In the following test case only the first two instances of passing a null argument to a nonnull function are diagnosed.  The third one isn't.

$ cat z.c && gcc -O2 -S -Wall -Wpedantic -fdump-tree-optimized=/dev/stdout z.c
__attribute__ ((nonnull)) void f (void*);

void f1 (void)
{
  f (0);           // Wnonnull (good)
}

void f2 (void)
{
  void *const p = 0;
  f (p);           // -Wnonnull (good)
}


void f3 (void)
{
  void *p = 0;
  f (p);           // missing -Wnonnull
}

z.c: In function ‘f1’:
z.c:5:3: warning: null argument where non-null required (argument 1) [-Wnonnull]
    5 |   f (0);           // Wnonnull (good)
      |   ^
z.c: In function ‘f2’:
z.c:11:3: warning: null argument where non-null required (argument 1) [-Wnonnull]
   11 |   f (p);           // -Wnonnull (good)
      |   ^

;; Function f1 (f1, funcdef_no=0, decl_uid=1932, cgraph_uid=1, symbol_order=0)

f1 ()
{
  <bb 2> [local count: 1073741824]:
  f (0B); [tail call]
  return;

}



;; Function f2 (f2, funcdef_no=4, decl_uid=1935, cgraph_uid=2, symbol_order=1)

f2 ()
{
  <bb 2> [local count: 1073741824]:
  f (0B); [tail call]
  return;

}



;; Function f3 (f3, funcdef_no=6, decl_uid=1939, cgraph_uid=3, symbol_order=2)

f3 ()
{
  <bb 2> [local count: 1073741824]:
  f (0B); [tail call]
  return;

}


Clang is similarly ineffective on its own, but its analyzer detects all three:

$ clang -O2 -S -Wall --analyze z.c
z.c:5:3: warning: Null pointer passed as an argument to a 'nonnull' parameter
  f (0);           // Wnonnull (good)
  ^~~~~
z.c:11:3: warning: Null pointer passed as an argument to a 'nonnull' parameter
  f (p);           // -Wnonnull (good)
  ^~~~~
z.c:18:3: warning: Null pointer passed as an argument to a 'nonnull' parameter
  f (p);           // missing -Wnonnull
  ^~~~~
3 warnings generated.