The Clang project sanitizers may produce false positives, but in general are quite good.
The GitHub CI job now builds and runs with sanitizers on Ubuntu and MacOS, the differences are striking:

ASAN+LSAN

Ubuntu: 168 failed, 14 broken
MacOS: 5 failed

• frontend/key & frontend/pubkey seem transient and build environment related
• lua:execute & lua:override interesting
• pkg_elf/analyse_elf: this is also failing on the SH Debian build

Are the Ubuntu failures all false positives, or is the Ubuntu sanitizer just better?

UBSAN

Ubuntu: 185 failed, many fail inside UCL.
MacOS: not running, fills the disk of the build machine

Shall the UCL problems be excluded or addressed upstream or both?

TSAN

No problems :)