It's an interesting system. I wonder if it's powerful enough to express the rather complicated constraints on objects of type va_list. Warnings for violations of those constraints would be valuable - there are common portability errors that could be caught - but it's never been important enough to write a custom check pass for it. If your system can handle it, we could consider (assuming it's included) providing the check file that defines them with GCC as a worked example, maybe even including it in -Wall (which would ensure that your pass got exercised and therefore didn't break through disuse).
I describe the constraints in http://gcc.gnu.org/ml/gcc-patches/2002-06/msg01293.html and can explain further if they don't make sense. (I don't swear that I have them perfectly accurate, but I'm pretty sure.) zw
