https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109609
--- Comment #14 from Richard Biener <rguenth at gcc dot gnu.org> --- Btw, looking at the user modref_access_analysis::get_access_for_fnspec it interprets the size as upper bound (also for 't'). Likewise for get_access_for_fnspec. Just the check_fnspec use in tree-ssa-alias.cc interprets both as exact sizes. So a "conservative" fix that's backportable would simply adjust the tree-ssa-alias.cc use to behave similarly.