taintednm.c: (in function f)
taintednm.c:15:7: Attributes merged in ensures clause in states that cannot be
                     combined (t2 is untainted, s is tainted): bogus merge
   taintednm.c:1:32: s becomes tainted
taintednm.c:24:10: Stack-allocated storage t reachable from return value: t

Finished checking --- 2 code warnings, as expected

taintednm.c: (in function f)
taintednm.c:16:18: Invalid transfer from tainted t to untainted (Possibly
                      tainted storage used as untainted.): system(..., t, ...)
   taintednm.c:15:7: t becomes tainted
   taintednm.xh:23:55: s becomes untainted
taintednm.c:19:18: Invalid transfer from tainted t to untainted (Possibly
                      tainted storage used as untainted.): system(..., t, ...)
   taintednm.c:18:7: t becomes tainted
   taintednm.xh:23:55: s becomes untainted
taintednm.c:22:18: Invalid transfer from tainted t to untainted (Possibly
                      tainted storage used as untainted.): system(..., t, ...)
   taintednm.c:18:7: t becomes tainted
   taintednm.xh:23:55: s becomes untainted
taintednm.c:24:10: Stack-allocated storage t reachable from return value: t

Finished checking --- 4 code warnings, as expected