I don't know the code at all but this looks like a false positive? 1) `composite_get_rightmost` calls `moniker_get_tree_representation` with the composite iface directly. 2) In `moniker_get_tree_representation` then `unsafe_impl_from_IMoniker(moniker) != NULL` is always true. and so it calls: ``` moniker_get_tree_representation(comp_moniker->left, node, &node->left); moniker_get_tree_representation(comp_moniker->right, node, &node->right); ``` 3) This fills both left and right nodes (well unless `calloc` fails but lets ignore it as errors are swallowed anyway). 4) `moniker_tree_get_rightmost` then will always have a left and right node and will always return a node which is different from root? -- https://gitlab.winehq.org/wine/wine/-/merge_requests/4768#note_62045