diff --git a/bin/dnssec/dnssec-dsfromkey.c b/bin/dnssec/dnssec-dsfromkey.c
index b598d91d0e..610d23e36d 100644
--- a/bin/dnssec/dnssec-dsfromkey.c
+++ b/bin/dnssec/dnssec-dsfromkey.c
@@ -464,7 +464,7 @@ main(int argc, char **argv) {
 	dns_rdataset_init(&rdataset);
 
 	if (usekeyset || filename != NULL) {
-		if (argc < isc_commandline_index + 1 && filename != NULL) {
+		if (argc < isc_commandline_index + 1) {
 			/* using zone name as the zone file name */
 			namestr = filename;
 		} else {
@@ -479,6 +479,7 @@ main(int argc, char **argv) {
 		if (usekeyset) {
 			result = loadkeyset(dir, &rdataset);
 		} else {
+			INSIST(filename != NULL);
 			result = loadset(filename, &rdataset);
 		}
 
diff --git a/bin/named/config.c b/bin/named/config.c
index 0e44c5d639..48c84b2d98 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -854,6 +854,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	if (stack != NULL)
 		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
 
+	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
 	INSIST(keycount == dscpcount);
 
diff --git a/bin/named/server.c b/bin/named/server.c
index 5f9fdd21e2..4a5c7ee795 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -10610,17 +10610,21 @@ dumpdone(void *arg, isc_result_t result) {
 	char buf[1024+32];
 	const dns_master_style_t *style;
 
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
-	if (dctx->mdctx != NULL)
+	}
+	if (dctx->mdctx != NULL) {
 		dns_dumpctx_detach(&dctx->mdctx);
+	}
 	if (dctx->view == NULL) {
 		dctx->view = ISC_LIST_HEAD(dctx->viewlist);
-		if (dctx->view == NULL)
+		if (dctx->view == NULL) {
 			goto done;
+		}
 		INSIST(dctx->zone == NULL);
-	} else
+	} else {
 		goto resume;
+	}
  nextview:
 	fprintf(dctx->fp, ";\n; Start view %s\n;\n", dctx->view->view->name);
  resume:
@@ -10634,8 +10638,9 @@ dumpdone(void *arg, isc_result_t result) {
 	{
 		style = &dns_master_style_cache;
 		/* start cache dump */
-		if (dctx->view->view->cachedb != NULL)
+		if (dctx->view->view->cachedb != NULL) {
 			dns_db_attach(dctx->view->view->cachedb, &dctx->cache);
+		}
 		if (dctx->cache != NULL) {
 			fprintf(dctx->fp,
 				";\n; Cache dump of view '%s' (cache %s)\n;\n",
@@ -10647,43 +10652,52 @@ dumpdone(void *arg, isc_result_t result) {
 							    dctx->task,
 							    dumpdone, dctx,
 							    &dctx->mdctx);
-			if (result == DNS_R_CONTINUE)
+			if (result == DNS_R_CONTINUE) {
 				return;
-			if (result == ISC_R_NOTIMPLEMENTED)
+			}
+			if (result == ISC_R_NOTIMPLEMENTED) {
 				fprintf(dctx->fp, "; %s\n",
 					dns_result_totext(result));
-			else if (result != ISC_R_SUCCESS)
+			} else if (result != ISC_R_SUCCESS) {
 				goto cleanup;
+			}
 		}
 	}
 
 	if ((dctx->dumpadb || dctx->dumpbad || dctx->dumpfail) &&
-	    dctx->cache == NULL && dctx->view->view->cachedb != NULL)
+	    dctx->cache == NULL && dctx->view->view->cachedb != NULL) {
 		dns_db_attach(dctx->view->view->cachedb, &dctx->cache);
+	}
 
 	if (dctx->cache != NULL) {
-		if (dctx->dumpadb)
+		if (dctx->dumpadb) {
 			dns_adb_dump(dctx->view->view->adb, dctx->fp);
-		if (dctx->dumpbad)
+		}
+		if (dctx->dumpbad) {
 			dns_resolver_printbadcache(dctx->view->view->resolver,
 						   dctx->fp);
-		if (dctx->dumpfail)
+		}
+		if (dctx->dumpfail) {
 			dns_badcache_print(dctx->view->view->failcache,
 					   "SERVFAIL cache", dctx->fp);
+		}
 		dns_db_detach(&dctx->cache);
 	}
 	if (dctx->dumpzones) {
 		style = &dns_master_style_full;
  nextzone:
-		if (dctx->version != NULL)
+		if (dctx->version != NULL) {
 			dns_db_closeversion(dctx->db, &dctx->version,
 					    false);
-		if (dctx->db != NULL)
+		}
+		if (dctx->db != NULL) {
 			dns_db_detach(&dctx->db);
-		if (dctx->zone == NULL)
+		}
+		if (dctx->zone == NULL) {
 			dctx->zone = ISC_LIST_HEAD(dctx->view->zonelist);
-		else
+		} else {
 			dctx->zone = ISC_LIST_NEXT(dctx->zone, link);
+		}
 		if (dctx->zone != NULL) {
 			/* start zone dump */
 			dns_zone_name(dctx->zone->zone, buf, sizeof(buf));
@@ -10702,8 +10716,9 @@ dumpdone(void *arg, isc_result_t result) {
 							    dctx->task,
 							    dumpdone, dctx,
 							    &dctx->mdctx);
-			if (result == DNS_R_CONTINUE)
+			if (result == DNS_R_CONTINUE) {
 				return;
+			}
 			if (result == ISC_R_NOTIMPLEMENTED) {
 				fprintf(dctx->fp, "; %s\n",
 					dns_result_totext(result));
@@ -10711,26 +10726,31 @@ dumpdone(void *arg, isc_result_t result) {
 				POST(result);
 				goto nextzone;
 			}
-			if (result != ISC_R_SUCCESS)
+			if (result != ISC_R_SUCCESS) {
 				goto cleanup;
+			}
 		}
 	}
-	if (dctx->view != NULL)
+	if (dctx->view != NULL) {
 		dctx->view = ISC_LIST_NEXT(dctx->view, link);
-	if (dctx->view != NULL)
-		goto nextview;
+		if (dctx->view != NULL) {
+			goto nextview;
+		}
+	}
  done:
 	fprintf(dctx->fp, "; Dump complete\n");
 	result = isc_stdio_flush(dctx->fp);
-	if (result == ISC_R_SUCCESS)
+	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "dumpdb complete");
+	}
  cleanup:
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpdb failed: %s", dns_result_totext(result));
+	}
 	dumpcontext_destroy(dctx);
 }
 
@@ -15257,14 +15277,15 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 
 	/* Look for the optional class name. */
 	classtxt = next_token(lex, text);
-	if (classtxt != NULL) {
-		/* Look for the optional view name. */
-		viewtxt = next_token(lex, text);
-	}
-
 	if (classtxt != NULL) {
 		isc_textregion_t r;
 
+		/* Look for the optional view name. */
+		viewtxt = next_token(lex, text);
+
+		/*
+		 * If 'classtext' is not a valid class then it us a view name.
+		 */
 		r.base = classtxt;
 		r.length = strlen(classtxt);
 		result = dns_rdataclass_fromtext(&rdclass, &r);
diff --git a/bin/tests/optional/nsecify.c b/bin/tests/optional/nsecify.c
index 8a7f912812..784be63696 100644
--- a/bin/tests/optional/nsecify.c
+++ b/bin/tests/optional/nsecify.c
@@ -26,6 +26,9 @@
 
 static isc_mem_t *mctx = NULL;
 
+ISC_PLATFORM_NORETURN_PRE static inline void
+fatal(const char *message) ISC_PLATFORM_NORETURN_POST;
+
 static inline void
 fatal(const char *message) {
 	fprintf(stderr, "%s\n", message);
diff --git a/bin/tests/pkcs11/benchmarks/create.c b/bin/tests/pkcs11/benchmarks/create.c
index e169a377f3..3348b3428c 100644
--- a/bin/tests/pkcs11/benchmarks/create.c
+++ b/bin/tests/pkcs11/benchmarks/create.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/find.c b/bin/tests/pkcs11/benchmarks/find.c
index fb49f1f9e8..1231c41bcd 100644
--- a/bin/tests/pkcs11/benchmarks/find.c
+++ b/bin/tests/pkcs11/benchmarks/find.c
@@ -72,10 +72,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/genrsa.c b/bin/tests/pkcs11/benchmarks/genrsa.c
index 2e71d9f43e..c89c47cc22 100644
--- a/bin/tests/pkcs11/benchmarks/genrsa.c
+++ b/bin/tests/pkcs11/benchmarks/genrsa.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/login.c b/bin/tests/pkcs11/benchmarks/login.c
index af19be6b1f..64a80bb289 100644
--- a/bin/tests/pkcs11/benchmarks/login.c
+++ b/bin/tests/pkcs11/benchmarks/login.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/privrsa.c b/bin/tests/pkcs11/benchmarks/privrsa.c
index 1998c9d046..181075efa8 100644
--- a/bin/tests/pkcs11/benchmarks/privrsa.c
+++ b/bin/tests/pkcs11/benchmarks/privrsa.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/pubrsa.c b/bin/tests/pkcs11/benchmarks/pubrsa.c
index 6ef29a01d8..6edf643b16 100644
--- a/bin/tests/pkcs11/benchmarks/pubrsa.c
+++ b/bin/tests/pkcs11/benchmarks/pubrsa.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/session.c b/bin/tests/pkcs11/benchmarks/session.c
index de502f5099..41f37204ae 100644
--- a/bin/tests/pkcs11/benchmarks/session.c
+++ b/bin/tests/pkcs11/benchmarks/session.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/sha1.c b/bin/tests/pkcs11/benchmarks/sha1.c
index 9b53ba2eed..9a73ce1c3d 100644
--- a/bin/tests/pkcs11/benchmarks/sha1.c
+++ b/bin/tests/pkcs11/benchmarks/sha1.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/sign.c b/bin/tests/pkcs11/benchmarks/sign.c
index aea715238f..f767226866 100644
--- a/bin/tests/pkcs11/benchmarks/sign.c
+++ b/bin/tests/pkcs11/benchmarks/sign.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
diff --git a/bin/tests/pkcs11/benchmarks/verify.c b/bin/tests/pkcs11/benchmarks/verify.c
index c6207cbe0d..11d2549ca7 100644
--- a/bin/tests/pkcs11/benchmarks/verify.c
+++ b/bin/tests/pkcs11/benchmarks/verify.c
@@ -73,10 +73,10 @@ clock_gettime(int32_t id, struct timespec *tp)
 	UNUSED(id);
 
 	result = gettimeofday(&tv, NULL);
-	if (result)
-		return (result);
-	tp->tv_sec = tv.tv_sec;
-	tp->tv_nsec = (long) tv.tv_usec * 1000;
+	if (result == 0) {
+		tp->tv_sec = tv.tv_sec;
+		tp->tv_nsec = (long) tv.tv_usec * 1000;
+	}
 	return (result);
 }
 #endif
@@ -280,7 +280,7 @@ main(int argc, char *argv[]) {
 			fprintf(stderr,
 				"C_DestroyObject: Error = 0x%.8lX\n",
 				rv);
-			errflg = 1;
+			error = 1;
 		}
 	}
 
diff --git a/bin/tools/mdig.c b/bin/tools/mdig.c
index 29e2407705..a4e6968bf8 100644
--- a/bin/tools/mdig.c
+++ b/bin/tools/mdig.c
@@ -967,7 +967,6 @@ save_opt(struct query *query, char *code, char *value) {
 
 static isc_result_t
 parse_netprefix(isc_sockaddr_t **sap, const char *value) {
-	isc_result_t result = ISC_R_SUCCESS;
 	isc_sockaddr_t *sa = NULL;
 	struct in_addr in4;
 	struct in6_addr in6;
@@ -981,6 +980,7 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 
 	slash = strchr(buf, '/');
 	if (slash != NULL) {
+		isc_result_t result;
 		*slash = '\0';
 		result = isc_parse_uint32(&netmask, slash + 1, 10);
 		if (result != ISC_R_SUCCESS) {
diff --git a/bin/win32/BINDInstall/AccountInfo.cpp b/bin/win32/BINDInstall/AccountInfo.cpp
index 73357a834d..99d9afa7f0 100644
--- a/bin/win32/BINDInstall/AccountInfo.cpp
+++ b/bin/win32/BINDInstall/AccountInfo.cpp
@@ -215,15 +215,20 @@ CreateServiceAccount(char *name, char *password) {
 	ui.usri1_flags = UF_PASSWD_CANT_CHANGE | UF_DONT_EXPIRE_PASSWD |
 			 UF_SCRIPT;
 	ui.usri1_script_path = NULL;
+
 	/*
 	 * Call the NetUserAdd function, specifying level 1.
 	 */
 	nStatus = NetUserAdd(NULL, dwLevel, (LPBYTE)&ui, &dwError);
-
-	if (nStatus != NERR_Success)
+	if (nStatus != NERR_Success) {
 		return (FALSE);
+	}
 
 	retstat = AddPrivilegeToAcccount(name, SE_SERVICE_LOGON_PRIV);
+	if (retstat != RTN_OK) {
+		return (FALSE);
+	}
+
 	return (TRUE);
 }
 
@@ -239,9 +244,10 @@ AddPrivilegeToAcccount(LPTSTR name, LPWSTR PrivilegeName) {
 	/*
 	 * Open the policy on the target machine.
 	 */
-	if ((Status = OpenPolicy(NULL, POLICY_ALL_ACCESS, &PolicyHandle))
-		!= STATUS_SUCCESS)
+	Status = OpenPolicy(NULL, POLICY_ALL_ACCESS, &PolicyHandle);
+	if (Status != STATUS_SUCCESS) {
 		return (RTN_ERROR);
+	}
 
 	/*
 	 * Let's see if the account exists. Return if not
@@ -258,13 +264,14 @@ AddPrivilegeToAcccount(LPTSTR name, LPWSTR PrivilegeName) {
 	}
 
 	err = LsaNtStatusToWinError(SetPrivilegeOnAccount(PolicyHandle,
-		pSid, PrivilegeName, TRUE));
+				    pSid, PrivilegeName, TRUE));
 
 	LsaClose(PolicyHandle);
-	if (err == ERROR_SUCCESS)
+	if (err == ERROR_SUCCESS) {
 		return (RTN_OK);
-	else
+	} else {
 		return (err);
+	}
 }
 
 void
@@ -393,7 +400,6 @@ GetPrivilegesOnAccount(LSA_HANDLE PolicyHandle, PSID AccountSid,
 	NTSTATUS Status;
 	LSA_UNICODE_STRING *UserRights;
 	ULONG CountOfRights;
-	unsigned int retlen = 0;
 	DWORD i, j;
 	int found;
 
@@ -404,6 +410,7 @@ GetPrivilegesOnAccount(LSA_HANDLE PolicyHandle, PSID AccountSid,
 		return (Status);
 
 	for (i = 0; i < CountOfRights; i++) {
+		unsigned int retlen;
 		found = -1;
 		retlen = UserRights[i].Length/sizeof(wchar_t);
 		for (j = 0; j < *PrivCount; j++) {
diff --git a/bin/win32/BINDInstall/BINDInstall.rc b/bin/win32/BINDInstall/BINDInstall.rc
index be9550bbaa..96fe44fd6a 100644
--- a/bin/win32/BINDInstall/BINDInstall.rc
+++ b/bin/win32/BINDInstall/BINDInstall.rc
@@ -267,6 +267,7 @@ BEGIN
     IDS_UNINSTALL_MESSAGE   "Unregister Messages..."
     IDS_ERR_OPEN_SCM        "Could not open Service Control Manager\n(%s)"
     IDS_ERR_OPEN_SERVICE    "Could not open BIND Service\n(%s)"
+    IDS_ERR_START_SERVICE   "Could not start BIND Service\n(%s)"
     IDS_ERR_STOP_SERVICE    "Could not stop BIND Service\n(%s)"
     IDS_ERR_NONCRIT_FILE    "An error occurred while copying non-critical file %s\n(%s)\nDo you wish to continue?"
     IDS_ERR_COPY_FILE       "An error occurred while copying file %s\n(%s)\nInstallation will be terminated"
diff --git a/bin/win32/BINDInstall/BINDInstallDlg.cpp b/bin/win32/BINDInstall/BINDInstallDlg.cpp
index 2e904b0f86..050313659a 100644
--- a/bin/win32/BINDInstall/BINDInstallDlg.cpp
+++ b/bin/win32/BINDInstall/BINDInstallDlg.cpp
@@ -215,6 +215,7 @@ CBINDInstallDlg::CBINDInstallDlg(CWnd* pParent /*=NULL*/)
 	char winsys[MAX_PATH];
 
 	//{{AFX_DATA_INIT(CBINDInstallDlg)
+	/* cppcheck-suppress useInitializationList */
 	m_targetDir = _T("");
 	m_version = _T("");
 	m_toolsOnly = FALSE;
@@ -1089,7 +1090,6 @@ CBINDInstallDlg::UpdateService(CString StartName) {
 			SERVICE_ERROR_NORMAL, pathBuffer, NULL, NULL, NULL,
 			StartName, m_accountPassword, BIND_DISPLAY_NAME)
 			!= TRUE) {
-			DWORD err = GetLastError();
 			MsgBox(IDS_ERR_UPDATE_SERVICE, GetErrMessage());
 		}
 	}
@@ -1314,6 +1314,9 @@ void CBINDInstallDlg::StopBINDService() {
 	}
 
 	BOOL rc = ControlService(hBINDSvc, SERVICE_CONTROL_STOP, &svcStatus);
+	if (!rc) {
+		MsgBox(IDS_ERR_STOP_SERVICE, GetErrMessage());
+	}
 }
 
 /*
@@ -1328,30 +1331,38 @@ void CBINDInstallDlg::StartBINDService() {
 	}
 
 	SC_HANDLE hBINDSvc = OpenService(hSCManager, BIND_SERVICE_NAME,
-				      SERVICE_ALL_ACCESS);
+					 SERVICE_ALL_ACCESS);
 	if (!hBINDSvc) {
 		MsgBox(IDS_ERR_OPEN_SERVICE, GetErrMessage());
 	}
 	BOOL rc = StartService(hBINDSvc, 0, NULL);
+	if (!rc) {
+		MsgBox(IDS_ERR_START_SERVICE, GetErrMessage());
+	}
 }
 
 /*
  * Check to see if the BIND service is running or not
  */
-BOOL CBINDInstallDlg::CheckBINDService() {
+BOOL
+CBINDInstallDlg::CheckBINDService() {
 	SERVICE_STATUS svcStatus;
 
 	SC_HANDLE hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
 	if (hSCManager) {
 		SC_HANDLE hBINDSvc = OpenService(hSCManager, BIND_SERVICE_NAME,
-					      SERVICE_ALL_ACCESS);
+						 SERVICE_ALL_ACCESS);
 		if (hBINDSvc) {
 			BOOL rc = ControlService(hBINDSvc,
-				  SERVICE_CONTROL_INTERROGATE, &svcStatus);
-			if (!rc)
+						 SERVICE_CONTROL_INTERROGATE,
+						 &svcStatus);
+			if (!rc) {
+				/* cppcheck-suppress unreadVariable */
 				DWORD err = GetLastError();
+			}
 
-			return (svcStatus.dwCurrentState == SERVICE_RUNNING);
+			return (rc &&
+				svcStatus.dwCurrentState == SERVICE_RUNNING);
 		}
 	}
 	return (FALSE);
@@ -1560,14 +1571,16 @@ void CBINDInstallDlg::ProgramGroup(BOOL create) {
 		return;
 	}
 
-	hr = SHGetPathFromIDList(itemList, commonPath);
-	pMalloc->Free(itemList);
-
-	if (create) {
-		ProgramGroupCreate(commonPath);
+	if (SHGetPathFromIDList(itemList, commonPath)) {
+		if (create) {
+			ProgramGroupCreate(commonPath);
+		} else {
+			ProgramGroupRemove(commonPath);
+		}
 	} else {
-		ProgramGroupRemove(commonPath);
+		MessageBox("SHGetPathFromIDList failed");
 	}
+	pMalloc->Free(itemList);
 }
 
 CString CBINDInstallDlg::DestDir(int destination) {
diff --git a/bin/win32/BINDInstall/DirBrowse.cpp b/bin/win32/BINDInstall/DirBrowse.cpp
index 758dc60573..9692b5b0f9 100644
--- a/bin/win32/BINDInstall/DirBrowse.cpp
+++ b/bin/win32/BINDInstall/DirBrowse.cpp
@@ -46,6 +46,7 @@ CDirBrowse::CDirBrowse(CString initialDir, CWnd* pParent /*=NULL*/)
 	//{{AFX_DATA_INIT(CDirBrowse)
 		// NOTE: the ClassWizard will add member initialization here
 	//}}AFX_DATA_INIT
+	/* cppcheck-suppress useInitializationList */
 	m_selectedDir = initialDir;
 }
 
diff --git a/bin/win32/BINDInstall/VersionInfo.cpp b/bin/win32/BINDInstall/VersionInfo.cpp
index e83348fa2a..ddad36b706 100644
--- a/bin/win32/BINDInstall/VersionInfo.cpp
+++ b/bin/win32/BINDInstall/VersionInfo.cpp
@@ -79,8 +79,6 @@ CVersionInfo::CVersionInfo(CString filename)
 		// And finally the version info is ours
 		m_fixedInfo = (VS_FIXEDFILEINFO *)viBlob;
 
-		UINT blobLen = 0;
-
 		// If we got here, all is good
 	}
 	m_isValid = TRUE;
diff --git a/bin/win32/BINDInstall/resource.h b/bin/win32/BINDInstall/resource.h
index b176fe0930..6551205f54 100644
--- a/bin/win32/BINDInstall/resource.h
+++ b/bin/win32/BINDInstall/resource.h
@@ -91,6 +91,7 @@
 #define IDC_ACCOUNT_PASSWORD            1031
 #define IDC_ACCOUNT_PASSWORD_CONFIRM    1032
 #define IDC_TOOLS_ONLY			1033
+#define IDS_ERR_START_SERVICE		1034
 
 // Next default values for new objects
 // 
diff --git a/fuzz/dns_rdata_fromwire_text.c b/fuzz/dns_rdata_fromwire_text.c
index 7b001f21f7..425638abbf 100644
--- a/fuzz/dns_rdata_fromwire_text.c
+++ b/fuzz/dns_rdata_fromwire_text.c
@@ -38,14 +38,13 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size);
 
 static void
 nullmsg(dns_rdatacallbacks_t *cb, const char *fmt, ...) {
-	va_list ap;
 
 	UNUSED(cb);
 	UNUSED(fmt);
-	UNUSED(ap);
 }
 
-int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+int
+LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
 	char totext[1024];
 	dns_compress_t cctx;
 	dns_decompress_t dctx;
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 800271956c..1b18480fd5 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -1769,7 +1769,7 @@ make_dnskey(dst_key_t *key, unsigned char *buf, int bufsize,
 }
 
 static isc_result_t
-publish(dns_rdata_t *rdata, dns_diff_t *diff, dns_name_t *origin,
+addrdata(dns_rdata_t *rdata, dns_diff_t *diff, const dns_name_t *origin,
 	dns_ttl_t ttl, isc_mem_t *mctx)
 {
 	isc_result_t result;
@@ -1784,7 +1784,7 @@ publish(dns_rdata_t *rdata, dns_diff_t *diff, dns_name_t *origin,
 }
 
 static isc_result_t
-delrdata(dns_rdata_t *rdata, dns_diff_t *diff, dns_name_t *origin,
+delrdata(dns_rdata_t *rdata, dns_diff_t *diff, const dns_name_t *origin,
 	 dns_ttl_t ttl, isc_mem_t *mctx)
 {
 	isc_result_t result;
@@ -1804,7 +1804,6 @@ publish_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
 	    void (*report)(const char *, ...))
 {
 	isc_result_t result;
-	dns_difftuple_t *tuple = NULL;
 	unsigned char buf[DST_KEY_MAXSIZE];
 	char keystr[DST_KEY_FORMATSIZE];
 	dns_rdata_t dnskey = DNS_RDATA_INIT;
@@ -1828,10 +1827,7 @@ publish_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
 	}
 
 	/* publish key */
-	RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_ADD, origin, ttl,
-				    &dnskey, &tuple));
-	dns_diff_appendminimal(diff, &tuple);
-	result = ISC_R_SUCCESS;
+	result = addrdata(&dnskey, diff, origin, ttl, mctx);
 
  failure:
 	return (result);
@@ -1843,7 +1839,6 @@ remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
 	  void (*report)(const char *, ...))
 {
 	isc_result_t result;
-	dns_difftuple_t *tuple = NULL;
 	unsigned char buf[DST_KEY_MAXSIZE];
 	dns_rdata_t dnskey = DNS_RDATA_INIT;
 	char alg[80];
@@ -1853,10 +1848,7 @@ remove_key(dns_diff_t *diff, dns_dnsseckey_t *key, const dns_name_t *origin,
 	       reason, dst_key_id(key->key), alg);
 
 	RETERR(make_dnskey(key->key, buf, sizeof(buf), &dnskey));
-	RETERR(dns_difftuple_create(mctx, DNS_DIFFOP_DEL, origin, ttl, &dnskey,
-				    &tuple));
-	dns_diff_appendminimal(diff, &tuple);
-	result = ISC_R_SUCCESS;
+	result = delrdata(&dnskey, diff, origin, ttl, mctx);
 
  failure:
 	return (result);
@@ -1934,15 +1926,15 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 			if (!dns_rdataset_isassociated(cdnskey) ||
 			    !exists(cdnskey, &cdnskeyrdata))
 			{
-				RETERR(publish(&cdnskeyrdata, diff, origin,
-					       ttl, mctx));
+				RETERR(addrdata(&cdnskeyrdata, diff, origin,
+						ttl, mctx));
 			}
 			/* Only publish SHA-256 (SHA-1 is deprecated) */
 			if (!dns_rdataset_isassociated(cds) ||
 			    !exists(cds, &cds_sha256))
 			{
-				RETERR(publish(&cds_sha256, diff, origin,
-					       ttl, mctx));
+				RETERR(addrdata(&cds_sha256, diff, origin,
+						ttl, mctx));
 			}
 		}
 
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 1d1f258e54..e874639f8d 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -389,7 +389,7 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory) {
 	    (key->key_flags & DNS_KEYFLAG_TYPEMASK) != DNS_KEYTYPE_NOKEY)
 		return (key->func->tofile(key, directory));
 	else
-		return (ISC_R_SUCCESS);
+		return (ret);
 }
 
 void
diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
index 126091138c..3c1ddec1d0 100644
--- a/lib/dns/ecdb.c
+++ b/lib/dns/ecdb.c
@@ -756,7 +756,9 @@ rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
 	REQUIRE(iteratorp != NULL);
 	REQUIRE(DNS_RDATASETITER_VALID(*iteratorp));
 
+	/* cppcheck-suppress unreadVariable */
 	u.rdatasetiterator = *iteratorp;
+	*iteratorp = NULL;
 
 	mctx = u.ecdbiterator->common.db->mctx;
 	u.ecdbiterator->common.magic = 0;
@@ -765,8 +767,6 @@ rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) {
 			  &u.ecdbiterator->common.node);
 	isc_mem_put(mctx, u.ecdbiterator,
 		    sizeof(ecdb_rdatasetiter_t));
-
-	*iteratorp = NULL;
 }
 
 static isc_result_t
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 6e169bfa90..12dafa8e2a 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -2369,15 +2369,10 @@ dns_name_format(const dns_name_t *name, char *cp, unsigned int size) {
 	isc_buffer_init(&buf, cp, size - 1);
 	result = dns_name_totext(name, true, &buf);
 	if (result == ISC_R_SUCCESS) {
-		/*
-		 * Null terminate.
-		 */
-		isc_region_t r;
-		isc_buffer_usedregion(&buf, &r);
-		((char *) r.base)[r.length] = '\0';
-
-	} else
+		isc_buffer_putuint8(&buf, (uint8_t)'\0');
+	} else {
 		snprintf(cp, size, "<unknown>");
+	}
 }
 
 /*
diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 2495047442..e35745168d 100644
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -106,6 +106,8 @@ dns_nsec_buildrdata(dns_db_t *db, dns_dbversion_t *version,
 	unsigned int max_type;
 	dns_rdatasetiter_t *rdsiter;
 
+	REQUIRE(target != NULL);
+
 	memset(buffer, 0, DNS_NSEC_BUFFERSIZE);
 	dns_name_toregion(target, &r);
 	memmove(buffer, r.base, r.length);
diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c
index 04cff0b1ee..7f9c244c6a 100644
--- a/lib/dns/openssldh_link.c
+++ b/lib/dns/openssldh_link.c
@@ -243,6 +243,7 @@ progress_cb(int p, int n, BN_GENCB *cb) {
 
 	UNUSED(n);
 
+	/* cppcheck-suppress unreadVariable */
 	u.dptr = BN_GENCB_get_arg(cb);
 	if (u.fptr != NULL)
 		u.fptr(p);
@@ -303,6 +304,7 @@ openssldh_generate(dst_key_t *key, int generator, void (*callback)(int)) {
 		if (callback == NULL) {
 			BN_GENCB_set_old(cb, NULL, NULL);
 		} else {
+			/* cppcheck-suppress unreadVariable */
 			u.fptr = callback;
 			BN_GENCB_set(cb, &progress_cb, u.dptr);
 		}
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index 6503688dff..ecf13c7625 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -426,6 +426,7 @@ progress_cb(int p, int n, BN_GENCB *cb) {
 
 	UNUSED(n);
 
+	/* cppcheck-suppress unreadVariable */
 	u.dptr = BN_GENCB_get_arg(cb);
 	if (u.fptr != NULL)
 		u.fptr(p);
@@ -494,6 +495,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
 	if (callback == NULL) {
 		BN_GENCB_set_old(cb, NULL, NULL);
 	} else {
+		/* cppcheck-suppress unreadVariable */
 		u.fptr = callback;
 		BN_GENCB_set(cb, &progress_cb, u.dptr);
 	}
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 70f81c47e5..b0e5a2c6e6 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -2948,6 +2948,12 @@ dns_rbt_indent(FILE *f, int depth) {
 
 void
 dns_rbt_printnodeinfo(dns_rbtnode_t *n, FILE *f) {
+
+	if (n == NULL) {
+		fprintf(f, "Null node\n");
+		return;
+	}
+
 	fprintf(f, "Node info for nodename: ");
 	printnodename(n, true, f);
 	fprintf(f, "\n");
@@ -2967,7 +2973,7 @@ dns_rbt_printnodeinfo(dns_rbtnode_t *n, FILE *f) {
 	fprintf(f, "Right: %p\n", n->right);
 	fprintf(f, "Left: %p\n", n->left);
 	fprintf(f, "Down: %p\n", n->down);
-	fprintf(f, "daTa: %p\n", n->data);
+	fprintf(f, "Data: %p\n", n->data);
 }
 
 static void
@@ -3000,8 +3006,12 @@ print_text_helper(dns_rbtnode_t *root, dns_rbtnode_t *parent,
 
 	if (root != NULL) {
 		printnodename(root, true, f);
+		/*
+		 * Don't use IS_RED(root) as it tests for 'root != NULL'
+		 * and cppcheck produces false positives.
+		 */
 		fprintf(f, " (%s, %s", direction,
-			IS_RED(root) ? "RED" : "BLACK");
+			COLOR(root) == RED ? "RED" : "BLACK");
 
 		if ((! IS_ROOT(root) && PARENT(root) != parent) ||
 		    (  IS_ROOT(root) && depth > 0 &&
@@ -3025,13 +3035,22 @@ print_text_helper(dns_rbtnode_t *root, dns_rbtnode_t *parent,
 
 		depth++;
 
-		if (IS_RED(root) && IS_RED(LEFT(root)))
+		/*
+		 * Don't use IS_RED(root) as it tests for 'root != NULL'
+		 * and cppcheck produces false positives.
+		 */
+		if (COLOR(root) == RED && IS_RED(LEFT(root))) {
 			fprintf(f, "** Red/Red color violation on left\n");
+		}
 		print_text_helper(LEFT(root), root, depth, "left",
 					  data_printer, f);
 
-		if (IS_RED(root) && IS_RED(RIGHT(root)))
+		/*
+		 * Don't use IS_RED(root) as cppcheck produces false positives.
+		 */
+		if (COLOR(root) == RED && IS_RED(RIGHT(root))) {
 			fprintf(f, "** Red/Red color violation on right\n");
+		}
 		print_text_helper(RIGHT(root), root, depth, "right",
 					  data_printer, f);
 
diff --git a/lib/dns/rcode.c b/lib/dns/rcode.c
index 0ccda5c3ca..7dc51ee246 100644
--- a/lib/dns/rcode.c
+++ b/lib/dns/rcode.c
@@ -360,8 +360,10 @@ dns_secalg_format(dns_secalg_t alg, char *cp, unsigned int size) {
 	result = dns_secalg_totext(alg, &b);
 	isc_buffer_usedregion(&b, &r);
 	r.base[r.length] = 0;
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		/* cppcheck-suppress unreadVariable */
 		r.base[0] = 0;
+	}
 }
 
 isc_result_t
@@ -390,7 +392,10 @@ dns_keyflags_fromtext(dns_keyflags_t *flagsp, isc_textregion_t *source)
 {
 	isc_result_t result;
 	char *text, *end;
-	unsigned int value, mask;
+	unsigned int value = 0;
+#ifdef notyet
+	unsigned int mask = 0;
+#endif
 
 	result = maybe_numeric(&value, source, 0xffff, true);
 	if (result == ISC_R_SUCCESS) {
@@ -402,7 +407,6 @@ dns_keyflags_fromtext(dns_keyflags_t *flagsp, isc_textregion_t *source)
 
 	text = source->base;
 	end = source->base + source->length;
-	value = mask = 0;
 
 	while (text < end) {
 		struct keyflag *p;
@@ -422,8 +426,8 @@ dns_keyflags_fromtext(dns_keyflags_t *flagsp, isc_textregion_t *source)
 #ifdef notyet
 		if ((mask & p->mask) != 0)
 			warn("overlapping key flags");
-#endif
 		mask |= p->mask;
+#endif
 		text += len;
 		if (delim != NULL)
 			text++; /* Skip "|" */
@@ -456,8 +460,10 @@ dns_dsdigest_format(dns_dsdigest_t typ, char *cp, unsigned int size) {
 	result = dns_dsdigest_totext(typ, &b);
 	isc_buffer_usedregion(&b, &r);
 	r.base[r.length] = 0;
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
+		/* cppcheck-suppress unreadVariable */
 		r.base[0] = 0;
+	}
 }
 
 /*
diff --git a/lib/dns/tests/tkey_test.c b/lib/dns/tests/tkey_test.c
index 66a30b9f29..5b0fb033dc 100644
--- a/lib/dns/tests/tkey_test.c
+++ b/lib/dns/tests/tkey_test.c
@@ -55,6 +55,7 @@ __wrap_isc__mem_get(isc_mem_t *mctx, size_t size)
 	mock_assert(has_enough_memory, "mock isc_mem_get failed",
 		    __FILE__, __LINE__);
 
+	/* cppcheck-suppress leakNoVarFunctionCall */
 	return (malloc(size));
 }
 
diff --git a/lib/dns/ttl.c b/lib/dns/ttl.c
index 848ab0b701..ee33c00440 100644
--- a/lib/dns/ttl.c
+++ b/lib/dns/ttl.c
@@ -121,6 +121,7 @@ dns_ttl_totext(uint32_t src, bool verbose,
 		 * here because region.base is type unsigned char *.
 		 */
 		isc_buffer_usedregion(target, &region);
+		/* cppcheck-suppress unreadVariable */
 		region.base[region.length - 1] =
 			toupper(region.base[region.length - 1]);
 	}
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 1904c26dc6..49e5722528 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -6123,17 +6123,17 @@ dns_zone_maintenance(dns_zone_t *zone) {
 
 static inline bool
 was_dumping(dns_zone_t *zone) {
-	bool dumping;
 
 	REQUIRE(LOCKED_ZONE(zone));
 
-	dumping = DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING);
-	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_DUMPING);
-	if (!dumping) {
-		DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDDUMP);
-		isc_time_settoepoch(&zone->dumptime);
+	if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_DUMPING)) {
+		return (true);
 	}
-	return (dumping);
+
+	DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_DUMPING);
+	DNS_ZONE_CLRFLAG(zone, DNS_ZONEFLG_NEEDDUMP);
+	isc_time_settoepoch(&zone->dumptime);
+	return (false);
 }
 
 /*%
diff --git a/lib/irs/win32/resconf.c b/lib/irs/win32/resconf.c
index 45d3629bf1..2b3eac2e8f 100644
--- a/lib/irs/win32/resconf.c
+++ b/lib/irs/win32/resconf.c
@@ -32,7 +32,6 @@ isc_result_t
 get_win32_searchlist(irs_resconf_t *conf) {
 	isc_result_t result = ISC_R_SUCCESS;
 	HKEY hKey;
-	BOOL keyFound = TRUE;
 	char searchlist[MAX_PATH];
 	DWORD searchlen = MAX_PATH;
 	LSTATUS status;
diff --git a/lib/isc/lex.c b/lib/isc/lex.c
index e1f4653ee0..902fa5fdd3 100644
--- a/lib/isc/lex.c
+++ b/lib/isc/lex.c
@@ -839,7 +839,6 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 			FATAL_ERROR(__FILE__, __LINE__,
 				    "Unexpected state %d",
 				    state);
-			ISC_UNREACHABLE();
 		}
 
 	} while (!done);
diff --git a/lib/isc/ratelimiter.c b/lib/isc/ratelimiter.c
index 5f2eab7891..cf97ad7b39 100644
--- a/lib/isc/ratelimiter.c
+++ b/lib/isc/ratelimiter.c
@@ -194,7 +194,6 @@ isc_ratelimiter_dequeue(isc_ratelimiter_t *rl, isc_event_t *event) {
 
 static void
 ratelimiter_tick(isc_task_t *task, isc_event_t *event) {
-	isc_result_t result = ISC_R_SUCCESS;
 	isc_ratelimiter_t *rl = (isc_ratelimiter_t *)event->ev_arg;
 	isc_event_t *p;
 	uint32_t pertic;
@@ -214,6 +213,7 @@ ratelimiter_tick(isc_task_t *task, isc_event_t *event) {
 			 */
 			ISC_LIST_UNLINK(rl->pending, p, ev_ratelink);
 		} else {
+			isc_result_t result;
 			/*
 			 * No work left to do.  Stop the timer so that we don't
 			 * waste resources by having it fire periodically.
diff --git a/lib/isc/sockaddr.c b/lib/isc/sockaddr.c
index 832be1c2ce..8dd3125aa3 100644
--- a/lib/isc/sockaddr.c
+++ b/lib/isc/sockaddr.c
@@ -164,6 +164,7 @@ isc_sockaddr_totext(const isc_sockaddr_t *sockaddr, isc_buffer_t *target) {
 	 */
 	isc_buffer_availableregion(target, &avail);
 	INSIST(avail.length >= 1);
+	/* cppcheck-suppress unreadVariable */
 	avail.base[0] = '\0';
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/isc/tests/hmac_test.c b/lib/isc/tests/hmac_test.c
index 9e49baffcb..b8d9a03d5c 100644
--- a/lib/isc/tests/hmac_test.c
+++ b/lib/isc/tests/hmac_test.c
@@ -170,8 +170,10 @@ isc_hmac_update_test(void **state) {
 static void
 isc_hmac_reset_test(void **state) {
 	isc_hmac_t *hmac = *state;
+#if 0
 	unsigned char digest[ISC_MAX_MD_SIZE] __attribute((unused));
 	unsigned int digestlen __attribute((unused));
+#endif
 
 	assert_non_null(hmac);
 
diff --git a/lib/isc/tests/md_test.c b/lib/isc/tests/md_test.c
index 672d2134ed..6442b499c9 100644
--- a/lib/isc/tests/md_test.c
+++ b/lib/isc/tests/md_test.c
@@ -157,8 +157,10 @@ isc_md_update_test(void **state) {
 static void
 isc_md_reset_test(void **state) {
 	isc_md_t *md = *state;
+#if 0
 	unsigned char digest[ISC_MAX_MD_SIZE] __attribute((unused));
 	unsigned int digestlen __attribute((unused));
+#endif
 
 	assert_non_null(md);
 
diff --git a/lib/isc/tests/queue_test.c b/lib/isc/tests/queue_test.c
index c60e1e27b9..89ed2d4e23 100644
--- a/lib/isc/tests/queue_test.c
+++ b/lib/isc/tests/queue_test.c
@@ -137,6 +137,8 @@ queue_valid(void **state) {
 	assert_non_null(p);
 	assert_int_equal(p->value, 5);
 
+	assert_null(queue.head);
+	assert_null(queue.tail);
 	assert_true(ISC_QUEUE_EMPTY(queue));
 
 	ISC_QUEUE_DESTROY(queue);
diff --git a/lib/isc/tests/random_test.c b/lib/isc/tests/random_test.c
index c3877d9655..dcad858398 100644
--- a/lib/isc/tests/random_test.c
+++ b/lib/isc/tests/random_test.c
@@ -541,6 +541,7 @@ blockfrequency(isc_mem_t *mctx, uint16_t *values, size_t length) {
 
 	/* Preconditions (section 2.2.7 in NIST SP 800-22) */
 	assert_true(numbits >= 100);
+	/* cppcheck-suppress constArgument */
 	assert_true(mbits >= 20);
 	assert_true((double) mbits > (0.01 * numbits));
 	assert_true(numblocks < 100);
diff --git a/lib/isc/tests/task_test.c b/lib/isc/tests/task_test.c
index a47eb9ba36..0622a73d32 100644
--- a/lib/isc/tests/task_test.c
+++ b/lib/isc/tests/task_test.c
@@ -421,6 +421,8 @@ basic_cb(isc_task_t *task, isc_event_t *event) {
 		j += 100;
 	}
 
+	UNUSED(j);
+
 	if (verbose) {
 		print_message("# task %s\n", (char *)event->ev_arg);
 	}
diff --git a/lib/isc/unix/resource.c b/lib/isc/unix/resource.c
index 1b8b945ef4..a00ae12565 100644
--- a/lib/isc/unix/resource.c
+++ b/lib/isc/unix/resource.c
@@ -164,6 +164,7 @@ isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value) {
 			return (ISC_R_SUCCESS);
 	}
 #endif
+	/* cppcheck-suppress duplicateCondition */
 	if (resource == isc_resource_openfiles && rlim_value == RLIM_INFINITY) {
 		if (getrlimit(unixresource, &rl) == 0) {
 			rl.rlim_cur = rl.rlim_max;
diff --git a/lib/isc/win32/file.c b/lib/isc/win32/file.c
index ad5ba50691..46992691c3 100644
--- a/lib/isc/win32/file.c
+++ b/lib/isc/win32/file.c
@@ -352,7 +352,6 @@ isc_file_template(const char *path, const char *templet, char *buf,
 isc_result_t
 isc_file_renameunique(const char *file, char *templet) {
 	int fd;
-	int res = 0;
 	isc_result_t result = ISC_R_SUCCESS;
 
 	REQUIRE(file != NULL);
@@ -365,6 +364,7 @@ isc_file_renameunique(const char *file, char *templet) {
 		close(fd);
 
 	if (result == ISC_R_SUCCESS) {
+		int res;
 		res = isc_file_safemovefile(file, templet);
 		if (res != 0) {
 			result = isc__errno2result(errno);
diff --git a/lib/isc/win32/interfaceiter.c b/lib/isc/win32/interfaceiter.c
index 10667faed7..d8cbaa396e 100644
--- a/lib/isc/win32/interfaceiter.c
+++ b/lib/isc/win32/interfaceiter.c
@@ -278,8 +278,6 @@ isc_interfaceiter_create(isc_mem_t *mctx, isc_interfaceiter_t **iterp) {
  ioctl_failure:
 	if (iter->buf4 != NULL)
 		isc_mem_put(mctx, iter->buf4, iter->buf4size);
-
- alloc_failure:
 	if (iter->socket != INVALID_SOCKET)
 		(void) closesocket(iter->socket);
 
diff --git a/lib/isc/win32/ntgroups.c b/lib/isc/win32/ntgroups.c
index 6f5e7ba830..850d076aea 100644
--- a/lib/isc/win32/ntgroups.c
+++ b/lib/isc/win32/ntgroups.c
@@ -39,10 +39,14 @@
 
 #define MAX_NAME_LENGTH 256
 
+#define CHECK(op) \
+	do { result = (op); if (result != ISC_R_SUCCESS) { goto cleanup; } } while (0)
+
 isc_result_t
 isc_ntsecurity_getaccountgroups(char *username, char **GroupList,
 				unsigned int maxgroups,
-				unsigned int *totalGroups) {
+				unsigned int *totalGroups)
+{
 	LPGROUP_USERS_INFO_0 pTmpBuf;
 	LPLOCALGROUP_USERS_INFO_0 pTmpLBuf;
 	DWORD i;
@@ -56,10 +60,15 @@ isc_ntsecurity_getaccountgroups(char *username, char **GroupList,
 	NET_API_STATUS nStatus;
 	size_t retlen;
 	wchar_t user[MAX_NAME_LENGTH];
-
-	retlen = mbstowcs(user, username, MAX_NAME_LENGTH);
+	isc_result_t result;
 
 	*totalGroups = 0;
+
+	retlen = mbstowcs(user, username, MAX_NAME_LENGTH);
+	if (retlen == (size_t) (-1)) {
+		return (ISC_R_FAILURE);
+	}
+
 	/*
 	 * Call the NetUserGetLocalGroups function
 	 * specifying information level 0.
@@ -68,24 +77,22 @@ isc_ntsecurity_getaccountgroups(char *username, char **GroupList,
 	 * function should also return the names of the local
 	 * groups in which the user is indirectly a member.
 	 */
-	nStatus = NetUserGetLocalGroups(NULL,
-				   user,
-				   dwLevel,
-				   dwFlags,
-				   (LPBYTE *) &pBuf,
-				   dwPrefMaxLen,
-				   &dwEntriesRead,
-				   &dwTotalEntries);
+	nStatus = NetUserGetLocalGroups(NULL, user, dwLevel, dwFlags,
+					(LPBYTE *) &pBuf, dwPrefMaxLen,
+					&dwEntriesRead, &dwTotalEntries);
 	/*
 	 * See if the call succeeds,
 	 */
 	if (nStatus != NERR_Success) {
-		if (nStatus == ERROR_ACCESS_DENIED)
+		if (nStatus == ERROR_ACCESS_DENIED) {
 			return (ISC_R_NOPERM);
-		if (nStatus == ERROR_MORE_DATA)
+		}
+		if (nStatus == ERROR_MORE_DATA) {
 			return (ISC_R_NOSPACE);
-		if (nStatus == NERR_UserNotFound)
+		}
+		if (nStatus == NERR_UserNotFound) {
 			dwEntriesRead = 0;
+		}
 	}
 
 	if (pBuf != NULL) {
@@ -96,24 +103,32 @@ isc_ntsecurity_getaccountgroups(char *username, char **GroupList,
 		 for (i = 0;
 		     (i < dwEntriesRead && *totalGroups < maxgroups); i++) {
 			assert(pTmpLBuf != NULL);
-			if (pTmpLBuf == NULL)
+			if (pTmpLBuf == NULL) {
 				break;
+			}
 			retlen = wcslen(pTmpLBuf->lgrui0_name);
 			GroupList[*totalGroups] = (char *) malloc(retlen +1);
-			if (GroupList[*totalGroups] == NULL)
-				return (ISC_R_NOMEMORY);
+			if (GroupList[*totalGroups] == NULL) {
+				CHECK(ISC_R_NOMEMORY);
+			}
 
 			retlen = wcstombs(GroupList[*totalGroups],
-				 pTmpLBuf->lgrui0_name, retlen);
-			GroupList[*totalGroups][retlen] = '\0';
-			if (strcmp(GroupList[*totalGroups], "None") == 0)
+					  pTmpLBuf->lgrui0_name, retlen);
+			if (retlen == (size_t) (-1)) {
 				free(GroupList[*totalGroups]);
-			else
+				CHECK(ISC_R_FAILURE);
+			}
+			GroupList[*totalGroups][retlen] = '\0';
+			if (strcmp(GroupList[*totalGroups], "None") == 0) {
+				free(GroupList[*totalGroups]);
+			} else {
 				(*totalGroups)++;
+			}
 			pTmpLBuf++;
 		}
 	}
 	/* Free the allocated memory. */
+	/* cppcheck-suppress duplicateCondition */
 	if (pBuf != NULL)
 		NetApiBufferFree(pBuf);
 
@@ -121,23 +136,22 @@ isc_ntsecurity_getaccountgroups(char *username, char **GroupList,
 	/*
 	 * Call the NetUserGetGroups function, specifying level 0.
 	 */
-	nStatus = NetUserGetGroups(NULL,
-			      user,
-			      dwLevel,
-			      (LPBYTE*)&pgrpBuf,
-			      dwPrefMaxLen,
-			      &dwEntriesRead,
-			      &dwTotalEntries);
+	nStatus = NetUserGetGroups(NULL, user, dwLevel,
+				  (LPBYTE*)&pgrpBuf, dwPrefMaxLen,
+				   &dwEntriesRead, &dwTotalEntries);
 	/*
 	 * See if the call succeeds,
 	 */
 	if (nStatus != NERR_Success) {
-		if (nStatus == ERROR_ACCESS_DENIED)
+		if (nStatus == ERROR_ACCESS_DENIED) {
 			return (ISC_R_NOPERM);
-		if (nStatus == ERROR_MORE_DATA)
+		}
+		if (nStatus == ERROR_MORE_DATA) {
 			return (ISC_R_NOSPACE);
-		if (nStatus == NERR_UserNotFound)
+		}
+		if (nStatus == NERR_UserNotFound) {
 			dwEntriesRead = 0;
+		}
 	}
 
 	if (pgrpBuf != NULL) {
@@ -149,28 +163,43 @@ isc_ntsecurity_getaccountgroups(char *username, char **GroupList,
 		     (i < dwEntriesRead && *totalGroups < maxgroups); i++) {
 			assert(pTmpBuf != NULL);
 
-			if (pTmpBuf == NULL)
+			if (pTmpBuf == NULL) {
 				break;
+			}
 			retlen = wcslen(pTmpBuf->grui0_name);
 			GroupList[*totalGroups] = (char *) malloc(retlen +1);
-			if (GroupList[*totalGroups] == NULL)
-				return (ISC_R_NOMEMORY);
+			if (GroupList[*totalGroups] == NULL) {
+				CHECK(ISC_R_NOMEMORY);
+			}
 
 			retlen = wcstombs(GroupList[*totalGroups],
 				 pTmpBuf->grui0_name, retlen);
-			GroupList[*totalGroups][retlen] = '\0';
-			if (strcmp(GroupList[*totalGroups], "None") == 0)
+			if (retlen == (size_t) (-1)) {
 				free(GroupList[*totalGroups]);
-			else
+				CHECK(ISC_R_FAILURE);
+			}
+			GroupList[*totalGroups][retlen] = '\0';
+			if (strcmp(GroupList[*totalGroups], "None") == 0) {
+				free(GroupList[*totalGroups]);
+			} else {
 				(*totalGroups)++;
+			}
 			pTmpBuf++;
 		}
 	}
 	/*
 	 * Free the allocated memory.
 	 */
-	if (pgrpBuf != NULL)
+	/* cppcheck-suppress duplicateCondition */
+	if (pgrpBuf != NULL) {
 		NetApiBufferFree(pgrpBuf);
+	}
 
 	return (ISC_R_SUCCESS);
+
+ cleanup:
+	while (--(*totalGroups) > 0) {
+		free(GroupList[*totalGroups]);
+	}
+	return (result);
 }
diff --git a/lib/isc/win32/socket.c b/lib/isc/win32/socket.c
index 4ef5c031ec..2226374ab9 100644
--- a/lib/isc/win32/socket.c
+++ b/lib/isc/win32/socket.c
@@ -1334,9 +1334,9 @@ use_min_mtu(isc_socket_t *sock) {
 
 static isc_result_t
 allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
-		isc_socket_t **socketp) {
+		isc_socket_t **socketp)
+{
 	isc_socket_t *sock;
-	isc_result_t result;
 
 	sock = isc_mem_get(manager->mctx, sizeof(*sock));
 
@@ -1385,13 +1385,6 @@ allocate_socket(isc_socketmgr_t *manager, isc_sockettype_t type,
 	*socketp = sock;
 
 	return (ISC_R_SUCCESS);
-
- error:
-	if (sock->recvbuf.base != NULL)
-		isc_mem_put(manager->mctx, sock->recvbuf.base, sock->recvbuf.len);
-	isc_mem_put(manager->mctx, sock, sizeof(*sock));
-
-	return (result);
 }
 
 /*
@@ -2321,7 +2314,6 @@ restart_accept(isc_socket_t *parent, IoCompletionInfo *lpo)
 static isc_threadresult_t WINAPI
 SocketIoThread(LPVOID ThreadContext) {
 	isc_socketmgr_t *manager = ThreadContext;
-	BOOL bSuccess = FALSE;
 	DWORD nbytes;
 	IoCompletionInfo *lpo = NULL;
 	isc_socket_t *sock = NULL;
@@ -2351,6 +2343,8 @@ SocketIoThread(LPVOID ThreadContext) {
 	 * Loop forever waiting on I/O Completions and then processing them
 	 */
 	while (TRUE) {
+		BOOL bSuccess;
+
 		wait_again:
 		bSuccess = GetQueuedCompletionStatus(manager->hIoCompletionPort,
 						     &nbytes,
@@ -3491,6 +3485,7 @@ isc_socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how) {
 		_set_state(sock, SOCK_CLOSED);
 	}
 	how &= ~ISC_SOCKCANCEL_CONNECT;
+	UNUSED(how);
 
 	maybe_free_socket(&sock, __LINE__);
 }
diff --git a/lib/isc/win32/time.c b/lib/isc/win32/time.c
index 144ab61252..acaed0d0f6 100644
--- a/lib/isc/win32/time.c
+++ b/lib/isc/win32/time.c
@@ -87,7 +87,9 @@ isc_time_set(isc_time_t *t, unsigned int seconds, unsigned int nanoseconds) {
 	i1.LowPart = temp.dwLowDateTime;
 	i1.HighPart = temp.dwHighDateTime;
 
+	/* cppcheck-suppress unreadVariable */
 	i1.QuadPart += (unsigned __int64)nanoseconds/100;
+	/* cppcheck-suppress unreadVariable */
 	i1.QuadPart += (unsigned __int64)seconds*10000000;
 
 	t->absolute.dwLowDateTime = i1.LowPart;
@@ -137,6 +139,7 @@ isc_time_nowplusinterval(isc_time_t *t, const isc_interval_t *i) {
 	if (UINT64_MAX - i1.QuadPart < (unsigned __int64)i->interval)
 		return (ISC_R_RANGE);
 
+	/* cppcheck-suppress unreadVariable */
 	i1.QuadPart += i->interval;
 
 	t->absolute.dwLowDateTime  = i1.LowPart;
@@ -165,6 +168,7 @@ isc_time_add(const isc_time_t *t, const isc_interval_t *i, isc_time_t *result)
 	if (UINT64_MAX - i1.QuadPart < (unsigned __int64)i->interval)
 		return (ISC_R_RANGE);
 
+	/* cppcheck-suppress unreadVariable */
 	i1.QuadPart += i->interval;
 
 	result->absolute.dwLowDateTime = i1.LowPart;
@@ -186,6 +190,7 @@ isc_time_subtract(const isc_time_t *t, const isc_interval_t *i,
 	if (i1.QuadPart < (unsigned __int64) i->interval)
 		return (ISC_R_RANGE);
 
+	/* cppcheck-suppress unreadVariable */
 	i1.QuadPart -= i->interval;
 
 	result->absolute.dwLowDateTime = i1.LowPart;
@@ -201,9 +206,13 @@ isc_time_microdiff(const isc_time_t *t1, const isc_time_t *t2) {
 
 	REQUIRE(t1 != NULL && t2 != NULL);
 
+	/* cppcheck-suppress unreadVariable */
 	i1.LowPart  = t1->absolute.dwLowDateTime;
+	/* cppcheck-suppress unreadVariable */
 	i1.HighPart = t1->absolute.dwHighDateTime;
+	/* cppcheck-suppress unreadVariable */
 	i2.LowPart  = t2->absolute.dwLowDateTime;
+	/* cppcheck-suppress unreadVariable */
 	i2.HighPart = t2->absolute.dwHighDateTime;
 
 	if (i1.QuadPart <= i2.QuadPart)
@@ -226,9 +235,13 @@ isc_time_seconds(const isc_time_t *t) {
 
 	SystemTimeToFileTime(&epoch1970, &temp);
 
+	/* cppcheck-suppress unreadVariable */
 	i1.LowPart  = t->absolute.dwLowDateTime;
+	/* cppcheck-suppress unreadVariable */
 	i1.HighPart = t->absolute.dwHighDateTime;
+	/* cppcheck-suppress unreadVariable */
 	i2.LowPart  = temp.dwLowDateTime;
+	/* cppcheck-suppress unreadVariable */
 	i2.HighPart = temp.dwHighDateTime;
 
 	i3 = (i1.QuadPart - i2.QuadPart) / 10000000;
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 09877f6952..b6c70e4bc6 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -2602,8 +2602,9 @@ parse_unitstring(char *str, isc_resourcevalue_t *valuep) {
 	default:
 		return (ISC_R_FAILURE);
 	}
-	if (value > UINT64_MAX / unit)
+	if (value > ((uint64_t)UINT64_MAX / unit)) {
 		return (ISC_R_FAILURE);
+	}
 	*valuep = value * unit;
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index 06b5134080..699924c899 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -2222,7 +2222,6 @@ print_symval(cfg_printer_t *pctx, const char *name, cfg_obj_t *obj) {
 
 void
 cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
-	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_clausedef_t * const *clauseset;
 
 	REQUIRE(pctx != NULL);
@@ -2238,6 +2237,7 @@ cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 		for (clause = *clauseset;
 		     clause->name != NULL;
 		     clause++) {
+			isc_result_t result;
 			result = isc_symtab_lookup(obj->value.map.symtab,
 						   clause->name, 0, &symval);
 			if (result == ISC_R_SUCCESS) {
diff --git a/lib/ns/client.c b/lib/ns/client.c
index cac10a4c4d..034b5bbf15 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -543,11 +543,10 @@ exit_check(ns_client_t *client) {
 
 		if (client->nreads > 0) {
 			dns_tcpmsg_cancelread(&client->tcpmsg);
-		}
-
-		/* Still waiting for read cancel completion. */
-		if (client->nreads > 0) {
-			return (true);
+			/* Still waiting for read cancel completion? */
+			if (client->nreads > 0) {
+				return (true);
+			}
 		}
 
 		if (client->tcpmsg_valid) {
@@ -638,22 +637,20 @@ exit_check(ns_client_t *client) {
 		if (client->naccepts > 0) {
 			isc_socket_cancel(client->tcplistener, client->task,
 					  ISC_SOCKCANCEL_ACCEPT);
-		}
-
-		/* Still waiting for accept cancel completion. */
-		if (client->naccepts > 0) {
-			return (true);
+			/* Still waiting for accept cancel completion? */
+			if (client->naccepts > 0) {
+				return (true);
+			}
 		}
 
 		/* Accept cancel is complete. */
 		if (client->nrecvs > 0) {
 			isc_socket_cancel(client->udpsocket, client->task,
 					  ISC_SOCKCANCEL_RECV);
-		}
-
-		/* Still waiting for recv cancel completion. */
-		if (client->nrecvs > 0) {
-			return (true);
+			/* Still waiting for recv cancel completion? */
+			if (client->nrecvs > 0) {
+				return (true);
+			}
 		}
 
 		/* Still waiting for control event to be delivered */
@@ -1071,7 +1068,6 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 	isc_netaddr_t netaddr;
 	int match;
 	unsigned int sockflags = ISC_SOCKFLAG_IMMEDIATE;
-	isc_dscp_t dispdscp = -1;
 
 	if (TCP_CLIENT(client)) {
 		sock = client->tcpsocket;
@@ -1101,9 +1097,10 @@ client_sendpkg(ns_client_t *client, isc_buffer_t *buffer) {
 		pktinfo = NULL;
 
 	if (client->dispatch != NULL) {
-		dispdscp = dns_dispatch_getdscp(client->dispatch);
-		if (dispdscp != -1)
-			client->dscp = dispdscp;
+		isc_dscp_t dscp = dns_dispatch_getdscp(client->dispatch);
+		if (dscp != -1) {
+			client->dscp = dscp;
+		}
 	}
 
 	if (client->dscp == -1) {
@@ -3792,7 +3789,7 @@ get_client(ns_clientmgr_t *manager, ns_interface_t *ifp,
 	ev = &client->ctlevent;
 	isc_task_send(client->task, &ev);
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 static isc_result_t
@@ -3865,7 +3862,7 @@ get_worker(ns_clientmgr_t *manager, ns_interface_t *ifp, isc_socket_t *sock,
 	ev = &client->ctlevent;
 	isc_task_send(client->task, &ev);
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 isc_result_t
@@ -3914,7 +3911,7 @@ ns__clientmgr_getclient(ns_clientmgr_t *manager, ns_interface_t *ifp,
 
 	*clientp = client;
 
-	return (ISC_R_SUCCESS);
+	return (result);
 }
 
 isc_result_t
@@ -4031,6 +4028,8 @@ ns_client_logv(ns_client_t *client, isc_logcategory_t *category,
 	const char *signer = "", *qname = "";
 	dns_name_t *q = NULL;
 
+	REQUIRE(client != NULL);
+
 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
 
 	if (client->signer != NULL) {