x+1 on a pointer is x+sizeof(*x)*1. The overflow check is treating it as (int)x+1 Ideally, we'd love to have a `__pointer_<op>_overflow()` intrinsic which would do the right thing for pointers.