Usefulness of static code analysis beyond linting is greatly overstated (by people selling static code analysis tools).
As proven by a large majority of C developers ignoring lint since 1979.
Coverity isn't useless. It finds these kinds of buffer overflow errors easily. It's shameful that a prominent keystone FOSS project is using such outdated coding practices in the first place. Not using the free tooling available for such projects is doubly so.
Systemd uses Simmle LGTM and QL for static code analysis which is a good thing since Coverty Scan is currently down without an ETA for restoration.