https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106441
--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> --- __analyzer_callee_test_3 (int a, int b, int (**out_fn) (int)) { int square (int z) { return z * z; } *out_fn = square; This really should be warning that the assignment of the nested function is escaping the current scope because the chain value goes out of the scope at the end.