fill_db_untrusted: follow untrusted data down the call tree