out is assigned NULL, and for the parse-only case stays that way. Then
call_env_result() is called, which doesn't dereference out in the
parse-only case, but Coverity doesn't realize it and hence complains.
parse_only:
if (env->rule->pair.parsed.offset >= 0) tmpl_out = ((uint8_t *)*call_env_rctx->data) + env->rule->pair.parsed.offset;
+ /* coverity[var_deref_model] */
result = call_env_result(*call_env_rctx->data, request, out, tmpl_out, env, &call_env_rctx->tmpl_expanded);
if (result != CALL_ENV_SUCCESS) {
if (call_env_rctx->result) *call_env_rctx->result = result;