DCA shows some lost results (I'll update as I go through them):

• curl__curl cpp/path-injection
  Lost results flow out via global here: https://github.com/curl/curl/blob/7e814c8717939393d4436d75f5f0c3ffa98c8c53/src/tool_getparam.c#L2900 (see https://github.com/curl/curl/blob/7e814c8717939393d4436d75f5f0c3ffa98c8c53/src/tool_getparam.c#L1561) Has big switch statement.
• erlang__otp cpp/use-after-free
  Lost results flow out of assign here https://github.com/erlang/otp/blob/12509834ed59004b2add47e12806aaaaa43834b8/erts/emulator/asmjit/core/virtmem.cpp#L342 (see https://github.com/erlang/otp/blob/12509834ed59004b2add47e12806aaaaa43834b8/erts/emulator/asmjit/core/string.cpp#L139)
  It does seem like the lost result is an FP
• git-linux cpp/uncontrolled-allocation-size
  Lost result flows out of the first argument of strbuf_read here https://github.com/git/git/blob/041f5ea1cf987a4068ef5f39ba0a09be85952064/apply.c#L413 (see https://github.com/git/git/blob/041f5ea1cf987a4068ef5f39ba0a09be85952064/strbuf.c#L445)
• git-linux cpp/path-injection
  Lost result flows out of strbuf_add_absolute_path here https://github.com/git/git/blob/041f5ea1cf987a4068ef5f39ba0a09be85952064/tempfile.c#L137 (see https://github.com/git/git/blob/041f5ea1cf987a4068ef5f39ba0a09be85952064/strbuf.c#L782)
• ImageMagick-ImageMagick cpp/path-injection
  Lost results flow out of AddValueToSplayTree (see https://github.com/ImageMagick/ImageMagick/blob/21db2a08eebf2d13a0af158eae1403b8ebcd73de/MagickCore/splay-tree.c#L154)
• microsoft__CCF cpp/path-injection
  Lost results flow out of parseOptionImpl (see https://github.com/microsoft/CCF/blob/cb7650a640bf68712e2889d154864ae245dfe037/3rdparty/test/doctest/doctest.h#L6450)
• neovim__neovim cpp/uncontrolled-allocation-size
  Lost results flow out of
  • coladvance2 (see https://github.com/neovim/neovim/blob/c0f222d55b780831382a4034cec5c643d0504f58/src/nvim/cursor.c#L96)
  • set_sofo (see https://github.com/neovim/neovim/blob/c0f222d55b780831382a4034cec5c643d0504f58/src/nvim/spellfile.c#L1529)
• neovim__neovim cpp/unbounded-write
  Lost results flow out of
  • separate_nextcmd (see https://github.com/neovim/neovim/blob/c0f222d55b780831382a4034cec5c643d0504f58/src/nvim/ex_docmd.c#L4084)
  • globpath (see https://github.com/neovim/neovim/blob/5333d6371bfa2fe048e5d99e0e843657b3b0e33f/src/nvim/cmdexpand.c#L3275)
  • file_skip (see https://github.com/neovim/neovim/blob/5333d6371bfa2fe048e5d99e0e843657b3b0e33f/src/nvim/os/fileio.c#L364)
• nlohmann__json cpp/path-injection
  Same lost result as CCF (comes from 3rd party library)
• openjdk-jdk cpp/uncontrolled-allocation-size
  Lost results flow out of get_line (see https://github.com/openjdk/jdk/blob/8dc43aa0fe8cdba2a2953258de02c6afa072987a/src/hotspot/share/ci/ciReplay.cpp#L601)
• openttd__openttd cpp/path-injection
  Lost results flow out of getOpt (see https://github.com/OpenTTD/OpenTTD/blob/36bee83864ecffe526d7693dab8bb04fb3f6a4e2/src/misc/getoptdata.cpp#L22)
• systemd-linux cpp/system-data-exposure
  Lost results flow out of siphash24_compress (see https://github.com/systemd/systemd/blob/12a233265de17d52e75d169b2cd822e5998e5012/src/basic/siphash24.c#L73, has non-top-levelswitch)
• vim__vim cpp/unbounded-write
  Lost results flow out of
  • separate_nextcmd (see https://github.com/vim/vim/blob/a5a1ec1826c0e43d0282ba4d35c155a97bab3e27/src/ex_docmd.c#L4804)
  • parse_command_modifiers (see https://github.com/vim/vim/blob/a5a1ec1826c0e43d0282ba4d35c155a97bab3e27/src/ex_docmd.c#L2695)