"Deterministically locating all undefined behavior is undecidable. Static analyzers can only locate a subset of it."
It might be true but barely matters when we have tools like KCC. It's built on an executable semantics of C that runs in a framework on top of Maude rewrite engine.
That's fascinating; thank you for that. I often find academic papers are too densely written to me to read, but the authors of that paper have gone out of their way to describe everything in a straightforward manner.
Commonly-used type punning techniques frequently exhibit undefined behavior due to strict aliasing: https://blog.regehr.org/archives/1307 .