byval arguments are uninstrumented, but can be used as actual pointers

[hal-ler]

The byval attributes are uninstrumented (given fake upper bounds), but in reality the programmer can take the address of such argument and pass it along as any other pointer. At the IR level this looks as passing the "fake" pointer (with no bounds information) to the callee. This pattern is actually hit in either SPEC2006 or Chrome. There is also no need to use fake bounds information, since the actual size is already known at compile time.