C and C++ have no way to say a pointer might be null, and clang's nullability annotations don't check what happens inside a function. Here's how a clang fork follows control flow to catch unchecked null dereferences at compile time.