diff --git a/cfg/gnu.cfg b/cfg/gnu.cfg
index 6c9efb5ec..9dd7e6298 100644
--- a/cfg/gnu.cfg
+++ b/cfg/gnu.cfg
@@ -13,11 +13,17 @@
     <alloc init="true">xcalloc</alloc>
     <dealloc>free</dealloc>
   </memory>
+  <!-- https://linux.die.net/man/3/backtrace -->
+  <memory>
+    <alloc init="true">backtrace_symbols</alloc>
+    <dealloc>free</dealloc>
+  </memory>
   <!-- void xexit(int status); -->
   <function name="xexit">
     <noreturn>true</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
+      <not-bool/>
     </arg>
   </function>
   <!-- void * xmalloc(size_t size); -->
@@ -25,9 +31,10 @@
     <use-retval/>
     <returnValue type="void *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:</valid>
+      <not-bool/>
     </arg>
   </function>
   <!-- char *xstrdup(const char *s); -->
@@ -35,7 +42,7 @@
     <noreturn>false</noreturn>
     <returnValue type="char *"/>
     <use-retval/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -46,13 +53,14 @@
     <use-retval/>
     <noreturn>false</noreturn>
     <returnValue type="void *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>1:</valid>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
+      <not-bool/>
     </arg>
   </function>
   <!-- void * xrealloc(void *block, size_t newsize); -->
@@ -63,9 +71,10 @@
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
+      <not-bool/>
     </arg>
   </function>
   <!-- http://man7.org/linux/man-pages/man3/asprintf.3.html -->
@@ -74,11 +83,11 @@
     <returnValue type="int"/>
     <use-retval/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
     </arg>
     <formatstr/>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <formatstr/>
       <not-uninit/>
     </arg>
@@ -89,11 +98,11 @@
     <returnValue type="int"/>
     <use-retval/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
     </arg>
     <formatstr/>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <formatstr/>
       <not-uninit/>
     </arg>
@@ -106,21 +115,23 @@
   <function name="accept4">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="inout">
       <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-uninit/>
+      <not-bool/>
     </arg>
     <leak-ignore/>
   </function>
+  <!-- https://www.gnu.org/software/libc/manual/html_node/Getopt-Long-Options.html#Getopt-Long-Options -->
   <!-- int getopt_long(int argc, char * const argv[],
            const char *optstring,
            const struct option *longopts, int *longindex); -->
@@ -129,23 +140,25 @@
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <use-retval/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-bool/>
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-null/>
       <strz/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-null/>
     </arg>
-    <arg nr="5"/>
+    <arg nr="5" direction="out">
+      <not-bool/>
+    </arg>
   </function>
   <!-- void *__builtin_memset(void *s, int c, size_t n); -->
   <define name="__builtin_memset" value="memset"/>
@@ -154,9 +167,10 @@
     <returnValue type="long long"/>
     <use-retval/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
+      <not-bool/>
     </arg>
   </function>
   <!-- char *strndupa(const char *s, size_t n); -->
@@ -164,13 +178,14 @@
     <returnValue type="char *"/>
     <use-retval/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>0:</valid>
+      <not-bool/>
     </arg>
   </function>
   <!-- http://man7.org/linux/man-pages/man3/strsep.3.html -->
@@ -179,12 +194,13 @@
     <use-retval/>
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-null/>
+      <not-bool/>
     </arg>
   </function>
   <!-- char *strdupa(const char *s); -->
@@ -192,9 +208,10 @@
     <use-retval/>
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
+      <not-bool/>
     </arg>
   </function>
   <!-- http://www.gnu.org/software/libc/manual/html_node/Backtraces.html -->
@@ -202,12 +219,13 @@
   <function name="backtrace">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
+      <not-bool/>
     </arg>
   </function>
   <!-- char ** backtrace_symbols (void *const *buffer, int size) -->
@@ -215,177 +233,196 @@
     <returnValue type="char **"/>
     <noreturn>false</noreturn>
     <use-retval/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
+      <not-bool/>
     </arg>
   </function>
   <!-- void backtrace_symbols_fd (void *const *buffer, int size, int fd) -->
   <function name="backtrace_symbols_fd">
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <returnValue type="void"/>
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
+      <not-bool/>
     </arg>
   </function>
   <!-- char *qecvt(long double value, int ndigit, int * decpt, int * sign); -->
-  <function name="ecvt">
+  <function name="qecvt">
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-null/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="out">
       <not-null/>
+      <not-bool/>
     </arg>
   </function>
   <!-- char *qfcvt(double value, int ndigit, int * decpt, int * sign); -->
   <function name="qfcvt">
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-null/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="out">
       <not-null/>
+      <not-bool/>
     </arg>
   </function>
   <!-- char *qgcvt(long double value, int ndigit, char *buf); -->
   <function name="qgcvt">
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-null/>
+      <not-bool/>
     </arg>
   </function>
+  <!-- https://linux.die.net/man/3/ecvt_r -->
   <!-- int ecvt_r (double value, int ndigit, int *decpt, int *neg, char *buf, size_t len); -->
   <function name="ecvt_r">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <pure/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-null/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="out">
       <not-null/>
     </arg>
-    <arg nr="5">
+    <arg nr="5" direction="out">
       <not-null/>
+      <minsize type="argvalue" arg="6"/>
     </arg>
-    <arg nr="6">
+    <arg nr="6" direction="in">
       <not-uninit/>
       <valid>0:</valid>
+      <not-bool/>
     </arg>
+    <warn severity="style" reason="Obsolescent" alternatives="sprintf"/>
   </function>
   <!-- int fcvt_r (double value, int ndigit, int *decpt, int *neg, char *buf, size_t len); -->
   <function name="fcvt_r">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <pure/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-null/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="out">
       <not-null/>
     </arg>
-    <arg nr="5">
+    <arg nr="5" direction="out">
       <not-null/>
+      <minsize type="argvalue" arg="6"/>
     </arg>
-    <arg nr="6">
+    <arg nr="6" direction="in">
       <not-uninit/>
       <valid>0:</valid>
+      <not-bool/>
     </arg>
+    <warn severity="style" reason="Obsolescent" alternatives="sprintf"/>
   </function>
   <!-- int qecvt_r (long double value, int ndigit, int *decpt, int *neg, char *buf, size_t len); -->
   <function name="qecvt_r">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <pure/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-null/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="out">
       <not-null/>
     </arg>
-    <arg nr="5">
+    <arg nr="5" direction="out">
       <not-null/>
+      <minsize type="argvalue" arg="6"/>
     </arg>
-    <arg nr="6">
+    <arg nr="6" direction="in">
       <not-uninit/>
       <valid>0:</valid>
+      <not-bool/>
     </arg>
+    <warn severity="style" reason="Obsolescent" alternatives="sprintf"/>
   </function>
   <!-- int qfcvt_r (long double value, int ndigit, int *decpt, int *neg, char *buf, size_t len); -->
   <function name="qfcvt_r">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <pure/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-null/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="out">
       <not-null/>
     </arg>
-    <arg nr="5">
+    <arg nr="5" direction="out">
       <not-null/>
+      <minsize type="argvalue" arg="6"/>
     </arg>
-    <arg nr="6">
+    <arg nr="6" direction="in">
       <not-uninit/>
       <valid>0:</valid>
+      <not-bool/>
     </arg>
+    <warn severity="style" reason="Obsolescent" alternatives="sprintf"/>
   </function>
   <!-- https://www.gnu.org/software/gnulib/manual/html_node/c_002dstrcasestr.html -->
   <!-- size_t strcasestr(const char *s1, const char *s2); -->
@@ -395,13 +432,14 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <pure/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
+      <not-bool/>
     </arg>
   </function>
   <!-- http://linux.die.net/man/2/getresuid -->