Verification Blind Spots: When Branchless Code Defeats Static Analysis

We identify and characterize a class of verification blind spots in AST-pattern-based static analysis tools: safety-critical constraints that become invisible when program semantics shift from control flow to arithmetic. Using three benchmark programs that encode division-by-zero protection, forbidden-value filtering, and bounded state cycling without any conditional branching, we demonstrate that a representative constraint scanner -- which successfully detects all three constraints in their branched equivalents -- finds zero constraints in the branchless forms. Z3 SMT proofs confirm mathematical equivalence between each branchless program and its branched counterpart, establishing that the constraints are preserved in the code's semantics but lost in the tool's detection model. We formalize the control-flow assumption, present a taxonomy of constraint survivability, survey five widely-used tools that share the blind spot, and demonstrate a dual-sort AST-to-Z3 conversion technique that recovers full constraint visibility.