Bug path

x7
‘x7’: events 1-3
6 int **md = calloc (1, 1);
^~~~~~~~~~~~~
|
(1) allocated here
7
8 return md[0][0]; /* { dg-warning "possibly-NULL" "unchecked deref" } */
~~~~~~~~
| |
| (3) ‘md’ leaks here; was allocated at (1)
(2) assuming ‘md’ is non-NULL