Proposed by a community member BoHsian Chen.
Detect if an uninitialized value is passed to a function defined outside of the current translation unit (or also returned from a function?) and flag it as a hotspot (since in many cases a function expects its parameters to be initialized to some sensible values).
Such rule shall produce FPs for the pattern of initializing a value passing it as an output pointer, and that is fine for a hotspot.
Report the argument &s of func(&s) in main1.c.