diff --git a/lib/valueflow.cpp b/lib/valueflow.cpp
index feec36dca..960572e27 100644
--- a/lib/valueflow.cpp
+++ b/lib/valueflow.cpp
@@ -2586,7 +2586,12 @@ static bool valueFlowForwardVariable(Token* const startToken,
             }
         }
 
-        else if (tok2->str() == "}" && indentlevel == varusagelevel) {
+        // TODO: Check for eFunction
+        else if (tok2->str() == "}" && indentlevel <= 0 && tok2->scope() && tok2->scope()->type == Scope::eLambda) {  
+            return true;
+        }
+
+        else if (tok2->str() == "}" && indentlevel == varusagelevel) {  
             ++number_of_if;
 
             // Set "conditional" flag for all values
diff --git a/test/testnullpointer.cpp b/test/testnullpointer.cpp
index 819031b10..4ad2cc500 100644
--- a/test/testnullpointer.cpp
+++ b/test/testnullpointer.cpp
@@ -87,6 +87,7 @@ private:
         TEST_CASE(nullpointer45);
         TEST_CASE(nullpointer46); // #9441
         TEST_CASE(nullpointer47); // #6850
+        TEST_CASE(nullpointer48); // #9196
         TEST_CASE(nullpointer_addressOf); // address of
         TEST_CASE(nullpointerSwitch); // #2626
         TEST_CASE(nullpointer_cast); // #4692
@@ -1632,6 +1633,15 @@ private:
         ASSERT_EQUALS("[test.cpp:4] -> [test.cpp:2]: (warning) Either the condition '!a' is redundant or there is possible null pointer dereference: p.\n", errout.str());
     }
 
+    void nullpointer48() {
+        check("template<class T>\n"
+              "auto f(T& x) -> decltype(x);\n"
+              "int& g(int* x) {\n"
+              "    return f(*x);\n"
+              "}\n");
+        ASSERT_EQUALS("", errout.str());
+    }
+
     void nullpointer_addressOf() { // address of
         check("void f() {\n"
               "  struct X *x = 0;\n"