: ‘palette.palette_t::palsize’ may be used uninitialized
#  133 |             if ( palette.palsize > 0 )
#      |             ^~
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp: scope_hint: In function ‘void ml_decode_ethosu_stream(ml_decode_result_t*, const uint8_t*, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:334:15: note: ‘palette.palette_t::palsize’ was declared here
#  334 |     palette_t palette;
#      |               ^~~~~~~
#  131|               w_uncompressed = 1;
#  132|               int uncompressed_bits;
#  133|->             if ( palette.palsize > 0 )
#  134|               {
#  135|                   // Uncompressed bits is given by palette size.

Error: COMPILER_WARNING (CWE-457): [#def90]
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:205:63: warning[-Wmaybe-uninitialized]: ‘w_grc_div’ may be used uninitialized
#  205 |                 int max_symbols = w_uncompressed && w_grc_div > 5 ? 8 : 12;
#      |                                                     ~~~~~~~~~~^~~
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp: scope_hint: In function ‘void ml_decode_ethosu_stream(ml_decode_result_t*, const uint8_t*, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:57:9: note: ‘w_grc_div’ was declared here
#   57 |     int w_grc_div;
#      |         ^~~~~~~~~
#  203|               {
#  204|                   w_unary1_len = 0;
#  205|->                 int max_symbols = w_uncompressed && w_grc_div > 5 ? 8 : 12;
#  206|                   if ( w_unary0 != 0 )
#  207|                   {

Error: COMPILER_WARNING (CWE-457): [#def91]
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:292:21: warning[-Wmaybe-uninitialized]: ‘palette.palette_t::direct_offset’ may be used uninitialized
#  292 |                 val = w_value[i] - palette.palsize + palette.direct_offset;
#      |                 ~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp: scope_hint: In function ‘void ml_decode_ethosu_stream(ml_decode_result_t*, const uint8_t*, int)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_decode.cpp:334:15: note: ‘palette.palette_t::direct_offset’ was declared here
#  334 |     palette_t palette;
#      |               ^~~~~~~
#  290|               else
#  291|               {
#  292|->                 val = w_value[i] - palette.palsize + palette.direct_offset;
#  293|               }
#  294|               int sign = val & 1;

Error: COMPILER_WARNING: [#def92]
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_encode.cpp: scope_hint: In function ‘void update_palette(mle_context_t*, palette_t*, const int16_t*, int, bool, bool, bool)’
mesa-26.1.1/src/gallium/drivers/ethosu/mlw_codec/source/mlw_encode.cpp:224:9: warning[-Wunused-but-set-variable=]: variable ‘common_val’ set but not used
#  224 |     int common_val = 0;
#      |         ^~~~~~~~~~
#  222|       }
#  223|   
#  224|->     int common_val = 0;
#  225|       int common_freq = 0;
#  226|       for ( int i = 0; i < 512; i++ )

Error: GCC_ANALYZER_WARNING (CWE-476): [#def93]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:763:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:752:7: branch_false: following ‘false’ branch (when ‘nn_core_count != 0’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:757:15: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:757:15: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml.c:763:4: danger: ‘subgraph’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/2)
#  761|   
#  762|      subgraph->base.device = pdevice;
#  763|->    subgraph->screen = screen;
#  764|      subgraph->operations = UTIL_DYNARRAY_INIT;
#  765|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def94]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:257:27: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>[w][h][ic]’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: return_function: returning to ‘etna_ml_lower_convolution’ from ‘pointwise_to_2x2’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:612:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:17: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: call_function: calling ‘reorder_for_hw_depthwise’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: return_function: returning to ‘etna_ml_lower_convolution’ from ‘reorder_for_hw_depthwise’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:626:12: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:629:39: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:637:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:643:7: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:643:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:648:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:651:7: call_function: calling ‘requantize_weights’ from ‘etna_ml_lower_convolution’
#  255|                     map_out[oc][w][h][ic] = requantized + operation->weight_zero_point - 0x80;
#  256|                  } else {
#  257|->                   uint8_t val = map_in[oc][w][h][ic];
#  258|                     double dequantized = weight_tensor->scales[oc] * (val - weight_tensor->zero_points[oc]);
#  259|                     uint8_t requantized = round(dequantized / operation->weight_scale);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def95]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:307:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘map_out’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
#  305|         uint8_t *map_out = output + channel * 2 * 2 * operation->input_channels;
#  306|   
#  307|->       map_out[0] = map_in[0];
#  308|         if (operation->weight_signed) {
#  309|            map_out[1] = operation->weight_zero_point - 128;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def96]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:344:13: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘output’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: return_function: returning to ‘etna_ml_lower_convolution’ from ‘pointwise_to_2x2’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:612:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: following ‘true’ branch (when ‘nn_core_version <= 7’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:614:14: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:615:16: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:617:13: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:617:13: call_function: calling ‘expand_depthwise’ from ‘etna_ml_lower_convolution’
#  342|         for (unsigned i = 0; i < operation->weight_width * operation->weight_height * operation->input_channels; i++) {
#  343|            if (i % operation->input_channels == in_depth)
#  344|->             map_out[i] = map_in[i];
#  345|            else if (operation->weight_signed)
#  346|               map_out[i] = operation->weight_zero_point - 128;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def97]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:368:61: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘input’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: return_function: returning to ‘etna_ml_lower_convolution’ from ‘pointwise_to_2x2’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:612:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_false: following ‘false’ branch (when ‘nn_core_version > 7’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:18: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:17: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: call_function: calling ‘reorder_for_hw_depthwise’ from ‘etna_ml_lower_convolution’
#  366|         unsigned out_channel = i % operation->output_channels;
#  367|   
#  368|->       output[out_channel][i / operation->output_channels] = input[i];
#  369|      }
#  370|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def98]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:368:61: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:551:1: enter_function: entry to ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:609:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: call_function: calling ‘pointwise_to_2x2’ from ‘etna_ml_lower_convolution’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:610:7: return_function: returning to ‘etna_ml_lower_convolution’ from ‘pointwise_to_2x2’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:612:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:613:10: branch_false: following ‘false’ branch (when ‘nn_core_version > 7’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:18: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:619:17: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:620:10: call_function: calling ‘reorder_for_hw_depthwise’ from ‘etna_ml_lower_convolution’
#  366|         unsigned out_channel = i % operation->output_channels;
#  367|   
#  368|->       output[out_channel][i / operation->output_channels] = input[i];
#  369|      }
#  370|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def99]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:592:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*operation.weight_tensor’ where non-null expected
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:591:31: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:592:4: danger: argument 1 (‘malloc((long unsigned int)weight_size)’) from [(1)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#  590|                             poperation->conv.weight_tensor->dims[3];
#  591|      operation->weight_tensor = malloc(weight_size);
#  592|->    memcpy(operation->weight_tensor, poperation->conv.weight_tensor->data, weight_size);
#  593|      operation->weight_tensor_size = weight_size;
#  594|      operation->weight_width = poperation->conv.weight_tensor->dims[1];

Error: GCC_ANALYZER_WARNING (CWE-688): [#def100]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:606:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*operation.bias_tensor’ where non-null expected
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:605:29: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:606:4: danger: argument 1 (‘malloc((long unsigned int)bias_size)’) from [(1)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#  604|                           sizeof(int32_t);
#  605|      operation->bias_tensor = malloc(bias_size);
#  606|->    memcpy(operation->bias_tensor, poperation->conv.bias_tensor->data, bias_size);
#  607|      operation->bias_tensor_size = bias_size;
#  608|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def101]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:747:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*operation.weight_tensor’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:737:31: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:747:4: danger: ‘calloc(1, 8)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/7/codeFlows/0/threadFlows/0/locations/0)
#  745|   
#  746|      uint8_t *weight_map = operation->weight_tensor;
#  747|->    weight_map[0] = compute_weight_add(poperation->input_tensors[1]->scale, poperation->input_tensors[0]->scale, operation->weight_scale);
#  748|   
#  749|      operation->bias_tensor = calloc(1, 4);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def102]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:752:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*operation.bias_tensor’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:749:29: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:752:4: danger: ‘calloc(1, 4)’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/8/codeFlows/0/threadFlows/0/locations/0)
#  750|      operation->bias_tensor_size = 4;
#  751|      int32_t *bias_map = (int32_t *)operation->bias_tensor;
#  752|->    bias_map[0] = compute_bias_add(poperation->input_tensors[1]->scale, poperation->input_tensors[0]->scale,
#  753|                                     poperation->input_tensors[1]->zero_point, poperation->input_tensors[0]->zero_point,
#  754|                                     operation->weight_scale);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def103]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:856:10: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*operation.weight_tensor’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:848:31: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:854:24: branch_true: following ‘true’ branch (when ‘i < kernel_size’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:855:16: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:855:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:856:20: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:856:10: danger: ‘calloc(1, (long unsigned int)kernel_size) + (sizetype)i’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/10/codeFlows/0/threadFlows/0/locations/0)
#  854|      for(unsigned i = 0; i < kernel_size; i++) {
#  855|         if (i % (operation->weight_width * operation->weight_height * operation->input_channels + 1) == 0)
#  856|->          weight_map[i] = first_weight;
#  857|         else if (i % (operation->weight_width * operation->weight_height * operation->input_channels + 1) == operation->output_channels)
#  858|            weight_map[i] = second_weight;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def104]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:877:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*operation.bias_tensor’
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:854:24: branch_false: following ‘false’ branch (when ‘i >= kernel_size’)...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:863:43: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:863:29: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:876:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:877:15: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:877:7: danger: ‘calloc(1, (long unsigned int)(*operation.output_channels * 4)) + (long unsigned int)oc * 4’ could be NULL: unchecked value from [(3)](sarif:/runs/0/results/11/codeFlows/0/threadFlows/0/locations/2)
#  875|      int bias = zero_point_diff * round(bias_scale);
#  876|      for(unsigned oc = 0; oc < operation->output_channels; oc++)
#  877|->       bias_map[oc] = bias;
#  878|   }
#  879|   

Error: GCC_ANALYZER_WARNING (CWE-688): [#def105]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:934:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*operation.weight_tensor’ where non-null expected
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:933:31: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:934:4: danger: argument 1 (‘malloc((long unsigned int)fc_weight_size)’) from [(1)](sarif:/runs/0/results/12/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#  932|                                 poperation->conv.weight_tensor->dims[3];
#  933|      operation->weight_tensor = malloc(fc_weight_size);
#  934|->    memcpy(operation->weight_tensor, poperation->conv.weight_tensor->data, fc_weight_size);
#  935|      operation->weight_tensor_size = fc_weight_size;
#  936|      operation->weight_width = poperation->conv.weight_tensor->dims[3];

Error: GCC_ANALYZER_WARNING (CWE-688): [#def106]
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:948:4: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*operation.bias_tensor’ where non-null expected
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:947:29: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/etnaviv/etnaviv_ml_nn.c:948:4: danger: argument 1 (‘malloc((long unsigned int)fc_bias_size)’) from [(1)](sarif:/runs/0/results/13/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#  946|                              sizeof(int32_t);
#  947|      operation->bias_tensor = malloc(fc_bias_size);
#  948|->    memcpy(operation->bias_tensor, poperation->conv.bias_tensor->data, fc_bias_size);
#  949|      operation->bias_tensor_size = fc_bias_size;
#  950|   }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def107]
mesa-26.1.1/src/gallium/drivers/freedreno/ir3/ir3_gallium.c:334:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘hwcso’
mesa-26.1.1/src/gallium/drivers/freedreno/ir3/ir3_gallium.c:299:37: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/freedreno/ir3/ir3_gallium.c:334:4: danger: ‘hwcso’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  332|       */
#  333|   
#  334|->    hwcso->shader =
#  335|         ir3_shader_from_nir(compiler, nir, &(struct ir3_shader_options){
#  336|                                 /* TODO: force to single on a6xx with legacy

Error: GCC_ANALYZER_WARNING (CWE-476): [#def108]
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4000:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:3998:37: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4000:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0)
# 3998|      struct panfrost_rasterizer *so = CALLOC_STRUCT(panfrost_rasterizer);
# 3999|   
# 4000|->    so->base = *cso;
# 4001|   
# 4002|   #if PAN_ARCH <= 7

Error: GCC_ANALYZER_WARNING (CWE-476): [#def109]
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4073:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4070:39: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4073:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
# 4071|      UNUSED struct panfrost_device *dev = pan_device(pctx->screen);
# 4072|   
# 4073|->    so->num_elements = num_elements;
# 4074|      memcpy(so->pipe, elements, sizeof(*elements) * num_elements);
# 4075|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def110]
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4171:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4170:36: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4171:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/0)
# 4169|   
# 4170|      struct panfrost_zsa_state *so = CALLOC_STRUCT(panfrost_zsa_state);
# 4171|->    so->base = *zsa;
# 4172|   
# 4173|      const struct pipe_stencil_state front = zsa->stencil[0];

Error: GCC_ANALYZER_WARNING (CWE-476): [#def111]
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4300:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘so’
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4299:38: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/panfrost/pan_cmdstream.c:4300:4: danger: ‘so’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
# 4298|   
# 4299|      struct panfrost_blend_state *so = CALLOC_STRUCT(panfrost_blend_state);
# 4300|->    so->base = *blend;
# 4301|   
# 4302|      so->pan.logicop_enable = blend->logicop_enable;

Error: COMPILER_WARNING: [#def112]
mesa-26.1.1/src/gallium/drivers/r300/r300_emit.c: scope_hint: In function ‘r300_emit_query_start’
mesa-26.1.1/src/gallium/drivers/r300/r300_emit.c:678:14: warning[-Wunused-but-set-variable=]: variable ‘dwords’ set but not used
#  678 |     unsigned dwords = 4;
#      |              ^~~~~~
#  676|       struct r300_surface *surf = NULL;
#  677|       bool use_dummy_z = false;
#  678|->     unsigned dwords = 4;
#  679|       CS_LOCALS(r300);
#  680|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def113]
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:93:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:630:6: enter_function: entry to ‘si_log_draw_state’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:632:7: branch_false: following ‘false’ branch (when ‘log’ is non-NULL)...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:635:4: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:638:4: call_function: calling ‘si_dump_gfx_shader’ from ‘si_log_draw_state’
#   91|   
#   92|      struct si_log_chunk_shader *chunk = CALLOC_STRUCT(si_log_chunk_shader);
#   93|->    chunk->ctx = ctx;
#   94|      chunk->shader = current;
#   95|      si_shader_selector_reference(ctx, &chunk->sel, current->selector);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def114]
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:107:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:106:40: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:107:4: danger: ‘chunk’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0)
#  105|   
#  106|      struct si_log_chunk_shader *chunk = CALLOC_STRUCT(si_log_chunk_shader);
#  107|->    chunk->ctx = ctx;
#  108|      chunk->shader = &program->shader;
#  109|      si_compute_reference(&chunk->program, program);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def115]
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:363:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘chunk’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:438:13: enter_function: entry to ‘si_dump_compute_descriptors’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_debug_gfx_compute.c:445:4: call_function: calling ‘si_dump_descriptors’ from ‘si_dump_compute_descriptors’
#  361|      struct si_log_chunk_desc_list *chunk =
#  362|         CALLOC_VARIANT_LENGTH_STRUCT(si_log_chunk_desc_list, 4 * (size_t)element_dw_size * num_elements);
#  363|->    chunk->shader_name = shader_name;
#  364|      chunk->elem_name = elem_name;
#  365|      chunk->element_dw_size = element_dw_size;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def116]
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:505:13: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘transfer’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:442:6: enter_function: entry to ‘si_handle_sqtt’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:445:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:479:28: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:488:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:490:11: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:490:11: call_function: calling ‘si_get_sqtt_trace’ from ‘si_handle_sqtt’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:490:11: return_function: returning to ‘si_handle_sqtt’ from ‘si_get_sqtt_trace’
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:488:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:495:14: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:495:13: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:498:14: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:504:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:505:13: branch_true: ...to here
mesa-26.1.1/src/gallium/drivers/radeonsi/si_sqtt.c:505:13: danger: use of uninitialized value ‘transfer’ here
#  503|   
#  504|            if (sctx->spm.ptr) {
#  505|->             pipe_buffer_unmap(&sctx->b, transfer);
#  506|               sctx->spm.ptr = NULL;
#  507|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def117]
mesa-26.1.1/src/gallium/drivers/rocket/rkt_ml.c:316:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘subgraph’
mesa-26.1.1/src/gallium/drivers/rocket/rkt_ml.c:314:15: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/drivers/rocket/rkt_ml.c:316:4: danger: ‘subgraph’ could be NULL: unchecked value from [(1)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/0)
#  314|      subgraph = calloc(1, sizeof(*subgraph));
#  315|      subgraph->base.device = pdevice;
#  316|->    subgraph->context = dev->context;
#  317|   
#  318|      tensor_count = count_tensors(poperations, count);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def118]
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5656:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5640:1: enter_function: entry to ‘lower_vri_to_var_instr’
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5648:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5648:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5650:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5652:31: call_function: inlined call to ‘nir_src_as_intrinsic’ from ‘lower_vri_to_var_instr’
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5653:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5653:7: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5655:31: call_function: inlined call to ‘nir_src_as_intrinsic’ from ‘lower_vri_to_var_instr’
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5656:8: branch_false: ...to here
mesa-26.1.1/src/gallium/drivers/zink/nir_to_spirv/nir_to_spirv.c:5656:8: danger: dereference of NULL ‘<unknown>’
# 5654|         return false;
# 5655|      nir_intrinsic_instr *vri = nir_src_as_intrinsic(lvd->src[0]);
# 5656|->    if (vri->intrinsic != nir_intrinsic_vulkan_resource_index)
# 5657|         return false;
# 5658|   

Error: COMPILER_WARNING: [#def119]
mesa-26.1.1/src/util/u_math.h:48: included_from: Included from here.
mesa-26.1.1/src/util/box.h:4: included_from: Included from here.
mesa-26.1.1/src/gallium/include/pipe/p_state.h:52: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/zink/zink_types.h:37: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/zink/zink_program.h:27: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/zink/zink_program.c:24: included_from: Included from here.
mesa-26.1.1/src/gallium/drivers/zink/zink_program.c: scope_hint: In function ‘zink_link_gfx_shader’
mesa-26.1.1/src/gallium/drivers/zink/zink_program.c:2549:18: warning[-Wunused-but-set-variable=]: variable ‘i’ set but not used
# 2549 |    u_foreach_bit(i, shader_stages)
#      |                  ^
mesa-26.1.1/src/util/bitscan.h:110:37: note: in definition of macro ‘u_foreach_bit’
#  110 |    for (uint32_t __dword = (dword), b;                     \
#      |                                     ^
# 2547|      }
# 2548|      struct zink_gfx_program *prog = gfx_program_create(ctx, zshaders, 3, hash, is_mesh);
# 2549|->    u_foreach_bit(i, shader_stages)
# 2550|         assert(prog->shaders[i]);
# 2551|      _mesa_hash_table_insert_pre_hashed(ht, hash, prog->shaders, prog);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def120]
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:398:19: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘a_comps[i]’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:782:1: enter_function: entry to ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:786:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:789:38: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:791:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: return_function: returning to ‘lvp_nir_lower_cooperative_matrix’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘lower_impl’ from ‘lvp_nir_lower_cooperative_matrix’
#  396|            ref = nir_imm_zero(b, 1, glsl_base_type_bit_size(c_desc.element_type));
#  397|   
#  398|->          nir_def *a_i = a_comps[i];
#  399|            nir_def *b_j = b_comps[j]; /* B is stored transposed */
#  400|            nir_def *val;

Error: GCC_ANALYZER_WARNING (CWE-457): [#def121]
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:431:16: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘c_comps[i]’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:782:1: enter_function: entry to ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:786:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:789:38: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:791:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: return_function: returning to ‘lvp_nir_lower_cooperative_matrix’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘lower_impl’ from ‘lvp_nir_lower_cooperative_matrix’
#  429|   
#  430|         if (glsl_base_type_is_integer(c_desc.element_type)) {
#  431|->          ref = nir_iadd(b, ref, c_comps[i]);
#  432|         } else {
#  433|            ref = nir_fadd(b, ref, c_comps[i]);

Error: GCC_ANALYZER_WARNING (CWE-457): [#def122]
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:433:16: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘c_comps[i]’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:782:1: enter_function: entry to ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:786:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:789:38: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:791:4: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘nir_shader_get_entrypoint’ from ‘lvp_nir_lower_cooperative_matrix’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: return_function: returning to ‘lvp_nir_lower_cooperative_matrix’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:801:16: call_function: calling ‘lower_impl’ from ‘lvp_nir_lower_cooperative_matrix’
#  431|            ref = nir_iadd(b, ref, c_comps[i]);
#  432|         } else {
#  433|->          ref = nir_fadd(b, ref, c_comps[i]);
#  434|         }
#  435|         d_comps[i] = ref;

Error: COMPILER_WARNING (CWE-563): [#def123]
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_reduce_finish_call’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:457:33: warning[-Wunused-variable]: unused variable ‘src_desc’
#  457 |    struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src0_deref->type);
#      |                                 ^~~~~~~~
#  455|      nir_deref_instr *dst_deref = nir_src_as_deref(call->params[0]);
#  456|      nir_deref_instr *src0_deref = nir_src_as_deref(call->params[1]);
#  457|->    struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src0_deref->type);
#  458|      nir_function *fnptr = call->callee;
#  459|      nir_cmat_reduce reduce = nir_cmat_call_reduce_flags(call);

Error: COMPILER_WARNING (CWE-563): [#def124]
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_reduce_call’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:506:33: warning[-Wunused-variable]: unused variable ‘src_desc’
#  506 |    struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src_deref->type);
#      |                                 ^~~~~~~~
#  504|      nir_deref_instr *dst_deref = nir_src_as_deref(call->params[0]);
#  505|      nir_deref_instr *src_deref = nir_src_as_deref(call->params[1]);
#  506|->    struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src_deref->type);
#  507|      nir_cmat_reduce reduce = nir_cmat_call_reduce_flags(call);
#  508|      nir_def *src = load_cmat_src(b, call->params[1]);

Error: COMPILER_WARNING (CWE-563): [#def125]
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_reduce_2x2_call’
mesa-26.1.1/src/gallium/frontends/lavapipe/nir/lvp_nir_lower_cooperative_matrix.c:565:33: warning[-Wunused-variable]: unused variable ‘src_desc’
#  565 |    struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src_deref->type);
#      |                                 ^~~~~~~~
#  563|      nir_deref_instr *dst_deref = nir_src_as_deref(call->params[0]);
#  564|      nir_deref_instr *src_deref = nir_src_as_deref(call->params[1]);
#  565|->    struct glsl_cmat_description src_desc = *glsl_get_cmat_description(src_deref->type);
#  566|      nir_function *fnptr = call->callee;
#  567|      nir_def *lane_id = nir_load_subgroup_invocation(b);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def126]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:82:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.input_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
#   80|      operation->input_tensors = calloc(operation->input_count, sizeof(void *));
#   81|      for (unsigned i = 0; i < node->inputs->size; i++)
#   82|->       operation->input_tensors[i] = &tensors[node->inputs->data[i]];
#   83|   
#   84|      operation->output_count = node->outputs->size;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def127]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:87:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.output_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
#   85|      operation->output_tensors = calloc(operation->output_count, sizeof(void *));
#   86|      for (unsigned i = 0; i < node->outputs->size; i++)
#   87|->       operation->output_tensors[i] = &tensors[node->outputs->data[i]];
#   88|   
#   89|      switch (node_registration->builtin_code) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def128]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:111:33: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.input_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
#  109|            operation->conv.stride_y = params->stride_height;
#  110|            if (params->padding == kTfLitePaddingSame) {
#  111|->             struct pipe_tensor *in = operation->input_tensors[0];
#  112|               struct pipe_tensor *wt = &tensors[node->inputs->data[1]];
#  113|               calc_same_padding(in->dims[1], wt->dims[1], params->stride_height,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def129]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:143:33: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.input_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
#  141|            operation->conv.stride_y = params->stride_height;
#  142|            if (params->padding == kTfLitePaddingSame) {
#  143|->             struct pipe_tensor *in = operation->input_tensors[0];
#  144|               struct pipe_tensor *wt = &tensors[node->inputs->data[1]];
#  145|               calc_same_padding(in->dims[1], wt->dims[1], params->stride_height,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def130]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:177:30: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘operation.input_tensors’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:826:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: call_function: calling ‘teflon_debug’ from ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:827:4: return_function: returning to ‘PrepareDelegate’ from ‘teflon_debug’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:833:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:834:11: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:837:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:840:19: call_function: calling ‘check_op_support’ from ‘PrepareDelegate’
#  175|         operation->pooling.stride_y = params->stride_height;
#  176|         if (params->padding == kTfLitePaddingSame) {
#  177|->          struct pipe_tensor *in = operation->input_tensors[0];
#  178|            calc_same_padding(in->dims[1], params->filter_height, params->stride_height,
#  179|                              1, &operation->pooling.padding_top, &operation->pooling.padding_bottom);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def131]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:366:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tensor’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
#  364|      if (tf_tensor.data.data) {
#  365|         unsigned size = tensor_data_size(tf_tensor);
#  366|->       tensor->data = malloc(size);
#  367|         memcpy(tensor->data, tf_tensor.data.data, size);
#  368|      }

Error: GCC_ANALYZER_WARNING (CWE-688): [#def132]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:367:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘malloc((long unsigned int)tensor_data_size(*<unknown>))’ where non-null expected
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
#  365|         unsigned size = tensor_data_size(tf_tensor);
#  366|         tensor->data = malloc(size);
#  367|->       memcpy(tensor->data, tf_tensor.data.data, size);
#  368|      }
#  369|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def133]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:370:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘tensor’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: acquire_memory: this call could return NULL
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
#  368|      }
#  369|   
#  370|->    tensor->type_size = tf_format_to_size(tf_tensor.type);
#  371|      tensor->index = index;
#  372|      for (int out_dim = 0; out_dim < 4; out_dim++) {

Error: GCC_ANALYZER_WARNING (CWE-688): [#def134]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:388:10: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_69].scale.size, 4)’ where non-null expected
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
#  386|         if (quant->scale->size > 1 && !all_scales_equal(quant)) {
#  387|            tensor->scales = calloc(quant->scale->size, sizeof(*tensor->scales));
#  388|->          memcpy(tensor->scales, quant->scale->data, quant->scale->size * sizeof(*tensor->scales));
#  389|   
#  390|            tensor->zero_points = calloc(quant->scale->size, sizeof(*tensor->zero_points));

Error: GCC_ANALYZER_WARNING (CWE-688): [#def135]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:393:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_69].scale.size, 4)’ where non-null expected
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
#  391|            if (quant->zero_point->size == quant->scale->size) {
#  392|               /* Same number of zero_points as scales - copy directly */
#  393|->             memcpy(tensor->zero_points, quant->zero_point->data, quant->scale->size * sizeof(*tensor->zero_points));
#  394|            } else if (quant->zero_point->size == 1) {
#  395|               /* Single zero_point for all channels (common for symmetric quantization) - replicate it */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def136]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:397:16: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘calloc((long unsigned int)*MEM[(const struct TfLiteAffineQuantization *)tf_tensor$quantization$params_69].scale.size, 4)’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
#  395|               /* Single zero_point for all channels (common for symmetric quantization) - replicate it */
#  396|               for (int i = 0; i < quant->scale->size; i++) {
#  397|->                tensor->zero_points[i] = quant->zero_point->data[0];
#  398|               }
#  399|            } else {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def137]
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:404:16: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘*tensor.zero_points + (long unsigned int)i * 4’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:813:1: enter_function: entry to ‘PrepareDelegate’
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:818:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:820:24: branch_false: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:822:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: branch_true: ...to here
mesa-26.1.1/src/gallium/frontends/teflon/tfl_device.c:823:7: call_function: calling ‘fill_tensor’ from ‘PrepareDelegate’
#  402|                       index, quant->scale->size, quant->zero_point->size);
#  403|               for (int i = 0; i < quant->scale->size; i++) {
#  404|->                tensor->zero_points[i] = quant->zero_point->data[0];
#  405|               }
#  406|            }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def138]
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:138:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:68:10: enter_function: entry to ‘pvr_rogue_CreateImageView’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:85:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:88:12: call_function: inlined call to ‘pvr_image_view_get_image’ from ‘pvr_rogue_CreateImageView’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:127:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:132:4: branch_false: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:134:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:136:10: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:136:10: call_function: inlined call to ‘__vk_find_struct’ from ‘pvr_rogue_CreateImageView’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:138:7: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_image.c:138:7: danger: dereference of NULL ‘<unknown>’
#  136|            vk_find_struct_const(pCreateInfo->pNext,
#  137|                                 SAMPLER_YCBCR_CONVERSION_INFO);
#  138|->       VK_FROM_HANDLE(vk_ycbcr_conversion, conversion, pConversion->conversion);
#  139|         assert(conversion);
#  140|   

Error: GCC_ANALYZER_WARNING (CWE-457): [#def139]
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:2870:14: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*mrt_attachment_map[i]’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3388:10: enter_function: entry to ‘pvr_rogue_CreateGraphicsPipelines’
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3400:25: branch_true: following ‘true’ branch (when ‘i < createInfoCount’)...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3406:50: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3407:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3409:10: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3400:25: branch_true: following ‘true’ branch (when ‘i < createInfoCount’)...
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3406:50: branch_true: ...to here
mesa-26.1.1/src/imagination/vulkan/pvr_arch_pipeline.c:3402:10: call_function: calling ‘pvr_graphics_pipeline_create’ from ‘pvr_rogue_CreateGraphicsPipelines’
# 2868|   
# 2869|         for (uint32_t i = 0; i < rp->color_attachment_count; i++) {
# 2870|->          if (mrt_attachment_map[i] != VK_ATTACHMENT_UNUSED) {
# 2871|               memcpy(&mrt_setup.mrt_resources[i],
# 2872|                      &mrt_setup_tmp.mrt_resources[mrt_attachment_map[i]],

Error: GCC_ANALYZER_WARNING (CWE-457): [#def140]
mesa-26.1.1/src/intel/common/mi_builder.h:458:1: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘((int64_t *)((char *)&value + offsetof(struct mi_value, <U6dc0>)))[1]’
mesa-26.1.1/src/intel/vulkan_hasvk/genX_query.c:1282:6: enter_function: entry to ‘gfx7_CmdWriteTimestamp2’
mesa-26.1.1/src/intel/vulkan_hasvk/genX_query.c:1297:7: branch_true: following ‘true’ branch (when ‘stage == 1’)...
mesa-26.1.1/src/intel/vulkan_hasvk/genX_query.c:1298:7: call_function: inlined call to ‘anv_address_add’ from ‘gfx7_CmdWriteTimestamp2’
mesa-26.1.1/src/intel/vulkan_hasvk/genX_query.c:1298:7: call_function: inlined call to ‘mi_store’ from ‘gfx7_CmdWriteTimestamp2’
#  456|   
#  457|   static inline struct mi_value
#  458|-> mi_value_half(struct mi_value value, bool top_32_bits)
#  459|   {
#  460|      switch (value.type) {

Error: COMPILER_WARNING (CWE-563): [#def141]
mesa-26.1.1/src/intel/compiler/brw/brw_compile_tcs.cpp: scope_hint: In function ‘bool run_tcs(brw_shader&)’
mesa-26.1.1/src/intel/compiler/brw/brw_compile_tcs.cpp:94:30: warning[-Wunused-variable]: unused variable ‘vue_prog_data’
#   94 |    struct brw_vue_prog_data *vue_prog_data = brw_vue_prog_data(s.prog_data);
#      |                              ^~~~~~~~~~~~~
#   92|      assert(s.stage == MESA_SHADER_TESS_CTRL);
#   93|   
#   94|->    struct brw_vue_prog_data *vue_prog_data = brw_vue_prog_data(s.prog_data);
#   95|   
#   96|      assert(vue_prog_data->dispatch_mode == INTEL_DISPATCH_MODE_TCS_SINGLE_PATCH ||

Error: COMPILER_WARNING (CWE-563): [#def142]
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_offset(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp:2081:35: warning[-Wunused-variable]: unused variable ‘fs_prog_data’
# 2081 |    const struct brw_fs_prog_data *fs_prog_data =
#      |                                   ^~~~~~~~~~~~
# 2079|   
# 2080|      const brw_fs_thread_payload &payload = shader->fs_payload();
# 2081|->    const struct brw_fs_prog_data *fs_prog_data =
# 2082|         brw_fs_prog_data(shader->prog_data);
# 2083|   

Error: COMPILER_WARNING (CWE-563): [#def143]
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘void emit_pixel_interpolater_alu_at_sample(const brw_builder&, const brw_reg&, const brw_reg&, glsl_interp_mode)’
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp:2216:35: warning[-Wunused-variable]: unused variable ‘fs_prog_data’
# 2216 |    const struct brw_fs_prog_data *fs_prog_data =
#      |                                   ^~~~~~~~~~~~
# 2214|   {
# 2215|      const brw_fs_thread_payload &payload = bld.shader->fs_payload();
# 2216|->    const struct brw_fs_prog_data *fs_prog_data =
# 2217|         brw_fs_prog_data(bld.shader->prog_data);
# 2218|      const brw_builder ubld = bld.exec_all().group(16, 0);

Error: COMPILER_WARNING (CWE-563): [#def144]
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp: scope_hint: In function ‘brw_reg brw_per_primitive_reg(const brw_builder&, int, unsigned int)’
mesa-26.1.1/src/intel/compiler/brw/brw_from_nir.cpp:3699:35: warning[-Wunused-variable]: unused variable ‘prog_data’
# 3699 |    const struct brw_fs_prog_data *prog_data = brw_fs_prog_data(s.prog_data);
#      |                                   ^~~~~~~~~
# 3697|             location == VARYING_SLOT_PRIMITIVE_ID);
# 3698|   
# 3699|->    const struct brw_fs_prog_data *prog_data = brw_fs_prog_data(s.prog_data);
# 3700|   
# 3701|      comp += (s.fs.per_primitive_offsets[location] % 16) / 4;

Error: COMPILER_WARNING (CWE-563): [#def145]
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_cooperative_matrix.c: scope_hint: In function ‘lower_cmat_per_element_op’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_cooperative_matrix.c:595:22: warning[-Wunused-variable]: unused variable ‘src_info’
#  595 |    const slice_info *src_info = get_slice_info(state, src_slice);
#      |                      ^~~~~~~~
#  593|      nir_deref_instr *src_slice = nir_src_as_deref(call->params[3]);
#  594|      const slice_info *dst_info = get_slice_info(state, dst_slice);
#  595|->    const slice_info *src_info = get_slice_info(state, src_slice);
#  596|      assert(cmat_descriptions_are_equal(dst_info->desc, src_info->desc));
#  597|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def146]
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:157:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘any_hit_impl’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:131:1: enter_function: entry to ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:139:7: branch_false: following ‘false’ branch (when ‘any_hit’ is NULL)...
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:146:30: branch_false: ...to here
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:146:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:146:30: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:148:24: call_function: inlined call to ‘nir_before_impl’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:151:22: call_function: calling ‘brw_nir_rt_mem_hit_addr’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:151:22: return_function: returning to ‘brw_nir_lower_intersection_shader’ from ‘brw_nir_rt_mem_hit_addr’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:154:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:154:4: call_function: inlined call to ‘nir_imm_false’ from ‘brw_nir_lower_intersection_shader’
mesa-26.1.1/src/intel/compiler/brw/brw_nir_lower_intersection_shader.c:157:4: danger: dereference of NULL ‘nir_shader_get_entrypoint(intersection)’
#  155|   
#  156|      assert(nir_block_num_preds(impl->end_block) == 1);
#  157|->    nir_foreach_pred(block, impl->end_block) {
#  158|         b->cursor = nir_after_block_before_jump(block);
#  159|         nir_push_if(b, nir_load_var(b, commit));

Error: GCC_ANALYZER_WARNING (CWE-457): [#def147]
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:113:7: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*end_preds[i]’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:91:1: enter_function: entry to ‘intel_nir_apply_tcs_quads_workaround’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:95:30: call_function: calling ‘nir_shader_get_entrypoint’ from ‘intel_nir_apply_tcs_quads_workaround’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:95:30: return_function: returning to ‘intel_nir_apply_tcs_quads_workaround’ from ‘nir_shader_get_entrypoint’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:108:4: call_function: inlined call to ‘_nir_pred_iter_end’ from ‘intel_nir_apply_tcs_quads_workaround’
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:112:16: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:113:7: branch_true: ...to here
mesa-26.1.1/src/intel/compiler/intel_nir_tcs_workarounds.c:113:7: danger: use of uninitialized value ‘*end_preds[i]’ here
#  111|   
#  112|      for (i = 0; i < num_end_preds; i++) {
#  113|->       emit_quads_workaround(&b, end_preds[i]);
#  114|      }
#  115|   

Error: COMPILER_WARNING (CWE-563): [#def148]
mesa-26.1.1/src/intel/compiler/jay/jay_from_nir.c: scope_hint: In function ‘jay_emit_intrinsic’
mesa-26.1.1/src/intel/compiler/jay/jay_from_nir.c:1097:18: warning[-Wunused-variable]: unused variable ‘f’
# 1097 |    jay_function *f = nj->f;
#      |                  ^
# 1095|   {
# 1096|      jay_shader *s = nj->s;
# 1097|->    jay_function *f = nj->f;
# 1098|      jay_builder *b = &nj->bld;
# 1099|      jay_cs_payload *cs =

Error: COMPILER_WARNING (CWE-563): [#def149]
mesa-26.1.1/src/intel/compiler/jay/jay_from_nir.c: scope_hint: In function ‘jay_emit_if’
mesa-26.1.1/src/intel/compiler/jay/jay_from_nir.c:2122:15: warning[-Wunused-variable]: unused variable ‘else_first_2’
# 2122 |    jay_block *else_first_2 = jay_emit_cf_list(nj, &nif->else_list);
#      |               ^~~~~~~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c23-extensions’ may have been intended to silence earlier diagnostics
# 2120|      nj->after_block = else_first;
# 2121|   
# 2122|->    jay_block *else_first_2 = jay_emit_cf_list(nj, &nif->else_list);
# 2123|      jay_block *else_last = nj->current_block;
# 2124|      assert(else_first == else_first_2);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def150]
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:360:13: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘access’ where non-null expected
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:353:27: acquire_memory: this call could return NULL
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:355:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:356:11: branch_true: ...to here
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:359:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:360:13: branch_true: ...to here
mesa-26.1.1/src/intel/compiler/jay/jay_lower_scoreboard.c:360:13: danger: argument 1 (‘access’) from [(1)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#  358|         } else {
#  359|            jay_foreach_block(func, block) {
#  360|->             memset(access, 0, sizeof(*access) * nr_keys);
#  361|               lower_send_local(func, block);
#  362|               lower_regdist_local(func, block, access);

Error: COMPILER_WARNING (CWE-563): [#def151]
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c: scope_hint: In function ‘collect_fragment_output’
mesa-26.1.1/src/intel/compiler/jay/jay_nir.c:136:13: warning[-Wunused-variable]: unused variable ‘wrmask’
#  136 |    unsigned wrmask = nir_intrinsic_write_mask(intr);
#      |             ^~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c23-extensions’ may have been intended to silence earlier diagnostics
#  134|         return false;
#  135|   
#  136|->    unsigned wrmask = nir_intrinsic_write_mask(intr);
#  137|      assert(nir_intrinsic_component(intr) == 0 && "component should be lowered");
#  138|      assert(util_is_power_of_two_nonzero(wrmask + 1) &&

Error: GCC_ANALYZER_WARNING (CWE-476): [#def152]
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:361:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:357:1: enter_function: entry to ‘add_copy’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:361:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘add_copy’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:361:7: return_function: returning to ‘add_copy’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:361:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(copies, 1, 4)’
#  359|      if (dst != src) {
#  360|         assert(r_file(dst) == r_file(src));
#  361|->       util_dynarray_append(copies, ((struct jay_parallel_copy) { dst, src }));
#  362|      }
#  363|   }

Error: COMPILER_WARNING (CWE-563): [#def153]
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c: scope_hint: In function ‘build_partition’
mesa-26.1.1/src/intel/compiler/jay/jay_register_allocate.c:1393:19: warning[-Wunused-variable]: unused variable ‘max_vec’
# 1393 |          unsigned max_vec = 8;
#      |                   ^~~~~~~
cc1: note: unrecognized command-line option ‘-Wno-c23-extensions’ may have been intended to silence earlier diagnostics
# 1391|         /* GPR partition blocks must be vector size aligned to avoid crossing */
# 1392|         if (file == GPR && i != (n - 1)) {
# 1393|->          unsigned max_vec = 8;
# 1394|            assert(util_is_aligned(blocks[i], max_vec * jay_grf_per_gpr(shader)));
# 1395|         }

Error: COMPILER_WARNING (CWE-563): [#def154]
mesa-26.1.1/src/intel/compiler/jay/jay_spill.c: scope_hint: In function ‘remat_to’
mesa-26.1.1/src/intel/compiler/jay/jay_spill.c:187:14: warning[-Wunused-variable]: unused variable ‘I’
#  187 |    jay_inst *I = ctx->defs[node];
#      |              ^
cc1: note: unrecognized command-line option ‘-Wno-c23-extensions’ may have been intended to silence earlier diagnostics
#  185|   remat_to(jay_builder *b, jay_def dst, struct spill_ctx *ctx, unsigned node)
#  186|   {
#  187|->    jay_inst *I = ctx->defs[node];
#  188|      assert(can_remat(I));
#  189|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def155]
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:385:4: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘bbo’
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:603:1: enter_function: entry to ‘anv_cmd_buffer_chain_generation_batch’
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:611:25: release_memory: ‘new_bbo’ is NULL
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:622:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:625:37: branch_false: ...to here
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:626:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:627:7: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:627:7: release_memory: ‘new_bbo’ is NULL
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:627:7: call_function: calling ‘anv_batch_bo_destroy’ from ‘anv_cmd_buffer_chain_generation_batch’
#  383|   {
#  384|      anv_reloc_list_finish(&bbo->relocs);
#  385|->    ANV_ADDR_BINDING_REPORT_BO_UNBIND(cmd_buffer->device, &cmd_buffer->vk.base,
#  386|                                        bbo->bo);
#  387|      ANV_DMR_BO_FREE(&cmd_buffer->vk.base, bbo->bo);

Error: GCC_ANALYZER_WARNING (CWE-126): [#def156]
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:385:4: warning[-Wanalyzer-out-of-bounds]: stack-based buffer over-read
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:1146:1: enter_function: entry to ‘anv_cmd_buffer_add_secondary’
mesa-26.1.1/src/intel/vulkan/anv_batch_chain.c:1176:25: call_function: calling ‘anv_batch_bo_list_clone’ from ‘anv_cmd_buffer_add_secondary’
#  383|   {
#  384|      anv_reloc_list_finish(&bbo->relocs);
#  385|->    ANV_ADDR_BINDING_REPORT_BO_UNBIND(cmd_buffer->device, &cmd_buffer->vk.base,
#  386|                                        bbo->bo);
#  387|      ANV_DMR_BO_FREE(&cmd_buffer->vk.base, bbo->bo);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def157]
mesa-26.1.1/src/intel/vulkan/anv_device.c:2174:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2169:1: enter_function: entry to ‘get_effective_time_domain’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2173:10: call_function: inlined call to ‘__vk_find_struct’ from ‘get_effective_time_domain’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2174:58: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_device.c:2174:58: danger: dereference of NULL ‘<unknown>’
# 2172|         const VkSwapchainCalibratedTimestampInfoEXT *swap =
# 2173|            vk_find_struct_const(timestamp->pNext, SWAPCHAIN_CALIBRATED_TIMESTAMP_INFO_EXT);
# 2174|->       return wsi_common_get_time_domain(swap->swapchain, swap->presentStage, swap->timeDomainId);
# 2175|      } else {
# 2176|         return timestamp->timeDomain;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def158]
mesa-26.1.1/src/intel/vulkan/anv_device.c:2304:58: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2180:10: enter_function: entry to ‘anv_GetCalibratedTimestampsKHR’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2201:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/intel/vulkan/anv_device.c:2203:4: branch_false: ...to here
mesa-26.1.1/src/intel/vulkan/anv_device.c:2299:25: branch_true: following ‘true’ branch (when ‘i < timestampCount’)...
mesa-26.1.1/src/intel/vulkan/anv_device.c:2300:26: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_device.c:2303:16: call_function: inlined call to ‘__vk_find_struct’ from ‘anv_GetCalibratedTimestampsKHR’
mesa-26.1.1/src/intel/vulkan/anv_device.c:2304:58: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_device.c:2304:58: danger: dereference of NULL ‘<unknown>’
# 2302|            const VkSwapchainCalibratedTimestampInfoEXT *swap =
# 2303|                  vk_find_struct_const(pTimestampInfos[i].pNext, SWAPCHAIN_CALIBRATED_TIMESTAMP_INFO_EXT);
# 2304|->          if (wsi_common_get_time_domain(swap->swapchain, swap->presentStage, swap->timeDomainId) ==
# 2305|                VK_TIME_DOMAIN_DEVICE_KHR) {
# 2306|               pTimestamps[i] = (uint64_t)((double)pTimestamps[i] * 1e9 / (double)device->physical->info.timestamp_frequency);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def159]
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:271:10: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:197:1: enter_function: entry to ‘anv_nir_analyze_push_constants_ranges’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: call_function: calling ‘nir_foreach_function_with_impl_first’ from ‘anv_nir_analyze_push_constants_ranges’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: return_function: returning to ‘anv_nir_analyze_push_constants_ranges’ from ‘nir_foreach_function_with_impl_first’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:213:7: branch_false: following ‘false’ branch (when ‘block’ is NULL)...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: branch_false: ...to here
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: call_function: calling ‘nir_foreach_function_with_impl_next’ from ‘anv_nir_analyze_push_constants_ranges’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: return_function: returning to ‘anv_nir_analyze_push_constants_ranges’ from ‘nir_foreach_function_with_impl_next’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:212:4: branch_false: following ‘false’ branch...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:224:4: branch_true: following ‘true’ branch (when ‘entry’ is non-NULL)...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:225:37: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:248:13: branch_true: following ‘true’ branch (when ‘first_hole == -1’)...
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:260:13: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:260:13: call_function: calling ‘util_dynarray_grow_bytes’ from ‘anv_nir_analyze_push_constants_ranges’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:260:13: return_function: returning to ‘anv_nir_analyze_push_constants_ranges’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/intel/vulkan/anv_nir_push_constants_analysis.c:271:10: danger: dereference of NULL ‘util_dynarray_grow_bytes(&ranges, 1, 12)’
#  269|            /* first_hole is one beyond the end, so we don't need to add 1 */
#  270|            entry->range.length = first_hole - first_bit;
#  271|->          entry->benefit = 0;
#  272|   
#  273|            for (int i = 0; i < entry->range.length; i++)

Error: GCC_ANALYZER_WARNING (CWE-688): [#def160]
mesa-26.1.1/src/intel/vulkan/anv_shader.c:330:7: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘stream’ where non-null expected
mesa-26.1.1/src/intel/vulkan/anv_shader.c:280:19: acquire_memory: this call could return NULL
mesa-26.1.1/src/intel/vulkan/anv_shader.c:284:25: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-26.1.1/src/intel/vulkan/anv_shader.c:285:20: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_shader.c:284:25: branch_true: following ‘true’ branch (when ‘i != 4’)...
mesa-26.1.1/src/intel/vulkan/anv_shader.c:285:20: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_shader.c:286:7: branch_false: following ‘false’ branch (when ‘push_size == 0’)...
mesa-26.1.1/src/intel/vulkan/anv_shader.c:329:8: branch_false: ...to here
mesa-26.1.1/src/intel/vulkan/anv_shader.c:329:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/intel/vulkan/anv_shader.c:330:7: branch_true: ...to here
mesa-26.1.1/src/intel/vulkan/anv_shader.c:330:7: danger: argument 4 (‘stream’) from [(1)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/0) could be NULL where non-null expected
#argument 4 of ‘__builtin_fwrite’ must be non-null
#  328|   
#  329|      if (shader->bind_map.inline_dwords_count > 0) {
#  330|->       fprintf(stream, "Inline promoted dwords: ");
#  331|         for (unsigned i = 0; i < bind_map->inline_dwords_count; i++)
#  332|            fprintf(stream, "%hhu, ", bind_map->inline_dwords[i]);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def161]
mesa-26.1.1/src/intel/vulkan/anv_shader.c:586:4: warning[-Wanalyzer-null-argument]: use of NULL ‘code’ where non-null expected
mesa-26.1.1/src/intel/vulkan/anv_shader.c:561:1: enter_function: entry to ‘anv_shader_reloc_begin’
mesa-26.1.1/src/intel/vulkan/anv_shader.c:575:4: call_function: inlined call to ‘vk_multialloc_add_size_align’ from ‘anv_shader_reloc_begin’
mesa-26.1.1/src/intel/vulkan/anv_shader.c:578:9: call_function: inlined call to ‘vk_multialloc_zalloc2’ from ‘anv_shader_reloc_begin’
mesa-26.1.1/src/intel/vulkan/anv_shader.c:585:4: release_memory: ‘code’ is NULL
mesa-26.1.1/src/intel/vulkan/anv_shader.c:585:4: release_memory: ‘code’ is NULL
mesa-26.1.1/src/intel/vulkan/anv_shader.c:586:4: danger: argument 1 (‘code’) NULL where non-null expected
#  584|       */
#  585|      reloc->relocated_code = code;
#  586|->    memcpy(reloc->relocated_code, in_code, shader->prog_data->program_size);
#  587|   
#  588|      uint32_t rv_count = anv_shader_set_relocs(device, reloc_values, shader);

Error: COMPILER_WARNING (CWE-563): [#def162]
mesa-26.1.1/src/intel/vulkan/anv_shader.c: scope_hint: In function ‘anv_replay_rt_shader_group’
mesa-26.1.1/src/intel/vulkan/anv_shader.c:911:19: warning[-Wunused-variable]: unused variable ‘result’
#  911 |          VkResult result = anv_shader_reloc_begin(&reloc, device,
#      |                   ^~~~~~
#  909|   
#  910|            struct anv_shader_reloc reloc;
#  911|->          VkResult result = anv_shader_reloc_begin(&reloc, device,
#  912|                                                     shader->code,
#  913|                                                     shader, NULL);

Error: GCC_ANALYZER_WARNING (CWE-775): [#def163]
mesa-26.1.1/src/loader/loader.c:257:13: warning[-Wanalyzer-fd-leak]: leak of file descriptor ‘loader_open_device(device_41->nodes[2])’
mesa-26.1.1/src/loader/loader.c:230:1: enter_function: entry to ‘loader_open_render_node_platform_devices’
mesa-26.1.1/src/loader/loader.c:241:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/loader/loader.c:246:13: branch_false: ...to here
mesa-26.1.1/src/loader/loader.c:249:16: branch_true: following ‘true’ branch...
mesa-26.1.1/src/loader/loader.c:250:7: branch_true: ...to here
mesa-26.1.1/src/loader/loader.c:252:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/loader/loader.c:253:12: branch_true: ...to here
mesa-26.1.1/src/loader/loader.c:252:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/loader/loader.c:256:34: branch_true: ...to here
mesa-26.1.1/src/loader/loader.c:256:15: call_function: calling ‘loader_open_device’ from ‘loader_open_render_node_platform_devices’
mesa-26.1.1/src/loader/loader.c:256:15: return_function: returning to ‘loader_open_render_node_platform_devices’ from ‘loader_open_device’
mesa-26.1.1/src/loader/loader.c:257:13: danger: ‘loader_open_device(device_41->nodes[2])’ leaks here; was opened at [(12)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/11)
#  255|   
#  256|            fd = loader_open_device(device->nodes[DRM_NODE_RENDER]);
#  257|->          if (fd < 0)
#  258|               continue;
#  259|   

Error: COMPILER_WARNING (CWE-563): [#def164]
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c:1473:16: warning[-Wunused-variable]: unused variable ‘start_count’
# 1473 |       uint32_t start_count = nv_push_dw_count(p);
#      |                ^~~~~~~~~~~
# 1471|   
# 1472|      if (use_zcull) {
# 1473|->       uint32_t start_count = nv_push_dw_count(p);
# 1474|         struct nil_zcull zcull_info;
# 1475|         uint64_t addr_begin, addr_end;

Error: COMPILER_WARNING (CWE-563): [#def165]
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c: scope_hint: In function ‘nvk_CmdBeginRendering’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c:1583:16: warning[-Wunused-variable]: unused variable ‘end_count’
# 1583 |       uint32_t end_count = nv_push_dw_count(p);
#      |                ^~~~~~~~~
# 1581|               break;
# 1582|         }
# 1583|->       uint32_t end_count = nv_push_dw_count(p);
# 1584|         assert(end_count - start_count <= zcull_count);
# 1585|      } else {

Error: COMPILER_WARNING: [#def166]
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c: scope_hint: In function ‘nvk_mme_set_anti_alias_test_check’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_draw.c:3483:20: warning[-Wunused-but-set-variable=]: variable ‘expected’ set but not used
# 3483 |    const uint32_t* expected = NULL;
#      |                    ^~~~~~~~
# 3481|         {0x000f0002, 0x32, 0x12, 0x0f000f, 0x0f000f, 0xf000f0, 0xf000f0},
# 3482|      };
# 3483|->    const uint32_t* expected = NULL;
# 3484|      for (int i = 0; i < ARRAY_SIZE(expected_table); i++) {
# 3485|         if (expected_table[i][0] == test->params[0]) {

Error: GCC_ANALYZER_WARNING (CWE-476): [#def167]
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1273:1: enter_function: entry to ‘nvk_CmdCopyMemoryIndirectKHR’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1281:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1285:13: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1286:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1293:33: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1295:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1295:7: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1301:11: branch_true: following ‘true’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1304:16: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1305:10: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘nvk_CmdCopyMemoryIndirectKHR’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: return_function: returning to ‘nvk_CmdCopyMemoryIndirectKHR’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/nouveau/vulkan/nvk_cmd_indirect.c:1309:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct nvk_cmd_buffer *)commandBuffer.copy_memory_indirect_temps, 1, 8)’
# 1307|            return;
# 1308|         }
# 1309|->       util_dynarray_append_typed(&cmd->copy_memory_indirect_temps,
# 1310|                                    struct nvk_cmd_mem*, temp_mem);
# 1311|      }

Error: GCC_ANALYZER_WARNING (CWE-476): [#def168]
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:210:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:165:1: enter_function: entry to ‘nvkmd_nouveau_exec_ctx_exec’
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:175:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:175:7: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:178:25: branch_true: following ‘true’ branch (when ‘i < exec_count’)...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:178:25: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:180:28: branch_true: following ‘true’ branch (when ‘j < exec_count’)...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:181:20: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:181:13: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:191:11: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:191:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:192:28: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:193:13: branch_false: following ‘false’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:202:16: branch_false: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:202:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:202:10: branch_true: ...to here
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:210:7: call_function: calling ‘util_dynarray_grow_bytes’ from ‘nvkmd_nouveau_exec_ctx_exec’
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:210:7: return_function: returning to ‘nvkmd_nouveau_exec_ctx_exec’ from ‘util_dynarray_grow_bytes’
mesa-26.1.1/src/nouveau/vulkan/nvkmd/nouveau/nvkmd_nouveau_ctx.c:210:7: danger: dereference of NULL ‘util_dynarray_grow_bytes(&*(struct nvkmd_nouveau_exec_ctx *)_ctx.req_push, 1, 16)’
#  208|            .flags = flags,
#  209|         };
#  210|->       util_dynarray_append(&ctx->req_push, push);
#  211|         ctx->req.push_count++;
#  212|      }

Error: COMPILER_WARNING (CWE-563): [#def169]
mesa-26.1.1/src/panfrost/compiler/bifrost/bi_lower_mkvec_swz.c: scope_hint: In function ‘build_mkvec_v4i8_to’
mesa-26.1.1/src/panfrost/compiler/bifrost/bi_lower_mkvec_swz.c:136:12: warning[-Wunused-variable]: unused variable ‘valid_swizzle’
#  136 |       bool valid_swizzle =
#      |            ^~~~~~~~~~~~~
#  134|          bi_is_zero(src[1]) && bi_is_zero(src[3])) {
#  135|         unsigned v2u8_bytes[4] = { bytes[0], bytes[0], bytes[2], bytes[2] };
#  136|->       bool valid_swizzle =
#  137|            bi_swizzle_from_byte_channels(v2u8_bytes, &swizzle);
#  138|         assert(valid_swizzle);

Error: GCC_ANALYZER_WARNING (CWE-688): [#def170]
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:189:16: warning[-Wanalyzer-possible-null-argument]: use of possibly-NULL ‘*a.<U2320>.sparse’ where non-null expected
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:153:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:154:16: branch_true: ...to here
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:162:13: branch_false: following ‘false’ branch...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:169:13: branch_false: ...to here
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:173:10: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:181:13: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:183:16: branch_true: ...to here
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:185:45: acquire_memory: this call could return NULL
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:188:16: branch_true: following ‘true’ branch (when ‘left != 0’)...
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:189:16: branch_true: ...to here
mesa-26.1.1/src/panfrost/compiler/bifrost/nodearray.h:189:16: danger: argument 1 (‘malloc((long unsigned int)min(max >> 2, max(*a.sparse_capacity * 2, 64)) * 8)’) from [(9)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/8) could be NULL where non-null expected
#  187|   
#  188|               if (left)
#  189|->                memcpy(a->sparse, data, left * sizeof(nodearray_sparse));
#  190|            }
#  191|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def171]
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:60:24: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:19:1: enter_function: entry to ‘lower_fs_input_load’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:24:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:28:33: call_function: inlined call to ‘nir_intrinsic_io_semantics’ from ‘lower_fs_input_load’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:56:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_fs_inputs.c:60:24: danger: dereference of NULL ‘pan_varying_layout_find_slot(*(const struct lower_fs_inputs_ctx *)cb_data.varying_layout, (enum <anonymous>)sem.location)’
#   58|         slot = pan_varying_layout_find_slot(ctx->varying_layout, sem.location);
#   59|         assert(slot);
#   60|->       use_ld_var_buf = slot->offset < pan_ld_var_buf_off_size(ctx->arch);
#   61|      }
#   62|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def172]
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:89:46: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:138:1: enter_function: entry to ‘lower_vs_output_store’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:150:20: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:150:34: branch_true: ...to here
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:153:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:154:7: call_function: calling ‘build_attr_buf_write’ from ‘lower_vs_output_store’
#   87|      nir_def *addr = nir_lea_buf_pan(b, nir_imm_int(b, res), index);
#   88|      addr = nir_pack_64_2x32(b, addr);
#   89|->    addr = nir_iadd(b, addr, nir_imm_int64(b, slot->offset));
#   90|   
#   91|      /* Tag writes to gl_PointSize with a special intrinsic */

Error: GCC_ANALYZER_WARNING (CWE-476): [#def173]
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:196:60: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:181:7: branch_false: following ‘false’ branch (when ‘var’ is NULL)...
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:191:7: branch_false: ...to here
mesa-26.1.1/src/panfrost/compiler/pan_nir_lower_vs_outputs.c:196:60: danger: dereference of NULL ‘<unknown>’
#  194|             slot->location == sem.location);
#  195|   
#  196|->    const glsl_type *var_type = glsl_vector_type(base_type, slot->ncomps);
#  197|      if (is_per_view)
#  198|         var_type = glsl_array_type(var_type, PAN_MAX_MULTIVIEW_VIEW_COUNT, false);

Error: COMPILER_WARNING (CWE-563): [#def174]
mesa-26.1.1/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c: scope_hint: In function ‘panvk_v10_CmdBeginRendering’
mesa-26.1.1/src/panfrost/vulkan/csf/panvk_vX_cmd_draw.c:3002:9: warning[-Wunused-variable]: unused variable ‘resuming’
# 3002 |    bool resuming = pRenderingInfo->flags & VK_RENDERING_RESUMING_BIT;
#      |         ^~~~~~~~
# 3000|      VK_FROM_HANDLE(panvk_cmd_buffer, cmdbuf, commandBuffer);
# 3001|      ASSERTED struct panvk_cmd_graphics_state *state = &cmdbuf->state.gfx;
# 3002|->    bool resuming = pRenderingInfo->flags & VK_RENDERING_RESUMING_BIT;
# 3003|   
# 3004|      panvk_per_arch(cmd_init_render_state)(cmdbuf, pRenderingInfo);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def175]
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:338:7: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:290:1: enter_function: entry to ‘panvk_MapMemory2KHR’
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:296:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:301:23: branch_false: ...to here
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:326:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:333:8: branch_false: ...to here
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:333:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:334:53: branch_true: ...to here
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:334:53: call_function: inlined call to ‘__vk_find_struct’ from ‘panvk_MapMemory2KHR’
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:338:7: branch_true: ...to here
mesa-26.1.1/src/panfrost/vulkan/panvk_device_memory.c:338:7: danger: dereference of NULL ‘<unknown>’
#  336|         assert(placed_info != NULL);
#  337|         assert(offset == 0 && size == mem->bo->size);
#  338|->       host_addr = placed_info->pPlacedAddress;
#  339|         map_flags |= MAP_FIXED;
#  340|      }

Error: COMPILER_WARNING (CWE-563): [#def176]
mesa-26.1.1/src/panfrost/vulkan/panvk_image.c: scope_hint: In function ‘create_ms_images’
mesa-26.1.1/src/panfrost/vulkan/panvk_image.c:646:27: warning[-Wunused-variable]: unused variable ‘res’
#  646 |       struct panvk_image *res = panvk_image_from_handle(img->ms_imgs[msaa_idx]);
#      |                           ^~~
#  644|                           &img->ms_imgs[msaa_idx]);
#  645|   
#  646|->       struct panvk_image *res = panvk_image_from_handle(img->ms_imgs[msaa_idx]);
#  647|         assert(res->vk.format == img->vk.format);
#  648|         assert(res->plane_count == img->plane_count);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def177]
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:796:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘vtdev’
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:780:1: enter_function: entry to ‘vdrm_vpipe_connect’
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:784:18: call_function: calling ‘connect_sock’ from ‘vdrm_vpipe_connect’
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:784:18: return_function: returning to ‘vdrm_vpipe_connect’ from ‘connect_sock’
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:789:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:794:12: branch_false: ...to here
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:794:12: acquire_memory: this call could return NULL
mesa-26.1.1/src/virtio/vdrm/vdrm_vpipe.c:796:4: danger: ‘vtdev’ could be NULL: unchecked value from [(10)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/9)
#  794|      vtdev = calloc(1, sizeof(*vtdev));
#  795|   
#  796|->    vtdev->sock_fd = sock_fd;
#  797|      simple_mtx_init(&vtdev->lock, mtx_plain);
#  798|   

Error: GCC_ANALYZER_WARNING (CWE-476): [#def178]
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1829:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘fences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1864:1: enter_function: entry to ‘vn_WaitForFences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1870:4: call_function: calling ‘_mesa_trace_scope_begin’ from ‘vn_WaitForFences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1870:4: return_function: returning to ‘vn_WaitForFences’ from ‘_mesa_trace_scope_begin’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: acquire_memory: this call could return NULL
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1877:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1880:10: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1881:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1882:19: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1882:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’
# 1827|      uint32_t cur = 0;
# 1828|      for (uint32_t i = 0; i < *count; i++) {
# 1829|->       VkResult result = vn_get_fence_status(device, fences[i], relax_state);
# 1830|         if (result != VK_SUCCESS) {
# 1831|            if (result < 0)

Error: GCC_ANALYZER_WARNING (CWE-457): [#def179]
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1829:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1864:1: enter_function: entry to ‘vn_WaitForFences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1870:4: call_function: calling ‘_mesa_trace_scope_begin’ from ‘vn_WaitForFences’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1870:4: return_function: returning to ‘vn_WaitForFences’ from ‘_mesa_trace_scope_begin’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1875:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1876:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1877:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1880:10: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1881:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1882:19: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:1882:19: call_function: calling ‘vn_remove_signaled_fences’ from ‘vn_WaitForFences’
# 1827|      uint32_t cur = 0;
# 1828|      for (uint32_t i = 0; i < *count; i++) {
# 1829|->       VkResult result = vn_get_fence_status(device, fences[i], relax_state);
# 1830|         if (result != VK_SUCCESS) {
# 1831|            if (result < 0)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def180]
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2420:25: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘semaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2433:1: enter_function: entry to ‘vn_WaitSemaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2437:4: call_function: calling ‘_mesa_trace_scope_begin’ from ‘vn_WaitSemaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2437:4: return_function: returning to ‘vn_WaitSemaphores’ from ‘_mesa_trace_scope_begin’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2442:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2443:10: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2442:8: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2444:16: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: acquire_memory: this call could return NULL
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2446:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2446:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2447:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2448:7: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2448:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2451:10: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2452:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2453:19: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2453:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’
# 2418|      for (uint32_t i = 0; i < *count; i++) {
# 2419|         uint64_t val = 0;
# 2420|->       VkResult result = vn_get_semaphore_counter_value(device, semaphores[i],
# 2421|                                                          relax_state, &val);
# 2422|         if (result != VK_SUCCESS)

Error: GCC_ANALYZER_WARNING (CWE-457): [#def181]
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2420:25: warning[-Wanalyzer-use-of-uninitialized-value]: use of uninitialized value ‘*<unknown>’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2433:1: enter_function: entry to ‘vn_WaitSemaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2437:4: call_function: calling ‘_mesa_trace_scope_begin’ from ‘vn_WaitSemaphores’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2437:4: return_function: returning to ‘vn_WaitSemaphores’ from ‘_mesa_trace_scope_begin’
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2442:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2443:10: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2442:8: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2444:16: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2445:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2446:7: branch_true: following ‘true’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2446:7: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2447:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2448:7: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2448:7: branch_false: following ‘false’ branch...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2451:10: branch_false: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2452:14: branch_true: following ‘true’ branch (when ‘result == 1’)...
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2453:19: branch_true: ...to here
mesa-26.1.1/src/virtio/vulkan/vn_queue.c:2453:19: call_function: calling ‘vn_remove_signaled_semaphores’ from ‘vn_WaitSemaphores’
# 2418|      for (uint32_t i = 0; i < *count; i++) {
# 2419|         uint64_t val = 0;
# 2420|->       VkResult result = vn_get_semaphore_counter_value(device, semaphores[i],
# 2421|                                                          relax_state, &val);
# 2422|         if (result != VK_SUCCESS)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def182]
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:147:4: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘state’
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1185:1: enter_function: entry to ‘vk_cmd_build_acceleration_structures’
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1198:59: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1219:25: branch_true: following ‘true’ branch (when ‘i < infoCount’)...
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1219:25: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1221:28: branch_false: following ‘false’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1225:7: branch_false: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_acceleration_structure.c:1225:7: call_function: calling ‘vk_acceleration_structure_build_state_init’ from ‘vk_cmd_build_acceleration_structures’
#  145|                                              const struct vk_acceleration_structure_build_args *args)
#  146|   {
#  147|->    state->build_info = build_info;
#  148|      state->leaf_node_count = leaf_count;
#  149|      state->internal_node_count = MAX2(leaf_count, 2) - 1;

Error: GCC_ANALYZER_WARNING (CWE-476): [#def183]
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:423:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bindings’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:407:1: enter_function: entry to ‘vk_common_CmdBindVertexBuffers2EXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:418:4: branch_true: following ‘true’ branch (when ‘bindingCount > 8’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:418:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:418:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:420:25: branch_true: following ‘true’ branch (when ‘b < bindingCount’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:421:7: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:425:26: branch_true: following ‘true’ branch (when ‘pStrides’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:428:40: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:425:26: branch_true: following ‘true’ branch (when ‘pSizes’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:427:36: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:425:26: call_function: inlined call to ‘vk_strided_device_address_range’ from ‘vk_common_CmdBindVertexBuffers2EXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:429:26: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:429:26: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:423:7: danger: ‘bindings + (long unsigned int)b * 56’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/0/codeFlows/0/threadFlows/0/locations/3)
#  421|         VK_FROM_HANDLE(vk_buffer, buffer, pBuffers[b]);
#  422|   
#  423|->       bindings[b] = (VkBindVertexBuffer3InfoKHR) {
#  424|            .sType = VK_STRUCTURE_TYPE_BIND_VERTEX_BUFFER_3_INFO_KHR,
#  425|            .addressRange = vk_strided_device_address_range(

Error: GCC_ANALYZER_WARNING (CWE-476): [#def184]
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:586:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘bindings’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:571:1: enter_function: entry to ‘vk_common_CmdBindTransformFeedbackBuffersEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:581:4: branch_true: following ‘true’ branch (when ‘bindingCount > 8’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:581:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:581:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:583:25: branch_true: following ‘true’ branch (when ‘b < bindingCount’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:584:7: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:588:26: branch_true: following ‘true’ branch (when ‘pSizes’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:590:28: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:588:26: branch_true: following ‘true’ branch (when ‘pOffsets’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:589:40: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:588:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdBindTransformFeedbackBuffersEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:591:26: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:591:26: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:586:7: danger: ‘bindings + (long unsigned int)b * 40’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/1/codeFlows/0/threadFlows/0/locations/3)
#  584|         VK_FROM_HANDLE(vk_buffer, buffer, pBuffers[b]);
#  585|   
#  586|->       bindings[b] = (VkBindTransformFeedbackBuffer2InfoEXT) {
#  587|            .sType = VK_STRUCTURE_TYPE_BIND_TRANSFORM_FEEDBACK_BUFFER_2_INFO_EXT,
#  588|            .addressRange = vk_device_address_range(

Error: GCC_ANALYZER_WARNING (CWE-476): [#def185]
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:619:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffers’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:605:1: enter_function: entry to ‘vk_common_CmdBeginTransformFeedbackEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:614:4: branch_true: following ‘true’ branch (when ‘counterBufferCount > 8’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:614:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:614:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:616:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:617:7: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:621:26: branch_true: following ‘true’ branch (when ‘pCounterBufferOffsets’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:622:66: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:621:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdBeginTransformFeedbackEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:624:26: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:624:26: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:619:7: danger: ‘buffers + (long unsigned int)b * 40’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/2/codeFlows/0/threadFlows/0/locations/3)
#  617|         VK_FROM_HANDLE(vk_buffer, buffer, pCounterBuffers[b]);
#  618|   
#  619|->       buffers[b] = (VkBindTransformFeedbackBuffer2InfoEXT) {
#  620|            .sType = VK_STRUCTURE_TYPE_BIND_TRANSFORM_FEEDBACK_BUFFER_2_INFO_EXT,
#  621|            .addressRange = vk_device_address_range(

Error: GCC_ANALYZER_WARNING (CWE-476): [#def186]
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:652:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘buffers’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:638:1: enter_function: entry to ‘vk_common_CmdEndTransformFeedbackEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:647:4: branch_true: following ‘true’ branch (when ‘counterBufferCount > 8’)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:647:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:647:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:649:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:650:7: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:654:26: branch_true: following ‘true’ branch (when ‘pCounterBufferOffsets’ is non-NULL)...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:655:66: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:654:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdEndTransformFeedbackEXT’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:657:26: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:657:26: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:652:7: danger: ‘buffers + (long unsigned int)b * 40’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/3/codeFlows/0/threadFlows/0/locations/3)
#  650|         VK_FROM_HANDLE(vk_buffer, buffer, pCounterBuffers[b]);
#  651|   
#  652|->       buffers[b] = (VkBindTransformFeedbackBuffer2InfoEXT) {
#  653|            .sType = VK_STRUCTURE_TYPE_BIND_TRANSFORM_FEEDBACK_BUFFER_2_INFO_EXT,
#  654|            .addressRange = vk_device_address_range(

Error: GCC_ANALYZER_WARNING (CWE-476): [#def187]
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:806:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘regions’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:795:1: enter_function: entry to ‘vk_common_CmdCopyBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:803:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:803:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:803:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:805:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:806:14: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:807:22: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdCopyBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:812:22: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdCopyBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:806:7: danger: ‘regions + (long unsigned int)r * 64’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/4/codeFlows/0/threadFlows/0/locations/3)
#  804|   
#  805|      for (uint32_t r = 0; r < pCopyBufferInfo->regionCount; r++) {
#  806|->       regions[r] = (VkDeviceMemoryCopyKHR) {
#  807|            .srcRange = vk_device_address_range(
#  808|               src_buffer,

Error: GCC_ANALYZER_WARNING (CWE-476): [#def188]
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:845:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘regions’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:834:1: enter_function: entry to ‘vk_common_CmdCopyBufferToImage2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:841:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:841:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:841:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:844:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:845:14: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:847:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdCopyBufferToImage2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:845:7: danger: ‘regions + (long unsigned int)r * 88’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/5/codeFlows/0/threadFlows/0/locations/3)
#  843|   
#  844|      for (uint32_t r = 0; r < pCopyBufferToImageInfo->regionCount; r++) {
#  845|->       regions[r] = (VkDeviceMemoryImageCopyKHR) {
#  846|            .sType = VK_STRUCTURE_TYPE_DEVICE_MEMORY_IMAGE_COPY_KHR,
#  847|            .addressRange = vk_device_address_range(

Error: GCC_ANALYZER_WARNING (CWE-476): [#def189]
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:886:7: warning[-Wanalyzer-possible-null-dereference]: dereference of possibly-NULL ‘regions’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:875:1: enter_function: entry to ‘vk_common_CmdCopyImageToBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:882:4: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:882:4: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:882:4: acquire_memory: this call could return NULL
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:885:25: branch_true: following ‘true’ branch...
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:886:14: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:888:26: call_function: inlined call to ‘vk_device_address_range’ from ‘vk_common_CmdCopyImageToBuffer2’
mesa-26.1.1/src/vulkan/runtime/vk_command_buffer.c:886:7: danger: ‘regions + (long unsigned int)r * 88’ could be NULL: unchecked value from [(4)](sarif:/runs/0/results/6/codeFlows/0/threadFlows/0/locations/3)
#  884|   
#  885|      for (uint32_t r = 0; r < pCopyImageToBufferInfo->regionCount; r++) {
#  886|->       regions[r] = (VkDeviceMemoryImageCopyKHR) {
#  887|            .sType = VK_STRUCTURE_TYPE_DEVICE_MEMORY_IMAGE_COPY_KHR,
#  888|            .addressRange = vk_device_address_range(

Error: GCC_ANALYZER_WARNING (CWE-476): [#def190]
mesa-26.1.1/src/vulkan/runtime/vk_device.c:890:63: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘0’
mesa-26.1.1/src/vulkan/runtime/vk_device.c:873:1: enter_function: entry to ‘vk_common_GetCalibratedTimestampsKHR’
mesa-26.1.1/src/vulkan/runtime/vk_device.c:885:25: branch_true: following ‘true’ branch (when ‘i < timestampCount’)...
mesa-26.1.1/src/vulkan/runtime/vk_device.c:886:47: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_device.c:887:10: branch_true: following ‘true’ branch (when ‘domain == 1000208000’)...
mesa-26.1.1/src/vulkan/runtime/vk_device.c:889:16: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_device.c:889:16: call_function: inlined call to ‘__vk_find_struct’ from ‘vk_common_GetCalibratedTimestampsKHR’
mesa-26.1.1/src/vulkan/runtime/vk_device.c:890:63: branch_true: ...to here
mesa-26.1.1/src/vulkan/runtime/vk_device.c:890:63: danger: dereference of NULL ‘<unknown>’
#  888|            const VkSwapchainCalibratedTimestampInfoEXT *swap =
#  889|                  vk_find_struct_const(pTimestampInfos[i].pNext, SWAPCHAIN_CALIBRATED_TIMESTAMP_INFO_EXT);
#  890|->          domain = wsi_common_get_time_domain(swap->swapchain, swap->presentStage, swap->timeDomainId);
#  891|         }
#  892|         if (domain == device->calibrate_time_domain)

Error: GCC_ANALYZER_WARNING (CWE-476): [#def191]
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:517:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:1035:1: enter_function: entry to ‘vk_nir_lower_descriptor_heaps’
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:1049:7: call_function: calling ‘nir_shader_instructions_pass’ from ‘vk_nir_lower_descriptor_heaps’
#  515|   {
#  516|      nir_def *index = NULL;
#  517|->    if (deref->deref_type == nir_deref_type_array) {
#  518|         index = deref->arr.index.ssa;
#  519|         deref = nir_deref_instr_parent(deref);

Error: GCC_ANALYZER_WARNING (CWE-476): [#def192]
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:522:8: warning[-Wanalyzer-null-dereference]: dereference of NULL ‘deref’
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:1035:1: enter_function: entry to ‘vk_nir_lower_descriptor_heaps’
mesa-26.1.1/src/vulkan/runtime/vk_nir_lower_descriptor_heaps.c:1049:7: call_function: calling ‘nir_shader_instructions_pass’ from ‘vk_nir_lower_descriptor_heaps’
#  520|      }
#  521|   
#  522|->    if (deref->deref_type != nir_deref_type_var)
#  523|         return false;
#  524|   

Scan Properties