https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109950
--- Comment #4 from LIU Hao <lh_mouse at 126 dot com> --- Given the fact that GCC is already able to warn about out-of-range indexes for an array, why wouldn't it be possible to infer that `*(data + next)` is always an element of `data`? If the result of `data + next` (after array-to-pointer conversion) does not point to an element of `data` (or the past-the-end position, but that's not the case, as it's not dereferenceable), then the behavior will be undefined.