package sfBugs;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.SQLException;

import edu.umd.cs.findbugs.annotations.DesireWarning;

public class Bug3506138 {

    public static Connection getConnection() {
        throw new UnsupportedOperationException();
    }

    @DesireWarning("ODR_OPEN_DATABASE_RESOURCE")
    public static void main(String[] args) throws Exception {
        Connection conn;
        PreparedStatement pstm = null;
        try {
            conn = getConnection();
            pstm = conn.prepareStatement("123");
            pstm.executeUpdate();
        } finally {
            if (pstm != null)
                pstm.close();
        }
    }
}

@@ -54,33 +54,29 @@
 ava.sql.
-PreparedStatement
+DriverManager
 ;%0Aimport
@@ -89,20 +89,25 @@
 sql.
-SQLException
+PreparedStatement
 ;%0A%0Ai
@@ -158,16 +158,70 @@
 Warning;
+%0Aimport edu.umd.cs.findbugs.annotations.ExpectWarning;
 %0A%0Apublic
@@ -351,22 +351,22 @@
 %7D%0A%0A    @
-Desire
+Expect
 Warning(
@@ -422,26 +422,438 @@
 oid 
-main(String%5B%5D args
+test0(String url) throws Exception %7B%0A        Connection conn;%0A        PreparedStatement pstm = null;%0A        try %7B%0A            conn = DriverManager.getConnection(url);%0A            pstm = conn.prepareStatement(%22123%22);%0A            pstm.executeUpdate();%0A        %7D finally %7B%0A            if (pstm != null)%0A                pstm.close();%0A        %7D%0A    %7D%0A    %0A    @DesireWarning(%22ODR_OPEN_DATABASE_RESOURCE%22)%0A    public static void test1(
 ) th
@@ -1162,10 +1162,18 @@
 %7D%0A    %7D%0A
+    %0A  %0A
 %7D%0A

Update test case to show the problem is that we don't track the return value of unknown methods that happen to return a Connection