Cross compiling Kernel with all options enabled and compiler wrapper

Hello,

I am a student, and I'm working on a project with the goal to analyze 
the potential of static code analysis (or rather tools that make use of 
it that are presented in papers) to discover security vulnerabilities in 
kernels.

For this, I want to compile the NetBSD kernel with all options enabled 
so that there is as much as possible to analyze (akin to the 
allyesconfig for Linux). I was able to compile the kernel (including 
userland) on my Linux machine using build.sh, but I am still not 
completely understanding how the build process works.

Also, I need the compiler to give me an intermediate representation of 
the kernel for the tools that I want to test. This can be accomplished 
by gllvm, which means the toolchain needs to use a compiler wrapper 
instead of the freshly built clang directly. As far as I understand it, 
build.sh needs to be modified in order to use a different binary as the 
clang compiler.

I'd be glad if someone could give me a hint or two on those two things, 
and I'm happy to clarify things if something doesn't make sense.

Regards,
Nando