As shown in PR 94355 comment 11, this code reports a use-after-free (and a spurious leak and spurious null deref):

struct S {
    S() { p = new int(); }
    ~S() { delete p; }
    int* p = nullptr;
};

int main() {
    S s;
    S ss = s;
}

Ideally the copy construction of 'ss' would flag that we end up with two owners of the heap pointer. The new object should either make a deep copy (allocate a new object as a copy of *s.p) or should clear the source so it's left empty (which would require a move constructor, not just the trivial copy constructor that makes the shallow copy here).

In other words, rather than flagging three symptoms, flag the cause. The type manages dynamic resources but doesn't have a user-provided copy or move constructor and so manages them unsafely.