- Vendor C++ toolchains may miss warnings that GCC or Clang catch, such as implicit narrowing conversions.
- A constant-time memcmp function had a bug where a uint8_t accumulator truncated 32-bit XOR results, comparing only every fourth byte.
- Enabling -Wconversion under GCC flagged the bug, but the vendor toolchain did not, despite the flag being set.
- Reviewers should test code with the latest GCC or Clang with maximal warnings to uncover hidden issues.