We have avoided using the GCC nonnull attributes that glibc uses
extensively because they would cause undesirable (and dangerous)
optimizations. The clang attributes are much more benign and basically
only have effect for the static analyzer (recently also ubsan).
These are based on the bionic libc.