Use stripTopLevelSpecifiers() to get the allocated element type for malloc().

cpp/ql/src/semmle/code/cpp/models/implementations/Allocation.qll

@@ -343,7 +343,8 @@ class CallAllocationExpr extends AllocationExpr, FunctionCall {
   override Expr getReallocPtr() { result = getArgument(target.getReallocPtrArg()) }
 
   override Type getAllocatedElementType() {
-    result = this.getFullyConverted().getUnderlyingType().(PointerType).getBaseType() and
+    result =
+      this.getFullyConverted().getType().stripTopLevelSpecifiers().(PointerType).getBaseType() and
     not result instanceof VoidType
   }