function main() {
  $a = array();
  $a['g'] = &$a;

  test($a);
  test($GLOBALS);
}
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.