[oliverames]

lint-c has failed on main since 0b8e0dc (run 41819072419, and again at 41842097689): four file/check pairs above the baseline and one below it. This is the whole remainder after a27d684; it does not repeat the allocation fixes already on main. It keeps clang-tidy red on open PRs (#1178, #1168, #1140, #1104).

Findings and fixes (each one is a path to NULL; one is a false positive)

File	Check	Fix
dm/host/hle_jit.c	bugprone-suspicious-realloc-usage (4)	jit_serve_load grew the request table and each request's rel_at, rel_off, rel_mod with p = realloc(p, ...). A failed realloc lost the block and the next store wrote through NULL. They now go through jit_realloc, which stops with jit: no memory for the request table.
dm/host/hle_oe.c	clang-analyzer-unix.StdCLibraryFunctions	DM_PROGRAMS was sized with ftell; its -1 became a SIZE_MAX count for fread over a 0-byte calloc. A failed ftell is logged and the file read as empty.
dm/host/web_apple.m	clang-analyzer-nullability.NullablePassedToNonnull (5)	json() passed a failed serialization to initWithData: (now returns ""); the font override (@(env) is nil for non-UTF-8) reached dataWithContentsOfFile: and pathExtension as nil (now ?: @""); initWithURL: may return nil, so the scheme handler fails the task with didFailWithError: instead of passing it on; the page address went to requestWithURL: unchecked (now skipped with a [RED] log); webshot passed TIFFRepresentation unchecked (now nil means no bitmap).
dm/gfx/vk/hle_vk.m	clang-analyzer-core.NullDereference	False positive in practice: replay always sets s->sq, but its own s->sq && check at the visibility buffer tells the analyzer it may be NULL. occ_start now returns on a NULL sq, as that check does.
dm/tools/lint_c_baseline.tsv	hle_vk.m clang-analyzer-security.ArrayBound	The ratchet's "one below it": 1 finding against 2 in the baseline. Lowered with lint_c.py tidy --update, 241 to 240 findings.

No count was raised and no NOLINT was added. No documentation entry: nothing here changes what a game or tool does.

Checked locally (Apple silicon Mac, LLVM 23.1.4 from Homebrew llvm@23, the release CI pins; make-built compile database for GAME=010015100B514000 as CI uses)

• Before the change, on this base: python3 dm/tools/lint_c.py tidy on the four files reproduced the same 11 findings as CI.
• python3 dm/tools/lint_c.py tidy -j 6 over the whole project: 240 findings in 73 files, 134 file/check pairs, baseline 240 findings; 0 file/check pairs above it, 0 below it.
• python3 -m unittest dm.tools.tests.test_lint_c: 19 tests OK.
• make -C dm/host/tests GAME=010015100B514000 run: exit 0, 504 checks (includes t_oe, which compiles hle_oe.c).
• make -C dm/host GAME=010015100B514000 dmhost: builds.

Not verified

• Behaviour at the changed lines at run time: the JIT serve path with a real jit.tsv, an out-of-memory or failed ftell, the web page in a window (the Vulkan occlusion query was not run on a game either). The changes are guard clauses on paths that did not fail before.
• The hosted lint-c, tests and other jobs: see the checks below.

Front-ends: none

[oliverames]

Closing as superseded: f8a5618d takes every item of this PR onto main: hle_jit.c's realloc guards, hle_oe.c's DM_PROGRAMS size guard, hle_vk.m's submit-queue guard, the web_apple.m JSON / font-path / URL and snapshot guards, with the same one-drop of the baseline. I checked each of the four files on main against this branch's diff; nothing unique is left, and the branch no longer merges cleanly. Re-ping if a site there should be guarded differently.