From 12726ff7163abc8bc1bfe2a5e34c29cda75f390a Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Fri, 5 Dec 2025 16:37:58 +0100
Subject: [PATCH 1/2] Update valueflow.cpp

---
 lib/valueflow.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index 8eb5735c986..b3bf773ecf3 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -5861,6 +5861,12 @@ static void valueFlowSubFunction(const TokenList& tokenlist,
                         continue;
                 }
 
+                if (argvar->isReference() && isVariableChanged(argvar, settings)) {
+                    argvalues.remove_if([](const ValueFlow::Value& v) {
+                        return !v.isUninitValue();
+                    });
+                }
+
                 if (argvalues.empty())
                     continue;
 

From 2129a660ca6ec25772bfcab1eee4b4b1227c3ac8 Mon Sep 17 00:00:00 2001
From: chrchr-github <78114321+chrchr-github@users.noreply.github.com>
Date: Fri, 5 Dec 2025 16:38:56 +0100
Subject: [PATCH 2/2] Update testnullpointer.cpp

---
 test/testnullpointer.cpp | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index ee971fd44a8..199bebac366 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -3020,6 +3020,21 @@ class TestNullPointer : public TestFixture {
               "    f(nullptr, nullptr);\n"
               "}\n", dinit(CheckOptions, $.inconclusive = true));
         ASSERT_EQUALS("", errout_str());
+
+        check("struct T {\n" // #14308
+              "    bool b{};\n"
+              "    T* next{};\n"
+              "};\n"
+              "bool g(const T*& r) {\n"
+              "    const T* t = r;\n"
+              "    r = t->next;\n"
+              "    return t->b;\n"
+              "}\n"
+              "void f(const T* tok) {\n"
+              "    if (g(tok)) {}\n"
+              "    if (tok) {}\n"
+              "}\n", dinit(CheckOptions, $.inconclusive = true));
+        ASSERT_EQUALS("", errout_str());
     }
 
     // Check if pointer is null and the dereference it