debug: add __smatch_state_count()