diff --git a/CHANGES b/CHANGES
index 2ec6731f59..4408f3ab87 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4264.	[bug]		Check const of strchr/strrchr assignments match
+			argument's const status. [RT #41150]
+
 4262.	[bug]		Fixed a bug in epoll socket code that caused
 			sockets to not be registered for ready
 			notification in some cases, causing named to not
diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index b1b871d09b..f731a1388a 100644
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -58,7 +58,7 @@ dns_zone_t *zone = NULL;
 dns_zonetype_t zonetype = dns_zone_master;
 static int dumpzone = 0;
 static const char *output_filename;
-static char *prog_name = NULL;
+static const char *prog_name = NULL;
 static const dns_master_style_t *outputstyle = NULL;
 static enum { progmode_check, progmode_compile } progmode;
 
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 145e6107ad..ac56b4330e 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -720,7 +720,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
  */
 
 static void
-plus_option(char *option, isc_boolean_t is_batchfile,
+plus_option(const char *option, isc_boolean_t is_batchfile,
 	    dig_lookup_t *lookup)
 {
 	isc_result_t result;
@@ -735,7 +735,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 	strncpy(option_store, option, sizeof(option_store));
 	option_store[sizeof(option_store)-1]=0;
 	ptr = option_store;
-	cmd = next_token(&ptr,"=");
+	cmd = next_token(&ptr, "=");
 	if (cmd == NULL) {
 		printf(";; Invalid option %s\n", option_store);
 		return;
@@ -1207,7 +1207,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 	invalid_option:
 	need_value:
 		fprintf(stderr, "Invalid option: +%s\n",
-			 option);
+			option);
 		usage();
 	}
 	return;
@@ -1434,14 +1434,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				 value);
 		return (value_from_next);
 	case 'y':
-		ptr = next_token(&value,":");	/* hmac type or name */
+		ptr = next_token(&value, ":");	/* hmac type or name */
 		if (ptr == NULL) {
 			usage();
 		}
 		ptr2 = next_token(&value, ":");	/* name or secret */
 		if (ptr2 == NULL)
 			usage();
-		ptr3 = next_token(&value,":"); /* secret or NULL */
+		ptr3 = next_token(&value, ":"); /* secret or NULL */
 		if (ptr3 != NULL) {
 			parse_hmac(ptr);
 			ptr = ptr2;
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index be6803e685..36e7d4405f 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -456,7 +456,7 @@ append(const char *text, int len, char **p, char *end) {
 
 static isc_result_t
 reverse_octets(const char *in, char **p, char *end) {
-	char *dot = strchr(in, '.');
+	const char *dot = strchr(in, '.');
 	int len;
 	if (dot != NULL) {
 		isc_result_t result;
diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
index 6756a38129..4e2a18a936 100644
--- a/bin/dnssec/dnssec-revoke.c
+++ b/bin/dnssec/dnssec-revoke.c
@@ -79,7 +79,8 @@ main(int argc, char **argv) {
 #else
 	const char *engine = NULL;
 #endif
-	char *filename = NULL, *dir = NULL;
+	char const *filename = NULL;
+	char *dir = NULL;
 	char newname[1024], oldname[1024];
 	char keystr[DST_KEY_FORMATSIZE];
 	char *endp;
diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index e26356c788..a95d39a236 100644
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -122,7 +122,8 @@ main(int argc, char **argv) {
 #else
 	const char	*engine = NULL;
 #endif
-	char		*filename = NULL, *directory = NULL;
+	const char 	*filename = NULL;
+	char		*directory = NULL;
 	char		newname[1024];
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 057f09dd53..683e42b9be 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -2618,7 +2618,8 @@ get_ticket_realm(isc_mem_t *mctx) {
 	krb5_error_code rc;
 	krb5_ccache ccache;
 	krb5_principal princ;
-	char *name, *ticket_realm;
+	char *name;
+	const char * ticket_realm;
 
 	rc = krb5_init_context(&ctx);
 	if (rc != 0)
diff --git a/bin/tests/db_test.c b/bin/tests/db_test.c
index 259ed6c7e8..7926bf2293 100644
--- a/bin/tests/db_test.c
+++ b/bin/tests/db_test.c
@@ -367,7 +367,7 @@ main(int argc, char *argv[]) {
 	dns_name_t *fname;
 	unsigned int options = 0, zcoptions;
 	isc_time_t start, finish;
-	char *origintext;
+	const char *origintext;
 	dbinfo *dbi;
 	dns_dbversion_t *version;
 	dns_name_t *origin;
diff --git a/bin/tests/nsecify.c b/bin/tests/nsecify.c
index c31b08aaaf..6092083b4a 100644
--- a/bin/tests/nsecify.c
+++ b/bin/tests/nsecify.c
@@ -118,7 +118,7 @@ nsecify(char *filename) {
 	dns_db_t *db;
 	dns_dbversion_t *wversion;
 	dns_dbnode_t *node, *nextnode;
-	char *origintext;
+	const char *origintext;
 	dns_fixedname_t fname, fnextname;
 	dns_name_t *name, *nextname, *target;
 	isc_buffer_t b;
diff --git a/bin/tests/rbt_test.c b/bin/tests/rbt_test.c
index a62f4c3669..f0c0f8c69b 100644
--- a/bin/tests/rbt_test.c
+++ b/bin/tests/rbt_test.c
@@ -31,7 +31,7 @@
 #include <dns/fixedname.h>
 #include <dns/result.h>
 
-char *progname;
+const char *progname;
 isc_mem_t *mctx;
 
 #define DNSNAMELEN 255
diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
index 0744399482..44114b8066 100644
--- a/lib/dns/openssldh_link.c
+++ b/lib/dns/openssldh_link.c
@@ -617,7 +617,7 @@ BN_fromhex(BIGNUM *b, const char *str) {
 
 	RUNTIME_CHECK(strlen(str) < 1024U && strlen(str) % 2 == 0U);
 	for (i = 0; i < strlen(str); i += 2) {
-		char *s;
+		const char *s;
 		unsigned int high, low;
 
 		s = strchr(hexdigits, tolower((unsigned char)str[i]));
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index 72e422c370..6da37d5330 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -1391,8 +1391,7 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
 	UNUSED(pin);
 
 	if (engine == NULL) {
-		colon = strchr(label, ':');
-		if (colon == NULL)
+		if (strchr(label, ':') == NULL)
 			DST_RET(DST_R_NOENGINE);
 		tmpengine = isc_mem_strdup(key->mctx, label);
 		if (tmpengine == NULL)
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index fcd4815832..4670089395 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -17457,7 +17457,7 @@ dns_zone_keydone(dns_zone_t *zone, const char *keystr) {
 		kd->all = ISC_TRUE;
 	else {
 		isc_textregion_t r;
-		char *algstr;
+		const char *algstr;
 		dns_keytag_t keyid;
 		dns_secalg_t alg;
 		size_t n;
diff --git a/lib/isc/base32.c b/lib/isc/base32.c
index 2ee99b1824..5f0332d742 100644
--- a/lib/isc/base32.c
+++ b/lib/isc/base32.c
@@ -170,7 +170,7 @@ base32_decode_init(base32_decode_ctx_t *ctx, int length, const char base[],
 
 static inline isc_result_t
 base32_decode_char(base32_decode_ctx_t *ctx, int c) {
-	char *s;
+	const char *s;
 	unsigned int last;
 
 	if (ctx->seen_end)
diff --git a/lib/isc/base64.c b/lib/isc/base64.c
index 6b4cb1bf7c..26c3a09b6b 100644
--- a/lib/isc/base64.c
+++ b/lib/isc/base64.c
@@ -118,7 +118,7 @@ base64_decode_init(base64_decode_ctx_t *ctx, int length, isc_buffer_t *target)
 
 static inline isc_result_t
 base64_decode_char(base64_decode_ctx_t *ctx, int c) {
-	char *s;
+	const char *s;
 
 	if (ctx->seen_end)
 		return (ISC_R_BADBASE64);
diff --git a/lib/isc/commandline.c b/lib/isc/commandline.c
index 416fba1927..e58b1b8ced 100644
--- a/lib/isc/commandline.c
+++ b/lib/isc/commandline.c
@@ -95,7 +95,7 @@ static char endopt = '\0';
 int
 isc_commandline_parse(int argc, char * const *argv, const char *options) {
 	static char *place = ENDOPT;
-	char *option;			/* Index into *options of option. */
+	const char *option;		/* Index into *options of option. */
 
 	REQUIRE(argc >= 0 && argv != NULL && options != NULL);
 
diff --git a/lib/isc/hex.c b/lib/isc/hex.c
index 00903c7374..0beb4ec402 100644
--- a/lib/isc/hex.c
+++ b/lib/isc/hex.c
@@ -95,7 +95,7 @@ hex_decode_init(hex_decode_ctx_t *ctx, int length, isc_buffer_t *target)
 
 static inline isc_result_t
 hex_decode_char(hex_decode_ctx_t *ctx, int c) {
-	char *s;
+	const char *s;
 
 	if ((s = strchr(hex, toupper(c))) == NULL)
 		return (ISC_R_BADHEX);
diff --git a/lib/isc/include/isc/file.h b/lib/isc/include/isc/file.h
index 7137410b61..615aaf2eca 100644
--- a/lib/isc/include/isc/file.h
+++ b/lib/isc/include/isc/file.h
@@ -312,8 +312,8 @@ isc_file_safecreate(const char *filename, FILE **fp);
  */
 
 isc_result_t
-isc_file_splitpath(isc_mem_t *mctx, char *path,
-		   char **dirname, char **basename);
+isc_file_splitpath(isc_mem_t *mctx, const char *path,
+		   char **dirname, char const **basename);
 /*%<
  * Split a path into dirname and basename.  If 'path' contains no slash
  * (or, on windows, backslash), then '*dirname' is set to ".".
diff --git a/lib/isc/string.c b/lib/isc/string.c
index 56ec444bff..3a2bf345aa 100644
--- a/lib/isc/string.c
+++ b/lib/isc/string.c
@@ -56,14 +56,14 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-static char digits[] = "0123456789abcdefghijklmnoprstuvwxyz";
+static const char digits[] = "0123456789abcdefghijklmnoprstuvwxyz";
 
 isc_uint64_t
 isc_string_touint64(char *source, char **end, int base) {
 	isc_uint64_t tmp;
 	isc_uint64_t overflow;
 	char *s = source;
-	char *o;
+	const char *o;
 	char c;
 
 	if ((base < 0) || (base == 1) || (base > 36)) {
diff --git a/lib/isc/unix/file.c b/lib/isc/unix/file.c
index c2abd440e1..3fc2a29125 100644
--- a/lib/isc/unix/file.c
+++ b/lib/isc/unix/file.c
@@ -204,8 +204,9 @@ isc_file_mktemplate(const char *path, char *buf, size_t buflen) {
 
 isc_result_t
 isc_file_template(const char *path, const char *templet, char *buf,
-			size_t buflen) {
-	char *s;
+		  size_t buflen)
+{
+	const char *s;
 
 	REQUIRE(path != NULL);
 	REQUIRE(templet != NULL);
@@ -262,7 +263,7 @@ isc_file_renameunique(const char *file, char *templet) {
 		if (errno != EEXIST)
 			return (isc__errno2result(errno));
 		for (cp = x;;) {
-			char *t;
+			const char *t;
 			if (*cp == '\0')
 				return (ISC_R_FAILURE);
 			t = strchr(alphnum, *cp);
@@ -461,7 +462,7 @@ isc_file_ischdiridempotent(const char *filename) {
 
 const char *
 isc_file_basename(const char *filename) {
-	char *s;
+	const char *s;
 
 	REQUIRE(filename != NULL);
 
@@ -579,9 +580,11 @@ isc_file_safecreate(const char *filename, FILE **fp) {
 }
 
 isc_result_t
-isc_file_splitpath(isc_mem_t *mctx, char *path, char **dirname, char **basename)
+isc_file_splitpath(isc_mem_t *mctx, const char *path, char **dirname,
+		   char const **basename)
 {
-	char *dir, *file, *slash;
+	char *dir;
+	const char *file, *slash;
 
 	if (path == NULL)
 		return (ISC_R_INVALIDFILE);
diff --git a/lib/isc/win32/file.c b/lib/isc/win32/file.c
index ede94d6063..5b50262f1c 100644
--- a/lib/isc/win32/file.c
+++ b/lib/isc/win32/file.c
@@ -264,7 +264,8 @@ isc_file_mktemplate(const char *path, char *buf, size_t buflen) {
 
 isc_result_t
 isc_file_template(const char *path, const char *templet, char *buf,
-			size_t buflen) {
+		  size_t buflen)
+{
 	char *s;
 
 	REQUIRE(path != NULL);
@@ -509,7 +510,7 @@ isc_file_basename(const char *filename) {
 isc_result_t
 isc_file_progname(const char *filename, char *progname, size_t namelen) {
 	const char *s;
-	char *p;
+	const char *p;
 	size_t len;
 
 	REQUIRE(filename != NULL);
@@ -621,9 +622,11 @@ isc_file_safecreate(const char *filename, FILE **fp) {
 }
 
 isc_result_t
-isc_file_splitpath(isc_mem_t *mctx, char *path, char **dirname, char **basename)
+isc_file_splitpath(isc_mem_t *mctx, const char *path, char **dirname,
+		   char const ** basename)
 {
-	char *dir, *file, *slash;
+	char *dir;
+	const char *file, *slash;
 	char *backslash;
 
 	slash = strrchr(path, '/');