[Bug analyzer/126806] New: [analyzer] false fd-leak warning for a caller-owned struct member

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=126806

            Bug ID: 126806
           Summary: [analyzer] false fd-leak warning for a caller-owned
                    struct member
           Product: gcc
           Version: 16.1.0
            Status: UNCONFIRMED
          Keywords: diagnostic
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: hello at bjornpagen dot com
  Target Milestone: ---
              Host: aarch64-apple-darwin24
            Target: aarch64-apple-darwin24
             Build: aarch64-apple-darwin24

Created attachment 65308
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=65308&action=edit
Plain C reduced testcase

The analyzer reports a caller-owned listening socket as leaked when a function
reads it through a struct pointer and passes it to accept. The caller still
owns the socket. The accepted descriptor is closed. The analyzer should not
report a leak.

Testcase:
#include <sys/socket.h>
#include <unistd.h>

struct server {
        int listener;
};

int accept_one(struct server *s)
{
        int fd = accept(s->listener, 0, 0);
        if (fd < 0)
                return -1;
        close(fd);
        return 0;
}

Command:
gcc-16 -O2 -fanalyzer -c repro.c

Compiler output:
repro.c:12:18: warning: leak of file descriptor '*s.listener' [CWE-775]
[-Wanalyzer-fd-leak]

Expected result:
The analyzer emits no diagnostic. The function does not take ownership of
s->listener. It closes the descriptor returned by accept.

Versions tested:
GCC 16.1.0 reproduces the warning on aarch64-apple-darwin24.
The official gcc:16.1.0 container reproduces it on aarch64-linux.
GCC master commit 475e9efffaf8de781d7e17b687faf1807e104b01 reproduces it on
aarch64-linux.
The testcase compiles cleanly with -Wall -Wextra when -fanalyzer is absent.
The warning also occurs at -O0 and -O1.

Environment:
Using built-in specs.
COLLECT_GCC=g++-16
COLLECT_LTO_WRAPPER=/Users/bjorn/.gcc/versions/16.1.0/libexec/gcc/aarch64-apple-darwin24/16.1.0/lto-wrapper
Target: aarch64-apple-darwin24
Configured with: ../gcc-16.1.0/configure
--prefix=/Users/bjorn/.gcc/versions/16.1.0 --enable-languages=c,c++
--disable-nls --enable-checking=release --program-suffix=-16 --with-system-zlib
--build=aarch64-apple-darwin24
--with-sysroot=/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 16.1.0 (GCC)

PR 114677 covers an fd stored through an int pointer. PR 108648 is a larger
field report involving fd members. Neither contains this accept-based
reduction.