-fsanitize=pointer-overflow fails to detect overflow with pointer to VLA

[efriedma-quic]

Testcase:

void f(void g(void*, void*)) {
  int x = 2;
  unsigned long long y = 0x8000000000000000;
  int a[2][2];
  int (*aa)[x] = a;
  g(&aa[y], aa+y);
}
void g(void*, void*){}
int main(){ f(g); }

Compiling with -fsanitize=pointer-overflow, no error is triggered by the resulting program. It should trigger on the subscripting/pointer arithmetic (like it does with a constant array, or if the offfset is 0x4000000000000000).