This might be a false positive
Turns out (~PTR_MASK) != (0xFFFFFFFF - PTR_MASK) in 64 bit land
as https://godbolt.org/z/TWjeE3nde illustrates
https://github.com/ndantam/tlsfmalloc/blob/master/src/tlsf.c#L840=
tmp_b = (bhdr_t*) ( (intptr_t)b->prev_hdr & BLOCK_SIZE );
using ~STATE_MASK or even #define BLOCK_SIZE (~PTR_MASK) resolves the issue
rockbox project: www.rockbox.org