In the glibc master branch, at sunrpc/key_call.c file, the memset at line 105 would be removed by compiler DSE pass at O1 or higher optimization level, making the developer's intention (i.e. avoid leaving secret key in memory) failing.


  86 /* key_secretkey_is_set() returns 1 if the keyserver has a secret key
  87  * stored for the caller's effective uid; it returns 0 otherwise
  88  *
  89  * N.B.:  The KEY_NET_GET key call is undocumented.  Applications shouldn't
  90  * be using it, because it allows them to get the user's secret key.
  91  */
  92 int
  93 key_secretkey_is_set (void)
  94 {
  95   struct key_netstres kres;
  96 
  97   memset (&kres, 0, sizeof (kres));
  98   if (key_call ((u_long) KEY_NET_GET, (xdrproc_t) xdr_void,
  99                 (char *) NULL, (xdrproc_t) xdr_key_netstres,
 100                 (char *) &kres) &&
 101       (kres.status == KEY_SUCCESS) &&
 102       (kres.key_netstres_u.knet.st_priv_key[0] != 0))
 103     {
 104       /* avoid leaving secret key in memory */
 105       memset (kres.key_netstres_u.knet.st_priv_key, 0, HEXKEYBYTES);
 106       return 1;
 107     }
 108   return 0;
 109 }


Note that the USENIX Security 2017 paper "Dead Store Elimination (Still) Considered Harmful" (https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/yang) gives a deep analysis on this problem.

We should use memset_s or other library function to mitigate this problem.
Several mitigations have been discussed in the Security 2017 paper.