stds.h: __nonnull__ has four underscores