Automated code scanners do have their uses
Slashdot is carrying the story of a rather large bug find in the X11 code.
Judging by the patch, it looks like the problem was due to a lack of caffeine:
if (getuid() == 0 || geteuid != 0)
The OpenBSD code auditors seem to have found this one independently:
This is one of those little things that deliberate code auditing can catch, and that the OpenBSD project is noted for. It would be very interesting, I think, to compare the results from an automated tool (like Coverity‘s, which found this X11 bug for DHS), with those of talented humans (like the OpenBSD folks) on the same corpus of code.