https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103483
--- Comment #16 from Andrew Macleod <amacleod at redhat dot com> --- The only thing I can think of is it is *guaranteed* to be out of range, then assume that is because those other values were handled elsewhere and don't report it? L_3 int [5, +INF] <bb 3> [local count: 354334800]: _4 = (long unsigned int) L_3; sink.0_5 = sink; __builtin_memcpy (sink.0_5, "12", _4); _4 : long unsigned int [5, 2147483647] That is different than if _4 was varying or [1, 2147483647]. of course, then you wont catch the cases where its guaranteed that we are going to copy too many bytes. But then, you don't get those if you just turn it off either.