The problem that was fixed in D25326 for inlined functions keeps biting us for the top-level functions as well. Namely, i had to use check::PreStmt<ReturnStmt> rather than check::EndFunction in D57558 because in the basic_test test the paths get merged before invoking the check::EndFunction callback, which makes it impossible to recover the return value (which never gets stored in the Environment because it's, well, a literal). I don't have an immediate fix for the whole overall problem, so for now, as a hack, check::PreStmt<ReturnStmt> keeps being used.
However, the problem with check::PreStmt<ReturnStmt> is that automatic destructors for function-local variables are not yet evaluated when this callback is invoked. This causes false negatives in MIGChecker: if memory is released in an automatic destructor and then an error code is returned, the bug is not found because the Static Analyzer evalues the destructor *after* the pre-return. Arguably, this may also be treated as a bug, depending on what does the "Pre" in PreStmt<ReturnStmt> stand for.
But regardless, for now it seems that we'd have to subscribe on both callbacks.