Noticed the following new warnings (errors) while compiling libc with gcc 12:

rename.c: In function 'push_dir':
rename.c:138:24: error: pointer may be used after 'realloc' [-Werror=use-after-free]
138 | pool_end += temp - dirnames_pool;
| ~~~~~^~~~~~~~~~~~~~~
rename.c:132:22: note: call to 'realloc' here
132 | temp = (char *)realloc(dirnames_pool, pool_size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
rename.c:156:25: error: pointer may be used after 'realloc' [-Werror=use-after-free]
156 | stack_top += temp - dirstack;
| ^
rename.c:149:29: note: call to 'realloc' here
149 | temp = (Stacked_Dir *)realloc(dirstack,
| ^~~~~~~~~~~~~~~~~
150 | stack_size * sizeof(Stacked_Dir));
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In function '_instr',
inlined from '_innum' at doscan.c:285:13,
inlined from '_doscan_low' at doscan.c:225:11:
doscan.c:542:9: error: pointer 'orig_ptr_517' may be used after 'realloc' [-Werror=use-after-free]
542 | free(orig_ptr);
| ^~~~~~~~~~~~~~
doscan.c:538:27: note: call to 'realloc' here
538 | *(char **)arg_ptr = realloc(orig_ptr, string_length);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In file included from nmalign.c:13:
nmalign.c: In function 'memalign':
nmalcdef.h:41:23: error: 'free' called on pointer '<unknown>' with nonzero offset 16 [-Werror=free-nonheap-object]
41 | # define nfree free
nmalign.c:144:13: note: in expansion of macro 'nfree'
144 | nfree(PTR(__nmalloc_split(&m, alignment - misalign)));
| ^~~~~
nmalign.c:144:23: note: returned from '__nmalloc_split'
144 | nfree(PTR(__nmalloc_split(&m, alignment - misalign)));
nmalcdef.h:190:36: note: in definition of macro 'PTR'
190 | #define PTR(m) (void*)((byte*)(m) + DATAOFFSET)
| ^
nmalcdef.h:42:23: error: 'realloc' called on pointer 'm' with nonzero offset 16 [-Werror=free-nonheap-object]
42 | # define nrealloc realloc
nmalign.c:145:20: note: in expansion of macro 'nrealloc'
145 | return nrealloc(PTR(m), size);
| ^~~~~~~~
nmalign.c:113:14: note: declared here
113 | memblockp m = NULL;
| ^

mcount.c: In function 'mcount':
mcount.c:80:8: error: array subscript -1 is outside array bounds of 'int[1]' [-Werror=array-bounds]
80 | to = *((&_to)-1) - 12;
| ^~~~~~~~~~~
mcount.c:56:17: note: at offset -4 into object '_to' of size 4
56 | void mcount(int _to)
| ~~~~^~~
mcount.c:81:7: error: array subscript -2 is outside array bounds of 'int[1]' [-Werror=array-bounds]
81 | ebp = *((&_to)-2); /* glean the caller's return address from the stack */
| ~~~~^~~~~~~~~~~~~
mcount.c:56:17: note: at offset -8 into object '_to' of size 4
56 | void mcount(int _to)
| ~~~~^~~

The attached patches will resolve them.

Also, I think there's a possible memory leak in doscan.c: If
'allocate_char_buffer' is set, but 'ptr' isn't, the allocation will be leaked.
Maybe that can never happen, but the logic is a bit hard to follow.