The pointer analysis treats calls to exported functions in the runtime package specially because when the analysis was written, the package was mostly C code so there wasn't much to analyze. Instead of looking at the source for that package, the analysis has built-in knowledge of the aliasing and callgraph effects of the important functions, which are few.

Even though the runtime package is now in Go, I would not revisit this decision because the package makes such extensive use of unsafe.Pointer conversions, which the pointer analysis handles unsoundly: it treats a conversion from unsafe.Pointer to T just like new(T).

You can see the list of PTA intrinsics in golang.org/x/tools/go/pointer/intrinsics.go.

So, working as intended, and tough luck if you work on the runtime. :(

Hm, I'm having trouble understanding how PTA and package runtime instrinsics would be relevant to the particular issue I pointed out. All of the efaceOf calls are direct calls via the function's name, so it's odd to me that it finds a couple of them, but not all?