https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90264
--- Comment #1 from Jeffrey A. Law <law at redhat dot com> --- It doesn't look like a false positive to me. We set *seq = 0. Assume we do not return -1 from line A. The for loop's initial test will be false because out = *seq = 0 out - *seq must also be zero and if that's <= len, then we'll *out = `\0' which dereferences a NULL pointer.