ScanAndProcessReturnValue uses the current origin to report warnings for method return values. The origin's IL offset is updated at certain spots in ReflectionMethodBodyScanner, but not for ret opcodes. Instead we just track the possible return values:

And later report warnings about the return value using the current origin (which will have whatever IL offset we last updated it to):

We probably should be tracking the IL offset for each ret instruction instead. I can't think of a case where this produces any different warning behavior, but it requires a workaround in how we handle trim analysis patterns in the linker.