diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index a12ff40019..7c720ea672 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -1494,6 +1494,7 @@ save_opt(dig_lookup_t *lookup, char *code, char *value) {
 	if (lookup->ednsopts == NULL) {
 		cloneopts(lookup, NULL);
 	}
+	INSIST(lookup->ednsopts != NULL);
 
 	if (lookup->ednsopts[lookup->ednsoptscnt].value != NULL) {
 		isc_mem_free(mctx, lookup->ednsopts[lookup->ednsoptscnt].value);
diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index dc3b8d2428..e12169043a 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -362,6 +362,7 @@ main(int argc, char **argv) {
 	setup_logging(mctx, &log);
 
 	if (predecessor == NULL) {
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (label == NULL) {
 			fatal("the key label was not specified");
 		}
@@ -383,6 +384,7 @@ main(int argc, char **argv) {
 			      isc_result_totext(ret));
 		}
 
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (strchr(label, ':') == NULL) {
 			char *l;
 			int len;
@@ -394,11 +396,13 @@ main(int argc, char **argv) {
 			label = l;
 		}
 
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (algname == NULL) {
 			fatal("no algorithm specified");
 		}
 
 		r.base = algname;
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		r.length = strlen(algname);
 		ret = dns_secalg_fromtext(&alg, &r);
 		if (ret != ISC_R_SUCCESS) {
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 996b3ac6a6..849947f08d 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -1180,10 +1180,12 @@ main(int argc, char **argv) {
 	}
 
 	if (ctx.predecessor == NULL && ctx.policy == NULL) {
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (algname == NULL) {
 			fatal("no algorithm specified");
 		}
 		r.base = algname;
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		r.length = strlen(algname);
 		ret = dns_secalg_fromtext(&ctx.alg, &r);
 		if (ret != ISC_R_SUCCESS) {
diff --git a/lib/dns/update.c b/lib/dns/update.c
index 49f177002b..2de3b5bf46 100644
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -2183,7 +2183,7 @@ failure:
 		dst_key_free(&state->zone_keys[i]);
 	}
 
-	if (state != &mystate && state != NULL) {
+	if (state != &mystate) {
 		*statep = NULL;
 		state->magic = 0;
 		isc_mem_put(diff->mctx, state, sizeof(*state));
diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index f90c520540..ba58d02d15 100644
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -445,6 +445,7 @@ more_frags(isc__mem_t *ctx, size_t new_size) {
 	if (ctx->basic_blocks == NULL) {
 		more_basic_blocks(ctx);
 	}
+	INSIST(ctx->basic_blocks != NULL);
 
 	total_size = ctx->mem_target;
 	tmp = ctx->basic_blocks;
@@ -516,6 +517,7 @@ mem_getunlocked(isc__mem_t *ctx, size_t size) {
 	if (ctx->freelists[new_size] == NULL) {
 		more_frags(ctx, new_size);
 	}
+	INSIST(ctx->freelists[new_size] != NULL);
 
 	/*
 	 * The free list uses the "rounded-up" size "new_size".
diff --git a/lib/isc/radix.c b/lib/isc/radix.c
index 72416a61a5..fccad5baae 100644
--- a/lib/isc/radix.c
+++ b/lib/isc/radix.c
@@ -232,15 +232,16 @@ isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target,
 
 	*target = NULL;
 
-	if (radix->head == NULL) {
+	node = radix->head;
+
+	if (node == NULL) {
 		return (ISC_R_NOTFOUND);
 	}
 
-	node = radix->head;
 	addr = isc_prefix_touchar(prefix);
 	bitlen = prefix->bitlen;
 
-	while (node->bit < bitlen) {
+	while (node != NULL && node->bit < bitlen) {
 		if (node->prefix) {
 			stack[cnt++] = node;
 		}
@@ -251,13 +252,9 @@ isc_radix_search(isc_radix_tree_t *radix, isc_radix_node_t **target,
 		} else {
 			node = node->l;
 		}
-
-		if (node == NULL) {
-			break;
-		}
 	}
 
-	if (node && node->prefix) {
+	if (node != NULL && node->prefix) {
 		stack[cnt++] = node;
 	}
 
diff --git a/lib/ns/client.c b/lib/ns/client.c
index 00badb4ac5..d91380aed0 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -1365,7 +1365,9 @@ process_ecs(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 
 		if ((addrlen % 8) != 0) {
 			uint8_t bits = ~0U << (8 - (addrlen % 8));
+			/* cppcheck-suppress objectIndex */
 			bits &= paddr[addrbytes - 1];
+			/* cppcheck-suppress objectIndex */
 			if (bits != paddr[addrbytes - 1]) {
 				return (DNS_R_OPTERR);
 			}