SonarCloud instance reports the issue here:

    static char *temp_path = NULL;
    char temp_path_storage[PATH_MAX];
    if (temp_path == NULL) {
        int pathSize = confstr(_CS_DARWIN_USER_TEMP_DIR, temp_path_storage, PATH_MAX);
        if (pathSize == 0 || pathSize > PATH_MAX) {
            strlcpy(temp_path_storage, "/tmp", sizeof(temp_path_storage));
        }
        temp_path = temp_path_storage; // <---- ERROR
    }
    return JNU_NewStringPlatform(env, temp_path);

"Address of stack memory associated with local variable 'temp_path_storage' is still referred to by the static variable 'temp_path' upon returning to the caller. This will be a dangling reference"

Seems to exist since:
 7113349: Initial changeset for Macosx port to jdk