server/mpm/event/event.c:1699: error: INTEGER_OVERFLOW_L2
  ([0, +oo] - 1):unsigned32 by call to `TO_QUEUE_REMOVE`.

server/mpm/event/event.c:1698:9: Unknown value from: __infer_skip
1696.     rv = apr_pollset_add(event_pollset, &cs->pfd);
1697.     if (rv != APR_SUCCESS && !APR_STATUS_IS_EEXIST(rv)) {
1698.         AP_DEBUG_ASSERT(0);
              ^
1699.         TO_QUEUE_REMOVE(q, cs);
1700.         apr_thread_mutex_unlock(timeout_mutex);

server/mpm/event/event.c:1699:9: Call
1697.     if (rv != APR_SUCCESS && !APR_STATUS_IS_EEXIST(rv)) {
1698.         AP_DEBUG_ASSERT(0);
1699.         TO_QUEUE_REMOVE(q, cs);
              ^
1700.         apr_thread_mutex_unlock(timeout_mutex);
1701.         ap_log_error(APLOG_MARK, APLOG_ERR, rv, ap_server_conf, APLOGNO(03092)

server/mpm/event/event.c:317:1: <LHS trace>
315. }
316. 
317. static void TO_QUEUE_REMOVE(struct timeout_queue *q, event_conn_state_t *el)
     ^
318. {
319.     APR_RING_REMOVE(el, timeout_list);

server/mpm/event/event.c:317:1: Parameter `*q->total`
  315. }
  316. 
  317. static void TO_QUEUE_REMOVE(struct timeout_queue *q, event_conn_state_t *el)
       ^
  318. {
  319.     APR_RING_REMOVE(el, timeout_list);

server/mpm/event/event.c:321:5: Binary operation: ([0, +oo] - 1):unsigned32 by call to `TO_QUEUE_REMOVE` 
  319.     APR_RING_REMOVE(el, timeout_list);
  320.     APR_RING_ELEM_INIT(el, timeout_list);
  321.     --*q->total;
           ^
  322.     --q->count;
  323. }

static void TO_QUEUE_REMOVE(struct timeout_queue *q, event_conn_state_t *el)
{
    APR_RING_REMOVE(el, timeout_list);
    APR_RING_ELEM_INIT(el, timeout_list);
    --*q->total;
    --q->count;
}
['static void process_lingering_close(event_conn_state_t *cs)\n{\n    apr_socket_t *csd = ap_get_conn_socket(cs->c);\n    char dummybuf[LINGERING_BUF_SIZE];\n    apr_size_t nbytes;\n    apr_status_t rv;\n    struct timeout_queue *q;\n    do {\n        nbytes = sizeof(dummybuf);\n        rv = apr_socket_recv(csd, dummybuf, &nbytes);\n    } while (rv == APR_SUCCESS);\n    if (!APR_STATUS_IS_EAGAIN(rv)) {\n        rv = apr_socket_close(csd);\n        AP_DEBUG_ASSERT(rv == APR_SUCCESS);\n        ap_queue_info_push_pool(worker_queue_info, cs->p);\n        return;\n    }\n    cs->pfd.reqevents = APR_POLLIN;\n    cs->pub.sense = CONN_SENSE_DEFAULT;\n    q = (cs->pub.state == CONN_STATE_LINGER_SHORT) ? short_linger_q : linger_q;\n    apr_thread_mutex_lock(timeout_mutex);\n    TO_QUEUE_APPEND(q, cs);\n    rv = apr_pollset_add(event_pollset, &cs->pfd);\n    if (rv != APR_SUCCESS && !APR_STATUS_IS_EEXIST(rv)) {\n        AP_DEBUG_ASSERT(0);\n        TO_QUEUE_REMOVE(q, cs);\n        apr_thread_mutex_unlock(timeout_mutex);\n        ap_log_error(APLOG_MARK, APLOG_ERR, rv, ap_server_conf, APLOGNO(03092)\n                     "process_lingering_close: apr_pollset_add failure");\n        rv = apr_socket_close(cs->pfd.desc.s);\n        AP_DEBUG_ASSERT(rv == APR_SUCCESS);\n        ap_queue_info_push_pool(worker_queue_info, cs->p);\n        return;\n    }\n    apr_thread_mutex_unlock(timeout_mutex);\n}', 'static void TO_QUEUE_REMOVE(struct timeout_queue *q, event_conn_state_t *el)\n{\n    APR_RING_REMOVE(el, timeout_list);\n    APR_RING_ELEM_INIT(el, timeout_list);\n    --*q->total;\n    --q->count;\n}']