Sibling post gave a case study as a citation providing evidence of the assertion: http://blog.regehr.org/archives/1292 http://blog.regehr.org/archives/1292 In

Sibling post gave a case study as a citation providing evidence of the assertion: http://blog.regehr.org/archives/1292 http://blog.regehr.org/archives/1292 In that case (sqlite) code that passed UBSan, ASan, valgrind, and compiled correctly on all current compilers was studied. A new dynamic undefined behavior checker found additional UB defects at a rate over 1 per thousand lines of code. I would believe your codebase could have a defect rate one, maybe even two orders of magnitude lower. But short of a formal code-correctness proof, better than that seems unlikely.