Sibling post gave a case study as a citation providing evidence of the assertion: <a href="http:&#x2F;&#x2F;blog.regehr.org&#x2F;archives&#x2F;1292" rel="nofollow">http:&#x2F;&#x2F;blog.regehr.org&#x2F;archives&#x2F;1292</a><p>In that case (sqlite) code that passed UBSan, ASan, valgrind, and compiled correctly on all current compilers was studied.  A new dynamic undefined behavior checker found additional UB defects at a rate over 1 per thousand lines of code.<p>I would believe your codebase could have a defect rate one, maybe even two orders of magnitude lower.  But short of a formal code-correctness proof, better than that seems unlikely.