how about marking this and friends with `FUNC_ATTR_NONNULL_ARG`?