diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
index 15c631f727c..d2c1688c7de 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
@@ -1083,3 +1083,56 @@ ssa.cpp:
 #  239|     v239_5(void)                 = UnmodeledUse                    : mu*
 #  239|     v239_6(void)                 = AliasedUse                      : ~m244_5
 #  239|     v239_7(void)                 = ExitFunction                    : 
+
+#  247| char* VoidStarIndirectParameters(char*, int)
+#  247|   Block 0
+#  247|     v247_1(void)           = EnterFunction                      : 
+#  247|     m247_2(unknown)        = AliasedDefinition                  : 
+#  247|     mu247_3(unknown)       = UnmodeledDefinition                : 
+#  247|     r247_4(glval<char *>)  = VariableAddress[src]               : 
+#  247|     m247_5(char *)         = InitializeParameter[src]           : &:r247_4
+#  247|     r247_6(char *)         = Load                               : &:r247_4, m247_5
+#  247|     m247_7(unknown)        = InitializeIndirection[src]         : &:r247_6
+#  247|     r247_8(glval<int>)     = VariableAddress[size]              : 
+#  247|     m247_9(int)            = InitializeParameter[size]          : &:r247_8
+#  248|     r248_1(glval<char *>)  = VariableAddress[dst]               : 
+#  248|     r248_2(glval<unknown>) = FunctionAddress[operator new[]]    : 
+#  248|     r248_3(glval<int>)     = VariableAddress[size]              : 
+#  248|     r248_4(int)            = Load                               : &:r248_3, m247_9
+#  248|     r248_5(unsigned long)  = Convert                            : r248_4
+#  248|     r248_6(unsigned long)  = Constant[1]                        : 
+#  248|     r248_7(unsigned long)  = Mul                                : r248_5, r248_6
+#  248|     r248_8(void *)         = Call                               : func:r248_2, 0:r248_7
+#  248|     m248_9(unknown)        = ^CallSideEffect                    : ~m247_7
+#  248|     m248_10(unknown)       = Chi                                : total:m247_7, partial:m248_9
+#  248|     r248_11(char *)        = Convert                            : r248_8
+#  248|     m248_12(char *)        = Store                              : &:r248_1, r248_11
+#  249|     r249_1(char)           = Constant[97]                       : 
+#  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
+#  249|     r249_3(char *)         = Load                               : &:r249_2, m247_5
+#  249|     r249_4(glval<char>)    = CopyValue                          : r249_3
+#  249|     m249_5(char)           = Store                              : &:r249_4, r249_1
+#  249|     m249_6(unknown)        = Chi                                : total:m248_10, partial:m249_5
+#  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
+#  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
+#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_12
+#  250|     r250_4(void *)         = Convert                            : r250_3
+#  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
+#  250|     r250_6(char *)         = Load                               : &:r250_5, m247_5
+#  250|     r250_7(void *)         = Convert                            : r250_6
+#  250|     r250_8(glval<int>)     = VariableAddress[size]              : 
+#  250|     r250_9(int)            = Load                               : &:r250_8, m247_9
+#  250|     r250_10(void *)        = Call                               : func:r250_1, 0:r250_4, 1:r250_7, 2:r250_9
+#  250|     v250_11(void)          = ^SizedBufferReadSideEffect[1]      : &:r250_7, r250_9, ~m249_5
+#  250|     m250_12(unknown)       = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
+#  250|     m250_13(unknown)       = Chi                                : total:m249_6, partial:m250_12
+#  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
+#  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
+#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_12
+#  251|     m251_4(char *)         = Store                              : &:r251_1, r251_3
+#  247|     v247_10(void)          = ReturnIndirection                  : &:r247_6, ~m250_13
+#  247|     r247_11(glval<char *>) = VariableAddress[#return]           : 
+#  247|     v247_12(void)          = ReturnValue                        : &:r247_11, m251_4
+#  247|     v247_13(void)          = UnmodeledUse                       : mu*
+#  247|     v247_14(void)          = AliasedUse                         : ~m250_13
+#  247|     v247_15(void)          = ExitFunction                       : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
index ef8570bd1a5..3fd39a6b7a1 100644
--- a/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
@@ -1078,3 +1078,56 @@ ssa.cpp:
 #  239|     v239_5(void)                 = UnmodeledUse                    : mu*
 #  239|     v239_6(void)                 = AliasedUse                      : ~m244_5
 #  239|     v239_7(void)                 = ExitFunction                    : 
+
+#  247| char* VoidStarIndirectParameters(char*, int)
+#  247|   Block 0
+#  247|     v247_1(void)           = EnterFunction                      : 
+#  247|     m247_2(unknown)        = AliasedDefinition                  : 
+#  247|     mu247_3(unknown)       = UnmodeledDefinition                : 
+#  247|     r247_4(glval<char *>)  = VariableAddress[src]               : 
+#  247|     m247_5(char *)         = InitializeParameter[src]           : &:r247_4
+#  247|     r247_6(char *)         = Load                               : &:r247_4, m247_5
+#  247|     m247_7(unknown)        = InitializeIndirection[src]         : &:r247_6
+#  247|     r247_8(glval<int>)     = VariableAddress[size]              : 
+#  247|     m247_9(int)            = InitializeParameter[size]          : &:r247_8
+#  248|     r248_1(glval<char *>)  = VariableAddress[dst]               : 
+#  248|     r248_2(glval<unknown>) = FunctionAddress[operator new[]]    : 
+#  248|     r248_3(glval<int>)     = VariableAddress[size]              : 
+#  248|     r248_4(int)            = Load                               : &:r248_3, m247_9
+#  248|     r248_5(unsigned long)  = Convert                            : r248_4
+#  248|     r248_6(unsigned long)  = Constant[1]                        : 
+#  248|     r248_7(unsigned long)  = Mul                                : r248_5, r248_6
+#  248|     r248_8(void *)         = Call                               : func:r248_2, 0:r248_7
+#  248|     m248_9(unknown)        = ^CallSideEffect                    : ~m247_2
+#  248|     m248_10(unknown)       = Chi                                : total:m247_2, partial:m248_9
+#  248|     r248_11(char *)        = Convert                            : r248_8
+#  248|     m248_12(char *)        = Store                              : &:r248_1, r248_11
+#  249|     r249_1(char)           = Constant[97]                       : 
+#  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
+#  249|     r249_3(char *)         = Load                               : &:r249_2, m247_5
+#  249|     r249_4(glval<char>)    = CopyValue                          : r249_3
+#  249|     m249_5(char)           = Store                              : &:r249_4, r249_1
+#  249|     m249_6(unknown)        = Chi                                : total:m247_7, partial:m249_5
+#  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
+#  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
+#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_12
+#  250|     r250_4(void *)         = Convert                            : r250_3
+#  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
+#  250|     r250_6(char *)         = Load                               : &:r250_5, m247_5
+#  250|     r250_7(void *)         = Convert                            : r250_6
+#  250|     r250_8(glval<int>)     = VariableAddress[size]              : 
+#  250|     r250_9(int)            = Load                               : &:r250_8, m247_9
+#  250|     r250_10(void *)        = Call                               : func:r250_1, 0:r250_4, 1:r250_7, 2:r250_9
+#  250|     v250_11(void)          = ^SizedBufferReadSideEffect[1]      : &:r250_7, r250_9, ~m249_5
+#  250|     m250_12(unknown)       = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
+#  250|     m250_13(unknown)       = Chi                                : total:m248_10, partial:m250_12
+#  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
+#  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
+#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_12
+#  251|     m251_4(char *)         = Store                              : &:r251_1, r251_3
+#  247|     v247_10(void)          = ReturnIndirection                  : &:r247_6, ~m249_6
+#  247|     r247_11(glval<char *>) = VariableAddress[#return]           : 
+#  247|     v247_12(void)          = ReturnValue                        : &:r247_11, m251_4
+#  247|     v247_13(void)          = UnmodeledUse                       : mu*
+#  247|     v247_14(void)          = AliasedUse                         : ~m250_13
+#  247|     v247_15(void)          = ExitFunction                       : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/ssa.cpp b/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
index 761289c5017..40a8017b9ef 100644
--- a/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
+++ b/cpp/ql/test/library-tests/ir/ssa/ssa.cpp
@@ -243,3 +243,10 @@ void ExplicitConstructorCalls() {
   Constructible c2 = Constructible(2);
   c2.g();
 }
+
+char *VoidStarIndirectParameters(char *src, int size) {
+  char *dst = new char[size];
+  *src = 'a';
+  memcpy(dst, src, size);
+  return dst;
+}
\ No newline at end of file
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
index 83021d91c9c..b4d5e1833cf 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir.expected
@@ -1026,3 +1026,53 @@ ssa.cpp:
 #  239|     v239_5(void)                 = UnmodeledUse                    : mu*
 #  239|     v239_6(void)                 = AliasedUse                      : ~mu239_3
 #  239|     v239_7(void)                 = ExitFunction                    : 
+
+#  247| char* VoidStarIndirectParameters(char*, int)
+#  247|   Block 0
+#  247|     v247_1(void)           = EnterFunction                      : 
+#  247|     mu247_2(unknown)       = AliasedDefinition                  : 
+#  247|     mu247_3(unknown)       = UnmodeledDefinition                : 
+#  247|     r247_4(glval<char *>)  = VariableAddress[src]               : 
+#  247|     m247_5(char *)         = InitializeParameter[src]           : &:r247_4
+#  247|     r247_6(char *)         = Load                               : &:r247_4, m247_5
+#  247|     mu247_7(unknown)       = InitializeIndirection[src]         : &:r247_6
+#  247|     r247_8(glval<int>)     = VariableAddress[size]              : 
+#  247|     m247_9(int)            = InitializeParameter[size]          : &:r247_8
+#  248|     r248_1(glval<char *>)  = VariableAddress[dst]               : 
+#  248|     r248_2(glval<unknown>) = FunctionAddress[operator new[]]    : 
+#  248|     r248_3(glval<int>)     = VariableAddress[size]              : 
+#  248|     r248_4(int)            = Load                               : &:r248_3, m247_9
+#  248|     r248_5(unsigned long)  = Convert                            : r248_4
+#  248|     r248_6(unsigned long)  = Constant[1]                        : 
+#  248|     r248_7(unsigned long)  = Mul                                : r248_5, r248_6
+#  248|     r248_8(void *)         = Call                               : func:r248_2, 0:r248_7
+#  248|     mu248_9(unknown)       = ^CallSideEffect                    : ~mu247_3
+#  248|     r248_10(char *)        = Convert                            : r248_8
+#  248|     m248_11(char *)        = Store                              : &:r248_1, r248_10
+#  249|     r249_1(char)           = Constant[97]                       : 
+#  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
+#  249|     r249_3(char *)         = Load                               : &:r249_2, m247_5
+#  249|     r249_4(glval<char>)    = CopyValue                          : r249_3
+#  249|     mu249_5(char)          = Store                              : &:r249_4, r249_1
+#  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
+#  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
+#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_11
+#  250|     r250_4(void *)         = Convert                            : r250_3
+#  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
+#  250|     r250_6(char *)         = Load                               : &:r250_5, m247_5
+#  250|     r250_7(void *)         = Convert                            : r250_6
+#  250|     r250_8(glval<int>)     = VariableAddress[size]              : 
+#  250|     r250_9(int)            = Load                               : &:r250_8, m247_9
+#  250|     r250_10(void *)        = Call                               : func:r250_1, 0:r250_4, 1:r250_7, 2:r250_9
+#  250|     v250_11(void)          = ^SizedBufferReadSideEffect[1]      : &:r250_7, r250_9, ~mu247_3
+#  250|     mu250_12(unknown)      = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
+#  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
+#  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
+#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_11
+#  251|     m251_4(char *)         = Store                              : &:r251_1, r251_3
+#  247|     v247_10(void)          = ReturnIndirection                  : &:r247_6, ~mu247_3
+#  247|     r247_11(glval<char *>) = VariableAddress[#return]           : 
+#  247|     v247_12(void)          = ReturnValue                        : &:r247_11, m251_4
+#  247|     v247_13(void)          = UnmodeledUse                       : mu*
+#  247|     v247_14(void)          = AliasedUse                         : ~mu247_3
+#  247|     v247_15(void)          = ExitFunction                       : 
diff --git a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
index 83021d91c9c..b4d5e1833cf 100644
--- a/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
+++ b/cpp/ql/test/library-tests/ir/ssa/unaliased_ssa_ir_unsound.expected
@@ -1026,3 +1026,53 @@ ssa.cpp:
 #  239|     v239_5(void)                 = UnmodeledUse                    : mu*
 #  239|     v239_6(void)                 = AliasedUse                      : ~mu239_3
 #  239|     v239_7(void)                 = ExitFunction                    : 
+
+#  247| char* VoidStarIndirectParameters(char*, int)
+#  247|   Block 0
+#  247|     v247_1(void)           = EnterFunction                      : 
+#  247|     mu247_2(unknown)       = AliasedDefinition                  : 
+#  247|     mu247_3(unknown)       = UnmodeledDefinition                : 
+#  247|     r247_4(glval<char *>)  = VariableAddress[src]               : 
+#  247|     m247_5(char *)         = InitializeParameter[src]           : &:r247_4
+#  247|     r247_6(char *)         = Load                               : &:r247_4, m247_5
+#  247|     mu247_7(unknown)       = InitializeIndirection[src]         : &:r247_6
+#  247|     r247_8(glval<int>)     = VariableAddress[size]              : 
+#  247|     m247_9(int)            = InitializeParameter[size]          : &:r247_8
+#  248|     r248_1(glval<char *>)  = VariableAddress[dst]               : 
+#  248|     r248_2(glval<unknown>) = FunctionAddress[operator new[]]    : 
+#  248|     r248_3(glval<int>)     = VariableAddress[size]              : 
+#  248|     r248_4(int)            = Load                               : &:r248_3, m247_9
+#  248|     r248_5(unsigned long)  = Convert                            : r248_4
+#  248|     r248_6(unsigned long)  = Constant[1]                        : 
+#  248|     r248_7(unsigned long)  = Mul                                : r248_5, r248_6
+#  248|     r248_8(void *)         = Call                               : func:r248_2, 0:r248_7
+#  248|     mu248_9(unknown)       = ^CallSideEffect                    : ~mu247_3
+#  248|     r248_10(char *)        = Convert                            : r248_8
+#  248|     m248_11(char *)        = Store                              : &:r248_1, r248_10
+#  249|     r249_1(char)           = Constant[97]                       : 
+#  249|     r249_2(glval<char *>)  = VariableAddress[src]               : 
+#  249|     r249_3(char *)         = Load                               : &:r249_2, m247_5
+#  249|     r249_4(glval<char>)    = CopyValue                          : r249_3
+#  249|     mu249_5(char)          = Store                              : &:r249_4, r249_1
+#  250|     r250_1(glval<unknown>) = FunctionAddress[memcpy]            : 
+#  250|     r250_2(glval<char *>)  = VariableAddress[dst]               : 
+#  250|     r250_3(char *)         = Load                               : &:r250_2, m248_11
+#  250|     r250_4(void *)         = Convert                            : r250_3
+#  250|     r250_5(glval<char *>)  = VariableAddress[src]               : 
+#  250|     r250_6(char *)         = Load                               : &:r250_5, m247_5
+#  250|     r250_7(void *)         = Convert                            : r250_6
+#  250|     r250_8(glval<int>)     = VariableAddress[size]              : 
+#  250|     r250_9(int)            = Load                               : &:r250_8, m247_9
+#  250|     r250_10(void *)        = Call                               : func:r250_1, 0:r250_4, 1:r250_7, 2:r250_9
+#  250|     v250_11(void)          = ^SizedBufferReadSideEffect[1]      : &:r250_7, r250_9, ~mu247_3
+#  250|     mu250_12(unknown)      = ^SizedBufferMustWriteSideEffect[0] : &:r250_4, r250_9
+#  251|     r251_1(glval<char *>)  = VariableAddress[#return]           : 
+#  251|     r251_2(glval<char *>)  = VariableAddress[dst]               : 
+#  251|     r251_3(char *)         = Load                               : &:r251_2, m248_11
+#  251|     m251_4(char *)         = Store                              : &:r251_1, r251_3
+#  247|     v247_10(void)          = ReturnIndirection                  : &:r247_6, ~mu247_3
+#  247|     r247_11(glval<char *>) = VariableAddress[#return]           : 
+#  247|     v247_12(void)          = ReturnValue                        : &:r247_11, m251_4
+#  247|     v247_13(void)          = UnmodeledUse                       : mu*
+#  247|     v247_14(void)          = AliasedUse                         : ~mu247_3
+#  247|     v247_15(void)          = ExitFunction                       :