Security fail (memset being optimized away)

It doesn't quench my curiosity, though. :wink:
What about other (your own) functions?

Isn't it a bug, if a compiler takes false assumptions on
volatiles? This would mean that it doesn't work, even though
it really should (which, of course, is of little help in the
real world).

In my experience, most of the assumptions PEOPLE make about what Volatile means is incorrect. The compiler is doing what it is allowed to.

Check out: http://www.open-std.org/jtc1/sc22/wg21/docs/papers/2018/p1152r0.html
JF's paper has a pretty solid explanation of what volatile really means (as well as ways we can fix it).