How do you find undefined behavior in a codebase?

Layered defense, because UB is invisible by default, the compiler isn't required to warn. First, compile with -Wall -Wextra (and ideally -Werror) to catch precursors: uninitialized variable use, signed/unsigned comparison mismatches, suspicious shifts, missing returns. Second, run the sanitizers during development and testing: UndefinedBehaviorSanitizer (-fsanitize=undefined) instruments the binary to trap signed overflow, out-of-bounds shifts, misaligned accesses, and null derefs with exact file/line diagnostics; AddressSanitizer (-fsanitize=address) catches out-of-bounds memory access, use-after-free, and leaks. Third, use static analyzers (clang-tidy, Coverity, cppcheck) which flag some UB by analysis without running. For embedded specifically, you run the sanitizers against host-side unit tests of your portable logic, since instrumented binaries are usually too big and slow for the target, which is itself an argument for keeping firmware logic decoupled from hardware so it's testable on a PC. The overarching discipline: never treat "it works" as proof, and prefer safe idioms (unsigned for wraparound, 1u << n, memcpy for punning, bounds checks at input boundaries).