[gsg]

I've heard of several:

http://embed.cs.utah.edu/ioc/ http://code.google.com/p/c-semantics/

Haven't used either in anger though.

[mjn]

Thanks! I'd run across the first one, but it's also only for the case of integer overflow. The 2nd is new to me, and looks quite comprehensive.