diff --git a/CHANGES b/CHANGES
index 4059963b93..8f0a980f7e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3401.	[bug]		Addressed Coverity warnings. [RT #31484]
+
 3400.	[cleanup]	"named -V" can now report a source ID string, defined
 			in the "srcid" file in the build tree and normally set
 			to the most recent git hash.  [RT #31494]
diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index 12e0ab4679..c7587c5c78 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -439,6 +439,7 @@ main(int argc, char **argv) {
 			if (isc_commandline_option != '?')
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					program, isc_commandline_option);
+			/* FALLTHROUGH */
 		case 'h':
 			usage();
 
diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index 2d37ddf78d..a9bf3a8bf7 100644
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -354,6 +354,7 @@ main(int argc, char **argv) {
 			if (isc_commandline_option != '?')
 				fprintf(stderr, "%s: invalid argument -%c\n",
 					prog_name, isc_commandline_option);
+			/* FALLTHROUGH */
 		case 'h':
 			usage();
 
diff --git a/bin/named/client.c b/bin/named/client.c
index fefe6a4378..d090061b83 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -1377,10 +1377,9 @@ client_request(isc_task_t *task, isc_event_t *event) {
 
 	INSIST(client->recursionquota == NULL);
 
-	INSIST(client->state ==
-	       TCP_CLIENT(client) ?
-	       NS_CLIENTSTATE_READING :
-	       NS_CLIENTSTATE_READY);
+	INSIST(client->state == (TCP_CLIENT(client) ?
+				       NS_CLIENTSTATE_READING :
+				       NS_CLIENTSTATE_READY));
 
 	ns_client_requests++;
 
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index 4e68c55057..1aef3d75ce 100644
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -755,6 +755,7 @@ main(int argc, char **argv) {
 					program, isc_commandline_option);
 				usage(1);
 			}
+			/* FALLTHROUGH */
 		case 'h':
 			usage(0);
 			break;
diff --git a/bin/tests/dst/t_dst.c b/bin/tests/dst/t_dst.c
index 91f38638ff..e7f1add1ac 100644
--- a/bin/tests/dst/t_dst.c
+++ b/bin/tests/dst/t_dst.c
@@ -560,24 +560,26 @@ sig_fromfile(char *path, isc_buffer_t *iscbuf) {
 	char		*p;
 	char		*buf;
 
-	rval = stat(path, &sb);
+	fd = open(path, O_RDONLY);
+	if (fd < 0) {
+		t_info("open failed, errno == %d\n", errno);
+		return(1);
+	}
+
+	rval = fstat(fd, &sb);
 	if (rval != 0) {
 		t_info("stat %s failed, errno == %d\n", path, errno);
+		close(fd);
 		return(1);
 	}
 
 	buf = (char *) malloc((sb.st_size + 1) * sizeof(unsigned char));
 	if (buf == NULL) {
 		t_info("malloc failed, errno == %d\n", errno);
+		close(fd);
 		return(1);
 	}
 
-	fd = open(path, O_RDONLY);
-	if (fd < 0) {
-		t_info("open failed, errno == %d\n", errno);
-		(void) free(buf);
-		return(1);
-	}
 
 	len = sb.st_size;
 	p = buf;
@@ -651,10 +653,18 @@ t2_sigchk(char *datapath, char *sigpath, char *keyname,
 	/*
 	 * Read data from file in a form usable by dst_verify.
 	 */
-	rval = stat(datapath, &sb);
+	fd = open(datapath, O_RDONLY);
+	if (fd < 0) {
+		t_info("t2_sigchk: open failed %d\n", errno);
+		++*nprobs;
+		return;
+	}
+
+	rval = fstat(fd, &sb);
 	if (rval != 0) {
 		t_info("t2_sigchk: stat (%s) failed %d\n", datapath, errno);
 		++*nprobs;
+		close(fd);
 		return;
 	}
 
@@ -662,14 +672,7 @@ t2_sigchk(char *datapath, char *sigpath, char *keyname,
 	if (data == NULL) {
 		t_info("t2_sigchk: malloc failed %d\n", errno);
 		++*nprobs;
-		return;
-	}
-
-	fd = open(datapath, O_RDONLY);
-	if (fd < 0) {
-		t_info("t2_sigchk: open failed %d\n", errno);
-		(void) free(data);
-		++*nprobs;
+		close(fd);
 		return;
 	}
 
diff --git a/bin/tests/names/t_names.c b/bin/tests/names/t_names.c
index 3e27b26acf..b9a99b2809 100644
--- a/bin/tests/names/t_names.c
+++ b/bin/tests/names/t_names.c
@@ -219,13 +219,14 @@ chkdata(unsigned char *buf, size_t buflen, char *exp_data,
  * setup the buffer and return the data length.
  */
 static int
-getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
+getmsg(char *datafile_name, isc_buffer_t *pbuf)
 {
 	int			c;
-	int			len;
-	int			cnt;
+	unsigned int		len;
+	unsigned int		cnt;
 	unsigned char		*p;
 	FILE			*fp;
+	unsigned int		buflen;
 
 	fp = fopen(datafile_name, "r");
 	if (fp == NULL) {
@@ -233,7 +234,8 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 		return (0);
 	}
 
-	p = buf;
+	p = isc_buffer_used(pbuf);
+	buflen = isc_buffer_availablelength(pbuf);
 	cnt = 0;
 	len = 0;
 	while ((c = getc(fp)) != EOF) {
@@ -282,7 +284,6 @@ getmsg(char *datafile_name, unsigned char *buf, int buflen, isc_buffer_t *pbuf)
 	}
 
 	*p = '\0';
-	isc_buffer_init(pbuf, buf, cnt);
 	isc_buffer_add(pbuf, cnt);
 	return (cnt);
 }
@@ -2050,7 +2051,10 @@ test_dns_name_fromwire(char *datafile_name, int testname_offset, int downcase,
 	dns_decompress_t	dctx;
 
 	t_info("testing using %s\n", datafile_name);
-	len = getmsg(datafile_name, buf1, BIGBUFLEN, &iscbuf1);
+	isc_buffer_init(&iscbuf1, buf1, sizeof(buf1));
+	len = getmsg(datafile_name, &iscbuf1);
+	if (len == 0)
+		return (T_FAIL);
 
 	isc_buffer_setactive(&iscbuf1, len);
 	iscbuf1.current = testname_offset;
diff --git a/contrib/dlz/drivers/dlz_filesystem_driver.c b/contrib/dlz/drivers/dlz_filesystem_driver.c
index e70c2c2e63..931c00a98c 100644
--- a/contrib/dlz/drivers/dlz_filesystem_driver.c
+++ b/contrib/dlz/drivers/dlz_filesystem_driver.c
@@ -360,7 +360,7 @@ create_path(const char *zone, const char *host, const char *client,
 }
 
 static isc_result_t
-process_dir(isc_dir_t dir, void *passback, config_data_t *cd,
+process_dir(isc_dir_t *dir, void *passback, config_data_t *cd,
 	    dlist_t *dir_list, unsigned int basedirlen)
 {
 
@@ -386,10 +386,10 @@ process_dir(isc_dir_t dir, void *passback, config_data_t *cd,
 	foundHost = ISC_FALSE;
 
 	/* copy base directory name to tmp. */
-	strcpy(tmp, dir.dirname);
+	strcpy(tmp, dir->dirname);
 
-	/* dir.dirname will always have '*' as the last char. */
-	astPos = strlen(dir.dirname) - 1;
+	/* dir->dirname will always have '*' as the last char. */
+	astPos = strlen(dir->dirname) - 1;
 
 	/* if dir_list != NULL, were are performing a zone xfr */
 	if (dir_list != NULL) {
@@ -425,46 +425,48 @@ process_dir(isc_dir_t dir, void *passback, config_data_t *cd,
 
 				foundHost = ISC_TRUE;
 				/* set tmp again for use later */
-				strcpy(tmp, dir.dirname);
+				strcpy(tmp, dir->dirname);
 			}
 		} else {
 			/*
 			 * if splitcnt != 0 determine host from
 			 * ".host" directory entry
 			 */
-			while (isc_dir_read(&dir) == ISC_R_SUCCESS) {
+			while (isc_dir_read(dir) == ISC_R_SUCCESS) {
 				if (strncasecmp(".host",
-						dir.entry.name, 5) == 0) {
+						dir->entry.name, 5) == 0) {
 					/*
 					 * handle filesystem's special
 					 * wildcard "-"
 					 */
-					if (strcmp((char *) &dir.entry.name[6],
+					if (strcmp((char *) &dir->entry.name[6],
 						   "-") == 0)
 						strcpy(host, "*");
-					else
-						strcpy(host,
-						       (char *)
-						       &dir.entry.name[6]);
+					else {
+						strncpy(host,
+						   (char *) &dir->entry.name[6],
+						   sizeof(host) - 1);
+						host[255] = '\0';
+					}
 					foundHost = ISC_TRUE;
 					break;
 				}
 			}
 			/* reset dir list for use later */
-			isc_dir_reset(&dir);
+			isc_dir_reset(dir);
 		} /* end of else */
 	}
 
-	while (isc_dir_read(&dir) == ISC_R_SUCCESS) {
+	while (isc_dir_read(dir) == ISC_R_SUCCESS) {
 
 		isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
 			      DNS_LOGMODULE_DLZ, ISC_LOG_DEBUG(1),
 			      "Filesystem driver Dir name:"
 			      " '%s' Dir entry: '%s'\n",
-			      dir.dirname, dir.entry.name);
+			      dir->dirname, dir->entry.name);
 
 		/* skip any entries starting with "." */
-		if (dir.entry.name[0] == '.')
+		if (dir->entry.name[0] == '.')
 			continue;
 
 		/*
@@ -477,7 +479,7 @@ process_dir(isc_dir_t dir, void *passback, config_data_t *cd,
 		tmp[astPos] = '\0';
 
 		/* add name to base directory name. */
-		strcat(tmp, dir.entry.name);
+		strcat(tmp, dir->entry.name);
 
 		/* make sure we can stat entry */
 		if (stat(tmp, &sb) == 0 ) {
@@ -515,7 +517,7 @@ process_dir(isc_dir_t dir, void *passback, config_data_t *cd,
 		} else /* if we cannot stat entry, skip it. */
 			continue;
 
-		type = dir.entry.name;
+		type = dir->entry.name;
 		ttlStr = strchr(type,  cd->separator);
 		if (ttlStr == NULL) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_DATABASE,
@@ -687,7 +689,7 @@ fs_allnodes(const char *zone, void *driverarg, void *dbdata,
 	}
 
 	/* process the directory */
-	result = process_dir(dir, allnodes, cd, dir_list, basepathlen);
+	result = process_dir(&dir, allnodes, cd, dir_list, basepathlen);
 
 	/* close the directory */
 	isc_dir_close(&dir);
@@ -712,7 +714,7 @@ fs_allnodes(const char *zone, void *driverarg, void *dbdata,
 		}
 
 		/* process the directory */
-		result = process_dir(dir, allnodes, cd, dir_list, basepathlen);
+		result = process_dir(&dir, allnodes, cd, dir_list, basepathlen);
 
 		/* close the directory */
 		isc_dir_close(&dir);
@@ -841,7 +843,7 @@ fs_lookup(const char *zone, const char *name, void *driverarg,
 	}
 
 	/* process any records in the directory */
-	result = process_dir(dir, lookup, (config_data_t *) dbdata, NULL, 0);
+	result = process_dir(&dir, lookup, (config_data_t *) dbdata, NULL, 0);
 
 	/* close the directory */
 	isc_dir_close(&dir);
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index 35b4caeb0b..00be5c5956 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -1728,6 +1728,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *qname,
 		while (namehook != NULL) {
 			entry = namehook->entry;
 			bucket = entry->lock_bucket;
+			INSIST(bucket != DNS_ADB_INVALIDBUCKET);
 			LOCK(&adb->entrylocks[bucket]);
 
 			if (!FIND_RETURNLAME(find)
@@ -1758,6 +1759,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_name_t *qname,
 		while (namehook != NULL) {
 			entry = namehook->entry;
 			bucket = entry->lock_bucket;
+			INSIST(bucket != DNS_ADB_INVALIDBUCKET);
 			LOCK(&adb->entrylocks[bucket]);
 
 			if (!FIND_RETURNLAME(find)
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index eaaf55351c..6174df566f 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -2748,8 +2748,6 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 		result = open_socket(sockmgr, localaddr, 0, &sock);
 		if (result != ISC_R_SUCCESS)
 			goto end;
-		else if (!anyport)
-			break;
 		else if (portavailable(mgr, sock, NULL))
 			break;
 		if (held[i] != NULL)
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 7b69538ebd..954792b3d4 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -450,8 +450,7 @@ dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx,
 	result = dst_key_read_public(newfilename, type, mctx, &pubkey);
 	isc_mem_put(mctx, newfilename, newfilenamelen);
 	newfilename = NULL;
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	RETERR(result);
 
 	if ((type & (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC)) == DST_TYPE_PUBLIC ||
 	    (pubkey->key_flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY) {
@@ -510,7 +509,8 @@ dst_key_fromnamedfile(const char *filename, int type, isc_mem_t *mctx,
 		isc_mem_put(mctx, newfilename, newfilenamelen);
 	if (lex != NULL)
 		isc_lex_destroy(&lex);
-	dst_key_free(&key);
+	if (key != NULL)
+		dst_key_free(&key);
 	return (result);
 }
 
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 1919ec2e9f..e8ca73c445 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -1429,6 +1429,7 @@ dns_name_totext2(dns_name_t *name, unsigned int options, isc_buffer_t *target)
 				case 0x24: /* '$' */
 					if ((options & DNS_NAME_MASTERFILE) == 0)
 						goto no_escape;
+					/* FALLTHROUGH */
 				case 0x22: /* '"' */
 				case 0x28: /* '(' */
 				case 0x29: /* ')' */
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 5ae5f2e9b0..a96c0afeae 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -4171,6 +4171,8 @@ dns_validator_send(dns_validator_t *validator) {
 
 void
 dns_validator_cancel(dns_validator_t *validator) {
+	dns_fetch_t *fetch = NULL;
+
 	REQUIRE(VALID_VALIDATOR(validator));
 
 	LOCK(&validator->lock);
@@ -4180,8 +4182,8 @@ dns_validator_cancel(dns_validator_t *validator) {
 	if ((validator->attributes & VALATTR_CANCELED) == 0) {
 		validator->attributes |= VALATTR_CANCELED;
 		if (validator->event != NULL) {
-			if (validator->fetch != NULL)
-				dns_resolver_cancelfetch(validator->fetch);
+			fetch = validator->fetch;
+			validator->fetch = NULL;
 
 			if (validator->subvalidator != NULL)
 				dns_validator_cancel(validator->subvalidator);
@@ -4192,6 +4194,10 @@ dns_validator_cancel(dns_validator_t *validator) {
 		}
 	}
 	UNLOCK(&validator->lock);
+
+	/* Need to cancel fetch outside validator lock */
+	if (fetch != NULL)
+		dns_resolver_cancelfetch(fetch);
 }
 
 static void
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index eae39d9de3..589990ea8a 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -591,6 +591,7 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, isc_uint32_t ttl,
 	case XFRST_AXFR_END:
 	case XFRST_IXFR_END:
 		FAIL(DNS_R_EXTRADATA);
+		break;
 	default:
 		INSIST(0);
 		break;
diff --git a/lib/isc/include/isc/sockaddr.h b/lib/isc/include/isc/sockaddr.h
index 9b65d965a5..feb6c313c8 100644
--- a/lib/isc/include/isc/sockaddr.h
+++ b/lib/isc/include/isc/sockaddr.h
@@ -34,6 +34,7 @@ struct isc_sockaddr {
 		struct sockaddr		sa;
 		struct sockaddr_in	sin;
 		struct sockaddr_in6	sin6;
+		struct sockaddr_storage ss;
 #ifdef ISC_PLATFORM_HAVESYSUNH
 		struct sockaddr_un	sunix;
 #endif
diff --git a/lib/isc/inet_aton.c b/lib/isc/inet_aton.c
index 2bb9641349..9ef015f980 100644
--- a/lib/isc/inet_aton.c
+++ b/lib/isc/inet_aton.c
@@ -91,7 +91,7 @@ static char rcsid[] = "$Id$";
  */
 int
 isc_net_aton(const char *cp, struct in_addr *addr) {
-	unsigned long val;
+	isc_uint32_t val;
 	int base, n;
 	unsigned char c;
 	isc_uint8_t parts[4];
diff --git a/lib/isc/ratelimiter.c b/lib/isc/ratelimiter.c
index 07bcc7c7af..9a819870a3 100644
--- a/lib/isc/ratelimiter.c
+++ b/lib/isc/ratelimiter.c
@@ -291,6 +291,7 @@ isc_ratelimiter_stall(isc_ratelimiter_t *rl) {
 		result = isc_timer_reset(rl->timer, isc_timertype_inactive,
 				 	 NULL, NULL, ISC_FALSE);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
+		/* FALLTHROUGH */
 	case isc_ratelimiter_idle:
 	case isc_ratelimiter_stalled:
 		rl->state = isc_ratelimiter_stalled;
diff --git a/lib/isc/sockaddr.c b/lib/isc/sockaddr.c
index b241b1f1cf..4c3da2f672 100644
--- a/lib/isc/sockaddr.c
+++ b/lib/isc/sockaddr.c
@@ -219,13 +219,12 @@ isc_sockaddr_hash(const isc_sockaddr_t *sockaddr, isc_boolean_t address_only) {
 		break;
 	case AF_INET6:
 		in6 = &sockaddr->type.sin6.sin6_addr;
+		s = (const unsigned char *)in6;
 		if (IN6_IS_ADDR_V4MAPPED(in6)) {
-			s = (const unsigned char *)&in6[12];
+			s += 12;
 			length = sizeof(sockaddr->type.sin.sin_addr.s_addr);
-		} else {
-			s = (const unsigned char *)in6;
+		} else
 			length = sizeof(sockaddr->type.sin6.sin6_addr);
-		}
 		p = ntohs(sockaddr->type.sin6.sin6_port);
 		break;
 	default:
diff --git a/lib/isc/tests/Makefile.in b/lib/isc/tests/Makefile.in
index 2d2fa97590..31977c6951 100644
--- a/lib/isc/tests/Makefile.in
+++ b/lib/isc/tests/Makefile.in
@@ -36,10 +36,12 @@ LIBS =		@LIBS@ @ATFLIBS@
 
 OBJS =		isctest.@O@
 
-SRCS =		isctest.c hash_test.c symtab_test.c parse_test.c
+SRCS =		isctest.c hash_test.c sockaddr_test.c \
+		symtab_test.c parse_test.c
 
 SUBDIRS =
-TARGETS =	hash_test@EXEEXT@ symtab_test@EXEEXT@ parse_test@EXEEXT@
+TARGETS =	hash_test@EXEEXT@ sockaddr_test@EXEEXT@ \
+		symtab_test@EXEEXT@ parse_test@EXEEXT@
 
 @BIND9_MAKE_RULES@
 
@@ -55,6 +57,9 @@ parse_test@EXEEXT@: parse_test.@O@ isctest.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
 			parse_test.@O@ isctest.@O@ ${ISCLIBS} ${LIBS}
 
+sockaddr_test@EXEEXT@: sockaddr_test.@O@ isctest.@O@ ${ISCDEPLIBS}
+	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ \
+			sockaddr_test.@O@ isctest.@O@ ${ISCLIBS} ${LIBS}
 
 unit::
 	sh ${top_srcdir}/unit/unittest.sh
diff --git a/lib/isc/tests/sockaddr_test.c b/lib/isc/tests/sockaddr_test.c
new file mode 100644
index 0000000000..3e3f6dde73
--- /dev/null
+++ b/lib/isc/tests/sockaddr_test.c
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2012  Internet Systems Consortium, Inc. ("ISC")
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+ * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+ * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+ * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+ * PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* $Id$ */
+
+/*! \file */
+
+#include <config.h>
+
+#include <atf-c.h>
+
+#include <unistd.h>
+
+#include <isc/sockaddr.h>
+#include <isc/print.h>
+
+#include "isctest.h"
+
+/*
+ * Individual unit tests
+ */
+
+ATF_TC(sockaddr_hash);
+ATF_TC_HEAD(sockaddr_hash, tc) {
+	atf_tc_set_md_var(tc, "descr", "sockaddr hash");
+}
+ATF_TC_BODY(sockaddr_hash, tc) {
+	isc_result_t result;
+	isc_sockaddr_t addr;
+	struct in_addr in;
+	struct in6_addr in6;
+	unsigned int h1, h2, h3, h4;
+	int ret;
+
+	UNUSED(tc);
+
+	result = isc_test_begin(NULL);
+	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
+
+	in.s_addr = inet_addr("127.0.0.1");
+	isc_sockaddr_fromin(&addr, &in, 1);
+	h1 = isc_sockaddr_hash(&addr, ISC_TRUE);
+	h2 = isc_sockaddr_hash(&addr, ISC_FALSE);
+	ATF_CHECK(h1 != h2);
+
+	ret = inet_pton(AF_INET6, "::ffff:127.0.0.1", &in6);
+	ATF_CHECK(ret == 1);
+	isc_sockaddr_fromin6(&addr, &in6, 1);
+	h3 = isc_sockaddr_hash(&addr, ISC_TRUE);
+	h4 = isc_sockaddr_hash(&addr, ISC_FALSE);
+	ATF_CHECK(h1 == h3);
+	ATF_CHECK(h2 == h4);
+
+	isc_test_end();
+}
+
+/*
+ * Main
+ */
+ATF_TP_ADD_TCS(tp) {
+	ATF_TP_ADD_TC(tp, sockaddr_hash);
+
+	return (atf_no_error());
+}
+
diff --git a/lib/isc/timer.c b/lib/isc/timer.c
index 69315b6b7b..4e2961d673 100644
--- a/lib/isc/timer.c
+++ b/lib/isc/timer.c
@@ -592,7 +592,7 @@ dispatch(isc_timermgr_t *manager, isc_time_t *now) {
 
 	while (manager->nscheduled > 0 && !done) {
 		timer = isc_heap_element(manager->heap, 1);
-		INSIST(timer->type != isc_timertype_inactive);
+		INSIST(timer != NULL && timer->type != isc_timertype_inactive);
 		if (isc_time_compare(now, &timer->due) >= 0) {
 			if (timer->type == isc_timertype_ticker) {
 				type = ISC_TIMEREVENT_TICK;
diff --git a/lib/isc/unix/net.c b/lib/isc/unix/net.c
index b2fb30e4ed..3de50e0b31 100644
--- a/lib/isc/unix/net.c
+++ b/lib/isc/unix/net.c
@@ -301,8 +301,6 @@ try_ipv6only(void) {
 		goto close;
 	}
 
-	close(s);
-
 	ipv6only_result = ISC_R_SUCCESS;
 
 close:
@@ -358,7 +356,6 @@ try_ipv6pktinfo(void) {
 		goto close;
 	}
 
-	close(s);
 	ipv6pktinfo_result = ISC_R_SUCCESS;
 
 close:
diff --git a/lib/lwres/context.c b/lib/lwres/context.c
index 26572e3d74..0b9eac2bc0 100644
--- a/lib/lwres/context.c
+++ b/lib/lwres/context.c
@@ -377,6 +377,7 @@ lwres_context_send(lwres_context_t *ctx,
 		lwresult = context_connect(ctx);
 		if (lwresult != LWRES_R_SUCCESS)
 			return (lwresult);
+		INSIST(ctx->sock >= 0);
 	}
 
 	ret = sendto(ctx->sock, sendbase, sendlen, 0, NULL, 0);
diff --git a/lib/lwres/getipnode.c b/lib/lwres/getipnode.c
index cb432f1116..a4b2f9af2c 100644
--- a/lib/lwres/getipnode.c
+++ b/lib/lwres/getipnode.c
@@ -955,7 +955,7 @@ copyandmerge(struct hostent *he1, struct hostent *he2, int af, int *error_num)
 	npp = he->h_aliases;
 	cpp = (he1 != NULL) ? he1->h_aliases
 		: ((he2 != NULL) ?  he2->h_aliases : NULL);
-	while (*cpp != NULL) {
+	while (cpp != NULL && *cpp != NULL) {
 		len = strlen (*cpp) + 1;
 		*npp = malloc(len);
 		if (*npp == NULL)
diff --git a/lib/lwres/lwinetaton.c b/lib/lwres/lwinetaton.c
index e40c28f7ac..1d19f978bd 100644
--- a/lib/lwres/lwinetaton.c
+++ b/lib/lwres/lwinetaton.c
@@ -95,7 +95,7 @@ static char rcsid[] = "$Id: lwinetaton.c,v 1.16 2007/06/19 23:47:22 tbox Exp $";
  */
 int
 lwres_net_aton(const char *cp, struct in_addr *addr) {
-	unsigned long val;
+	lwres_uint32_t val;
 	int base, n;
 	unsigned char c;
 	lwres_uint8_t parts[4];
diff --git a/lib/lwres/print.c b/lib/lwres/print.c
index 591ed36ac3..87f30323fe 100644
--- a/lib/lwres/print.c
+++ b/lib/lwres/print.c
@@ -470,12 +470,16 @@ lwres__print_vsnprintf(char *str, size_t size, const char *format, va_list ap) {
 				pad--;
 			}
 			break;
+
 		case 'D':	/*deprecated*/
 			INSIST("use %ld instead of %D" == NULL);
+			break;
 		case 'O':	/*deprecated*/
 			INSIST("use %lo instead of %O" == NULL);
+			break;
 		case 'U':	/*deprecated*/
 			INSIST("use %lu instead of %U" == NULL);
+			break;
 
 		case 'L':
 #ifdef HAVE_LONG_DOUBLE