PointerCPA handles structs and unions in a strange way
PointerCPA handles struct dereferences in a special way: potential pointers to struct instances point to the struct-type declaration.
This deviates from the intended behavior of the PointerCPA, that holds a map from pointers to potential pointee memory locations.
I'm not sure what the idea behind this was, but I would prefer the PointerCPA to just give no information (\top) if it is not sure what to point to. This way, no special handling would be necessary.