https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92123
--- Comment #15 from Jakub Jelinek <jakub at gcc dot gnu.org> --- I think other fn spec attributes in trans-decl.c should be checked. E.g. for internal_pack, I see ".r", when the function sometimes returns a pointer to a field pointed by the first argument. The address of the descriptor doesn't escape then, but there is indirect escape. What about internal_unpack? Both cfi_desc_to_gfc_desc and gfc_desc_to_cfi_desc should be ".w." as Richi said.