diff --git a/CHANGES b/CHANGES
index 26b78d4f28..06e90008c2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4264.	[bug]		Check const of strchr/strrchr assignments match
+			argument's const status. [RT #41150]
+
 4263.	[contrib]	Address compiler warnings in mysqldyn module.
 			[RT #41130]
 
diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index 30dd0db1bd..70b8426d46 100644
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -58,7 +58,7 @@ dns_zone_t *zone = NULL;
 dns_zonetype_t zonetype = dns_zone_master;
 static int dumpzone = 0;
 static const char *output_filename;
-static char *prog_name = NULL;
+static const char *prog_name = NULL;
 static const dns_master_style_t *outputstyle = NULL;
 static enum { progmode_check, progmode_compile } progmode;
 
diff --git a/bin/dig/dig.c b/bin/dig/dig.c
index 50ca7d1460..52e5df009a 100644
--- a/bin/dig/dig.c
+++ b/bin/dig/dig.c
@@ -739,7 +739,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
  */
 
 static void
-plus_option(char *option, isc_boolean_t is_batchfile,
+plus_option(const char *option, isc_boolean_t is_batchfile,
 	    dig_lookup_t *lookup)
 {
 	isc_result_t result;
@@ -752,7 +752,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 	strncpy(option_store, option, sizeof(option_store));
 	option_store[sizeof(option_store)-1]=0;
 	ptr = option_store;
-	cmd = next_token(&ptr,"=");
+	cmd = next_token(&ptr, "=");
 	if (cmd == NULL) {
 		printf(";; Invalid option %s\n", option_store);
 		return;
@@ -1406,7 +1406,7 @@ plus_option(char *option, isc_boolean_t is_batchfile,
 	invalid_option:
 	need_value:
 		fprintf(stderr, "Invalid option: +%s\n",
-			 option);
+			option);
 		usage();
 	}
 	return;
@@ -1636,14 +1636,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				 value);
 		return (value_from_next);
 	case 'y':
-		ptr = next_token(&value,":");	/* hmac type or name */
+		ptr = next_token(&value, ":");	/* hmac type or name */
 		if (ptr == NULL) {
 			usage();
 		}
 		ptr2 = next_token(&value, ":");	/* name or secret */
 		if (ptr2 == NULL)
 			usage();
-		ptr3 = next_token(&value,":"); /* secret or NULL */
+		ptr3 = next_token(&value, ":"); /* secret or NULL */
 		if (ptr3 != NULL) {
 			parse_hmac(ptr);
 			ptr = ptr2;
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 2fb7283721..9785e900c1 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -463,7 +463,7 @@ append(const char *text, int len, char **p, char *end) {
 
 static isc_result_t
 reverse_octets(const char *in, char **p, char *end) {
-	char *dot = strchr(in, '.');
+	const char *dot = strchr(in, '.');
 	int len;
 	if (dot != NULL) {
 		isc_result_t result;
@@ -1069,13 +1069,17 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 	isc_uint32_t netmask = 0;
 	char *slash = NULL;
 	isc_boolean_t parsed = ISC_FALSE;
+	char buf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:XXX.XXX.XXX.XXX/128")];
 
-	if ((slash = strchr(value, '/'))) {
+	if (strlcpy(buf, value, sizeof(buf)) >= sizeof(buf))
+		fatal("invalid prefix '%s'\n", value);
+
+	slash = strchr(buf, '/');
+	if (slash != NULL) {
 		*slash = '\0';
 		result = isc_parse_uint32(&netmask, slash + 1, 10);
 		if (result != ISC_R_SUCCESS) {
-			*slash = '/';
-			fatal("invalid prefix length '%s': %s\n",
+			fatal("invalid prefix length in '%s': %s\n",
 			      value, isc_result_totext(result));
 		}
 	}
@@ -1083,21 +1087,19 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 	sa = isc_mem_allocate(mctx, sizeof(*sa));
 	if (sa == NULL)
 		fatal("out of memory");
-	if (inet_pton(AF_INET6, value, &in6) == 1) {
-		isc_sockaddr_fromin6(sa, &in6, 0);
+	if (inet_pton(AF_INET6, buf, &in6) == 1) {
 		parsed = ISC_TRUE;
+		isc_sockaddr_fromin6(sa, &in6, 0);
 		if (netmask == 0 || netmask > 128)
 			netmask = 128;
-	} else if (inet_pton(AF_INET, value, &in4) == 1) {
+	} else if (inet_pton(AF_INET, buf, &in4) == 1) {
 		parsed = ISC_TRUE;
 		isc_sockaddr_fromin(sa, &in4, 0);
 		if (netmask == 0 || netmask > 32)
 			netmask = 32;
 	} else if (netmask != 0) {
-		char buf[64];
 		int i;
 
-		strlcpy(buf, value, sizeof(buf));
 		for (i = 0; i < 3; i++) {
 			strlcat(buf, ".0", sizeof(buf));
 			if (inet_pton(AF_INET, buf, &in4) == 1) {
@@ -1106,12 +1108,8 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 				break;
 			}
 		}
-
 	}
 
-	if (slash != NULL)
-		*slash = '/';
-
 	if (!parsed)
 		fatal("invalid address '%s'", value);
 
@@ -1121,7 +1119,6 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 	return (ISC_R_SUCCESS);
 }
 
-
 /*
  * Parse HMAC algorithm specification
  */
diff --git a/bin/dnssec/dnssec-revoke.c b/bin/dnssec/dnssec-revoke.c
index 31375ee03f..7e2fab274e 100644
--- a/bin/dnssec/dnssec-revoke.c
+++ b/bin/dnssec/dnssec-revoke.c
@@ -86,7 +86,8 @@ main(int argc, char **argv) {
 #else
 	const char *engine = NULL;
 #endif
-	char *filename = NULL, *dir = NULL;
+	char const *filename = NULL;
+	char *dir = NULL;
 	char newname[1024], oldname[1024];
 	char keystr[DST_KEY_FORMATSIZE];
 	char *endp;
diff --git a/bin/dnssec/dnssec-settime.c b/bin/dnssec/dnssec-settime.c
index c5bd3ae6a7..3a26550c41 100644
--- a/bin/dnssec/dnssec-settime.c
+++ b/bin/dnssec/dnssec-settime.c
@@ -133,7 +133,8 @@ main(int argc, char **argv) {
 #else
 	const char	*engine = NULL;
 #endif
-	char		*filename = NULL, *directory = NULL;
+	const char 	*filename = NULL;
+	char		*directory = NULL;
 	char		newname[1024];
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index f4b1af2de6..66113c38ac 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -2701,7 +2701,8 @@ get_ticket_realm(isc_mem_t *mctx) {
 	krb5_error_code rc;
 	krb5_ccache ccache;
 	krb5_principal princ;
-	char *name, *ticket_realm;
+	char *name;
+	const char * ticket_realm;
 
 	rc = krb5_init_context(&ctx);
 	if (rc != 0)
diff --git a/bin/tests/db_test.c b/bin/tests/db_test.c
index 259ed6c7e8..7926bf2293 100644
--- a/bin/tests/db_test.c
+++ b/bin/tests/db_test.c
@@ -367,7 +367,7 @@ main(int argc, char *argv[]) {
 	dns_name_t *fname;
 	unsigned int options = 0, zcoptions;
 	isc_time_t start, finish;
-	char *origintext;
+	const char *origintext;
 	dbinfo *dbi;
 	dns_dbversion_t *version;
 	dns_name_t *origin;
diff --git a/bin/tests/nsecify.c b/bin/tests/nsecify.c
index c31b08aaaf..6092083b4a 100644
--- a/bin/tests/nsecify.c
+++ b/bin/tests/nsecify.c
@@ -118,7 +118,7 @@ nsecify(char *filename) {
 	dns_db_t *db;
 	dns_dbversion_t *wversion;
 	dns_dbnode_t *node, *nextnode;
-	char *origintext;
+	const char *origintext;
 	dns_fixedname_t fname, fnextname;
 	dns_name_t *name, *nextname, *target;
 	isc_buffer_t b;
diff --git a/bin/tests/rbt_test.c b/bin/tests/rbt_test.c
index a9d20d9635..0a59435a0f 100644
--- a/bin/tests/rbt_test.c
+++ b/bin/tests/rbt_test.c
@@ -31,7 +31,7 @@
 #include <dns/fixedname.h>
 #include <dns/result.h>
 
-char *progname;
+const char *progname;
 isc_mem_t *mctx;
 
 #define DNSNAMELEN 255
diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
index 71102453a9..0908617187 100644
--- a/bin/tools/mdig.c
+++ b/bin/tools/mdig.c
@@ -88,7 +88,7 @@
 
 static isc_mem_t *mctx;
 static dns_requestmgr_t *requestmgr;
-static char *batchname;
+static const char *batchname;
 static FILE *batchfp;
 static isc_boolean_t have_ipv4 = ISC_FALSE;
 static isc_boolean_t have_ipv6 = ISC_FALSE;
@@ -906,13 +906,16 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 	isc_uint32_t netmask = 0;
 	char *slash = NULL;
 	isc_boolean_t parsed = ISC_FALSE;
+	char buf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:XXX.XXX.XXX.XXX/128")];
 
-	if ((slash = strchr(value, '/'))) {
-		*slash = '\0';
+	if (strlcpy(buf, value, sizeof(buf)) >= sizeof(buf))
+		fatal("invalid prefix '%s'\n", value);
+
+	slash = strchr(buf, '/');
+	if (slash != NULL) {
 		result = isc_parse_uint32(&netmask, slash + 1, 10);
 		if (result != ISC_R_SUCCESS) {
-			*slash = '/';
-			fatal("invalid prefix length '%s': %s\n",
+			fatal("invalid prefix length in '%s': %s\n",
 			      value, isc_result_totext(result));
 		}
 	}
@@ -920,21 +923,19 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 	sa = isc_mem_allocate(mctx, sizeof(*sa));
 	if (sa == NULL)
 		fatal("out of memory");
-	if (inet_pton(AF_INET6, value, &in6) == 1) {
-		isc_sockaddr_fromin6(sa, &in6, 0);
+	if (inet_pton(AF_INET6, buf, &in6) == 1) {
 		parsed = ISC_TRUE;
+		isc_sockaddr_fromin6(sa, &in6, 0);
 		if (netmask == 0 || netmask > 128)
 			netmask = 128;
-	} else if (inet_pton(AF_INET, value, &in4) == 1) {
+	} else if (inet_pton(AF_INET, buf, &in4) == 1) {
 		parsed = ISC_TRUE;
 		isc_sockaddr_fromin(sa, &in4, 0);
 		if (netmask == 0 || netmask > 32)
 			netmask = 32;
 	} else if (netmask != 0) {
-		char buf[64];
 		int i;
 
-		strlcpy(buf, value, sizeof(buf));
 		for (i = 0; i < 3; i++) {
 			strlcat(buf, ".0", sizeof(buf));
 			if (inet_pton(AF_INET, buf, &in4) == 1) {
@@ -946,9 +947,6 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 
 	}
 
-	if (slash != NULL)
-		*slash = '/';
-
 	if (!parsed)
 		fatal("invalid address '%s'", value);
 
@@ -973,7 +971,7 @@ append(const char *text, int len, char **p, char *end) {
 
 static isc_result_t
 reverse_octets(const char *in, char **p, char *end) {
-	char *dot = strchr(in, '.');
+	const char *dot = strchr(in, '.');
 	int len;
 	if (dot != NULL) {
 		isc_result_t result;
@@ -989,7 +987,8 @@ reverse_octets(const char *in, char **p, char *end) {
 }
 
 static void
-get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int)
+get_reverse(char *reverse, size_t len, const char *value,
+	    isc_boolean_t ip6_int)
 {
 	int r;
 	isc_result_t result;
@@ -1515,13 +1514,14 @@ plus_option(char *option, struct query *query, isc_boolean_t global)
 static const char *single_dash_opts = "46hiv";
 /*static const char *dash_opts = "46bcfhiptvx";*/
 static isc_boolean_t
-dash_option(char *option, char *next, struct query *query,
+dash_option(const char *option, char *next, struct query *query,
 	    isc_boolean_t global, isc_boolean_t *setname)
 {
-	char opt, *value;
+	char opt;
+	const char *value;
 	isc_result_t result;
 	isc_boolean_t value_from_next;
-	isc_textregion_t tr;
+	isc_consttextregion_t tr;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
 	char textname[MXNAME];
diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
index 67fbf695dd..07077c7a77 100644
--- a/lib/dns/openssldh_link.c
+++ b/lib/dns/openssldh_link.c
@@ -623,7 +623,7 @@ BN_fromhex(BIGNUM *b, const char *str) {
 
 	RUNTIME_CHECK(strlen(str) < 1024U && strlen(str) % 2 == 0U);
 	for (i = 0; i < strlen(str); i += 2) {
-		char *s;
+		const char *s;
 		unsigned int high, low;
 
 		s = strchr(hexdigits, tolower((unsigned char)str[i]));
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index d799be0a13..46049d7163 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -1398,8 +1398,7 @@ opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label,
 	UNUSED(pin);
 
 	if (engine == NULL) {
-		colon = strchr(label, ':');
-		if (colon == NULL)
+		if (strchr(label, ':') == NULL)
 			DST_RET(DST_R_NOENGINE);
 		tmpengine = isc_mem_strdup(key->mctx, label);
 		if (tmpengine == NULL)
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index de41f176fe..0f971add29 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -18209,7 +18209,7 @@ dns_zone_keydone(dns_zone_t *zone, const char *keystr) {
 		kd->all = ISC_TRUE;
 	else {
 		isc_textregion_t r;
-		char *algstr;
+		const char *algstr;
 		dns_keytag_t keyid;
 		dns_secalg_t alg;
 		size_t n;
diff --git a/lib/isc/base32.c b/lib/isc/base32.c
index 2ee99b1824..5f0332d742 100644
--- a/lib/isc/base32.c
+++ b/lib/isc/base32.c
@@ -170,7 +170,7 @@ base32_decode_init(base32_decode_ctx_t *ctx, int length, const char base[],
 
 static inline isc_result_t
 base32_decode_char(base32_decode_ctx_t *ctx, int c) {
-	char *s;
+	const char *s;
 	unsigned int last;
 
 	if (ctx->seen_end)
diff --git a/lib/isc/base64.c b/lib/isc/base64.c
index 6b4cb1bf7c..26c3a09b6b 100644
--- a/lib/isc/base64.c
+++ b/lib/isc/base64.c
@@ -118,7 +118,7 @@ base64_decode_init(base64_decode_ctx_t *ctx, int length, isc_buffer_t *target)
 
 static inline isc_result_t
 base64_decode_char(base64_decode_ctx_t *ctx, int c) {
-	char *s;
+	const char *s;
 
 	if (ctx->seen_end)
 		return (ISC_R_BADBASE64);
diff --git a/lib/isc/commandline.c b/lib/isc/commandline.c
index c4e18df496..dbfe5dcf66 100644
--- a/lib/isc/commandline.c
+++ b/lib/isc/commandline.c
@@ -96,7 +96,7 @@ static char endopt = '\0';
 int
 isc_commandline_parse(int argc, char * const *argv, const char *options) {
 	static char *place = ENDOPT;
-	char *option;			/* Index into *options of option. */
+	const char *option;		/* Index into *options of option. */
 
 	REQUIRE(argc >= 0 && argv != NULL && options != NULL);
 
diff --git a/lib/isc/hex.c b/lib/isc/hex.c
index 00903c7374..0beb4ec402 100644
--- a/lib/isc/hex.c
+++ b/lib/isc/hex.c
@@ -95,7 +95,7 @@ hex_decode_init(hex_decode_ctx_t *ctx, int length, isc_buffer_t *target)
 
 static inline isc_result_t
 hex_decode_char(hex_decode_ctx_t *ctx, int c) {
-	char *s;
+	const char *s;
 
 	if ((s = strchr(hex, toupper(c))) == NULL)
 		return (ISC_R_BADHEX);
diff --git a/lib/isc/include/isc/file.h b/lib/isc/include/isc/file.h
index 2174f703b2..a7f26ccad9 100644
--- a/lib/isc/include/isc/file.h
+++ b/lib/isc/include/isc/file.h
@@ -315,8 +315,8 @@ isc_file_safecreate(const char *filename, FILE **fp);
  */
 
 isc_result_t
-isc_file_splitpath(isc_mem_t *mctx, char *path,
-		   char **dirname, char **basename);
+isc_file_splitpath(isc_mem_t *mctx, const char *path,
+		   char **dirname, char const **basename);
 /*%<
  * Split a path into dirname and basename.  If 'path' contains no slash
  * (or, on windows, backslash), then '*dirname' is set to ".".
diff --git a/lib/isc/string.c b/lib/isc/string.c
index 56ec444bff..3a2bf345aa 100644
--- a/lib/isc/string.c
+++ b/lib/isc/string.c
@@ -56,14 +56,14 @@
 #include <isc/string.h>
 #include <isc/util.h>
 
-static char digits[] = "0123456789abcdefghijklmnoprstuvwxyz";
+static const char digits[] = "0123456789abcdefghijklmnoprstuvwxyz";
 
 isc_uint64_t
 isc_string_touint64(char *source, char **end, int base) {
 	isc_uint64_t tmp;
 	isc_uint64_t overflow;
 	char *s = source;
-	char *o;
+	const char *o;
 	char c;
 
 	if ((base < 0) || (base == 1) || (base > 36)) {
diff --git a/lib/isc/unix/file.c b/lib/isc/unix/file.c
index 3a76e0833c..e986323f43 100644
--- a/lib/isc/unix/file.c
+++ b/lib/isc/unix/file.c
@@ -226,8 +226,9 @@ isc_file_mktemplate(const char *path, char *buf, size_t buflen) {
 
 isc_result_t
 isc_file_template(const char *path, const char *templet, char *buf,
-			size_t buflen) {
-	char *s;
+		  size_t buflen)
+{
+	const char *s;
 
 	REQUIRE(path != NULL);
 	REQUIRE(templet != NULL);
@@ -285,7 +286,7 @@ isc_file_renameunique(const char *file, char *templet) {
 		if (errno != EEXIST)
 			return (isc__errno2result(errno));
 		for (cp = x;;) {
-			char *t;
+			const char *t;
 			if (*cp == '\0')
 				return (ISC_R_FAILURE);
 			t = strchr(alphnum, *cp);
@@ -503,7 +504,7 @@ isc_file_ischdiridempotent(const char *filename) {
 
 const char *
 isc_file_basename(const char *filename) {
-	char *s;
+	const char *s;
 
 	REQUIRE(filename != NULL);
 
@@ -621,9 +622,11 @@ isc_file_safecreate(const char *filename, FILE **fp) {
 }
 
 isc_result_t
-isc_file_splitpath(isc_mem_t *mctx, char *path, char **dirname, char **basename)
+isc_file_splitpath(isc_mem_t *mctx, const char *path, char **dirname,
+		   char const **basename)
 {
-	char *dir, *file, *slash;
+	char *dir;
+	const char *file, *slash;
 
 	if (path == NULL)
 		return (ISC_R_INVALIDFILE);
diff --git a/lib/isc/win32/file.c b/lib/isc/win32/file.c
index 99e52d2e96..a1ae0027f4 100644
--- a/lib/isc/win32/file.c
+++ b/lib/isc/win32/file.c
@@ -325,7 +325,8 @@ isc_file_mktemplate(const char *path, char *buf, size_t buflen) {
 
 isc_result_t
 isc_file_template(const char *path, const char *templet, char *buf,
-			size_t buflen) {
+		  size_t buflen)
+{
 	char *s;
 
 	REQUIRE(path != NULL);
@@ -588,7 +589,7 @@ isc_file_basename(const char *filename) {
 isc_result_t
 isc_file_progname(const char *filename, char *progname, size_t namelen) {
 	const char *s;
-	char *p;
+	const char *p;
 	size_t len;
 
 	REQUIRE(filename != NULL);
@@ -700,9 +701,11 @@ isc_file_safecreate(const char *filename, FILE **fp) {
 }
 
 isc_result_t
-isc_file_splitpath(isc_mem_t *mctx, char *path, char **dirname, char **basename)
+isc_file_splitpath(isc_mem_t *mctx, const char *path, char **dirname,
+		   char const ** basename)
 {
-	char *dir, *file, *slash;
+	char *dir;
+	const char *file, *slash;
 	char *backslash;
 
 	slash = strrchr(path, '/');