I checked some of the new issues in the DCA results. There is at least one false positive in cs/dereferenced-value-may-be-null, which reports on the following pattern:

Method(new object(), null);
void Method(params object[] objs)
{
  var x = objs.Length; // reports objs can be null, because of the null arg in the call. 
}

At the same time, there are new true positives found in cs/cleartext-storage-of-sensitive-information because we consider all expressions passed to the params parameter of System.Diagnostics.TraceSource.TraceEvent.

The second DCA run seems good. We find 3 additional alerts, all end in TraceMessageSinks (arguments passed to the params parameter of System.Diagnostics.TraceSource.TraceEvent).