The cleanup attribute is written on a variable declaration, and the address of the declared variable is passed to the specified function in the attribute. This has some subtle issues we should diagnose on. Consider:

__attribute__((cleanup(free))) void *p = malloc(10);

This will pass &p to free, which is going to do the wrong thing. GCC diagnoses this kind of misuse (warning: 'free' called on unallocated object 'p' [-Wfree-nonheap-object]) and it would be good if we did the same: https://godbolt.org/z/nhqh9EazM