The C99 standard (Appendix J) identifies almost 200 forms of undefined behavior (UB). For many, many reasons, UB is basically the most egregious form of coding error. It is totally preventable, and the effects can be most devastating.

Even though not all kinds of UB can be detected by a static analysis tool, many are, and other tools do this pretty well.

Piggy-backing onto this -- would also be nice to identify implementation-defined behaviors (e.g. bit position of bit-fields) and unspecified behaviors.

As these are all part of the standard, it doesn't seem too hard to do intellectually, it's just a good amount of work. But work that IMO many users of lint, particularly those working in safety-critical fields such as automotive, energy, medical devices, defense, etc. would love to see.