From the article: "(the figure of 40% is a lower bound since STACK doesn't do the same level of analysis that gcc does)." So he adds a fudge factor to estimate

From the article: "(the figure of 40% is a lower bound since STACK doesn't do the same level of analysis that gcc does)." So he adds a fudge factor to estimate actual breakage and comes up with "nearly half". I dunno, seems fair to me.