Update java/ql/integration-tests/qlpack.yml

Simplify integration test
There is no need to include extra data extensions for this test. Move qlpack to the root of the integration test folder.
2026-05-27 09:31:30 +02:00 · 2022-12-15 11:39:28 -08:00 · 2022-12-15 09:48:56 -08:00
1977 changed files with 47008 additions and 151023 deletions
--- a/.github/actions/cache-query-compilation/action.yml
+++ b/.github/actions/cache-query-compilation/action.yml
@@ -23,19 +23,20 @@ runs:
      run: |
        MERGE_BASE=$(git cat-file commit $GITHUB_SHA | grep '^parent ' | head -1 | cut -f 2 -d " ")
        echo "merge_base=$MERGE_BASE" >> $GITHUB_ENV
-    - name: Restore cache (PR)
+    - name: Restore read-only cache (PR)
      if: ${{ github.event_name == 'pull_request' }}
-      uses: actions/cache/restore@v3
+      uses: erik-krogh/actions-cache@a88d0603fe5fb5606db9f002dfcadeb32b5f84c6
      with:
        path: '**/.cache'
+        read-only: true
        key: codeql-compile-${{ inputs.key }}-pr-${{ github.sha }}
        restore-keys: |
          codeql-compile-${{ inputs.key }}-${{ github.base_ref }}-${{ env.merge_base }}
          codeql-compile-${{ inputs.key }}-${{ github.base_ref }}-
          codeql-compile-${{ inputs.key }}-main-
-    - name: Fill cache (only branch push)
+    - name: Fill cache (push)
      if: ${{ github.event_name != 'pull_request' }}
-      uses: actions/cache@v3
+      uses: erik-krogh/actions-cache@a88d0603fe5fb5606db9f002dfcadeb32b5f84c6
      with:
        path: '**/.cache'
        key: codeql-compile-${{ inputs.key }}-${{ github.ref_name }}-${{ github.sha }} # just fill on main
--- a/.github/actions/os-version/action.yml
+++ b/.github/actions/os-version/action.yml
@@ -1,32 +0,0 @@
-name: OS Version
-description: Get OS version.
-
-outputs:
-  version:
-    description: "OS version"
-    value: ${{ steps.version.outputs.version }}
-
-runs:
-  using: composite
-  steps:
-    - if: runner.os == 'Linux'
-      shell: bash
-      run: |
-        . /etc/os-release
-        echo "VERSION=${NAME} ${VERSION}" >> $GITHUB_ENV
-    - if: runner.os == 'Windows'
-      shell: powershell
-      run: |
-        $objects = systeminfo.exe /FO CSV | ConvertFrom-Csv
-        "VERSION=$($objects.'OS Name') $($objects.'OS Version')" >> $env:GITHUB_ENV
-    - if: runner.os == 'macOS'
-      shell: bash
-      run: |
-        echo "VERSION=$(sw_vers -productName) $(sw_vers -productVersion)" >> $GITHUB_ENV
-    - name: Emit OS version
-      id: version
-      shell: bash
-      run: |
-        echo "$VERSION"
-        echo "version=${VERSION}" >> $GITHUB_OUTPUT
-
--- a/.github/workflows/atm-check-query-suite.yml
+++ b/.github/workflows/atm-check-query-suite.yml
@@ -13,7 +13,7 @@ on:

 jobs:
  atm-check-query-suite:
-    runs-on: ubuntu-latest-xl
+    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v3
@@ -23,12 +23,6 @@ jobs:
        with:
          channel: release

-      - name: Cache compilation cache
-        id: query-cache
-        uses: ./.github/actions/cache-query-compilation
-        with: 
-          key: atm-suite
-
      - name: Install ATM model
        run: |
          set -exu
@@ -56,13 +50,10 @@ jobs:
          echo "SARIF_PATH=${SARIF_PATH}" >> "${GITHUB_ENV}"

          codeql database analyze \
-            --threads=0 \
-            --ram 50000 \
            --format sarif-latest \
            --output "${SARIF_PATH}" \
            --sarif-group-rules-by-pack \
            -vv \
-            --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" \
            -- \
            "${DB_PATH}" \
            "${QUERY_PACK}/${QUERY_SUITE}"
--- a/.github/workflows/check-change-note.yml
+++ b/.github/workflows/check-change-note.yml
@@ -26,9 +26,3 @@ jobs:
        run: |
          gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
          grep true -c
-      - name: Fail if the change note filename doesn't match the expected format. The file name must be of the form 'YYYY-MM-DD.md' or 'YYYY-MM-DD-{title}.md', where '{title}' is arbitrary text.
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq '[.[].filename | select(test("/change-notes/.*[.]md$"))] | all(test("/change-notes/[0-9]{4}-[0-9]{2}-[0-9]{2}.*[.]md$"))' |
-          grep true -c
--- a/.github/workflows/close-stale.yml
+++ b/.github/workflows/close-stale.yml
@@ -12,7 +12,7 @@ jobs:
    runs-on: ubuntu-latest

    steps:
-    - uses: actions/stale@v7
+    - uses: actions/stale@v6
      with:
        repo-token: ${{ secrets.GITHUB_TOKEN }}
        stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
--- a/.github/workflows/mad_modelDiff.yml
+++ b/.github/workflows/mad_modelDiff.yml
@@ -11,7 +11,7 @@ on:
    branches:
      - main
    paths:
-      - "java/ql/src/utils/modelgenerator/**/*.*"
+      - "java/ql/src/utils/model-generator/**/*.*"
      - ".github/workflows/mad_modelDiff.yml"

 permissions:
@@ -40,12 +40,12 @@ jobs:
      - name: Download database
        env:
          SLUG: ${{ matrix.slug }}
-          GH_TOKEN: ${{ github.token }}
        run: |
          set -x
          mkdir lib-dbs
          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
-          gh api -H "Accept: application/zip" "/repos/${SLUG}/code-scanning/codeql/databases/java" > "$SHORTNAME.zip"
+          projectId=`curl -s https://lgtm.com/api/v1.0/projects/g/${SLUG} | jq .id`
+          curl -L "https://lgtm.com/api/v1.0/snapshots/$projectId/java" -o "$SHORTNAME.zip"
          unzip -q -d "${SHORTNAME}-db" "${SHORTNAME}.zip"
          mkdir "lib-dbs/$SHORTNAME/"
          mv "${SHORTNAME}-db/"$(ls -1 "${SHORTNAME}"-db)/* "lib-dbs/${SHORTNAME}/"
@@ -61,7 +61,7 @@ jobs:
            DATABASE=$2
            cd codeql-$QL_VARIANT
            SHORTNAME=`basename $DATABASE`
-            python java/ql/src/utils/modelgenerator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE ${SHORTNAME}.temp.model.yml
+            python java/ql/src/utils/model-generator/GenerateFlowModel.py --with-summaries --with-sinks $DATABASE ${SHORTNAME}.temp.model.yml
            mv java/ql/lib/ext/generated/${SHORTNAME}.temp.model.yml $MODELS/${SHORTNAME}Generated_${QL_VARIANT}.model.yml
            cd ..
          }
@@ -100,6 +100,4 @@ jobs:
        with:
          name: diffs
          path: tmp-models/*.html
-          # An html file is only produced if the generated models differ.
-          if-no-files-found: ignore
          retention-days: 20
--- a/.github/workflows/mad_regenerate-models.yml
+++ b/.github/workflows/mad_regenerate-models.yml
@@ -50,7 +50,7 @@ jobs:
          SLUG: ${{ matrix.slug }}
        run: |
          SHORTNAME=${SLUG//[^a-zA-Z0-9_]/}
-          java/ql/src/utils/modelgenerator/RegenerateModels.py "${SLUG}" dbs/${SHORTNAME}
+          java/ql/src/utils/model-generator/RegenerateModels.py "${SLUG}" dbs/${SHORTNAME}
      - name: Stage changes
        run: |
          find java -name "*.model.yml" -print0 | xargs -0 git add
--- a/.github/workflows/ql-for-ql-build.yml
+++ b/.github/workflows/ql-for-ql-build.yml
@@ -27,7 +27,7 @@ jobs:
        uses: ./.github/actions/find-latest-bundle
      - name: Find codeql
        id: find-codeql
-        uses: github/codeql-action/init@45955cb1830b640e2c1603ad72ad542a49d47b96
+        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
        with:
          languages: javascript # does not matter
          tools: ${{ steps.find-latest-bundle.outputs.url }}
@@ -38,14 +38,12 @@ jobs:
        shell: bash
        env:
          CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
-      - uses: ./.github/actions/os-version
-        id: os_version
      - name: Cache entire pack
        id: cache-pack
        uses: actions/cache@v3
        with:
          path: ${{ runner.temp }}/pack
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-pack-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/**/qlpack.yml') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}--${{ hashFiles('.github/workflows/ql-for-ql-build.yml') }}
+          key: ${{ runner.os }}-pack-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}-${{ hashFiles('ql/**/*.ql*') }}-${{ hashFiles('ql/**/qlpack.yml') }}-${{ hashFiles('ql/ql/src/ql.dbscheme*') }}-${{ steps.get-codeql-version.outputs.version }}--${{ hashFiles('.github/workflows/ql-for-ql-build.yml') }}
      - name: Cache queries
        if: steps.cache-pack.outputs.cache-hit != 'true'
        id: cache-queries
@@ -79,7 +77,7 @@ jobs:
            ql/target/release/ql-autobuilder.exe
            ql/target/release/ql-extractor
            ql/target/release/ql-extractor.exe
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}
+          key: ${{ runner.os }}-extractor-${{ hashFiles('ql/**/Cargo.lock') }}-${{ hashFiles('ql/**/*.rs') }}
      - name: Cache cargo
        if: steps.cache-extractor.outputs.cache-hit != 'true' && steps.cache-pack.outputs.cache-hit != 'true'
        uses: actions/cache@v3
@@ -88,7 +86,7 @@ jobs:
            ~/.cargo/registry
            ~/.cargo/git
            ql/target
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-rust-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
+          key: ${{ runner.os }}-rust-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
      - name: Check formatting
        if: steps.cache-extractor.outputs.cache-hit != 'true' && steps.cache-pack.outputs.cache-hit != 'true'
        run: cd ql; cargo fmt --all -- --check
@@ -139,20 +137,20 @@ jobs:
        env:
          CONF: ./ql-for-ql-config.yml
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@45955cb1830b640e2c1603ad72ad542a49d47b96
+        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
        with:
          languages: ql
          db-location: ${{ runner.temp }}/db
          config-file: ./ql-for-ql-config.yml
          tools: ${{ steps.find-latest-bundle.outputs.url }}
-      - name: Move pack queries
+      - name: Move pack cache
        run: |
-          cp -r ${PACK}/queries ql/ql/src
+          cp -r ${PACK}/.cache ql/ql/src/.cache
        env:
          PACK: ${{ runner.temp }}/pack

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@45955cb1830b640e2c1603ad72ad542a49d47b96
+        uses: github/codeql-action/analyze@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
        with:
          category: "ql-for-ql"
      - name: Copy sarif file to CWD
@@ -174,4 +172,4 @@ jobs:
        with:
          name: ql-for-ql-langs
          path: split-sarif
-          retention-days: 1
+          retention-days: 1
--- a/.github/workflows/ql-for-ql-dataset_measure.yml
+++ b/.github/workflows/ql-for-ql-dataset_measure.yml
@@ -25,18 +25,16 @@ jobs:

      - name: Find codeql
        id: find-codeql
-        uses: github/codeql-action/init@45955cb1830b640e2c1603ad72ad542a49d47b96
+        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
        with:
          languages: javascript # does not matter
-      - uses: ./.github/actions/os-version
-        id: os_version
      - uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            ql/target
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
+          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
      - name: Build Extractor
        run: cd ql; env "PATH=$PATH:`dirname ${CODEQL}`" ./scripts/create-extractor-pack.sh
        env:
--- a/.github/workflows/ql-for-ql-tests.yml
+++ b/.github/workflows/ql-for-ql-tests.yml
@@ -20,86 +20,30 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
-      - name: Find codeql
-        id: find-codeql
-        uses: github/codeql-action/init@45955cb1830b640e2c1603ad72ad542a49d47b96
-        with:
-          languages: javascript # does not matter
-      - uses: ./.github/actions/os-version
-        id: os_version
-      - uses: actions/cache@v3
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            ql/target
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-qltest-cargo-${{ hashFiles('ql/rust-toolchain.toml', 'ql/**/Cargo.lock') }}
-      - name: Build extractor
-        run: |
-          cd ql;
-          codeqlpath=$(dirname ${{ steps.find-codeql.outputs.codeql-path }});
-          env "PATH=$PATH:$codeqlpath" ./scripts/create-extractor-pack.sh
-      - name: Cache compilation cache
-        id: query-cache
-        uses: ./.github/actions/cache-query-compilation
-        with: 
-          key: ql-for-ql-tests
-      - name: Run QL tests
-        run: |
-          "${CODEQL}" test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --search-path "${{ github.workspace }}/ql/extractor-pack" --consistency-queries ql/ql/consistency-queries --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" ql/ql/test
-        env:
-          CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
-
-  other-os: 
-    strategy:
-      matrix:
-        os: [macos-latest, windows-latest]
-    needs: [qltest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@v3
-      - name: Install GNU tar 
-        if: runner.os == 'macOS'
-        run: |
-          brew install gnu-tar
-          echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
      - name: Find codeql
        id: find-codeql
        uses: github/codeql-action/init@77a8d2d10c0b403a8b4aadbd223dc489ecd22683
        with:
          languages: javascript # does not matter
-      - uses: ./.github/actions/os-version
-        id: os_version
      - uses: actions/cache@v3
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            ql/target
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-qltest-cargo-${{ hashFiles('ql/rust-toolchain.toml', 'ql/**/Cargo.lock') }}
+          key: ${{ runner.os }}-qltest-cargo-${{ hashFiles('ql/**/Cargo.lock') }}
      - name: Build extractor
-        if: runner.os != 'Windows'
        run: |
          cd ql;
          codeqlpath=$(dirname ${{ steps.find-codeql.outputs.codeql-path }});
          env "PATH=$PATH:$codeqlpath" ./scripts/create-extractor-pack.sh
-      - name: Build extractor (Windows)
-        if: runner.os == 'Windows'
-        shell: pwsh
+      - name: Run QL tests
        run: |
-          cd ql;
-          $Env:PATH += ";$(dirname ${{ steps.find-codeql.outputs.codeql-path }})"
-          pwsh ./scripts/create-extractor-pack.ps1
-      - name: Run a single QL tests - Unix
-        if: runner.os != 'Windows'
-        run: |
-          "${CODEQL}" test run --check-databases --search-path "${{ github.workspace }}/ql/extractor-pack" ql/ql/test/queries/style/DeadCode/DeadCode.qlref
+          "${CODEQL}" test run --check-databases --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --search-path "${{ github.workspace }}/ql/extractor-pack" --consistency-queries ql/ql/consistency-queries ql/ql/test
        env:
          CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
-      - name: Run a single QL tests - Windows
-        if: runner.os == 'Windows'
-        shell: pwsh
+      - name: Check QL formatting
        run: |
-          $Env:PATH += ";$(dirname ${{ steps.find-codeql.outputs.codeql-path }})"
-          codeql test run --check-databases --search-path "${{ github.workspace }}/ql/extractor-pack" ql/ql/test/queries/style/DeadCode/DeadCode.qlref
-      
+          find ql/ql/src "(" -name "*.ql" -or -name "*.qll" ")" -print0 | xargs -0 "${CODEQL}" query format --check-only
+        env:
+          CODEQL: ${{ steps.find-codeql.outputs.codeql-path }}
--- a/.github/workflows/ruby-build.yml
+++ b/.github/workflows/ruby-build.yml
@@ -48,8 +48,6 @@ jobs:
        run: |
          brew install gnu-tar
          echo "/usr/local/opt/gnu-tar/libexec/gnubin" >> $GITHUB_PATH
-      - uses: ./.github/actions/os-version
-        id: os_version
      - name: Cache entire extractor
        uses: actions/cache@v3
        id: cache-extractor
@@ -60,7 +58,7 @@ jobs:
            ruby/target/release/ruby-extractor
            ruby/target/release/ruby-extractor.exe
            ruby/ql/lib/codeql/ruby/ast/internal/TreeSitter.qll
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-extractor-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}--${{ hashFiles('ruby/**/*.rs') }}
+          key: ${{ runner.os }}-ruby-extractor-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}--${{ hashFiles('ruby/**/*.rs') }}
      - uses: actions/cache@v3
        if: steps.cache-extractor.outputs.cache-hit != 'true'
        with:
@@ -68,7 +66,7 @@ jobs:
            ~/.cargo/registry
            ~/.cargo/git
            ruby/target
-          key: ${{ runner.os }}-${{ steps.os_version.outputs.version }}-ruby-rust-cargo-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}
+          key: ${{ runner.os }}-ruby-rust-cargo-${{ hashFiles('ruby/rust-toolchain.toml', 'ruby/**/Cargo.lock') }}
      - name: Check formatting
        if: steps.cache-extractor.outputs.cache-hit != 'true'
        run: cargo fmt --all -- --check
@@ -117,10 +115,9 @@ jobs:
      - name: Build Query Pack
        run: |
          rm -rf target/packs
+          codeql pack create ../shared/ssa --output target/packs
          codeql pack create ../misc/suite-helpers --output target/packs
          codeql pack create ../shared/regex --output target/packs
-          codeql pack create ../shared/ssa --output target/packs
-          codeql pack create ../shared/tutorial --output target/packs
          codeql pack create ql/lib --output target/packs
          codeql pack create -j0 ql/src --output target/packs --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
          PACK_FOLDER=$(readlink -f target/packs/codeql/ruby-queries/*)
@@ -205,6 +202,11 @@ jobs:
      - name: Fetch CodeQL
        uses: ./.github/actions/fetch-codeql

+      - uses: actions/checkout@v3
+        with:
+          repository: Shopify/example-ruby-app
+          ref: 67a0decc5eb550f3a9228eda53925c3afd40dfe9
+
      - name: Download Ruby bundle
        uses: actions/download-artifact@v3
        with:
@@ -213,15 +215,26 @@ jobs:
      - name: Unzip Ruby bundle
        shell: bash
        run: unzip -q -d "${{ runner.temp }}/ruby-bundle" "${{ runner.temp }}/codeql-ruby-bundle.zip"
-
+      - name: Prepare test files
+        shell: bash
+        run: |
+          echo "import codeql.ruby.AST select count(File f)" > "test.ql"
+          echo "| 4 |" > "test.expected"
+          echo 'name: sample-tests
+          version: 0.0.0
+          dependencies:
+            codeql/ruby-all: "*"
+          extractor: ruby
+          tests: .
+          ' > qlpack.yml
      - name: Run QL test
        shell: bash
        run: |
-          codeql test run --search-path "${{ runner.temp }}/ruby-bundle" --additional-packs "${{ runner.temp }}/ruby-bundle" ruby/ql/test/library-tests/ast/constants/
+          codeql test run --search-path "${{ runner.temp }}/ruby-bundle" --additional-packs "${{ runner.temp }}/ruby-bundle" .
      - name: Create database
        shell: bash
        run: |
-          codeql database create --search-path "${{ runner.temp }}/ruby-bundle" --language ruby --source-root ruby/ql/test/library-tests/ast/constants/ ../database
+          codeql database create --search-path "${{ runner.temp }}/ruby-bundle" --language ruby --source-root . ../database
      - name: Analyze database
        shell: bash
        run: |
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -25,7 +25,6 @@ If you have an idea for a query that you would like to share with other CodeQL u

    Each language-specific directory contains further subdirectories that group queries based on their `@tags` or purpose.
    - Experimental queries and libraries are stored in the `experimental` subdirectory within each language-specific directory in the [CodeQL repository](https://github.com/github/codeql). For example, experimental Java queries and libraries are stored in `java/ql/src/experimental` and any corresponding tests in `java/ql/test/experimental`.
-    - Experimental queries need to include `experimental` in their `@tags`
    - The structure of an `experimental` subdirectory mirrors the structure of its parent directory.
    - Select or create an appropriate directory in `experimental` based on the existing directory structure of `experimental` or its parent directory.

--- a/config/identical-files.json
+++ b/config/identical-files.json
@@ -402,6 +402,16 @@
    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/ControlFlowReachability.qll",
    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/ControlFlowReachability.qll"
  ],
+  "Inline Test Expectations": [
+    "cpp/ql/test/TestUtilities/InlineExpectationsTest.qll",
+    "csharp/ql/test/TestUtilities/InlineExpectationsTest.qll",
+    "java/ql/test/TestUtilities/InlineExpectationsTest.qll",
+    "python/ql/test/TestUtilities/InlineExpectationsTest.qll",
+    "ruby/ql/test/TestUtilities/InlineExpectationsTest.qll",
+    "ql/ql/test/TestUtilities/InlineExpectationsTest.qll",
+    "go/ql/test/TestUtilities/InlineExpectationsTest.qll",
+    "swift/ql/test/TestUtilities/InlineExpectationsTest.qll"
+  ],
  "C++ ExternalAPIs": [
    "cpp/ql/src/Security/CWE/CWE-020/ExternalAPIs.qll",
    "cpp/ql/src/Security/CWE/CWE-020/ir/ExternalAPIs.qll"
@@ -495,6 +505,14 @@
    "python/ql/lib/semmle/python/dataflow/new/internal/TypeTracker.qll",
    "ruby/ql/lib/codeql/ruby/typetracking/TypeTracker.qll"
  ],
+  "CodeQL Tutorial": [
+    "cpp/ql/lib/tutorial.qll",
+    "csharp/ql/lib/tutorial.qll",
+    "java/ql/lib/tutorial.qll",
+    "javascript/ql/lib/tutorial.qll",
+    "python/ql/lib/tutorial.qll",
+    "ruby/ql/lib/tutorial.qll"
+  ],
  "AccessPathSyntax": [
    "csharp/ql/lib/semmle/code/csharp/dataflow/internal/AccessPathSyntax.qll",
    "go/ql/lib/semmle/go/dataflow/internal/AccessPathSyntax.qll",
@@ -513,6 +531,11 @@
    "ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll",
    "javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll"
  ],
+  "Hostname Regexp queries": [
+    "javascript/ql/src/Security/CWE-020/HostnameRegexpShared.qll",
+    "python/ql/src/Security/CWE-020/HostnameRegexpShared.qll",
+    "ruby/ql/src/queries/security/cwe-020/HostnameRegexpShared.qll"
+  ],
  "ApiGraphModels": [
    "javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll",
    "ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll",
--- a/cpp/downgrades/23f7cbb88a4eb29f30c3490363dc201bc054c5ff/exprs.ql
+++ b/cpp/downgrades/23f7cbb88a4eb29f30c3490363dc201bc054c5ff/exprs.ql
@@ -13,5 +13,5 @@ predicate isExprWithNewBuiltin(Expr expr) {
 from Expr expr, int kind, int kind_new, Location location
 where
  exprs(expr, kind, location) and
-  if isExprWithNewBuiltin(expr) then kind_new = 1 else kind_new = kind
+  if isExprWithNewBuiltin(expr) then kind_new = 0 else kind_new = kind
 select expr, kind_new, location
--- a/cpp/downgrades/73af5058c6899dcdb05754c27ca966aeb3a68c94/exprs.ql
+++ b/cpp/downgrades/73af5058c6899dcdb05754c27ca966aeb3a68c94/exprs.ql
@@ -9,5 +9,5 @@ class Location extends @location_expr {
 from Expr expr, int kind, int kind_new, Location location
 where
  exprs(expr, kind, location) and
-  if expr instanceof @blockassignexpr then kind_new = 1 else kind_new = kind
+  if expr instanceof @blockassignexpr then kind_new = 0 else kind_new = kind
 select expr, kind_new, location
--- a/cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/builtintypes.ql
+++ b/cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/builtintypes.ql
@@ -1,11 +0,0 @@
-class BuiltinType extends @builtintype {
-  string toString() { none() }
-}
-
-from BuiltinType type, string name, int kind, int kind_new, int size, int sign, int alignment
-where
-  builtintypes(type, name, kind, size, sign, alignment) and
-  if type instanceof @float16 or type instanceof @complex_float16
-  then kind_new = 2
-  else kind_new = kind
-select type, name, kind_new, size, sign, alignment
--- a/cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/old.dbscheme
+++ b/cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/old.dbscheme
--- a/cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/semmlecode.cpp.dbscheme
+++ b/cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/semmlecode.cpp.dbscheme
--- a/cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/upgrade.properties
+++ b/cpp/downgrades/a5bb28ed29f73855d64cc5f939cef977fa8fd19a/upgrade.properties
@@ -1,3 +0,0 @@
-description: Introduce (_Complex) _Float16 type
-compatibility: backwards
-builtintypes.rel: run builtintypes.qlo
--- a/cpp/downgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/old.dbscheme
+++ b/cpp/downgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/old.dbscheme
--- a/cpp/downgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/semmlecode.cpp.dbscheme
+++ b/cpp/downgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/semmlecode.cpp.dbscheme
--- a/cpp/downgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/upgrade.properties
+++ b/cpp/downgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/upgrade.properties
@@ -1,2 +0,0 @@
-description: Uncomment case splits in dbscheme
-compatibility: full
--- a/cpp/ql/lib/CHANGELOG.md
+++ b/cpp/ql/lib/CHANGELOG.md
@@ -1,28 +1,3 @@
-## 0.5.0
-
-### Breaking Changes
-
-The predicates in the `MustFlow::Configuration` class used by the `MustFlow` library (`semmle.code.cpp.ir.dataflow.MustFlow`) have changed to be defined directly in terms of the C++ IR instead of IR dataflow nodes.
-
-### Deprecated APIs
-
-* Deprecated `semmle.code.cpp.ir.dataflow.DefaultTaintTracking`. Use `semmle.code.cpp.ir.dataflow.TaintTracking`.
-* Deprecated `semmle.code.cpp.security.TaintTrackingImpl`. Use `semmle.code.cpp.ir.dataflow.TaintTracking`.
-* Deprecated `semmle.code.cpp.valuenumbering.GlobalValueNumberingImpl`. Use `semmle.code.cpp.valuenumbering.GlobalValueNumbering`, which exposes the same API.
-
-### Minor Analysis Improvements
-
-* The `ArgvSource` flow source now uses the second parameter of `main` as its source instead of the uses of this parameter.
-* The `ArgvSource` flow source has been generalized to handle cases where the argument vector of `main` is not named `argv`.
-* The `getaddrinfo` function is now recognized as a flow source.
-* The `secure_getenv` and `_wgetenv` functions are now recognized as local flow sources.
-* The `scanf` and `fscanf` functions and their variants are now recognized as flow sources.
-* Deleted the deprecated `getName` and `getShortName` predicates from the `Folder` class.
-
-## 0.4.6
-
-No user-facing changes.
-
 ## 0.4.5

 No user-facing changes.
--- a/cpp/ql/lib/change-notes/2022-11-14-deprecate-ast-gvn.md
+++ b/cpp/ql/lib/change-notes/2022-11-14-deprecate-ast-gvn.md
@@ -0,0 +1,6 @@
+---
+category: deprecated
+---
+
+
+* Deprecated `semmle.code.cpp.valuenumbering.GlobalValueNumberingImpl`. Use `semmle.code.cpp.valuenumbering.GlobalValueNumbering`, which exposes the same API.
--- a/cpp/ql/lib/change-notes/2022-11-16-must-flow.md
+++ b/cpp/ql/lib/change-notes/2022-11-16-must-flow.md
@@ -0,0 +1,4 @@
+---
+category: breaking
+---
+The predicates in the `MustFlow::Configuration` class used by the `MustFlow` library (`semmle.code.cpp.ir.dataflow.MustFlow`) have changed to be defined directly in terms of the C++ IR instead of IR dataflow nodes.
--- a/cpp/ql/lib/change-notes/2022-11-17-deleted-deps.md
+++ b/cpp/ql/lib/change-notes/2022-11-17-deleted-deps.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Deleted the deprecated `getName` and `getShortName` predicates from the `Folder` class.
--- a/cpp/ql/lib/change-notes/2022-11-25-deprecate-default-taint-tracking.md
+++ b/cpp/ql/lib/change-notes/2022-11-25-deprecate-default-taint-tracking.md
@@ -0,0 +1,6 @@
+---
+category: deprecated
+---
+
+* Deprecated `semmle.code.cpp.ir.dataflow.DefaultTaintTracking`. Use `semmle.code.cpp.ir.dataflow.TaintTracking`.
+* Deprecated `semmle.code.cpp.security.TaintTrackingImpl`. Use `semmle.code.cpp.ir.dataflow.TaintTracking`.
--- a/cpp/ql/lib/change-notes/2022-12-08-support-getaddrinfo-dataflow.md
+++ b/cpp/ql/lib/change-notes/2022-12-08-support-getaddrinfo-dataflow.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `getaddrinfo` function is now recognized as a flow source.
--- a/cpp/ql/lib/change-notes/2022-12-08-support-getenv-variants.md
+++ b/cpp/ql/lib/change-notes/2022-12-08-support-getenv-variants.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `secure_getenv` and `_wgetenv` functions are now recognized as local flow sources.
--- a/cpp/ql/lib/change-notes/2022-12-08-support-scanf-dataflow.md
+++ b/cpp/ql/lib/change-notes/2022-12-08-support-scanf-dataflow.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `scanf` and `fscanf` functions and their variants are now recognized as flow sources.
--- a/cpp/ql/lib/change-notes/2022-12-09-generalize-argv-source.md
+++ b/cpp/ql/lib/change-notes/2022-12-09-generalize-argv-source.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `ArgvSource` flow source has been generalized to handle cases where the argument vector of `main` is not named `argv`.
--- a/cpp/ql/lib/change-notes/released/0.4.6.md
+++ b/cpp/ql/lib/change-notes/released/0.4.6.md
@@ -1,3 +0,0 @@
-## 0.4.6
-
-No user-facing changes.
--- a/cpp/ql/lib/change-notes/released/0.5.0.md
+++ b/cpp/ql/lib/change-notes/released/0.5.0.md
@@ -1,20 +0,0 @@
-## 0.5.0
-
-### Breaking Changes
-
-The predicates in the `MustFlow::Configuration` class used by the `MustFlow` library (`semmle.code.cpp.ir.dataflow.MustFlow`) have changed to be defined directly in terms of the C++ IR instead of IR dataflow nodes.
-
-### Deprecated APIs
-
-* Deprecated `semmle.code.cpp.ir.dataflow.DefaultTaintTracking`. Use `semmle.code.cpp.ir.dataflow.TaintTracking`.
-* Deprecated `semmle.code.cpp.security.TaintTrackingImpl`. Use `semmle.code.cpp.ir.dataflow.TaintTracking`.
-* Deprecated `semmle.code.cpp.valuenumbering.GlobalValueNumberingImpl`. Use `semmle.code.cpp.valuenumbering.GlobalValueNumbering`, which exposes the same API.
-
-### Minor Analysis Improvements
-
-* The `ArgvSource` flow source now uses the second parameter of `main` as its source instead of the uses of this parameter.
-* The `ArgvSource` flow source has been generalized to handle cases where the argument vector of `main` is not named `argv`.
-* The `getaddrinfo` function is now recognized as a flow source.
-* The `secure_getenv` and `_wgetenv` functions are now recognized as local flow sources.
-* The `scanf` and `fscanf` functions and their variants are now recognized as flow sources.
-* Deleted the deprecated `getName` and `getShortName` predicates from the `Folder` class.
--- a/cpp/ql/lib/codeql-pack.release.yml
+++ b/cpp/ql/lib/codeql-pack.release.yml
@@ -1,2 +1,2 @@
 ---
-lastReleaseVersion: 0.5.0
+lastReleaseVersion: 0.4.5
--- a/cpp/ql/lib/definitions.qll
+++ b/cpp/ql/lib/definitions.qll
@@ -123,13 +123,6 @@ private predicate constructorCallTypeMention(ConstructorCall cc, TypeMention tm)
  )
 }

-/** Holds if `loc` has the container `container` and is on the line starting at `startLine`. */
-pragma[nomagic]
-private predicate hasContainerAndStartLine(Location loc, Container container, int startLine) {
-  loc.getStartLine() = startLine and
-  loc.getContainer() = container
-}
-
 /**
 * Gets an element, of kind `kind`, that element `e` uses, if any.
 * Attention: This predicate yields multiple definitions for a single location.
@@ -166,9 +159,9 @@ Top definitionOf(Top e, string kind) {
    // Multiple type mentions can be generated when a typedef is used, and
    // in such cases we want to exclude all but the originating typedef.
    not exists(Type secondary |
-      exists(File f, int startline, int startcol |
+      exists(TypeMention tm, File f, int startline, int startcol |
        typeMentionStartLoc(e, result, f, startline, startcol) and
-        typeMentionStartLoc(_, secondary, f, startline, startcol) and
+        typeMentionStartLoc(tm, secondary, f, startline, startcol) and
        (
          result = secondary.(TypedefType).getBaseType() or
          result = secondary.(TypedefType).getBaseType().(SpecifiedType).getBaseType()
@@ -191,9 +184,11 @@ Top definitionOf(Top e, string kind) {
    kind = "I" and
    result = e.(Include).getIncludedFile() and
    // exclude `#include` directives containing macros
-    not exists(MacroInvocation mi, Container container, int startLine |
-      hasContainerAndStartLine(e.(Include).getLocation(), container, startLine) and
-      hasContainerAndStartLine(mi.getLocation(), container, startLine)
+    not exists(MacroInvocation mi, Location l1, Location l2 |
+      l1 = e.(Include).getLocation() and
+      l2 = mi.getLocation() and
+      l1.getContainer() = l2.getContainer() and
+      l1.getStartLine() = l2.getStartLine()
      // (an #include directive must be always on it's own line)
    )
  ) and
--- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
@@ -916,15 +916,15 @@ private module Cached {
    TDataFlowCallSome(DataFlowCall call)

  cached
-  newtype TParamNodeOption =
-    TParamNodeNone() or
-    TParamNodeSome(ParamNode p)
+  newtype TParameterPositionOption =
+    TParameterPositionNone() or
+    TParameterPositionSome(ParameterPosition pos)

  cached
  newtype TReturnCtx =
    TReturnCtxNone() or
    TReturnCtxNoFlowThrough() or
-    TReturnCtxMaybeFlowThrough(ReturnPosition pos)
+    TReturnCtxMaybeFlowThrough(ReturnKindExt kind)

  cached
  newtype TTypedContentApprox =
@@ -1343,15 +1343,15 @@ class DataFlowCallOption extends TDataFlowCallOption {
  }
 }

-/** An optional `ParamNode`. */
-class ParamNodeOption extends TParamNodeOption {
+/** An optional `ParameterPosition`. */
+class ParameterPositionOption extends TParameterPositionOption {
  string toString() {
-    this = TParamNodeNone() and
+    this = TParameterPositionNone() and
    result = "(none)"
    or
-    exists(ParamNode p |
-      this = TParamNodeSome(p) and
-      result = p.toString()
+    exists(ParameterPosition pos |
+      this = TParameterPositionSome(pos) and
+      result = pos.toString()
    )
  }
 }
@@ -1363,7 +1363,7 @@ class ParamNodeOption extends TParamNodeOption {
 *
 * - `TReturnCtxNone()`: no return flow.
 * - `TReturnCtxNoFlowThrough()`: return flow, but flow through is not possible.
- * - `TReturnCtxMaybeFlowThrough(ReturnPosition pos)`: return flow, of kind `pos`, and
+ * - `TReturnCtxMaybeFlowThrough(ReturnKindExt kind)`: return flow, of kind `kind`, and
 *    flow through may be possible.
 */
 class ReturnCtx extends TReturnCtx {
@@ -1374,9 +1374,9 @@ class ReturnCtx extends TReturnCtx {
    this = TReturnCtxNoFlowThrough() and
    result = "(no flow through)"
    or
-    exists(ReturnPosition pos |
-      this = TReturnCtxMaybeFlowThrough(pos) and
-      result = pos.toString()
+    exists(ReturnKindExt kind |
+      this = TReturnCtxMaybeFlowThrough(kind) and
+      result = kind.toString()
    )
  }
 }
--- a/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
@@ -45,16 +45,6 @@ module Consistency {
    ) {
      none()
    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
-    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
-    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
  }

  private class RelevantNode extends Node {
@@ -111,7 +101,9 @@ module Consistency {
    exists(int c |
      c =
        strictcount(Node n |
-          not n.hasLocationInfo(_, _, _, _, _) and
+          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+          ) and
          not any(ConsistencyConfiguration conf).missingLocationExclude(n)
        ) and
      msg = "Nodes without location: " + c
@@ -256,7 +248,6 @@ module Consistency {
  query predicate uniqueParameterNodeAtPosition(
    DataFlowCallable c, ParameterPosition pos, Node p, string msg
  ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
    isParameterNode(p, c, pos) and
    not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
    msg = "Parameters with overlapping positions."
@@ -265,7 +256,6 @@ module Consistency {
  query predicate uniqueParameterNodePosition(
    DataFlowCallable c, ParameterPosition pos, Node p, string msg
  ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
    isParameterNode(p, c, pos) and
    not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
    msg = "Parameter node with multiple positions."
--- a/cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/ArrayLengthAnalysis.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/ArrayLengthAnalysis.qll
@@ -218,7 +218,7 @@ private predicate allocation(Instruction array, Length length, int delta) {
          length.(VNLength).getInstruction().getConvertedResultExpression() = lengthExpr
        )
        or
-        not deconstructMallocSizeExpr(alloc.getSizeExpr(), _, _) and
+        not exists(int d | deconstructMallocSizeExpr(alloc.getSizeExpr(), _, d)) and
        length.(VNLength).getInstruction().getConvertedResultExpression() = alloc.getSizeExpr() and
        delta = 0
      )
--- a/cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/RangeAnalysis.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/rangeanalysis/RangeAnalysis.qll
@@ -543,7 +543,9 @@ private predicate boundedPhiCand(
  PhiInstruction phi, boolean upper, Bound b, int delta, boolean fromBackEdge, int origdelta,
  Reason reason
 ) {
-  boundedPhiInp(phi, _, b, delta, upper, fromBackEdge, origdelta, reason)
+  exists(PhiInputOperand op |
+    boundedPhiInp(phi, op, b, delta, upper, fromBackEdge, origdelta, reason)
+  )
 }

 /**
--- a/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll
+++ b/cpp/ql/lib/experimental/semmle/code/cpp/semantic/analysis/RangeAnalysis.qll
@@ -664,7 +664,9 @@ private predicate boundedPhiCand(
  SemSsaPhiNode phi, boolean upper, SemBound b, int delta, boolean fromBackEdge, int origdelta,
  SemReason reason
 ) {
-  boundedPhiInp(phi, _, _, b, delta, upper, fromBackEdge, origdelta, reason)
+  exists(SemSsaVariable inp, SemSsaReadPositionPhiInputEdge edge |
+    boundedPhiInp(phi, inp, edge, b, delta, upper, fromBackEdge, origdelta, reason)
+  )
 }

 /**
--- a/cpp/ql/lib/qlpack.yml
+++ b/cpp/ql/lib/qlpack.yml
@@ -1,5 +1,5 @@
 name: codeql/cpp-all
-version: 0.5.1-dev
+version: 0.4.6-dev
 groups: cpp
 dbscheme: semmlecode.cpp.dbscheme
 extractor: cpp
@@ -7,4 +7,3 @@ library: true
 upgrades: upgrades
 dependencies:
  codeql/ssa: ${workspace}
-  codeql/tutorial: ${workspace}
--- a/cpp/ql/lib/semmle/code/cpp/Function.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Function.qll
@@ -318,7 +318,7 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
  MetricFunction getMetrics() { result = this }

  /** Holds if this function calls the function `f`. */
-  predicate calls(Function f) { this.calls(f, _) }
+  predicate calls(Function f) { exists(Locatable l | this.calls(f, l)) }

  /**
   * Holds if this function calls the function `f` in the `FunctionCall`
@@ -335,7 +335,7 @@ class Function extends Declaration, ControlFlowNode, AccessHolder, @function {
  }

  /** Holds if this function accesses a function or variable or enumerator `a`. */
-  predicate accesses(Declaration a) { this.accesses(a, _) }
+  predicate accesses(Declaration a) { exists(Locatable l | this.accesses(a, l)) }

  /**
   * Holds if this function accesses a function or variable or enumerator `a`
--- a/cpp/ql/lib/semmle/code/cpp/Location.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Location.qll
@@ -10,14 +10,12 @@ import semmle.code.cpp.File
 */
 class Location extends @location {
  /** Gets the container corresponding to this location. */
-  pragma[nomagic]
  Container getContainer() { this.fullLocationInfo(result, _, _, _, _) }

  /** Gets the file corresponding to this location, if any. */
  File getFile() { result = this.getContainer() }

  /** Gets the 1-based line number (inclusive) where this location starts. */
-  pragma[nomagic]
  int getStartLine() { this.fullLocationInfo(_, result, _, _, _) }

  /** Gets the 1-based column number (inclusive) where this location starts. */
--- a/cpp/ql/lib/semmle/code/cpp/Type.qll
+++ b/cpp/ql/lib/semmle/code/cpp/Type.qll
@@ -816,12 +816,6 @@ private predicate floatingPointTypeMapping(
  or
  // _Float128x
  kind = 50 and base = 2 and domain = TRealDomain() and realKind = 50 and extended = true
-  or
-  // _Float16
-  kind = 52 and base = 2 and domain = TRealDomain() and realKind = 52 and extended = false
-  or
-  // _Complex _Float16
-  kind = 53 and base = 2 and domain = TComplexDomain() and realKind = 52 and extended = false
 }

 /**
--- a/cpp/ql/lib/semmle/code/cpp/commons/Dependency.qll
+++ b/cpp/ql/lib/semmle/code/cpp/commons/Dependency.qll
@@ -33,7 +33,7 @@ DependencyOptions getDependencyOptions() { any() }
 class DependsSource extends Element {
  DependsSource() {
    // not inside a template instantiation
-    not this.isFromTemplateInstantiation(_) or
+    not exists(Element other | this.isFromTemplateInstantiation(other)) or
    // allow DeclarationEntrys of template specializations
    this.(DeclarationEntry).getDeclaration().(Function).isConstructedFrom(_) or
    this.(DeclarationEntry).getDeclaration().(Class).isConstructedFrom(_)
--- a/cpp/ql/lib/semmle/code/cpp/commons/Exclusions.qll
+++ b/cpp/ql/lib/semmle/code/cpp/commons/Exclusions.qll
@@ -69,9 +69,12 @@ predicate functionContainsDisabledCode(Function f) {
 */
 predicate functionContainsPreprocCode(Function f) {
  // `f` contains a preprocessor branch
-  exists(string file, int pbdStartLine, int fBlockStartLine, int fBlockEndLine |
+  exists(
+    PreprocessorBranchDirective pbd, string file, int pbdStartLine, int fBlockStartLine,
+    int fBlockEndLine
+  |
    functionLocation(f, file, fBlockStartLine, fBlockEndLine) and
-    pbdLocation(_, file, pbdStartLine) and
+    pbdLocation(pbd, file, pbdStartLine) and
    pbdStartLine <= fBlockEndLine and
    pbdStartLine >= fBlockStartLine
  )
--- a/cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll
+++ b/cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll
@@ -244,7 +244,9 @@ class ScanfFormatLiteral extends Expr {
  /**
   * Gets the maximum width option of the nth input (empty string if none is given).
   */
-  string getMaxWidthOpt(int n) { this.parseConvSpec(n, _, result, _, _) }
+  string getMaxWidthOpt(int n) {
+    exists(string spec, string len, string conv | this.parseConvSpec(n, spec, result, len, conv))
+  }

  /**
   * Gets the maximum width of the nth input.
@@ -254,12 +256,18 @@ class ScanfFormatLiteral extends Expr {
  /**
   * Gets the length flag of the nth conversion specifier.
   */
-  string getLength(int n) { this.parseConvSpec(n, _, _, result, _) }
+  string getLength(int n) {
+    exists(string spec, string width, string conv |
+      this.parseConvSpec(n, spec, width, result, conv)
+    )
+  }

  /**
   * Gets the conversion character of the nth conversion specifier.
   */
-  string getConversionChar(int n) { this.parseConvSpec(n, _, _, _, result) }
+  string getConversionChar(int n) {
+    exists(string spec, string width, string len | this.parseConvSpec(n, spec, width, len, result))
+  }

  /**
   * Gets the maximum length of the string that can be produced by the nth
--- a/cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll
+++ b/cpp/ql/lib/semmle/code/cpp/controlflow/SubBasicBlocks.qll
@@ -54,7 +54,7 @@ class SubBasicBlock extends ControlFlowNodeBase {
   * only condition under which a `SubBasicBlock` may have multiple
   * predecessors.
   */
-  predicate firstInBB() { this.getRankInBasicBlock(_) = 1 }
+  predicate firstInBB() { exists(BasicBlock bb | this.getRankInBasicBlock(bb) = 1) }

  /**
   * Holds if this `SubBasicBlock` comes last in its basic block. This is the
--- a/cpp/ql/lib/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
+++ b/cpp/ql/lib/semmle/code/cpp/controlflow/internal/ConstantExprs.qll
@@ -441,8 +441,8 @@ library class ExprEvaluator extends int {
      req = mid.(AssignExpr).getRValue()
    )
    or
-    exists(Variable v, boolean sub1 |
-      this.interestingVariableAccess(e, _, v, sub1) and
+    exists(VariableAccess va, Variable v, boolean sub1 |
+      this.interestingVariableAccess(e, va, v, sub1) and
      req = v.getAnAssignedValue() and
      (sub1 = true implies not this.ignoreVariableAssignment(e, v, req)) and
      sub = false
@@ -876,7 +876,7 @@ private predicate nonAnalyzableVariableDefinition(Variable v, StmtParent def) {
 * empirically to have effect only on a few rare and pathological examples.
 */
 private predicate tractableVariable(Variable v) {
-  not nonAnalyzableVariableDefinition(v, _) or
+  not exists(StmtParent def | nonAnalyzableVariableDefinition(v, def)) or
  strictcount(StmtParent def | nonAnalyzableVariableDefinition(v, def)) < 1000
 }

--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll
@@ -916,15 +916,15 @@ private module Cached {
    TDataFlowCallSome(DataFlowCall call)

  cached
-  newtype TParamNodeOption =
-    TParamNodeNone() or
-    TParamNodeSome(ParamNode p)
+  newtype TParameterPositionOption =
+    TParameterPositionNone() or
+    TParameterPositionSome(ParameterPosition pos)

  cached
  newtype TReturnCtx =
    TReturnCtxNone() or
    TReturnCtxNoFlowThrough() or
-    TReturnCtxMaybeFlowThrough(ReturnPosition pos)
+    TReturnCtxMaybeFlowThrough(ReturnKindExt kind)

  cached
  newtype TTypedContentApprox =
@@ -1343,15 +1343,15 @@ class DataFlowCallOption extends TDataFlowCallOption {
  }
 }

-/** An optional `ParamNode`. */
-class ParamNodeOption extends TParamNodeOption {
+/** An optional `ParameterPosition`. */
+class ParameterPositionOption extends TParameterPositionOption {
  string toString() {
-    this = TParamNodeNone() and
+    this = TParameterPositionNone() and
    result = "(none)"
    or
-    exists(ParamNode p |
-      this = TParamNodeSome(p) and
-      result = p.toString()
+    exists(ParameterPosition pos |
+      this = TParameterPositionSome(pos) and
+      result = pos.toString()
    )
  }
 }
@@ -1363,7 +1363,7 @@ class ParamNodeOption extends TParamNodeOption {
 *
 * - `TReturnCtxNone()`: no return flow.
 * - `TReturnCtxNoFlowThrough()`: return flow, but flow through is not possible.
- * - `TReturnCtxMaybeFlowThrough(ReturnPosition pos)`: return flow, of kind `pos`, and
+ * - `TReturnCtxMaybeFlowThrough(ReturnKindExt kind)`: return flow, of kind `kind`, and
 *    flow through may be possible.
 */
 class ReturnCtx extends TReturnCtx {
@@ -1374,9 +1374,9 @@ class ReturnCtx extends TReturnCtx {
    this = TReturnCtxNoFlowThrough() and
    result = "(no flow through)"
    or
-    exists(ReturnPosition pos |
-      this = TReturnCtxMaybeFlowThrough(pos) and
-      result = pos.toString()
+    exists(ReturnKindExt kind |
+      this = TReturnCtxMaybeFlowThrough(kind) and
+      result = kind.toString()
    )
  }
 }
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll
@@ -45,16 +45,6 @@ module Consistency {
    ) {
      none()
    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
-    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
-    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
  }

  private class RelevantNode extends Node {
@@ -111,7 +101,9 @@ module Consistency {
    exists(int c |
      c =
        strictcount(Node n |
-          not n.hasLocationInfo(_, _, _, _, _) and
+          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+          ) and
          not any(ConsistencyConfiguration conf).missingLocationExclude(n)
        ) and
      msg = "Nodes without location: " + c
@@ -256,7 +248,6 @@ module Consistency {
  query predicate uniqueParameterNodeAtPosition(
    DataFlowCallable c, ParameterPosition pos, Node p, string msg
  ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
    isParameterNode(p, c, pos) and
    not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
    msg = "Parameters with overlapping positions."
@@ -265,7 +256,6 @@ module Consistency {
  query predicate uniqueParameterNodePosition(
    DataFlowCallable c, ParameterPosition pos, Node p, string msg
  ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
    isParameterNode(p, c, pos) and
    not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
    msg = "Parameter node with multiple positions."
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/FlowVar.qll
@@ -450,8 +450,10 @@ module FlowVar_internal {
    }

    override string toString() {
-      this.definedByExpr(_, _) and
-      result = "assignment to " + v
+      exists(Expr e |
+        this.definedByExpr(e, _) and
+        result = "assignment to " + v
+      )
      or
      this.definedByInitialValue(_) and
      result = "initial value of " + v
--- a/cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll
@@ -54,7 +54,7 @@ class SubBasicBlock extends ControlFlowNodeBase {
   * only condition under which a `SubBasicBlock` may have multiple
   * predecessors.
   */
-  predicate firstInBB() { this.getRankInBasicBlock(_) = 1 }
+  predicate firstInBB() { exists(BasicBlock bb | this.getRankInBasicBlock(bb) = 1) }

  /**
   * Holds if this `SubBasicBlock` comes last in its basic block. This is the
--- a/cpp/ql/lib/semmle/code/cpp/dispatch/VirtualDispatchPrototype.qll
+++ b/cpp/ql/lib/semmle/code/cpp/dispatch/VirtualDispatchPrototype.qll
@@ -70,8 +70,8 @@ module VirtualDispatch {
   * that is, `c` or one of its supertypes overrides `f`.
   */
  private predicate cannotInherit(Class c, MemberFunction f) {
-    exists(MemberFunction override |
-      cannotInheritHelper(c, f, _, override) and
+    exists(Class overridingType, MemberFunction override |
+      cannotInheritHelper(c, f, overridingType, override) and
      override.overrides+(f)
    )
  }
--- a/cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll
+++ b/cpp/ql/lib/semmle/code/cpp/exprs/Expr.qll
@@ -53,7 +53,7 @@ class Expr extends StmtParent, @expr {
  Declaration getEnclosingDeclaration() { result = exprEnclosingElement(this) }

  /** Gets a child of this expression. */
-  Expr getAChild() { result = this.getChild(_) }
+  Expr getAChild() { exists(int n | result = this.getChild(n)) }

  /** Gets the parent of this expression, if any. */
  Element getParent() { exprparents(underlyingElement(this), _, unresolveElement(result)) }
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll
@@ -622,11 +622,7 @@ private predicate parameterFlowThroughAllowed(ParamNodeEx p, ReturnKindExt kind)
 }

 private module Stage1 implements StageSig {
-  class Ap extends int {
-    // workaround for bad functionality-induced joins (happens when using `Unit`)
-    pragma[nomagic]
-    Ap() { this in [0 .. 1] and this < 1 }
-  }
+  class Ap = Unit;

  private class Cc = boolean;

@@ -876,9 +872,9 @@ private module Stage1 implements StageSig {

  pragma[nomagic]
  private predicate revFlowOut(ReturnPosition pos, Configuration config) {
-    exists(NodeEx out |
+    exists(DataFlowCall call, NodeEx out |
      revFlow(out, _, config) and
-      viableReturnPosOutNodeCandFwd1(_, pos, out, config)
+      viableReturnPosOutNodeCandFwd1(call, pos, out, config)
    )
  }

@@ -1331,8 +1327,8 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      fwdFlow0(node, state, cc, summaryCtx, argAp, ap, apa, config) and
      PrevStage::revFlow(node, state, apa, config) and
@@ -1341,21 +1337,21 @@ private module MkStage<StageSig PrevStage> {

    pragma[inline]
    additional predicate fwdFlow(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, Configuration config
    ) {
      fwdFlow(node, state, cc, summaryCtx, argAp, ap, _, config)
    }

    pragma[nomagic]
    private predicate fwdFlow0(
-      NodeEx node, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap,
-      ApApprox apa, Configuration config
+      NodeEx node, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      Ap ap, ApApprox apa, Configuration config
    ) {
      sourceNode(node, state, config) and
      (if hasSourceCallCtx(config) then cc = ccSomeCall() else cc = ccNone()) and
      argAp = apNone() and
-      summaryCtx = TParamNodeNone() and
+      summaryCtx = TParameterPositionNone() and
      ap = getApNil(node) and
      apa = getApprox(ap)
      or
@@ -1376,7 +1372,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, pragma[only_bind_into](state), _, _, _, ap, apa, pragma[only_bind_into](config)) and
        jumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone()
      )
      or
@@ -1384,7 +1380,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStep(mid, node, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1394,7 +1390,7 @@ private module MkStage<StageSig PrevStage> {
        fwdFlow(mid, state0, _, _, _, nil, pragma[only_bind_into](config)) and
        additionalJumpStateStep(mid, state0, node, state, config) and
        cc = ccNone() and
-        summaryCtx = TParamNodeNone() and
+        summaryCtx = TParameterPositionNone() and
        argAp = apNone() and
        ap = getApNil(node) and
        apa = getApprox(ap)
@@ -1418,10 +1414,10 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowIn(_, node, state, _, cc, _, _, ap, apa, config) and
      if PrevStage::parameterMayFlowThrough(node, apa, config)
      then (
-        summaryCtx = TParamNodeSome(node.asNode()) and
+        summaryCtx = TParameterPositionSome(node.(ParamNodeEx).getPosition()) and
        argAp = apSome(ap)
      ) else (
-        summaryCtx = TParamNodeNone() and argAp = apNone()
+        summaryCtx = TParameterPositionNone() and argAp = apNone()
      )
      or
      // flow out of a callable
@@ -1437,19 +1433,16 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(
-        DataFlowCall call, CcCall ccc, RetNodeEx ret, boolean allowsFieldFlow, ApApprox innerArgApa
-      |
-        fwdFlowThrough(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, node, allowsFieldFlow, innerArgApa, apa, config) and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(DataFlowCall call, ParameterPosition summaryCtx0, Ap argAp0 |
+        fwdFlowOutFromArg(call, node, state, summaryCtx0, argAp0, ap, apa, config) and
+        fwdFlowIsEntered(call, cc, summaryCtx, argAp, summaryCtx0, argAp0, config)
      )
    }

    pragma[nomagic]
    private predicate fwdFlowStore(
      NodeEx node1, Ap ap1, TypedContent tc, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      exists(DataFlowType contentType, ApApprox apa1 |
        fwdFlow(node1, state, cc, summaryCtx, argAp, ap1, apa1, config) and
@@ -1480,8 +1473,8 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRead0(
-      NodeEx node1, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, ApNonNil ap,
-      Configuration config
+      NodeEx node1, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ApNonNil ap, Configuration config
    ) {
      fwdFlow(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, _, _, config)
@@ -1490,7 +1483,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowRead(
      Ap ap, Content c, NodeEx node1, NodeEx node2, FlowState state, Cc cc,
-      ParamNodeOption summaryCtx, ApOption argAp, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Configuration config
    ) {
      fwdFlowRead0(node1, state, cc, summaryCtx, argAp, ap, config) and
      PrevStage::readStepCand(node1, c, node2, config) and
@@ -1500,7 +1493,7 @@ private module MkStage<StageSig PrevStage> {
    pragma[nomagic]
    private predicate fwdFlowIn(
      DataFlowCall call, ParamNodeEx p, FlowState state, Cc outercc, CcCall innercc,
-      ParamNodeOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
+      ParameterPositionOption summaryCtx, ApOption argAp, Ap ap, ApApprox apa, Configuration config
    ) {
      exists(ArgNodeEx arg, boolean allowsFieldFlow |
        fwdFlow(arg, state, outercc, summaryCtx, argAp, ap, apa, config) and
@@ -1512,38 +1505,64 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate fwdFlowRetFromArg(
-      RetNodeEx ret, FlowState state, CcCall ccc, ParamNodeEx summaryCtx, Ap argAp, ApApprox argApa,
-      Ap ap, ApApprox apa, Configuration config
+      RetNodeEx ret, FlowState state, CcCall ccc, ParameterPosition summaryCtx, ParamNodeEx p,
+      Ap argAp, ApApprox argApa, Ap ap, ApApprox apa, Configuration config
    ) {
-      exists(ReturnKindExt kind |
+      exists(DataFlowCallable c, ReturnKindExt kind |
        fwdFlow(pragma[only_bind_into](ret), state, ccc,
-          TParamNodeSome(pragma[only_bind_into](summaryCtx.asNode())),
-          pragma[only_bind_into](apSome(argAp)), ap, pragma[only_bind_into](apa),
-          pragma[only_bind_into](config)) and
+          TParameterPositionSome(pragma[only_bind_into](summaryCtx)), apSome(argAp), ap, apa, config) and
+        getApprox(argAp) = argApa and
+        c = ret.getEnclosingCallable() and
        kind = ret.getKind() and
-        parameterFlowThroughAllowed(summaryCtx, kind) and
-        argApa = getApprox(argAp) and
-        PrevStage::returnMayFlowThrough(ret, argApa, apa, kind, pragma[only_bind_into](config))
+        p.isParameterOf(c, pragma[only_bind_into](summaryCtx)) and
+        parameterFlowThroughAllowed(p, kind)
      )
    }

    pragma[inline]
-    private predicate fwdFlowThrough0(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ParamNodeEx innerSummaryCtx,
-      Ap innerArgAp, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowInMayFlowThrough(
+      DataFlowCall call, Cc cc, CcCall innerCc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParamNodeEx param, Ap ap, ApApprox apa, Configuration config
    ) {
-      fwdFlowRetFromArg(ret, state, ccc, innerSummaryCtx, innerArgAp, innerArgApa, ap, apa, config) and
-      fwdFlowIsEntered(call, cc, ccc, summaryCtx, argAp, innerSummaryCtx, innerArgAp, config)
+      fwdFlowIn(call, pragma[only_bind_into](param), _, cc, innerCc, summaryCtx, argAp, ap,
+        pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
+      PrevStage::parameterMayFlowThrough(param, apa, config)
+    }
+
+    // dedup before joining with `flowThroughOutOfCall`
+    pragma[nomagic]
+    private predicate fwdFlowInMayFlowThroughProj(
+      DataFlowCall call, CcCall innerCc, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThrough(call, _, innerCc, _, _, _, _, apa, config)
+    }
+
+    /**
+     * Same as `flowThroughOutOfCall`, but restricted to calls that are reached
+     * in the flow covered by `fwdFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
+    pragma[nomagic]
+    private predicate fwdFlowThroughOutOfCall(
+      DataFlowCall call, CcCall ccc, RetNodeEx ret, NodeEx out, boolean allowsFieldFlow,
+      ApApprox argApa, ApApprox apa, Configuration config
+    ) {
+      fwdFlowInMayFlowThroughProj(call, ccc, argApa, config) and
+      flowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config)
    }

    pragma[nomagic]
-    private predicate fwdFlowThrough(
-      DataFlowCall call, Cc cc, FlowState state, CcCall ccc, ParamNodeOption summaryCtx,
-      ApOption argAp, Ap ap, ApApprox apa, RetNodeEx ret, ApApprox innerArgApa, Configuration config
+    private predicate fwdFlowOutFromArg(
+      DataFlowCall call, NodeEx out, FlowState state, ParameterPosition summaryCtx, Ap argAp, Ap ap,
+      ApApprox apa, Configuration config
    ) {
-      fwdFlowThrough0(call, cc, state, ccc, summaryCtx, argAp, ap, apa, ret, _, _, innerArgApa,
-        config)
+      exists(RetNodeEx ret, boolean allowsFieldFlow, CcCall ccc, ApApprox argApa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc),
+          summaryCtx, _, argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa),
+          config) and
+        fwdFlowThroughOutOfCall(call, ccc, ret, out, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
+      )
    }

    /**
@@ -1552,14 +1571,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate fwdFlowIsEntered(
-      DataFlowCall call, Cc cc, CcCall innerCc, ParamNodeOption summaryCtx, ApOption argAp,
-      ParamNodeEx p, Ap ap, Configuration config
+      DataFlowCall call, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+      ParameterPosition pos, Ap ap, Configuration config
    ) {
-      exists(ApApprox apa |
-        fwdFlowIn(call, pragma[only_bind_into](p), _, cc, innerCc, summaryCtx, argAp, ap,
-          pragma[only_bind_into](apa), pragma[only_bind_into](config)) and
-        PrevStage::parameterMayFlowThrough(p, apa, config) and
-        PrevStage::callMayFlowThroughRev(call, pragma[only_bind_into](config))
+      exists(ParamNodeEx param |
+        fwdFlowInMayFlowThrough(call, cc, _, summaryCtx, argAp, param, ap, _, config) and
+        pos = param.getPosition()
      )
    }

@@ -1579,31 +1596,23 @@ private module MkStage<StageSig PrevStage> {
      fwdFlowConsCand(ap1, c, ap2, config)
    }

-    pragma[nomagic]
-    private predicate returnFlowsThrough0(
-      DataFlowCall call, FlowState state, CcCall ccc, Ap ap, ApApprox apa, RetNodeEx ret,
-      ParamNodeEx innerSummaryCtx, Ap innerArgAp, ApApprox innerArgApa, Configuration config
-    ) {
-      fwdFlowThrough0(call, _, state, ccc, _, _, ap, apa, ret, innerSummaryCtx, innerArgAp,
-        innerArgApa, config)
-    }
-
    pragma[nomagic]
    private predicate returnFlowsThrough(
-      RetNodeEx ret, ReturnPosition pos, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
+      RetNodeEx ret, ReturnKindExt kind, FlowState state, CcCall ccc, ParamNodeEx p, Ap argAp,
      Ap ap, Configuration config
    ) {
-      exists(DataFlowCall call, ApApprox apa, boolean allowsFieldFlow, ApApprox innerArgApa |
-        returnFlowsThrough0(call, state, ccc, ap, apa, ret, p, argAp, innerArgApa, config) and
-        flowThroughOutOfCall(call, ccc, ret, _, allowsFieldFlow, innerArgApa, apa, config) and
-        pos = ret.getReturnPosition() and
-        if allowsFieldFlow = false then ap instanceof ApNil else any()
+      exists(boolean allowsFieldFlow, ApApprox argApa, ApApprox apa |
+        fwdFlowRetFromArg(pragma[only_bind_into](ret), state, pragma[only_bind_into](ccc), _, p,
+          argAp, pragma[only_bind_into](argApa), ap, pragma[only_bind_into](apa), config) and
+        kind = ret.getKind() and
+        fwdFlowThroughOutOfCall(_, ccc, ret, _, allowsFieldFlow, argApa, apa, config) and
+        (if allowsFieldFlow = false then ap instanceof ApNil else any())
      )
    }

    pragma[nomagic]
    private predicate flowThroughIntoCall(
-      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp, Ap ap,
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
      Configuration config
    ) {
      exists(ApApprox argApa |
@@ -1611,7 +1620,7 @@ private module MkStage<StageSig PrevStage> {
          allowsFieldFlow, argApa, pragma[only_bind_into](config)) and
        fwdFlow(arg, _, _, _, _, pragma[only_bind_into](argAp), argApa,
          pragma[only_bind_into](config)) and
-        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), ap,
+        returnFlowsThrough(_, _, _, _, p, pragma[only_bind_into](argAp), _,
          pragma[only_bind_into](config)) and
        if allowsFieldFlow = false then argAp instanceof ApNil else any()
      )
@@ -1630,13 +1639,12 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate flowOutOfCallAp(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, NodeEx out, boolean allowsFieldFlow,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, NodeEx out, boolean allowsFieldFlow,
      Ap ap, Configuration config
    ) {
      exists(ApApprox apa |
-        flowOutOfCallApa(call, ret, _, out, allowsFieldFlow, apa, config) and
-        fwdFlow(ret, _, _, _, _, ap, apa, config) and
-        pos = ret.getReturnPosition()
+        flowOutOfCallApa(call, ret, kind, out, allowsFieldFlow, apa, config) and
+        fwdFlow(ret, _, _, _, _, ap, apa, config)
      )
    }

@@ -1731,17 +1739,17 @@ private module MkStage<StageSig PrevStage> {
      )
      or
      // flow through a callable
-      exists(DataFlowCall call, ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, node, p, _, ap, innerReturnAp, config)
+      exists(DataFlowCall call, ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, node, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
      or
      // flow out of a callable
-      exists(ReturnPosition pos |
-        revFlowOut(_, node, pos, state, _, _, ap, config) and
-        if returnFlowsThrough(node, pos, state, _, _, _, ap, config)
+      exists(ReturnKindExt kind |
+        revFlowOut(_, node, kind, state, _, _, ap, config) and
+        if returnFlowsThrough(node, kind, state, _, _, _, ap, config)
        then (
-          returnCtx = TReturnCtxMaybeFlowThrough(pos) and
+          returnCtx = TReturnCtxMaybeFlowThrough(kind) and
          returnAp = apSome(ap)
        ) else (
          returnCtx = TReturnCtxNoFlowThrough() and returnAp = apNone()
@@ -1774,33 +1782,47 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate revFlowOut(
-      DataFlowCall call, RetNodeEx ret, ReturnPosition pos, FlowState state, ReturnCtx returnCtx,
+      DataFlowCall call, RetNodeEx ret, ReturnKindExt kind, FlowState state, ReturnCtx returnCtx,
      ApOption returnAp, Ap ap, Configuration config
    ) {
      exists(NodeEx out, boolean allowsFieldFlow |
        revFlow(out, state, returnCtx, returnAp, ap, config) and
-        flowOutOfCallAp(call, ret, pos, out, allowsFieldFlow, ap, config) and
+        flowOutOfCallAp(call, ret, kind, out, allowsFieldFlow, ap, config) and
        if allowsFieldFlow = false then ap instanceof ApNil else any()
      )
    }

+    /**
+     * Same as `flowThroughIntoCall`, but restricted to calls that are reached
+     * in the flow covered by `revFlow`, where data might flow through the target
+     * callable and back out at `call`.
+     */
    pragma[nomagic]
-    private predicate revFlowParamToReturn(
-      ParamNodeEx p, FlowState state, ReturnPosition pos, Ap returnAp, Ap ap, Configuration config
+    private predicate revFlowThroughIntoCall(
+      DataFlowCall call, ArgNodeEx arg, ParamNodeEx p, boolean allowsFieldFlow, Ap argAp,
+      Configuration config
    ) {
-      revFlow(pragma[only_bind_into](p), state, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp),
-        pragma[only_bind_into](ap), pragma[only_bind_into](config)) and
-      parameterFlowThroughAllowed(p, pos.getKind()) and
-      PrevStage::parameterMayFlowThrough(p, getApprox(ap), config)
+      flowThroughIntoCall(call, arg, p, allowsFieldFlow, argAp, config) and
+      revFlowIsReturned(call, _, _, _, _, config)
    }

    pragma[nomagic]
-    private predicate revFlowThrough(
-      DataFlowCall call, ReturnCtx returnCtx, ParamNodeEx p, FlowState state, ReturnPosition pos,
-      ApOption returnAp, Ap ap, Ap innerReturnAp, Configuration config
+    private predicate revFlowParamToReturn(
+      ParamNodeEx p, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap, Configuration config
    ) {
-      revFlowParamToReturn(p, state, pos, innerReturnAp, ap, config) and
-      revFlowIsReturned(call, returnCtx, returnAp, pos, innerReturnAp, config)
+      revFlow(p, state, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
+    }
+
+    pragma[nomagic]
+    private predicate revFlowInToReturn(
+      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnKindExt kind, Ap returnAp, Ap ap,
+      Configuration config
+    ) {
+      exists(ParamNodeEx p, boolean allowsFieldFlow |
+        revFlowParamToReturn(p, state, kind, returnAp, ap, config) and
+        revFlowThroughIntoCall(call, arg, p, allowsFieldFlow, ap, config)
+      )
    }

    /**
@@ -1810,12 +1832,12 @@ private module MkStage<StageSig PrevStage> {
     */
    pragma[nomagic]
    private predicate revFlowIsReturned(
-      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnPosition pos, Ap ap,
+      DataFlowCall call, ReturnCtx returnCtx, ApOption returnAp, ReturnKindExt kind, Ap ap,
      Configuration config
    ) {
      exists(RetNodeEx ret, FlowState state, CcCall ccc |
-        revFlowOut(call, ret, pos, state, returnCtx, returnAp, ap, config) and
-        returnFlowsThrough(ret, pos, state, ccc, _, _, ap, config) and
+        revFlowOut(call, ret, kind, state, returnCtx, returnAp, ap, config) and
+        returnFlowsThrough(ret, kind, state, ccc, _, _, ap, config) and
        matchesCall(ccc, call)
      )
    }
@@ -1893,17 +1915,17 @@ private module MkStage<StageSig PrevStage> {

    pragma[nomagic]
    private predicate parameterFlowsThroughRev(
-      ParamNodeEx p, Ap ap, ReturnPosition pos, Ap returnAp, Configuration config
+      ParamNodeEx p, Ap ap, ReturnKindExt kind, Ap returnAp, Configuration config
    ) {
-      revFlow(p, _, TReturnCtxMaybeFlowThrough(pos), apSome(returnAp), ap, config) and
-      parameterFlowThroughAllowed(p, pos.getKind())
+      revFlow(p, _, TReturnCtxMaybeFlowThrough(kind), apSome(returnAp), ap, config) and
+      parameterFlowThroughAllowed(p, kind)
    }

    pragma[nomagic]
    predicate parameterMayFlowThrough(ParamNodeEx p, Ap ap, Configuration config) {
-      exists(ReturnPosition pos |
-        returnFlowsThrough(_, pos, _, _, p, ap, _, config) and
-        parameterFlowsThroughRev(p, ap, pos, _, config)
+      exists(RetNodeEx ret, ReturnKindExt kind |
+        returnFlowsThrough(ret, kind, _, _, p, ap, _, config) and
+        parameterFlowsThroughRev(p, ap, kind, _, config)
      )
    }

@@ -1911,21 +1933,20 @@ private module MkStage<StageSig PrevStage> {
    predicate returnMayFlowThrough(
      RetNodeEx ret, Ap argAp, Ap ap, ReturnKindExt kind, Configuration config
    ) {
-      exists(ParamNodeEx p, ReturnPosition pos |
-        returnFlowsThrough(ret, pos, _, _, p, argAp, ap, config) and
-        parameterFlowsThroughRev(p, argAp, pos, ap, config) and
-        kind = pos.getKind()
+      exists(ParamNodeEx p |
+        returnFlowsThrough(ret, kind, _, _, p, argAp, ap, config) and
+        parameterFlowsThroughRev(p, argAp, kind, ap, config)
      )
    }

    pragma[nomagic]
-    private predicate revFlowThroughArg(
+    predicate revFlowInToReturnIsReturned(
      DataFlowCall call, ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp,
      Ap ap, Configuration config
    ) {
-      exists(ParamNodeEx p, Ap innerReturnAp |
-        revFlowThrough(call, returnCtx, p, state, _, returnAp, ap, innerReturnAp, config) and
-        flowThroughIntoCall(call, arg, p, _, ap, innerReturnAp, config)
+      exists(ReturnKindExt returnKind0, Ap returnAp0 |
+        revFlowInToReturn(call, arg, state, returnKind0, returnAp0, ap, config) and
+        revFlowIsReturned(call, returnCtx, returnAp, returnKind0, returnAp0, config)
      )
    }

@@ -1933,7 +1954,7 @@ private module MkStage<StageSig PrevStage> {
    predicate callMayFlowThroughRev(DataFlowCall call, Configuration config) {
      exists(ArgNodeEx arg, FlowState state, ReturnCtx returnCtx, ApOption returnAp, Ap ap |
        revFlow(arg, state, returnCtx, returnAp, ap, config) and
-        revFlowThroughArg(call, arg, state, returnCtx, returnAp, ap, config)
+        revFlowInToReturnIsReturned(call, arg, state, returnCtx, returnAp, ap, config)
      )
    }

@@ -1946,9 +1967,8 @@ private module MkStage<StageSig PrevStage> {
      conscand = count(TypedContent f0, Ap ap | fwdConsCand(f0, ap, config)) and
      states = count(FlowState state | fwdFlow(_, state, _, _, _, _, config)) and
      tuples =
-        count(NodeEx n, FlowState state, Cc cc, ParamNodeOption summaryCtx, ApOption argAp, Ap ap |
-          fwdFlow(n, state, cc, summaryCtx, argAp, ap, config)
-        )
+        count(NodeEx n, FlowState state, Cc cc, ParameterPositionOption summaryCtx, ApOption argAp,
+          Ap ap | fwdFlow(n, state, cc, summaryCtx, argAp, ap, config))
      or
      fwd = false and
      nodes = count(NodeEx node | revFlow(node, _, _, _, _, config)) and
@@ -2803,12 +2823,13 @@ private Configuration unbindConf(Configuration conf) {

 pragma[nomagic]
 private predicate nodeMayUseSummary0(
-  NodeEx n, ParamNodeEx p, FlowState state, AccessPathApprox apa, Configuration config
+  NodeEx n, DataFlowCallable c, ParameterPosition pos, FlowState state, AccessPathApprox apa,
+  Configuration config
 ) {
  exists(AccessPathApprox apa0 |
-    Stage5::parameterMayFlowThrough(p, _, _) and
+    c = n.getEnclosingCallable() and
    Stage5::revFlow(n, state, TReturnCtxMaybeFlowThrough(_), _, apa0, config) and
-    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParamNodeSome(p.asNode()),
+    Stage5::fwdFlow(n, state, any(CallContextCall ccc), TParameterPositionSome(pos),
      TAccessPathApproxSome(apa), apa0, config)
  )
 }
@@ -2817,9 +2838,10 @@ pragma[nomagic]
 private predicate nodeMayUseSummary(
  NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
 ) {
-  exists(ParamNodeEx p |
+  exists(DataFlowCallable c, ParameterPosition pos, ParamNodeEx p |
    Stage5::parameterMayFlowThrough(p, apa, config) and
-    nodeMayUseSummary0(n, p, state, apa, config)
+    nodeMayUseSummary0(n, c, pos, state, apa, config) and
+    p.isParameterOf(c, pos)
  )
 }

@@ -3749,8 +3771,8 @@ private predicate paramFlowsThrough(
  ReturnKindExt kind, FlowState state, CallContextCall cc, SummaryCtxSome sc, AccessPath ap,
  AccessPathApprox apa, Configuration config
 ) {
-  exists(RetNodeEx ret |
-    pathNode(_, ret, state, cc, sc, ap, config, _) and
+  exists(PathNodeMid mid, RetNodeEx ret |
+    pathNode(mid, ret, state, cc, sc, ap, config, _) and
    kind = ret.getKind() and
    apa = ap.getApprox() and
    parameterFlowThroughAllowed(sc.getParamNode(), kind)
@@ -4212,15 +4234,17 @@ private module FlowExploration {
      ap = TRevPartialNil() and
      exists(config.explorationLimit())
      or
-      revPartialPathStep(_, node, state, sc1, sc2, sc3, ap, config) and
-      not clearsContentEx(node, ap.getHead()) and
-      (
-        notExpectsContent(node) or
-        expectsContentEx(node, ap.getHead())
-      ) and
-      not fullBarrier(node, config) and
-      not stateBarrier(node, state, config) and
-      distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      exists(PartialPathNodeRev mid |
+        revPartialPathStep(mid, node, state, sc1, sc2, sc3, ap, config) and
+        not clearsContentEx(node, ap.getHead()) and
+        (
+          notExpectsContent(node) or
+          expectsContentEx(node, ap.getHead())
+        ) and
+        not fullBarrier(node, config) and
+        not stateBarrier(node, state, config) and
+        distSink(node.getEnclosingCallable(), config) <= config.explorationLimit()
+      )
    }

  pragma[nomagic]
@@ -4228,17 +4252,19 @@ private module FlowExploration {
    NodeEx node, FlowState state, CallContext cc, TSummaryCtx1 sc1, TSummaryCtx2 sc2,
    TSummaryCtx3 sc3, PartialAccessPath ap, Configuration config
  ) {
-    partialPathStep(_, node, state, cc, sc1, sc2, sc3, ap, config) and
-    not fullBarrier(node, config) and
-    not stateBarrier(node, state, config) and
-    not clearsContentEx(node, ap.getHead().getContent()) and
-    (
-      notExpectsContent(node) or
-      expectsContentEx(node, ap.getHead().getContent())
-    ) and
-    if node.asNode() instanceof CastingNode
-    then compatibleTypes(node.getDataFlowType(), ap.getType())
-    else any()
+    exists(PartialPathNodeFwd mid |
+      partialPathStep(mid, node, state, cc, sc1, sc2, sc3, ap, config) and
+      not fullBarrier(node, config) and
+      not stateBarrier(node, state, config) and
+      not clearsContentEx(node, ap.getHead().getContent()) and
+      (
+        notExpectsContent(node) or
+        expectsContentEx(node, ap.getHead().getContent())
+      ) and
+      if node.asNode() instanceof CastingNode
+      then compatibleTypes(node.getDataFlowType(), ap.getType())
+      else any()
+    )
  }

  /**
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll
@@ -916,15 +916,15 @@ private module Cached {
    TDataFlowCallSome(DataFlowCall call)

  cached
-  newtype TParamNodeOption =
-    TParamNodeNone() or
-    TParamNodeSome(ParamNode p)
+  newtype TParameterPositionOption =
+    TParameterPositionNone() or
+    TParameterPositionSome(ParameterPosition pos)

  cached
  newtype TReturnCtx =
    TReturnCtxNone() or
    TReturnCtxNoFlowThrough() or
-    TReturnCtxMaybeFlowThrough(ReturnPosition pos)
+    TReturnCtxMaybeFlowThrough(ReturnKindExt kind)

  cached
  newtype TTypedContentApprox =
@@ -1343,15 +1343,15 @@ class DataFlowCallOption extends TDataFlowCallOption {
  }
 }

-/** An optional `ParamNode`. */
-class ParamNodeOption extends TParamNodeOption {
+/** An optional `ParameterPosition`. */
+class ParameterPositionOption extends TParameterPositionOption {
  string toString() {
-    this = TParamNodeNone() and
+    this = TParameterPositionNone() and
    result = "(none)"
    or
-    exists(ParamNode p |
-      this = TParamNodeSome(p) and
-      result = p.toString()
+    exists(ParameterPosition pos |
+      this = TParameterPositionSome(pos) and
+      result = pos.toString()
    )
  }
 }
@@ -1363,7 +1363,7 @@ class ParamNodeOption extends TParamNodeOption {
 *
 * - `TReturnCtxNone()`: no return flow.
 * - `TReturnCtxNoFlowThrough()`: return flow, but flow through is not possible.
- * - `TReturnCtxMaybeFlowThrough(ReturnPosition pos)`: return flow, of kind `pos`, and
+ * - `TReturnCtxMaybeFlowThrough(ReturnKindExt kind)`: return flow, of kind `kind`, and
 *    flow through may be possible.
 */
 class ReturnCtx extends TReturnCtx {
@@ -1374,9 +1374,9 @@ class ReturnCtx extends TReturnCtx {
    this = TReturnCtxNoFlowThrough() and
    result = "(no flow through)"
    or
-    exists(ReturnPosition pos |
-      this = TReturnCtxMaybeFlowThrough(pos) and
-      result = pos.toString()
+    exists(ReturnKindExt kind |
+      this = TReturnCtxMaybeFlowThrough(kind) and
+      result = kind.toString()
    )
  }
 }
--- a/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll
@@ -45,16 +45,6 @@ module Consistency {
    ) {
      none()
    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodeAtPosition`. */
-    predicate uniqueParameterNodeAtPositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
-
-    /** Holds if `(c, pos, p)` should be excluded from the consistency test `uniqueParameterNodePosition`. */
-    predicate uniqueParameterNodePositionExclude(DataFlowCallable c, ParameterPosition pos, Node p) {
-      none()
-    }
  }

  private class RelevantNode extends Node {
@@ -111,7 +101,9 @@ module Consistency {
    exists(int c |
      c =
        strictcount(Node n |
-          not n.hasLocationInfo(_, _, _, _, _) and
+          not exists(string filepath, int startline, int startcolumn, int endline, int endcolumn |
+            n.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
+          ) and
          not any(ConsistencyConfiguration conf).missingLocationExclude(n)
        ) and
      msg = "Nodes without location: " + c
@@ -256,7 +248,6 @@ module Consistency {
  query predicate uniqueParameterNodeAtPosition(
    DataFlowCallable c, ParameterPosition pos, Node p, string msg
  ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodeAtPositionExclude(c, pos, p) and
    isParameterNode(p, c, pos) and
    not exists(unique(Node p0 | isParameterNode(p0, c, pos))) and
    msg = "Parameters with overlapping positions."
@@ -265,7 +256,6 @@ module Consistency {
  query predicate uniqueParameterNodePosition(
    DataFlowCallable c, ParameterPosition pos, Node p, string msg
  ) {
-    not any(ConsistencyConfiguration conf).uniqueParameterNodePositionExclude(c, pos, p) and
    isParameterNode(p, c, pos) and
    not exists(unique(ParameterPosition pos0 | isParameterNode(p, c, pos0))) and
    msg = "Parameter node with multiple positions."
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/Opcode.qll
@@ -30,7 +30,6 @@ private newtype TOpcode =
  TNegate() or
  TShiftLeft() or
  TShiftRight() or
-  TUnsignedShiftRight() or
  TBitAnd() or
  TBitOr() or
  TBitXor() or
@@ -653,15 +652,6 @@ module Opcode {
    final override string toString() { result = "ShiftRight" }
  }

-  /**
-   * The `Opcode` for a `UnsignedShiftRightInstruction`.
-   *
-   * See the `UnsignedShiftRightInstruction` documentation for more details.
-   */
-  class UnsignedShiftRight extends BinaryBitwiseOpcode, TUnsignedShiftRight {
-    final override string toString() { result = "UnsignedShiftRight" }
-  }
-
  /**
   * The `Opcode` for a `BitAndInstruction`.
   *
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll
@@ -1204,17 +1204,6 @@ class ShiftRightInstruction extends BinaryBitwiseInstruction {
  ShiftRightInstruction() { this.getOpcode() instanceof Opcode::ShiftRight }
 }

-/**
- * An instruction that shifts its left operand to the right by the number of bits specified by its
- * right operand.
- *
- * Both operands must have an integer type. The result has the same type as the left operand.
- * The leftmost bits are zero-filled.
- */
-class UnsignedShiftRightInstruction extends BinaryBitwiseInstruction {
-  UnsignedShiftRightInstruction() { this.getOpcode() instanceof Opcode::UnsignedShiftRight }
-}
-
 /**
 * An instruction that performs a binary arithmetic operation involving at least one pointer
 * operand.
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll
@@ -45,7 +45,7 @@ class Operand extends TStageOperand {
      this = reusedPhiOperand(use, def, predecessorBlock, _)
    )
    or
-    this = chiOperand(_, _)
+    exists(Instruction use | this = chiOperand(use, _))
  }

  /** Gets a textual representation of this element. */
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll
@@ -329,12 +329,12 @@ private module Cached {
  cached
  Instruction getChiInstructionTotalOperand(ChiInstruction chiInstr) {
    exists(
-      Alias::VirtualVariable vvar, OldInstruction oldInstr, OldBlock defBlock, int defRank,
-      int defOffset, OldBlock useBlock, int useRank
+      Alias::VirtualVariable vvar, OldInstruction oldInstr, Alias::MemoryLocation defLocation,
+      OldBlock defBlock, int defRank, int defOffset, OldBlock useBlock, int useRank
    |
      chiInstr = getChi(oldInstr) and
      vvar = Alias::getResultMemoryLocation(oldInstr).getVirtualVariable() and
-      hasDefinitionAtRank(vvar, _, defBlock, defRank, defOffset) and
+      hasDefinitionAtRank(vvar, defLocation, defBlock, defRank, defOffset) and
      hasUseAtRank(vvar, useBlock, useRank, oldInstr) and
      definitionReachesUse(vvar, defBlock, defRank, useBlock, useRank) and
      result = getDefinitionOrChiInstruction(defBlock, defOffset, vvar, _)
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Instruction.qll
@@ -1204,17 +1204,6 @@ class ShiftRightInstruction extends BinaryBitwiseInstruction {
  ShiftRightInstruction() { this.getOpcode() instanceof Opcode::ShiftRight }
 }

-/**
- * An instruction that shifts its left operand to the right by the number of bits specified by its
- * right operand.
- *
- * Both operands must have an integer type. The result has the same type as the left operand.
- * The leftmost bits are zero-filled.
- */
-class UnsignedShiftRightInstruction extends BinaryBitwiseInstruction {
-  UnsignedShiftRightInstruction() { this.getOpcode() instanceof Opcode::UnsignedShiftRight }
-}
-
 /**
 * An instruction that performs a binary arithmetic operation involving at least one pointer
 * operand.
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/Operand.qll
@@ -45,7 +45,7 @@ class Operand extends TStageOperand {
      this = reusedPhiOperand(use, def, predecessorBlock, _)
    )
    or
-    this = chiOperand(_, _)
+    exists(Instruction use | this = chiOperand(use, _))
  }

  /** Gets a textual representation of this element. */
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/InstructionTag.qll
@@ -72,19 +72,7 @@ newtype TInstructionTag =
  AsmInputTag(int elementIndex) { exists(AsmStmt asm | exists(asm.getChild(elementIndex))) } or
  ThisAddressTag() or
  ThisLoadTag() or
-  StructuredBindingAccessTag() or
-  // The next three cases handle generation of the constants -1, 0 and 1 for __except handling.
-  TryExceptGenerateNegativeOne() or
-  TryExceptGenerateZero() or
-  TryExceptGenerateOne() or
-  // The next three cases handle generation of comparisons for __except handling.
-  TryExceptCompareNegativeOne() or
-  TryExceptCompareZero() or
-  TryExceptCompareOne() or
-  // The next three cases handle generation of branching for __except handling.
-  TryExceptCompareNegativeOneBranch() or
-  TryExceptCompareZeroBranch() or
-  TryExceptCompareOneBranch()
+  StructuredBindingAccessTag()

 class InstructionTag extends TInstructionTag {
  final string toString() { result = "Tag" }
@@ -236,22 +224,4 @@ string getInstructionTagId(TInstructionTag tag) {
  tag = ThisLoadTag() and result = "ThisLoad"
  or
  tag = StructuredBindingAccessTag() and result = "StructuredBindingAccess"
-  or
-  tag = TryExceptCompareNegativeOne() and result = "TryExceptCompareNegativeOne"
-  or
-  tag = TryExceptCompareZero() and result = "TryExceptCompareZero"
-  or
-  tag = TryExceptCompareOne() and result = "TryExceptCompareOne"
-  or
-  tag = TryExceptGenerateNegativeOne() and result = "TryExceptGenerateNegativeOne"
-  or
-  tag = TryExceptGenerateZero() and result = "TryExceptGenerateNegativeOne"
-  or
-  tag = TryExceptGenerateOne() and result = "TryExceptGenerateOne"
-  or
-  tag = TryExceptCompareNegativeOneBranch() and result = "TryExceptCompareNegativeOneBranch"
-  or
-  tag = TryExceptCompareZeroBranch() and result = "TryExceptCompareZeroBranch"
-  or
-  tag = TryExceptCompareOneBranch() and result = "TryExceptCompareOneBranch"
 }
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedElement.qll
@@ -675,7 +675,6 @@ newtype TTranslatedElement =
  } or
  // A statement
  TTranslatedStmt(Stmt stmt) { translateStmt(stmt) } or
-  TTranslatedMicrosoftTryExceptHandler(MicrosoftTryExceptStmt stmt) or
  // A function
  TTranslatedFunction(Function func) { translateFunction(func) } or
  // A constructor init list
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedInitialization.qll
@@ -298,11 +298,11 @@ class TranslatedStringLiteralInitialization extends TranslatedDirectInitializati
    opcode instanceof Opcode::Store and
    resultType = getTypeForPRValue(expr.getType())
    or
-    exists(int elementCount |
+    exists(int startIndex, int elementCount |
      // If the initializer string isn't large enough to fill the target, then
      // we have to generate another instruction sequence to store a constant
      // zero into the remainder of the array.
-      zeroInitRange(_, elementCount) and
+      zeroInitRange(startIndex, elementCount) and
      (
        // Create a constant zero whose size is the size of the remaining
        // space in the target array.
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll
@@ -13,222 +13,6 @@ private import TranslatedInitialization

 TranslatedStmt getTranslatedStmt(Stmt stmt) { result.getAst() = stmt }

-TranslatedMicrosoftTryExceptHandler getTranslatedMicrosoftTryExceptHandler(
-  MicrosoftTryExceptStmt tryExcept
-) {
-  result.getAst() = tryExcept.getExcept()
-}
-
-class TranslatedMicrosoftTryExceptHandler extends TranslatedElement,
-  TTranslatedMicrosoftTryExceptHandler {
-  MicrosoftTryExceptStmt tryExcept;
-
-  TranslatedMicrosoftTryExceptHandler() { this = TTranslatedMicrosoftTryExceptHandler(tryExcept) }
-
-  final override string toString() { result = tryExcept.toString() }
-
-  final override Locatable getAst() { result = tryExcept.getExcept() }
-
-  override Instruction getFirstInstruction() { result = this.getChild(0).getFirstInstruction() }
-
-  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
-    // t1 = -1
-    tag = TryExceptGenerateNegativeOne() and
-    opcode instanceof Opcode::Constant and
-    resultType = getIntType()
-    or
-    // t2 = cmp t1, condition
-    tag = TryExceptCompareNegativeOne() and
-    opcode instanceof Opcode::CompareEQ and
-    resultType = getBoolType()
-    or
-    // if t2 goto ... else goto ...
-    tag = TryExceptCompareNegativeOneBranch() and
-    opcode instanceof Opcode::ConditionalBranch and
-    resultType = getVoidType()
-    or
-    // t1 = 0
-    tag = TryExceptGenerateZero() and
-    opcode instanceof Opcode::Constant and
-    resultType = getIntType()
-    or
-    // t2 = cmp t1, condition
-    tag = TryExceptCompareZero() and
-    opcode instanceof Opcode::CompareEQ and
-    resultType = getBoolType()
-    or
-    // if t2 goto ... else goto ...
-    tag = TryExceptCompareZeroBranch() and
-    opcode instanceof Opcode::ConditionalBranch and
-    resultType = getVoidType()
-    or
-    // t1 = 1
-    tag = TryExceptGenerateOne() and
-    opcode instanceof Opcode::Constant and
-    resultType = getIntType()
-    or
-    // t2 = cmp t1, condition
-    tag = TryExceptCompareOne() and
-    opcode instanceof Opcode::CompareEQ and
-    resultType = getBoolType()
-    or
-    // if t2 goto ... else goto ...
-    tag = TryExceptCompareOneBranch() and
-    opcode instanceof Opcode::ConditionalBranch and
-    resultType = getVoidType()
-    or
-    // unwind stack
-    tag = UnwindTag() and
-    opcode instanceof Opcode::Unwind and
-    resultType = getVoidType()
-  }
-
-  final override Instruction getInstructionRegisterOperand(InstructionTag tag, OperandTag operandTag) {
-    tag = TryExceptCompareNegativeOne() and
-    (
-      operandTag instanceof LeftOperandTag and
-      result = this.getTranslatedCondition().getResult()
-      or
-      operandTag instanceof RightOperandTag and
-      result = this.getInstruction(TryExceptGenerateNegativeOne())
-    )
-    or
-    tag = TryExceptCompareNegativeOneBranch() and
-    operandTag instanceof ConditionOperandTag and
-    result = this.getInstruction(TryExceptCompareNegativeOne())
-    or
-    tag = TryExceptCompareZero() and
-    (
-      operandTag instanceof LeftOperandTag and
-      result = this.getTranslatedCondition().getResult()
-      or
-      operandTag instanceof RightOperandTag and
-      result = this.getInstruction(TryExceptGenerateZero())
-    )
-    or
-    tag = TryExceptCompareZeroBranch() and
-    operandTag instanceof ConditionOperandTag and
-    result = this.getInstruction(TryExceptCompareZero())
-    or
-    tag = TryExceptCompareOne() and
-    (
-      operandTag instanceof LeftOperandTag and
-      result = this.getTranslatedCondition().getResult()
-      or
-      operandTag instanceof RightOperandTag and
-      result = this.getInstruction(TryExceptGenerateOne())
-    )
-    or
-    tag = TryExceptCompareOneBranch() and
-    operandTag instanceof ConditionOperandTag and
-    result = this.getInstruction(TryExceptCompareOne())
-  }
-
-  override string getInstructionConstantValue(InstructionTag tag) {
-    tag = TryExceptGenerateNegativeOne() and
-    result = "-1"
-    or
-    tag = TryExceptGenerateZero() and
-    result = "0"
-    or
-    tag = TryExceptGenerateOne() and
-    result = "1"
-  }
-
-  override Instruction getInstructionSuccessor(InstructionTag tag, EdgeKind kind) {
-    // Generate -1 -> Compare condition
-    tag = TryExceptGenerateNegativeOne() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(TryExceptCompareNegativeOne())
-    or
-    // Compare condition -> Branch
-    tag = TryExceptCompareNegativeOne() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(TryExceptCompareNegativeOneBranch())
-    or
-    // Branch -> Unwind or Generate 0
-    tag = TryExceptCompareNegativeOneBranch() and
-    (
-      kind instanceof TrueEdge and
-      // TODO: This is not really correct. The semantics of `EXCEPTION_CONTINUE_EXECUTION` is that
-      // we should continue execution at the point where the exception occurred. But we don't have
-      // any instruction to model this behavior.
-      result = this.getInstruction(UnwindTag())
-      or
-      kind instanceof FalseEdge and
-      result = this.getInstruction(TryExceptGenerateZero())
-    )
-    or
-    // Generate 0 -> Compare condition
-    tag = TryExceptGenerateZero() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(TryExceptCompareZero())
-    or
-    // Compare condition -> Branch
-    tag = TryExceptCompareZero() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(TryExceptCompareZeroBranch())
-    or
-    // Branch -> Unwind or Generate 1
-    tag = TryExceptCompareZeroBranch() and
-    (
-      kind instanceof TrueEdge and
-      result = this.getInstruction(UnwindTag())
-      or
-      kind instanceof FalseEdge and
-      result = this.getInstruction(TryExceptGenerateOne())
-    )
-    or
-    // Generate 1 -> Compare condition
-    tag = TryExceptGenerateOne() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(TryExceptCompareOne())
-    or
-    // Compare condition -> Branch
-    tag = TryExceptCompareOne() and
-    kind instanceof GotoEdge and
-    result = this.getInstruction(TryExceptCompareOneBranch())
-    or
-    // Branch -> Handler (the condition value is always 0, -1 or 1, and we've checked for 0 or -1 already.)
-    tag = TryExceptCompareOneBranch() and
-    (
-      kind instanceof TrueEdge and
-      result = this.getTranslatedHandler().getFirstInstruction()
-    )
-    or
-    // Unwind -> Parent
-    tag = UnwindTag() and
-    kind instanceof GotoEdge and
-    result = this.getParent().getChildSuccessor(this)
-  }
-
-  override Instruction getChildSuccessor(TranslatedElement child) {
-    child = this.getTranslatedCondition() and
-    result = this.getInstruction(TryExceptGenerateNegativeOne())
-    or
-    child = this.getTranslatedHandler() and
-    result = this.getParent().getChildSuccessor(this)
-  }
-
-  private TranslatedExpr getTranslatedCondition() {
-    result = getTranslatedExpr(tryExcept.getCondition())
-  }
-
-  private TranslatedStmt getTranslatedHandler() {
-    result = getTranslatedStmt(tryExcept.getExcept())
-  }
-
-  override TranslatedElement getChild(int id) {
-    id = 0 and
-    result = this.getTranslatedCondition()
-    or
-    id = 1 and
-    result = this.getTranslatedHandler()
-  }
-
-  final override Function getFunction() { result = tryExcept.getEnclosingFunction() }
-}
-
 abstract class TranslatedStmt extends TranslatedElement, TTranslatedStmt {
  Stmt stmt;

@@ -465,57 +249,15 @@ class TranslatedUnreachableReturnStmt extends TranslatedReturnStmt {
 }

 /**
- * A C/C++ `try` statement, or a `__try __except` or `__try __finally` statement.
- */
-private class TryOrMicrosoftTryStmt extends Stmt {
-  TryOrMicrosoftTryStmt() {
-    this instanceof TryStmt or
-    this instanceof MicrosoftTryStmt
-  }
-
-  /** Gets the number of `catch block`s of this statement. */
-  int getNumberOfCatchClauses() {
-    result = this.(TryStmt).getNumberOfCatchClauses()
-    or
-    this instanceof MicrosoftTryExceptStmt and
-    result = 1
-    or
-    this instanceof MicrosoftTryFinallyStmt and
-    result = 0
-  }
-
-  /** Gets the `body` statement of this statement. */
-  Stmt getStmt() {
-    result = this.(TryStmt).getStmt()
-    or
-    result = this.(MicrosoftTryStmt).getStmt()
-  }
-
-  /** Gets the `i`th translated handler of this statement. */
-  TranslatedElement getTranslatedHandler(int index) {
-    result = getTranslatedStmt(this.(TryStmt).getChild(index + 1))
-    or
-    index = 0 and
-    result = getTranslatedMicrosoftTryExceptHandler(this)
-  }
-
-  /** Gets the `finally` statement (usually a BlockStmt), if any. */
-  Stmt getFinally() { result = this.(MicrosoftTryFinallyStmt).getFinally() }
-}
-
-/**
- * The IR translation of a C++ `try` (or a `__try __except` or `__try __finally`) statement.
+ * The IR translation of a C++ `try` statement.
 */
 class TranslatedTryStmt extends TranslatedStmt {
-  override TryOrMicrosoftTryStmt stmt;
+  override TryStmt stmt;

  override TranslatedElement getChild(int id) {
    id = 0 and result = getBody()
    or
    result = getHandler(id - 1)
-    or
-    id = stmt.getNumberOfCatchClauses() + 1 and
-    result = this.getFinally()
  }

  override predicate hasInstruction(Opcode opcode, InstructionTag tag, CppType resultType) {
@@ -527,20 +269,8 @@ class TranslatedTryStmt extends TranslatedStmt {
  override Instruction getFirstInstruction() { result = getBody().getFirstInstruction() }

  override Instruction getChildSuccessor(TranslatedElement child) {
-    // All non-finally children go to the successor of the `try` if
-    // there is no finally block, but if there is a finally block
-    // then we go to that one.
-    child = [this.getBody(), this.getHandler(_)] and
-    (
-      not exists(this.getFinally()) and
-      result = this.getParent().getChildSuccessor(this)
-      or
-      result = this.getFinally().getFirstInstruction()
-    )
-    or
-    // And after the finally block we go to the successor of the `try`.
-    child = this.getFinally() and
-    result = this.getParent().getChildSuccessor(this)
+    // All children go to the successor of the `try`.
+    child = getAChild() and result = getParent().getChildSuccessor(this)
  }

  final Instruction getNextHandler(TranslatedHandler handler) {
@@ -560,9 +290,9 @@ class TranslatedTryStmt extends TranslatedStmt {
    result = getHandler(0).getFirstInstruction()
  }

-  private TranslatedElement getHandler(int index) { result = stmt.getTranslatedHandler(index) }
-
-  private TranslatedStmt getFinally() { result = getTranslatedStmt(stmt.getFinally()) }
+  private TranslatedHandler getHandler(int index) {
+    result = getTranslatedStmt(stmt.getChild(index + 1))
+  }

  private TranslatedStmt getBody() { result = getTranslatedStmt(stmt.getStmt()) }
 }
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll
@@ -1204,17 +1204,6 @@ class ShiftRightInstruction extends BinaryBitwiseInstruction {
  ShiftRightInstruction() { this.getOpcode() instanceof Opcode::ShiftRight }
 }

-/**
- * An instruction that shifts its left operand to the right by the number of bits specified by its
- * right operand.
- *
- * Both operands must have an integer type. The result has the same type as the left operand.
- * The leftmost bits are zero-filled.
- */
-class UnsignedShiftRightInstruction extends BinaryBitwiseInstruction {
-  UnsignedShiftRightInstruction() { this.getOpcode() instanceof Opcode::UnsignedShiftRight }
-}
-
 /**
 * An instruction that performs a binary arithmetic operation involving at least one pointer
 * operand.
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll
@@ -45,7 +45,7 @@ class Operand extends TStageOperand {
      this = reusedPhiOperand(use, def, predecessorBlock, _)
    )
    or
-    this = chiOperand(_, _)
+    exists(Instruction use | this = chiOperand(use, _))
  }

  /** Gets a textual representation of this element. */
--- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll
@@ -329,12 +329,12 @@ private module Cached {
  cached
  Instruction getChiInstructionTotalOperand(ChiInstruction chiInstr) {
    exists(
-      Alias::VirtualVariable vvar, OldInstruction oldInstr, OldBlock defBlock, int defRank,
-      int defOffset, OldBlock useBlock, int useRank
+      Alias::VirtualVariable vvar, OldInstruction oldInstr, Alias::MemoryLocation defLocation,
+      OldBlock defBlock, int defRank, int defOffset, OldBlock useBlock, int useRank
    |
      chiInstr = getChi(oldInstr) and
      vvar = Alias::getResultMemoryLocation(oldInstr).getVirtualVariable() and
-      hasDefinitionAtRank(vvar, _, defBlock, defRank, defOffset) and
+      hasDefinitionAtRank(vvar, defLocation, defBlock, defRank, defOffset) and
      hasUseAtRank(vvar, useBlock, useRank, oldInstr) and
      definitionReachesUse(vvar, defBlock, defRank, useBlock, useRank) and
      result = getDefinitionOrChiInstruction(defBlock, defOffset, vvar, _)
--- a/cpp/ql/lib/semmle/code/cpp/ir/internal/IRCppLanguage.qll
+++ b/cpp/ql/lib/semmle/code/cpp/ir/internal/IRCppLanguage.qll
@@ -67,7 +67,9 @@ class Class = Cpp::Class; // Used for inheritance conversions

 predicate getIdentityString = Print::getIdentityString/1;

-predicate hasCaseEdge(string minValue, string maxValue) { hasCaseEdge(_, minValue, maxValue) }
+predicate hasCaseEdge(string minValue, string maxValue) {
+  exists(Cpp::SwitchCase switchCase | hasCaseEdge(switchCase, minValue, maxValue))
+}

 predicate hasPositionalArgIndex(int argIndex) {
  exists(Cpp::FunctionCall call | exists(call.getArgument(argIndex))) or
--- a/cpp/ql/lib/semmle/code/cpp/metrics/MetricClass.qll
+++ b/cpp/ql/lib/semmle/code/cpp/metrics/MetricClass.qll
@@ -99,10 +99,10 @@ class MetricClass extends Class {
  }

  /** Gets any method that accesses some local field. */
-  Function getAccessingMethod() { this.accessesLocalField(result, _) }
+  Function getAccessingMethod() { exists(Field f | this.accessesLocalField(result, f)) }

  /** Gets any field that is accessed by a local method. */
-  Field getAccessedField() { this.accessesLocalField(_, result) }
+  Field getAccessedField() { exists(Function func | this.accessesLocalField(func, result)) }

  /** Gets the Henderson-Sellers lack-of-cohesion metric. */
  float getLackOfCohesionHS() {
@@ -517,10 +517,10 @@ private predicate dependsOnClassSimple(Class source, Class dest) {
    )
    or
    // a class depends on classes for which a call to its member function is done from a function
-    exists(MemberFunction target, MemberFunction f |
+    exists(MemberFunction target, MemberFunction f, Locatable l |
      f.getDeclaringType() = source and
      f instanceof MemberFunction and
-      f.calls(target, _) and
+      f.calls(target, l) and
      target instanceof MemberFunction and
      target.getDeclaringType() = dest
    )
--- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Allocation.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Allocation.qll
@@ -133,15 +133,13 @@ abstract class HeuristicAllocationExpr extends Expr {

  /**
   * Gets a constant multiplier for the allocation size given by `getSizeExpr`,
-   * in bytes. This predicate should be used with caution as it can be
-   * inaccurate for allocations identified using heuristics.
+   * in bytes.
   */
  int getSizeMult() { none() }

  /**
   * Gets the size of this allocation in bytes, if it is a fixed size and that
-   * size can be determined. This predicate should be used with caution as it
-   * can be inaccurate for allocations identified using heuristics.
+   * size can be determined.
   */
  int getSizeBytes() { none() }

--- a/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
+++ b/cpp/ql/lib/semmle/code/cpp/rangeanalysis/SimpleRangeAnalysis.qll
@@ -296,7 +296,7 @@ private predicate analyzableExpr(Expr e) {
    or
    // Also allow variable accesses, provided that they have SSA
    // information.
-    exists(RangeSsaDefinition def | e = def.getAUse(_))
+    exists(RangeSsaDefinition def, StackVariable v | e = def.getAUse(v))
    or
    e instanceof UnsignedBitwiseAndExpr
    or
--- a/cpp/ql/lib/semmle/code/cpp/security/FlowSources.qll
+++ b/cpp/ql/lib/semmle/code/cpp/security/FlowSources.qll
@@ -92,7 +92,7 @@ private class ArgvSource extends LocalFlowSource {
    exists(Function main, Parameter argv |
      main.hasGlobalName("main") and
      main.getParameter(1) = argv and
-      this.asParameter() = argv
+      this.asExpr() = argv.getAnAccess()
    )
  }

--- a/cpp/ql/lib/semmle/code/cpp/security/TaintTrackingImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/security/TaintTrackingImpl.qll
@@ -127,9 +127,9 @@ deprecated private predicate betweenFunctionsValueMoveTo(
  not unreachable(src) and
  not unreachable(dest) and
  (
-    exists(Call call, int i |
+    exists(Call call, Function called, int i |
      src = call.getArgument(i) and
-      resolveCallWithParam(call, _, i, dest) and
+      resolveCallWithParam(call, called, i, dest) and
      destFromArg = true
    )
    or
@@ -151,8 +151,8 @@ deprecated private predicate betweenFunctionsValueMoveTo(
    )
    or
    // If a parameter of type reference is tainted inside a function, taint the argument too
-    exists(Call call, int pi, Parameter p |
-      resolveCallWithParam(call, _, pi, p) and
+    exists(Call call, Function f, int pi, Parameter p |
+      resolveCallWithParam(call, f, pi, p) and
      p.getType() instanceof ReferenceType and
      src = p and
      dest = call.getArgument(pi) and
--- a/cpp/ql/lib/semmle/code/cpp/stmts/Stmt.qll
+++ b/cpp/ql/lib/semmle/code/cpp/stmts/Stmt.qll
@@ -34,7 +34,7 @@ class Stmt extends StmtParent, @stmt {
  }

  /** Gets a child of this statement. */
-  Element getAChild() { result = this.getChild(_) }
+  Element getAChild() { exists(int n | result = this.getChild(n)) }

  /** Gets the parent of this statement, if any. */
  StmtParent getParent() { stmtparents(underlyingElement(this), _, unresolveElement(result)) }
--- a/cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll
+++ b/cpp/ql/lib/semmle/code/cpp/valuenumbering/GlobalValueNumberingImpl.qll
@@ -183,7 +183,7 @@ private newtype GvnBase =
  // global variable will only get the same value number if they are
  // guaranteed to have the same value.
  GVN_OtherVariable(Variable x, ControlFlowNode dominator) { mk_OtherVariable(x, dominator, _) } or
-  deprecated GVN_FieldAccess(GVN s, Field f) {
+  GVN_FieldAccess(GVN s, Field f) {
    mk_DotFieldAccess(s, f, _) or
    mk_PointerFieldAccess_with_deref(s, f, _) or
    mk_ImplicitThisFieldAccess_with_deref(s, f, _)
@@ -192,7 +192,7 @@ private newtype GvnBase =
  // time the pointer was dereferenced, so we need to include a definition
  // location. As a crude (but safe) approximation, we use
  // `mostRecentSideEffect` to compute a definition location.
-  deprecated GVN_Deref(GVN p, ControlFlowNode dominator) {
+  GVN_Deref(GVN p, ControlFlowNode dominator) {
    mk_Deref(p, dominator, _) or
    mk_PointerFieldAccess(p, _, dominator, _) or
    mk_ImplicitThisFieldAccess_with_qualifier(p, _, dominator, _)
@@ -201,12 +201,10 @@ private newtype GvnBase =
    mk_ThisExpr(fcn, _) or
    mk_ImplicitThisFieldAccess(fcn, _, _, _)
  } or
-  deprecated GVN_Conversion(Type t, GVN child) { mk_Conversion(t, child, _) } or
-  deprecated GVN_BinaryOp(GVN lhs, GVN rhs, string opname) { mk_BinaryOp(lhs, rhs, opname, _) } or
-  deprecated GVN_UnaryOp(GVN child, string opname) { mk_UnaryOp(child, opname, _) } or
-  deprecated GVN_ArrayAccess(GVN x, GVN i, ControlFlowNode dominator) {
-    mk_ArrayAccess(x, i, dominator, _)
-  } or
+  GVN_Conversion(Type t, GVN child) { mk_Conversion(t, child, _) } or
+  GVN_BinaryOp(GVN lhs, GVN rhs, string opname) { mk_BinaryOp(lhs, rhs, opname, _) } or
+  GVN_UnaryOp(GVN child, string opname) { mk_UnaryOp(child, opname, _) } or
+  GVN_ArrayAccess(GVN x, GVN i, ControlFlowNode dominator) { mk_ArrayAccess(x, i, dominator, _) } or
  // Any expression that is not handled by the cases above is
  // given a unique number based on the expression itself.
  GVN_Unanalyzable(Expr e) { not analyzableExpr(e) }
@@ -342,7 +340,7 @@ private predicate analyzableDotFieldAccess(DotFieldAccess access) {
  not analyzableConst(access)
 }

-deprecated private predicate mk_DotFieldAccess(GVN qualifier, Field target, DotFieldAccess access) {
+private predicate mk_DotFieldAccess(GVN qualifier, Field target, DotFieldAccess access) {
  analyzableDotFieldAccess(access) and
  target = access.getTarget() and
  qualifier = globalValueNumber(access.getQualifier().getFullyConverted())
@@ -355,7 +353,7 @@ private predicate analyzablePointerFieldAccess(PointerFieldAccess access) {
  not analyzableConst(access)
 }

-deprecated private predicate mk_PointerFieldAccess(
+private predicate mk_PointerFieldAccess(
  GVN qualifier, Field target, ControlFlowNode dominator, PointerFieldAccess access
 ) {
  analyzablePointerFieldAccess(access) and
@@ -368,7 +366,7 @@ deprecated private predicate mk_PointerFieldAccess(
 * `obj->field` is equivalent to `(*obj).field`, so we need to wrap an
 * extra `GVN_Deref` around the qualifier.
 */
-deprecated private predicate mk_PointerFieldAccess_with_deref(
+private predicate mk_PointerFieldAccess_with_deref(
  GVN new_qualifier, Field target, PointerFieldAccess access
 ) {
  exists(GVN qualifier, ControlFlowNode dominator |
@@ -393,7 +391,7 @@ private predicate mk_ImplicitThisFieldAccess(
  fcn = access.getEnclosingFunction()
 }

-deprecated private predicate mk_ImplicitThisFieldAccess_with_qualifier(
+private predicate mk_ImplicitThisFieldAccess_with_qualifier(
  GVN qualifier, Field target, ControlFlowNode dominator, ImplicitThisFieldAccess access
 ) {
  exists(Function fcn |
@@ -402,7 +400,7 @@ deprecated private predicate mk_ImplicitThisFieldAccess_with_qualifier(
  )
 }

-deprecated private predicate mk_ImplicitThisFieldAccess_with_deref(
+private predicate mk_ImplicitThisFieldAccess_with_deref(
  GVN new_qualifier, Field target, ImplicitThisFieldAccess access
 ) {
  exists(GVN qualifier, ControlFlowNode dominator |
@@ -436,7 +434,7 @@ private predicate analyzableConversion(Conversion conv) {
  not analyzableConst(conv)
 }

-deprecated private predicate mk_Conversion(Type t, GVN child, Conversion conv) {
+private predicate mk_Conversion(Type t, GVN child, Conversion conv) {
  analyzableConversion(conv) and
  t = conv.getUnspecifiedType() and
  child = globalValueNumber(conv.getExpr())
@@ -450,7 +448,7 @@ private predicate analyzableBinaryOp(BinaryOperation op) {
  not analyzableConst(op)
 }

-deprecated private predicate mk_BinaryOp(GVN lhs, GVN rhs, string opname, BinaryOperation op) {
+private predicate mk_BinaryOp(GVN lhs, GVN rhs, string opname, BinaryOperation op) {
  analyzableBinaryOp(op) and
  lhs = globalValueNumber(op.getLeftOperand().getFullyConverted()) and
  rhs = globalValueNumber(op.getRightOperand().getFullyConverted()) and
@@ -465,7 +463,7 @@ private predicate analyzableUnaryOp(UnaryOperation op) {
  not analyzableConst(op)
 }

-deprecated private predicate mk_UnaryOp(GVN child, string opname, UnaryOperation op) {
+private predicate mk_UnaryOp(GVN child, string opname, UnaryOperation op) {
  analyzableUnaryOp(op) and
  child = globalValueNumber(op.getOperand().getFullyConverted()) and
  opname = op.getOperator()
@@ -488,9 +486,7 @@ private predicate analyzableArrayAccess(ArrayExpr ae) {
  not analyzableConst(ae)
 }

-deprecated private predicate mk_ArrayAccess(
-  GVN base, GVN offset, ControlFlowNode dominator, ArrayExpr ae
-) {
+private predicate mk_ArrayAccess(GVN base, GVN offset, ControlFlowNode dominator, ArrayExpr ae) {
  analyzableArrayAccess(ae) and
  base = globalValueNumber(ae.getArrayBase().getFullyConverted()) and
  offset = globalValueNumber(ae.getArrayOffset().getFullyConverted()) and
@@ -503,7 +499,7 @@ private predicate analyzablePointerDereferenceExpr(PointerDereferenceExpr deref)
  not analyzableConst(deref)
 }

-deprecated private predicate mk_Deref(GVN p, ControlFlowNode dominator, PointerDereferenceExpr deref) {
+private predicate mk_Deref(GVN p, ControlFlowNode dominator, PointerDereferenceExpr deref) {
  analyzablePointerDereferenceExpr(deref) and
  p = globalValueNumber(deref.getOperand().getFullyConverted()) and
  dominator = mostRecentSideEffect(deref)
--- a/cpp/ql/lib/semmle/code/cpp/valuenumbering/HashCons.qll
+++ b/cpp/ql/lib/semmle/code/cpp/valuenumbering/HashCons.qll
@@ -475,7 +475,9 @@ private predicate mk_NonmemberFunctionCall(Function fcn, HC_Args args, FunctionC
  fc.getTarget() = fcn and
  analyzableNonmemberFunctionCall(fc) and
  (
-    mk_ArgConsInner(_, _, fc.getNumberOfArguments() - 1, args, fc)
+    exists(HashCons head, HC_Args tail |
+      mk_ArgConsInner(head, tail, fc.getNumberOfArguments() - 1, args, fc)
+    )
    or
    fc.getNumberOfArguments() = 0 and
    args = HC_EmptyArgs()
@@ -492,7 +494,9 @@ private predicate analyzableExprCall(ExprCall ec) {
 private predicate mk_ExprCall(HashCons hc, HC_Args args, ExprCall ec) {
  hc.getAnExpr() = ec.getExpr() and
  (
-    mk_ArgConsInner(_, _, ec.getNumberOfArguments() - 1, args, ec)
+    exists(HashCons head, HC_Args tail |
+      mk_ArgConsInner(head, tail, ec.getNumberOfArguments() - 1, args, ec)
+    )
    or
    ec.getNumberOfArguments() = 0 and
    args = HC_EmptyArgs()
@@ -512,7 +516,9 @@ private predicate mk_MemberFunctionCall(Function fcn, HashCons qual, HC_Args arg
  analyzableMemberFunctionCall(fc) and
  hashCons(fc.getQualifier().getFullyConverted()) = qual and
  (
-    mk_ArgConsInner(_, _, fc.getNumberOfArguments() - 1, args, fc)
+    exists(HashCons head, HC_Args tail |
+      mk_ArgConsInner(head, tail, fc.getNumberOfArguments() - 1, args, fc)
+    )
    or
    fc.getNumberOfArguments() = 0 and
    args = HC_EmptyArgs()
@@ -535,8 +541,10 @@ private predicate mk_ArgCons(HashCons hc, int i, HC_Args list, Call c) {
  analyzableCall(c) and
  hc = hashCons(c.getArgument(i).getFullyConverted()) and
  (
-    mk_ArgConsInner(_, _, i - 1, list, c) and
-    i > 0
+    exists(HashCons head, HC_Args tail |
+      mk_ArgConsInner(head, tail, i - 1, list, c) and
+      i > 0
+    )
    or
    i = 0 and
    list = HC_EmptyArgs()
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme
@@ -303,11 +303,12 @@ affectedbymacroexpansion(
    int inv: @macroinvocation ref
 );

-case @macroinvocation.kind of
-  1 = @macro_expansion
-| 2 = @other_macro_reference
-;
-
+/*
+  case @macroinvocations.kind of
+    1 = macro expansion
+  | 2 = other macro reference
+  ;
+*/
 macroinvocations(
    unique int id: @macroinvocation,
    int macro_id: @ppd_define ref,
@@ -344,37 +345,28 @@ macro_argument_expanded(
 );

 /*
-case @function.kind of
-  1 = @normal_function
-| 2 = @constructor
-| 3 = @destructor
-| 4 = @conversion_function
-| 5 = @operator
-| 6 = @builtin_function     // GCC built-in functions, e.g. __builtin___memcpy_chk
-;
+  case @function.kind of
+    1 = normal
+  | 2 = constructor
+  | 3 = destructor
+  | 4 = conversion
+  | 5 = operator
+  | 6 = builtin     // GCC built-in functions, e.g. __builtin___memcpy_chk
+  ;
 */
-
 functions(
    unique int id: @function,
    string name: string ref,
    int kind: int ref
 );

-function_entry_point(
-    int id: @function ref,
-    unique int entry_point: @stmt ref
-);
+function_entry_point(int id: @function ref, unique int entry_point: @stmt ref);

-function_return_type(
-    int id: @function ref,
-    int return_type: @type ref
-);
+function_return_type(int id: @function ref, int return_type: @type ref);

-/**
- * If `function` is a coroutine, then this gives the `std::experimental::resumable_traits`
- * instance associated with it, and the variables representing the `handle` and `promise`
- * for it.
- */
+/** If `function` is a coroutine, then this gives the
+    std::experimental::resumable_traits instance associated with it,
+    and the variables representing the `handle` and `promise` for it. */
 coroutine(
  unique int function: @function ref,
  int traits: @type ref,
@@ -400,10 +392,7 @@ function_deleted(unique int id: @function ref);

 function_defaulted(unique int id: @function ref);

-member_function_this_type(
-    unique int id: @function ref,
-    int this_type: @type ref
-);
+member_function_this_type(unique int id: @function ref, int this_type: @type ref);

 #keyset[id, type_id]
 fun_decls(
@@ -506,10 +495,7 @@ params(
    int type_id: @type ref
 );

-overrides(
-    int new: @function ref,
-    int old: @function ref
-);
+overrides(int new: @function ref, int old: @function ref);

 #keyset[id, type_id]
 membervariables(
@@ -555,65 +541,63 @@ enumconstants(

@localscopevariable = @localvariable | @parameter;

-/**
- * Built-in types are the fundamental types, e.g., integral, floating, and void.
- */
-case @builtintype.kind of
-   1 = @errortype
-|  2 = @unknowntype
-|  3 = @void
-|  4 = @boolean
-|  5 = @char
-|  6 = @unsigned_char
-|  7 = @signed_char
-|  8 = @short
-|  9 = @unsigned_short
-| 10 = @signed_short
-| 11 = @int
-| 12 = @unsigned_int
-| 13 = @signed_int
-| 14 = @long
-| 15 = @unsigned_long
-| 16 = @signed_long
-| 17 = @long_long
-| 18 = @unsigned_long_long
-| 19 = @signed_long_long
-// ... 20 Microsoft-specific __int8
-// ... 21 Microsoft-specific __int16
-// ... 22 Microsoft-specific __int32
-// ... 23 Microsoft-specific __int64
-| 24 = @float
-| 25 = @double
-| 26 = @long_double
-| 27 = @complex_float         // C99-specific _Complex float
-| 28 = @complex_double        // C99-specific _Complex double
-| 29 = @complex_long_double   // C99-specific _Complex long double
-| 30 = @imaginary_float       // C99-specific _Imaginary float
-| 31 = @imaginary_double      // C99-specific _Imaginary double
-| 32 = @imaginary_long_double // C99-specific _Imaginary long double
-| 33 = @wchar_t               // Microsoft-specific
-| 34 = @decltype_nullptr      // C++11
-| 35 = @int128                // __int128
-| 36 = @unsigned_int128       // unsigned __int128
-| 37 = @signed_int128         // signed __int128
-| 38 = @float128              // __float128
-| 39 = @complex_float128      // _Complex __float128
-| 40 = @decimal32             // _Decimal32
-| 41 = @decimal64             // _Decimal64
-| 42 = @decimal128            // _Decimal128
-| 43 = @char16_t
-| 44 = @char32_t
-| 45 = @std_float32           // _Float32
-| 46 = @float32x              // _Float32x
-| 47 = @std_float64           // _Float64
-| 48 = @float64x              // _Float64x
-| 49 = @std_float128          // _Float128
-| 50 = @float128x             // _Float128x
-| 51 = @char8_t
-| 52 = @float16               // _Float16
-| 53 = @complex_float16       // _Complex _Float16
-;
+/*
+  Built-in types are the fundamental types, e.g., integral, floating, and void.

+  case @builtintype.kind of
+    1 = error
+  | 2 = unknown
+  | 3 = void
+  | 4 = boolean
+  | 5 = char
+  | 6 = unsigned_char
+  | 7 = signed_char
+  | 8 = short
+  | 9 = unsigned_short
+  | 10 = signed_short
+  | 11 = int
+  | 12 = unsigned_int
+  | 13 = signed_int
+  | 14 = long
+  | 15 = unsigned_long
+  | 16 = signed_long
+  | 17 = long_long
+  | 18 = unsigned_long_long
+  | 19 = signed_long_long
+  | 20 = __int8                 // Microsoft-specific
+  | 21 = __int16                // Microsoft-specific
+  | 22 = __int32                // Microsoft-specific
+  | 23 = __int64                // Microsoft-specific
+  | 24 = float
+  | 25 = double
+  | 26 = long_double
+  | 27 = _Complex_float         // C99-specific
+  | 28 = _Complex_double        // C99-specific
+  | 29 = _Complex_long double   // C99-specific
+  | 30 = _Imaginary_float       // C99-specific
+  | 31 = _Imaginary_double      // C99-specific
+  | 32 = _Imaginary_long_double // C99-specific
+  | 33 = wchar_t                // Microsoft-specific
+  | 34 = decltype_nullptr       // C++11
+  | 35 = __int128
+  | 36 = unsigned___int128
+  | 37 = signed___int128
+  | 38 = __float128
+  | 39 = _Complex___float128
+  | 40 = _Decimal32
+  | 41 = _Decimal64
+  | 42 = _Decimal128
+  | 43 = char16_t
+  | 44 = char32_t
+  | 45 = _Float32
+  | 46 = _Float32x
+  | 47 = _Float64
+  | 48 = _Float64x
+  | 49 = _Float128
+  | 50 = _Float128x
+  | 51 = char8_t
+  ;
+*/
 builtintypes(
    unique int id: @builtintype,
    string name: string ref,
@@ -623,23 +607,23 @@ builtintypes(
    int alignment: int ref
 );

-/**
- * Derived types are types that are directly derived from existing types and
- * point to, refer to, transform type data to return a new type.
- */
-case @derivedtype.kind of
-   1 = @pointer
-|  2 = @reference
-|  3 = @type_with_specifiers
-|  4 = @array
-|  5 = @gnu_vector
-|  6 = @routineptr
-|  7 = @routinereference
-|  8 = @rvalue_reference // C++11
-// ... 9 type_conforming_to_protocols deprecated
-| 10 = @block
-;
+/*
+  Derived types are types that are directly derived from existing types and
+  point to, refer to, transform type data to return a new type.

+  case @derivedtype.kind of
+    1 = pointer
+  | 2 = reference
+  | 3 = type_with_specifiers
+  | 4 = array
+  | 5 = gnu_vector
+  | 6 = routineptr
+  | 7 = routinereference
+  | 8 = rvalue_reference // C++11
+// ... 9 type_conforming_to_protocols deprecated
+  | 10 = block
+  ;
+*/
 derivedtypes(
    unique int id: @derivedtype,
    string name: string ref,
@@ -691,24 +675,23 @@ decltypes(
 );

 /*
-case @usertype.kind of
-   1 = @struct
-|  2 = @class
-|  3 = @union
-|  4 = @enum
-|  5 = @typedef                       // classic C: typedef typedef type name
-|  6 = @template
-|  7 = @template_parameter
-|  8 = @template_template_parameter
-|  9 = @proxy_class                   // a proxy class associated with a template parameter
+  case @usertype.kind of
+    1 = struct
+  | 2 = class
+  | 3 = union
+  | 4 = enum
+  | 5 = typedef                       // classic C: typedef typedef type name
+  | 6 = template
+  | 7 = template_parameter
+  | 8 = template_template_parameter
+  | 9 = proxy_class                   // a proxy class associated with a template parameter
 // ... 10 objc_class deprecated
 // ... 11 objc_protocol deprecated
 // ... 12 objc_category deprecated
-| 13 = @scoped_enum
-| 14 = @using_alias                  // a using name = type style typedef
-;
+  | 13 = scoped_enum
+  | 14 = using_alias                  // a using name = type style typedef
+  ;
 */
-
 usertypes(
    unique int id: @usertype,
    string name: string ref,
@@ -1179,10 +1162,7 @@ case @funbindexpr.kind of
 | 2 = @adl_call     // a call whose target is only found by ADL
 ;
 */
-iscall(
-    unique int caller: @funbindexpr ref,
-    int kind: int ref
-);
+iscall(unique int caller: @funbindexpr ref, int kind: int ref);

 numtemplatearguments(
    unique int expr_id: @expr ref,
--- a/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
+++ b/cpp/ql/lib/semmlecode.cpp.dbscheme.stats
--- a/shared/tutorial/tutorial.qll
+++ b/shared/tutorial/tutorial.qll
@@ -4,11 +4,6 @@
 * Note: Data is usually stored in a separate database and the QL libraries only contain predicates,
 * but for this tutorial both the data and the predicates are stored in the library.
 */
-
-/**
- * A person known to the QL detective tutorials, represented by a string
- * (their first name).
- */
 class Person extends string {
  Person() {
    this =
--- a/cpp/ql/lib/upgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/old.dbscheme
+++ b/cpp/ql/lib/upgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/old.dbscheme
--- a/cpp/ql/lib/upgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/upgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/semmlecode.cpp.dbscheme
--- a/cpp/ql/lib/upgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/upgrade.properties
+++ b/cpp/ql/lib/upgrades/625f706f2a44ae8dc3fc168bfe2637e65c30b012/upgrade.properties
@@ -1,2 +0,0 @@
-description: Uncomment case splits in dbscheme
-compatibility: full
--- a/cpp/ql/lib/upgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/old.dbscheme
+++ b/cpp/ql/lib/upgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/old.dbscheme
--- a/cpp/ql/lib/upgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/semmlecode.cpp.dbscheme
+++ b/cpp/ql/lib/upgrades/ba86bebea4c7a8235c2fa0e220391fbd4446a087/semmlecode.cpp.dbscheme
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Andrew Eisenberg	04b31ea343	Update java/ql/integration-tests/qlpack.yml	2022-12-15 11:39:28 -08:00
Andrew Eisenberg	b37c1391ce	Simplify integration test There is no need to include extra data extensions for this test. Move qlpack to the root of the integration test folder.	2022-12-15 09:48:56 -08:00