Fix #15006: FP invalidFree with new array

[ludviggunne]

No description provided.

[dmcppcheck]

Test results for commit 7f23298 (tools/test-my-pr.py, main compared to this PR):

Test: http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8880/
packages: 1000
Differing warnings: 122 (+116 -6)
AI review: 37 improvement, 11 regression, 2 unclear (http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8880/2026-10-05_07-31-15-7f232989d1f9-review.txt)
Timing: +0.6% (http://ec2-16-170-140-253.eu-north-1.compute.amazonaws.com/pr-8880/2026-10-05_07-31-15-7f232989d1f9_timing.html)

_{Posted automatically by the cppcheck PR test runner. +N: warnings only with this PR, -N: warnings only with main. The AI review is written by Claude and can be wrong.}

[dmcppcheck]

@claude review

[claude]

Review summary:

• The invalidFree fix works for the new case. The malloc case is still a known FP (TODO test).
• valueFlowSymbolicOperators: the new offset propagation has no overflow check on intvalue += constant, which is UB. It also shifts impossible and bound symbolic values, so it changes behaviour for all checkers. daca shows +116/-6 warnings, with 11 flagged as regressions; please look at those.
• Missing tests in testvalueflow.cpp for the new symbolic propagation.