Found using clang's undefined-behaviour sanitizer:
CC="clang -fsanitize=undefined -fno-sanitize-recover=undefined".
It reported errors
dcigettext.c:1219:25: runtime error: applying non-zero offset 8 to null pointer
because the code was computing
outbuf = freemem + sizeof (size_t);
where freemem == NULL.
* gettext-runtime/intl/dcigettext.c (_nl_find_msg): Initialize outbuf only after
having verified that freemem_size >= sizeof (size_t).