Range errors (dereferencing or incrementing the past-the-end iterator or decrementing the iterator of the first element of the range) and access of invalidated iterators lead to undefined behavior. There is no point to continue the analysis after such an error on the same execution path, but terminate it by a sink node (fatal error). This also improves the performance and helps avoiding double reports (e.g. in case of nested iterators).
I left errors caused by mismatched iterators non-fatal for now. This is debatable because passing a function expecting a range iterators for two different containers or applying a container modifier using a mismatched iterator also leads to undefined behavior. However, comparing two iterators of different containers always returns false thus it is non-fatal. Maybe we should separate these two cases and report the first one as fatal, the second one as non-fatal errors.