// CWE-476: null pointer dereference (unchecked malloc/argv pointer).
#include <stdlib.h>
__attribute__((noinline)) int vuln(int* p) {
    return *p; // sink: deref of possibly-null p
}
int main(int argc, char** argv) {
    int* p = 0;
    if (argc > 1)
        p = (int*)argv; // attacker-controlled, may be null in tests
    return vuln(p);
}