https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109266
--- Comment #2 from Jonny Grant <jg at jguk dot org> --- Thank you for your reply David. Your analyzer is very good already. I played around a bit, a base of nullptr doesn't give a warning. But changing to 0x10 does give array-bounds warning. cc1plus: note: source object is likely at address zero <source>:13:13: warning: array subscript 0 is outside array bounds of 'a_t [0]' [-Warray-bounds=] https://godbolt.org/z/PhhT48xxP Found Andrew Pinski comment says 4096 is not accessible: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106699#c1 I wondered if you know how to turn on that "cc1plus: note: source object is likely at address zero? It seems different from normal warnings. It would be fantastic if there was a way for me to specify on the gcc command line an address range I didn't want read and/or writable. That would be great to get build warnings from those addresses if the compiler could see them being accessed. At the moment, I always need to use the JTAG debugger to set some hw breakpoints on read from various addresses to catch those accesses (as they are mapped to the interrupt vector from 0x0). On Windows I've had various crashes where the access was address 0x10 so felt like that was probably a struct offset too I don't know very much about gcc internals. I did wonder if the analyzer can see the base address of the struct being passed as 0x0 in the RTL file? I tried -fdump-rtl-all but couldn't see the 0x0 address, or when I changed to 0x10 either