This is tangentially related to D91383: After that patch, the offset/size conditions for the variable index case are the same as for the no-variable case, with one exception: If there are no variables and the base offset is negative, we also check that V2 doesn't have unknown size.
I believe this check is not necessary. It was introduced in https://github.com/llvm/llvm-project/commit/e3ac099726571b58333b0fee827831d420d24285, but the problem was really with incorrect location sizes being provided in the first place (wrt handling of negative offsets), which was fixed by https://github.com/llvm/llvm-project/commit/1726fc698ccb85fe4bb23c200a50f28b57fc53cb. Unknown location sizes are still required to be non-negative, so the second access cannot start below zero.
I've added a test using a store and a memset to illustrate a case where this makes a difference.
This doesn't look right. The address loaded is modified in the loop.