diff --git a/CHANGES b/CHANGES
index 4cda9149ae..c6c72b239a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3390.	[bug]		Silence clang compiler warnings. [RT #30417]
+
 3389.	[bug]		Always return NOERROR (not 0) in TSIG. [RT #31275]
 
 3388.	[bug]		Fixed several Coverity warnings. [RT #30996]
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 2f29a7e140..a76bfb35f2 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -2597,7 +2597,7 @@ send_udp(dig_query_t *query) {
 static void
 connect_timeout(isc_task_t *task, isc_event_t *event) {
 	dig_lookup_t *l = NULL;
-	dig_query_t *query = NULL, *cq;
+	dig_query_t *query = NULL, *next, *cq;
 
 	UNUSED(task);
 	REQUIRE(event->ev_type == ISC_TIMEREVENT_IDLE);
@@ -2621,7 +2621,9 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			if (query->sock != NULL)
 				isc_socket_cancel(query->sock, NULL,
 						  ISC_SOCKCANCEL_ALL);
-			send_tcp_connect(ISC_LIST_NEXT(cq, link));
+			next = ISC_LIST_NEXT(cq, link);
+			if (next != NULL)
+				send_tcp_connect(next);
 		}
 		UNLOCK_LOOKUP;
 		return;
@@ -3599,15 +3601,19 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
  */
 void
 do_lookup(dig_lookup_t *lookup) {
+	dig_query_t *query;
 
 	REQUIRE(lookup != NULL);
 
 	debug("do_lookup()");
 	lookup->pending = ISC_TRUE;
-	if (lookup->tcp_mode)
-		send_tcp_connect(ISC_LIST_HEAD(lookup->q));
-	else
-		send_udp(ISC_LIST_HEAD(lookup->q));
+	query = ISC_LIST_HEAD(lookup->q);
+	if (query != NULL) {
+		if (lookup->tcp_mode)
+			send_tcp_connect(query);
+		else
+			send_udp(query);
+	}
 }
 
 /*%
diff --git a/bin/dnssec/dnssec-keyfromlabel.c b/bin/dnssec/dnssec-keyfromlabel.c
index be5323b082..3ad00d7a04 100644
--- a/bin/dnssec/dnssec-keyfromlabel.c
+++ b/bin/dnssec/dnssec-keyfromlabel.c
@@ -365,6 +365,8 @@ main(int argc, char **argv) {
 		fprintf(stderr, "The use of RSA (RSAMD5) is not recommended.\n"
 				"If you still wish to use RSA (RSAMD5) please "
 				"specify \"-a RSAMD5\"\n");
+		if (freeit != NULL)
+			free(freeit);
 		return (1);
 	} else {
 		r.base = algname;
diff --git a/bin/dnssec/dnssec-verify.c b/bin/dnssec/dnssec-verify.c
index f4cf0a27ca..682896cb76 100644
--- a/bin/dnssec/dnssec-verify.c
+++ b/bin/dnssec/dnssec-verify.c
@@ -282,6 +282,9 @@ main(int argc, char *argv[]) {
 	argc -= 1;
 	argv += 1;
 
+	POST(argc);
+	POST(argv);
+
 	if (origin == NULL)
 		origin = file;
 
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index 6ab4e28290..0f987b6579 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -520,14 +520,16 @@ goodsig(dns_name_t *origin, dns_rdata_t *sigrdata, dns_name_t *name,
 	dst_key_t *dstkey = NULL;
 	isc_result_t result;
 
-	dns_rdata_tostruct(sigrdata, &sig, NULL);
+	result = dns_rdata_tostruct(sigrdata, &sig, NULL);
+	check_result(result, "dns_rdata_tostruct()");
 
 	for (result = dns_rdataset_first(keyrdataset);
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(keyrdataset)) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_rdataset_current(keyrdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &key, NULL);
+		result = dns_rdata_tostruct(&rdata, &key, NULL);
+		check_result(result, "dns_rdata_tostruct()");
 		result = dns_dnssec_keyfromrdata(origin, &rdata, mctx,
 						 &dstkey);
 		if (result != ISC_R_SUCCESS)
@@ -821,6 +823,7 @@ innsec3params(dns_rdata_nsec3_t *nsec3, dns_rdataset_t *nsec3paramset) {
 
 		dns_rdataset_current(nsec3paramset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &nsec3param, NULL);
+		check_result(result, "dns_rdata_tostruct()");
 		if (nsec3param.flags == 0 &&
 		    nsec3param.hash == nsec3->hash &&
 		    nsec3param.iterations == nsec3->iterations &&
@@ -1021,7 +1024,8 @@ verifyset(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		dns_rdata_rrsig_t sig;
 
 		dns_rdataset_current(&sigrdataset, &rdata);
-		dns_rdata_tostruct(&rdata, &sig, NULL);
+		result = dns_rdata_tostruct(&rdata, &sig, NULL);
+		check_result(result, "dns_rdata_tostruct()");
 		if (rdataset->ttl != sig.originalttl) {
 			dns_name_format(name, namebuf, sizeof(namebuf));
 			type_format(rdataset->type, typebuf, sizeof(typebuf));
diff --git a/bin/named/client.c b/bin/named/client.c
index e8654cb097..5bec1c858a 100644
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -2416,6 +2416,9 @@ ns_client_replace(ns_client_t *client) {
 
 	CTRACE("replace");
 
+	REQUIRE(client != NULL);
+	REQUIRE(client->manager != NULL);
+
 	result = get_client(client->manager, client->interface,
 			    client->dispatch, TCP_CLIENT(client));
 	if (result != ISC_R_SUCCESS)
diff --git a/bin/named/control.c b/bin/named/control.c
index 8e5cbf60b8..fabe442aab 100644
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -61,7 +61,7 @@ command_compare(const char *text, const char *command) {
 isc_result_t
 ns_control_docommand(isccc_sexpr_t *message, isc_buffer_t *text) {
 	isccc_sexpr_t *data;
-	char *command;
+	char *command = NULL;
 	isc_result_t result;
 	int log_level;
 #ifdef HAVE_LIBSCF
diff --git a/bin/tests/names/dns_name_hash_data b/bin/tests/names/dns_name_hash_data
index 093ba45bbf..bf2fc79e4d 100644
--- a/bin/tests/names/dns_name_hash_data
+++ b/bin/tests/names/dns_name_hash_data
@@ -9,4 +9,4 @@
 #	cishm is 0 if a case insensitive hash of testname1 should match a
 #	case insensitive hash of testname2, otherwise cishm != 0
 #
-a.b.c.d	a.b.c.d.	0	0
+a.b.c.d	A.B.C.D	0	1
diff --git a/bin/tests/names/t_names.c b/bin/tests/names/t_names.c
index d3993c3f64..9420bc047d 100644
--- a/bin/tests/names/t_names.c
+++ b/bin/tests/names/t_names.c
@@ -27,6 +27,7 @@
 #include <isc/string.h>
 
 #include <dns/compress.h>
+#include <dns/fixedname.h>
 #include <dns/name.h>
 #include <dns/result.h>
 
@@ -166,7 +167,7 @@ chkdata(unsigned char *buf, size_t buflen, char *exp_data,
 		else {
 			t_info("bad data at position %lu, "
 			       "got 0x%.2x, expected 0x%.2x\n",
-			       (unsigned long)cnt, *p, *q);
+			       (unsigned long)cnt, *p, *v);
 			result = cnt + 1;
 		}
 		(void)free(data);
@@ -330,40 +331,6 @@ hname_to_tname(char *src, char *target, size_t len) {
 
 #endif	/* NEED_HNAME_TO_TNAME */
 
-/*%
- * initialize a dns_name_t from a text name, hiding all
- * buffer and other object initialization from the caller
- *
- */
-
-static isc_result_t
-dname_from_tname(char *name, dns_name_t *dns_name) {
-	int		len;
-	isc_buffer_t	txtbuf;
-	isc_buffer_t	*binbuf;
-	unsigned char	*junk;
-	isc_result_t	result;
-
-	len = strlen(name);
-	isc_buffer_init(&txtbuf, name, len);
-	isc_buffer_add(&txtbuf, len);
-	junk = (unsigned char *)malloc(sizeof(unsigned char) * BUFLEN);
-	binbuf = (isc_buffer_t *)malloc(sizeof(isc_buffer_t));
-	if ((junk != NULL) && (binbuf != NULL)) {
-		isc_buffer_init(binbuf, junk, BUFLEN);
-		dns_name_init(dns_name, NULL);
-		dns_name_setbuffer(dns_name, binbuf);
-		result = dns_name_fromtext(dns_name,  &txtbuf, NULL, 0, NULL);
-	} else {
-		result = ISC_R_NOSPACE;
-		if (junk != NULL)
-			(void)free(junk);
-		if (binbuf != NULL)
-			(void)free(binbuf);
-	}
-	return (result);
-}
-
 static const char *a3 =	"dns_name_init initializes 'name' to the empty name";
 
 static void
@@ -624,8 +591,10 @@ test_dns_name_hash(char *test_name1, char *test_name2,
 	isc_boolean_t	match;
 	unsigned int	hash1;
 	unsigned int	hash2;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t	fixed1;
+	dns_fixedname_t	fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 	isc_result_t	result;
 
 	rval = T_UNRESOLVED;
@@ -633,12 +602,17 @@ test_dns_name_hash(char *test_name1, char *test_name2,
 
 	t_info("testing names %s and %s\n", test_name1, test_name2);
 
-	result = dname_from_tname(test_name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	result = dns_name_fromstring2(dns_name1, test_name1, NULL, 0, NULL);
 	if (result == ISC_R_SUCCESS) {
-		result = dname_from_tname(test_name2, &dns_name2);
+		result = dns_name_fromstring2(dns_name2, test_name2, NULL,
+					      0, NULL);
 		if (result == ISC_R_SUCCESS) {
-			hash1 = dns_name_hash(&dns_name1, ISC_TRUE);
-			hash2 = dns_name_hash(&dns_name2, ISC_TRUE);
+			hash1 = dns_name_hash(dns_name1, ISC_TRUE);
+			hash2 = dns_name_hash(dns_name2, ISC_TRUE);
 			match = ISC_FALSE;
 			if (hash1 == hash2)
 				match = ISC_TRUE;
@@ -646,8 +620,8 @@ test_dns_name_hash(char *test_name1, char *test_name2,
 				++failures;
 				t_info("hash mismatch when ISC_TRUE\n");
 			}
-			hash1 = dns_name_hash(&dns_name1, ISC_FALSE);
-			hash2 = dns_name_hash(&dns_name2, ISC_FALSE);
+			hash1 = dns_name_hash(dns_name1, ISC_FALSE);
+			hash2 = dns_name_hash(dns_name2, ISC_FALSE);
 			match = ISC_FALSE;
 			if (hash1 == hash2)
 				match = ISC_TRUE;
@@ -660,11 +634,11 @@ test_dns_name_hash(char *test_name1, char *test_name2,
 			else
 				rval = T_FAIL;
 		} else {
-			t_info("dns_fromtext %s failed, result = %s\n",
+			t_info("dns_name_fromstring2 %s failed, result = %s\n",
 				test_name2, dns_result_totext(result));
 		}
 	} else {
-		t_info("dns_fromtext %s failed, result = %s\n",
+		t_info("dns_name_fromstring2 %s failed, result = %s\n",
 				test_name1, dns_result_totext(result));
 	}
 	return (rval);
@@ -766,8 +740,10 @@ test_dns_name_fullcompare(char *name1, char *name2,
 	int		nfails;
 	int		order;
 	unsigned int	nlabels;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 	isc_result_t	dns_result;
 	dns_namereln_t	dns_reln;
 
@@ -778,11 +754,16 @@ test_dns_name_fullcompare(char *name1, char *name2,
 	t_info("testing names %s and %s for relation %s\n", name1, name2,
 	       dns_namereln_to_text(exp_dns_reln));
 
-	dns_result = dname_from_tname(name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, name1, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			dns_reln = dns_name_fullcompare(&dns_name1, &dns_name2,
+			dns_reln = dns_name_fullcompare(dns_name1, dns_name2,
 					&order, &nlabels);
 
 			if (dns_reln != exp_dns_reln) {
@@ -814,11 +795,11 @@ test_dns_name_fullcompare(char *name1, char *name2,
 			else
 				result = T_FAIL;
 		} else {
-			t_info("dname_from_tname failed, result == %s\n",
+			t_info("dns_name_fromstring2 failed, result == %s\n",
 			       dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(result));
 	}
 
@@ -907,8 +888,10 @@ test_dns_name_compare(char *name1, char *name2, int exp_order) {
 	int		result;
 	int		order;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 
 	result = T_UNRESOLVED;
 
@@ -916,11 +899,16 @@ test_dns_name_compare(char *name1, char *name2, int exp_order) {
 	       exp_order == 0 ? "==": (exp_order == -1 ? "<" : ">"),
 	       name2);
 
-	dns_result = dname_from_tname(name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, name1, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			order = dns_name_compare(&dns_name1, &dns_name2);
+			order = dns_name_compare(dns_name1, dns_name2);
 			/*
 			 * Normalize order.
 			 */
@@ -935,11 +923,11 @@ test_dns_name_compare(char *name1, char *name2, int exp_order) {
 			} else
 				result = T_PASS;
 		} else {
-			t_info("dname_from_tname failed, result == %s\n",
+			t_info("dns_name_fromstring2 failed, result == %s\n",
 					dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 				dns_result_totext(result));
 	}
 
@@ -1010,19 +998,26 @@ test_dns_name_rdatacompare(char *name1, char *name2, int exp_order) {
 	int		result;
 	int		order;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 
 	result = T_UNRESOLVED;
 
 	t_info("testing %s %s %s\n", name1,
 	       exp_order == 0 ? "==": (exp_order == -1 ? "<" : ">"), name2);
 
-	dns_result = dname_from_tname(name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, name1, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			order = dns_name_rdatacompare(&dns_name1, &dns_name2);
+			order = dns_name_rdatacompare(dns_name1, dns_name2);
 			/*
 			 * Normalize order.
 			 */
@@ -1037,11 +1032,11 @@ test_dns_name_rdatacompare(char *name1, char *name2, int exp_order) {
 			} else
 				result = T_PASS;
 		} else {
-			t_info("dname_from_tname failed, result == %s\n",
+			t_info("dns_name_fromstring2 failed, result == %s\n",
 			       dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(result));
 	}
 
@@ -1113,19 +1108,26 @@ test_dns_name_issubdomain(char *name1, char *name2, isc_boolean_t exp_rval) {
 	int		result;
 	isc_boolean_t	rval;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 
 	result = T_UNRESOLVED;
 
 	t_info("testing %s %s a subdomain of %s\n", name1,
 	       exp_rval == 0 ? "is not" : "is", name2);
 
-	dns_result = dname_from_tname(name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, name1, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			rval = dns_name_issubdomain(&dns_name1, &dns_name2);
+			rval = dns_name_issubdomain(dns_name1, dns_name2);
 
 			if (rval != exp_rval) {
 				t_info("expected return value of %s, got %s\n",
@@ -1135,11 +1137,11 @@ test_dns_name_issubdomain(char *name1, char *name2, isc_boolean_t exp_rval) {
 			} else
 				result = T_PASS;
 		} else {
-			t_info("dname_from_tname failed, result == %s\n",
+			t_info("dns_name_fromstring2 failed, result == %s\n",
 			       dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(result));
 	}
 
@@ -1206,15 +1208,18 @@ test_dns_name_countlabels(char *test_name, unsigned int exp_nlabels) {
 	int		result;
 	unsigned int	nlabels;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name;
+	dns_fixedname_t	fixed;
+	dns_name_t	*dns_name;
 
 	result = T_UNRESOLVED;
 
 	t_info("testing %s\n", test_name);
 
-	dns_result = dname_from_tname(test_name, &dns_name);
+	dns_fixedname_init(&fixed);
+	dns_name = dns_fixedname_name(&fixed);
+	dns_result = dns_name_fromstring2(dns_name, test_name, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		nlabels = dns_name_countlabels(&dns_name);
+		nlabels = dns_name_countlabels(dns_name);
 
 		if (nlabels != exp_nlabels) {
 			t_info("expected %d, got %d\n", exp_nlabels, nlabels);
@@ -1222,7 +1227,7 @@ test_dns_name_countlabels(char *test_name, unsigned int exp_nlabels) {
 		} else
 			result = T_PASS;
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(dns_result));
 	}
 
@@ -1296,8 +1301,10 @@ test_dns_name_getlabel(char *test_name1, int label1_pos, char *test_name2,
 	unsigned int	cnt;
 	unsigned char	*p;
 	unsigned char	*q;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 	dns_label_t	dns_label1;
 	dns_label_t	dns_label2;
 	isc_result_t	dns_result;
@@ -1307,12 +1314,18 @@ test_dns_name_getlabel(char *test_name1, int label1_pos, char *test_name2,
 
 	t_info("testing with %s and %s\n", test_name1, test_name2);
 
-	dns_result = dname_from_tname(test_name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, test_name1, NULL,
+					  0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(test_name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, test_name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
-			dns_name_getlabel(&dns_name1, label1_pos, &dns_label1);
-			dns_name_getlabel(&dns_name2, label2_pos, &dns_label2);
+			dns_name_getlabel(dns_name1, label1_pos, &dns_label1);
+			dns_name_getlabel(dns_name2, label2_pos, &dns_label2);
 			if (dns_label1.length != dns_label2.length) {
 				t_info("label lengths differ\n");
 				++nfails;
@@ -1331,11 +1344,11 @@ test_dns_name_getlabel(char *test_name1, int label1_pos, char *test_name2,
 			else
 				result = T_FAIL;
 		} else {
-			t_info("dname_from_tname failed, result == %s",
+			t_info("dns_name_fromstring2 failed, result == %s",
 			       dns_result_totext(result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s",
+		t_info("dns_name_fromstring2 failed, result == %s",
 		       dns_result_totext(result));
 	}
 	return (result);
@@ -1409,8 +1422,10 @@ test_dns_name_getlabelsequence(char *test_name1, int label1_start,
 	unsigned int	cnt;
 	unsigned char	*p;
 	unsigned char	*q;
-	dns_name_t	dns_name1;
-	dns_name_t	dns_name2;
+	dns_fixedname_t fixed1;
+	dns_fixedname_t fixed2;
+	dns_name_t	*dns_name1;
+	dns_name_t	*dns_name2;
 	dns_name_t	dns_targetname1;
 	dns_name_t	dns_targetname2;
 	isc_result_t	dns_result;
@@ -1421,16 +1436,22 @@ test_dns_name_getlabelsequence(char *test_name1, int label1_start,
 
 	nfails = 0;
 	result = T_UNRESOLVED;
-	dns_result = dname_from_tname(test_name1, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_fixedname_init(&fixed2);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_name2 = dns_fixedname_name(&fixed2);
+	dns_result = dns_name_fromstring2(dns_name1, test_name1, NULL,
+					  0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
-		dns_result = dname_from_tname(test_name2, &dns_name2);
+		dns_result = dns_name_fromstring2(dns_name2, test_name2, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
 			t_info("testing %s %s\n", test_name1, test_name2);
 			dns_name_init(&dns_targetname1, NULL);
 			dns_name_init(&dns_targetname2, NULL);
-			dns_name_getlabelsequence(&dns_name1, label1_start,
+			dns_name_getlabelsequence(dns_name1, label1_start,
 						  range, &dns_targetname1);
-			dns_name_getlabelsequence(&dns_name2, label2_start,
+			dns_name_getlabelsequence(dns_name2, label2_start,
 						  range, &dns_targetname2);
 
 			/*
@@ -1461,11 +1482,11 @@ test_dns_name_getlabelsequence(char *test_name1, int label1_start,
 			else
 				result = T_FAIL;
 		} else {
-			t_info("dname_from_tname failed, result == %s",
+			t_info("dns_name_fromstring2 failed, result == %s",
 			       dns_result_totext(dns_result));
 		}
 	} else {
-		t_info("dname_from_tname failed, result == %s",
+		t_info("dns_name_fromstring2 failed, result == %s",
 		       dns_result_totext(dns_result));
 	}
 	return (result);
@@ -1532,7 +1553,8 @@ test_dns_name_fromregion(char *test_name) {
 	int		order;
 	unsigned int	nlabels;
 	isc_result_t	dns_result;
-	dns_name_t	dns_name1;
+	dns_fixedname_t fixed1;
+	dns_name_t	*dns_name1;
 	dns_name_t	dns_name2;
 	dns_namereln_t	dns_namereln;
 	isc_region_t	region;
@@ -1541,21 +1563,23 @@ test_dns_name_fromregion(char *test_name) {
 
 	t_info("testing %s\n", test_name);
 
-	dns_result = dname_from_tname(test_name, &dns_name1);
+	dns_fixedname_init(&fixed1);
+	dns_name1 = dns_fixedname_name(&fixed1);
+	dns_result = dns_name_fromstring2(dns_name1, test_name, NULL, 0, NULL);
 	if (dns_result == ISC_R_SUCCESS) {
 
-		dns_name_toregion(&dns_name1, &region);
+		dns_name_toregion(dns_name1, &region);
 
 		dns_name_init(&dns_name2, NULL);
 		dns_name_fromregion(&dns_name2, &region);
-		dns_namereln = dns_name_fullcompare(&dns_name1, &dns_name2,
+		dns_namereln = dns_name_fullcompare(dns_name1, &dns_name2,
 						    &order, &nlabels);
 		if (dns_namereln == dns_namereln_equal)
 			result = T_PASS;
 		else
 			result = T_FAIL;
 	} else {
-		t_info("dname_from_tname failed, result == %s\n",
+		t_info("dns_name_fromstring2 failed, result == %s\n",
 		       dns_result_totext(result));
 	}
 	return (result);
@@ -1982,8 +2006,9 @@ test_dns_name_fromwire(char *datafile_name, int testname_offset, int downcase,
 	char			buf2[BUFLEN];
 	isc_buffer_t		iscbuf1;
 	isc_buffer_t		iscbuf2;
+	dns_fixedname_t		fixed2;
 	dns_name_t		dns_name1;
-	dns_name_t		dns_name2;
+	dns_name_t		*dns_name2;
 	isc_result_t		dns_result;
 	dns_namereln_t		dns_namereln;
 	dns_decompress_t	dctx;
@@ -2004,10 +2029,13 @@ test_dns_name_fromwire(char *datafile_name, int testname_offset, int downcase,
 
 	if ((dns_result == exp_result) && (exp_result == ISC_R_SUCCESS)) {
 
-		dns_result = dname_from_tname(exp_name, &dns_name2);
+		dns_fixedname_init(&fixed2);
+		dns_name2 = dns_fixedname_name(&fixed2);
+		dns_result = dns_name_fromstring2(dns_name2, exp_name, NULL,
+						  0, NULL);
 		if (dns_result == ISC_R_SUCCESS) {
 			dns_namereln = dns_name_fullcompare(&dns_name1,
-							    &dns_name2,
+							    dns_name2,
 							    &order, &nlabels);
 			if (dns_namereln != dns_namereln_equal) {
 				t_info("dns_name_fullcompare  returned %s\n",
diff --git a/bin/tests/rbt/t_rbt.c b/bin/tests/rbt/t_rbt.c
index 9171534f04..38728208aa 100644
--- a/bin/tests/rbt/t_rbt.c
+++ b/bin/tests/rbt/t_rbt.c
@@ -1056,6 +1056,12 @@ t_dns_rbtnodechain_first(char *dbfile, char *expected_firstname,
 	dns_fixedname_t		dns_origin;
 	isc_result_t		expected_result;
 
+	REQUIRE(dbfile != NULL);
+	REQUIRE(expected_firstname != NULL);
+	REQUIRE(expected_firstorigin != NULL);
+	REQUIRE(expected_nextname != NULL);
+	REQUIRE(expected_nextorigin != NULL);
+
 	result = T_UNRESOLVED;
 
 	nfails = 0;
@@ -1247,6 +1253,12 @@ t_dns_rbtnodechain_last(char *dbfile, char *expected_lastname,
 	dns_fixedname_t		dns_origin;
 	isc_result_t		expected_result;
 
+	REQUIRE(dbfile != NULL);
+	REQUIRE(expected_lastname != NULL);
+	REQUIRE(expected_lastorigin != NULL);
+	REQUIRE(expected_prevname != NULL);
+	REQUIRE(expected_prevorigin != NULL);
+
 	result = T_UNRESOLVED;
 
 	nfails = 0;
diff --git a/bin/tests/system/dlzexternal/driver.c b/bin/tests/system/dlzexternal/driver.c
index 6ff6c6004a..dd9dd10925 100644
--- a/bin/tests/system/dlzexternal/driver.c
+++ b/bin/tests/system/dlzexternal/driver.c
@@ -116,7 +116,9 @@ add_name(struct dlz_example_data *state, struct record *list,
 		i = first_empty;
 	}
 	if (i == MAX_RECORDS) {
-		state->log(ISC_LOG_ERROR, "dlz_example: out of record space");
+		if (state->log != NULL)
+			state->log(ISC_LOG_ERROR,
+				   "dlz_example: out of record space");
 		return (ISC_R_FAILURE);
 	}
 	strcpy(list[i].name, name);
@@ -207,7 +209,6 @@ b9_add_helper(struct dlz_example_data *state,
 		state->writeable_zone = (dns_dlz_writeablezone_t *)ptr;
 }
 
-
 /*
  * Called to initialize the driver
  */
@@ -229,18 +230,23 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	/* Fill in the helper functions */
 	va_start(ap, dbdata);
 	while ((helper_name = va_arg(ap, const char *)) != NULL) {
-		b9_add_helper(state, helper_name, va_arg(ap, void*));
+		b9_add_helper(state, helper_name, va_arg(ap, void *));
 	}
 	va_end(ap);
 
 	if (argc < 2) {
-		state->log(ISC_LOG_ERROR,
-			   "dlz_example: please specify a zone name");
+		if (state->log != NULL)
+			state->log(ISC_LOG_ERROR,
+				   "dlz_example: please specify a zone name");
 		dlz_destroy(state);
 		return (ISC_R_FAILURE);
 	}
 
 	state->zone_name = strdup(argv[1]);
+	if (state->zone_name == NULL) {
+		free(state);
+		return (ISC_R_NOMEMORY);
+	}
 
 	sprintf(soa_data, "%s hostmaster.%s 123 900 600 86400 3600",
 		state->zone_name, state->zone_name);
@@ -252,9 +258,9 @@ dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	add_name(state, &state->current[0], state->zone_name,
 		 "a", 1800, "10.53.0.1");
 
-	state->log(ISC_LOG_INFO,
-		   "dlz_example: started for zone %s",
-		   state->zone_name);
+	if (state->log != NULL)
+		state->log(ISC_LOG_INFO, "dlz_example: started for zone %s",
+			   state->zone_name);
 
 	*dbdata = state;
 	return (ISC_R_SUCCESS);
@@ -267,9 +273,10 @@ void
 dlz_destroy(void *dbdata) {
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 
-	state->log(ISC_LOG_INFO,
-		   "dlz_example: shutting down zone %s",
-		   state->zone_name);
+	if (state->log != NULL)
+		state->log(ISC_LOG_INFO,
+			   "dlz_example: shutting down zone %s",
+			   state->zone_name);
 	free(state->zone_name);
 	free(state);
 }
@@ -305,6 +312,9 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
 
 	UNUSED(zone);
 
+	if (state->putrr == NULL)
+		return (ISC_R_NOTIMPLEMENTED);
+
 	if (strcmp(name, "@") == 0)
 		strcpy(full_name, state->zone_name);
 	else
@@ -367,6 +377,9 @@ dlz_allnodes(const char *zone, void *dbdata, dns_sdlzallnodes_t *allnodes) {
 	int i;
 
 	UNUSED(zone);
+	
+	if (state->putnamedrr == NULL)
+		return (ISC_R_NOTIMPLEMENTED);
 
 	for (i = 0; i < MAX_RECORDS; i++) {
 		isc_result_t result;
@@ -393,9 +406,10 @@ dlz_newversion(const char *zone, void *dbdata, void **versionp) {
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 
 	if (state->transaction_started) {
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: transaction already "
-			   "started for zone %s", zone);
+		if (state->log != NULL)
+			state->log(ISC_LOG_INFO,
+				   "dlz_example: transaction already "
+				   "started for zone %s", zone);
 		return (ISC_R_FAILURE);
 	}
 
@@ -415,9 +429,9 @@ dlz_closeversion(const char *zone, isc_boolean_t commit,
 	struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
 
 	if (!state->transaction_started) {
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: transaction not started for zone %s",
-			   zone);
+		if (state->log != NULL)
+			state->log(ISC_LOG_INFO, "dlz_example: transaction not "
+				   "started for zone %s", zone);
 		*versionp = NULL;
 		return;
 	}
@@ -428,9 +442,9 @@ dlz_closeversion(const char *zone, isc_boolean_t commit,
 
 	if (commit) {
 		int i;
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: committing transaction on zone %s",
-			   zone);
+		if (state->log != NULL)
+			state->log(ISC_LOG_INFO, "dlz_example: committing "
+				   "transaction on zone %s", zone);
 		for (i = 0; i < MAX_RECORDS; i++) {
 			if (strlen(state->adds[i].name) > 0U) {
 				add_name(state, &state->current[0],
@@ -450,9 +464,9 @@ dlz_closeversion(const char *zone, isc_boolean_t commit,
 			}
 		}
 	} else {
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: cancelling transaction on zone %s",
-			   zone);
+		if (state->log != NULL)
+			state->log(ISC_LOG_INFO, "dlz_example: cancelling "
+				   "transaction on zone %s", zone);
 	}
 	memset(state->adds, 0, sizeof(state->adds));
 	memset(state->deletes, 0, sizeof(state->deletes));
@@ -468,24 +482,27 @@ dlz_configure(dns_view_t *view, void *dbdata) {
 	isc_result_t result;
 
 
-	state->log(ISC_LOG_INFO, "dlz_example: starting configure");
+	if (state->log != NULL)
+		state->log(ISC_LOG_INFO, "dlz_example: starting configure");
+
 	if (state->writeable_zone == NULL) {
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: no writeable_zone method available");
+		if (state->log != NULL)
+			state->log(ISC_LOG_INFO, "dlz_example: no "
+				   "writeable_zone method available");
 		return (ISC_R_FAILURE);
 	}
 
 	result = state->writeable_zone(view, state->zone_name);
 	if (result != ISC_R_SUCCESS) {
-		state->log(ISC_LOG_ERROR,
-			   "dlz_example: failed to configure zone %s",
-			   state->zone_name);
+		if (state->log != NULL)
+			state->log(ISC_LOG_ERROR, "dlz_example: failed to "
+				   "configure zone %s", state->zone_name);
 		return (result);
 	}
 
-	state->log(ISC_LOG_INFO,
-		   "dlz_example: configured writeable zone %s",
-		   state->zone_name);
+	if (state->log != NULL)
+		state->log(ISC_LOG_INFO, "dlz_example: configured writeable "
+			   "zone %s", state->zone_name);
 	return (ISC_R_SUCCESS);
 }
 
@@ -506,14 +523,14 @@ dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(keydata);
 
 	if (strncmp(name, "deny.", 5) == 0) {
-		state->log(ISC_LOG_INFO,
-			   "dlz_example: denying update of name=%s by %s",
-			   name, signer);
+		if (state->log != NULL)
+			state->log(ISC_LOG_INFO, "dlz_example: denying update "
+				   "of name=%s by %s", name, signer);
 		return (ISC_FALSE);
 	}
-	state->log(ISC_LOG_INFO,
-		   "dlz_example: allowing update of name=%s by %s",
-		   name, signer);
+	if (state->log != NULL)
+		state->log(ISC_LOG_INFO, "dlz_example: allowing update of "
+			   "name=%s by %s", name, signer);
 	return (ISC_TRUE);
 }
 
@@ -580,9 +597,9 @@ dlz_addrdataset(const char *name, const char *rdatastr,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);
 
-	state->log(ISC_LOG_INFO,
-		   "dlz_example: adding rdataset %s '%s'",
-		   name, rdatastr);
+	if (state->log != NULL)
+		state->log(ISC_LOG_INFO, "dlz_example: adding rdataset %s '%s'",
+			   name, rdatastr);
 
 	return (modrdataset(state, name, rdatastr, &state->adds[0]));
 }
@@ -596,9 +613,9 @@ dlz_subrdataset(const char *name, const char *rdatastr,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);
 
-	state->log(ISC_LOG_INFO,
-		   "dlz_example: subtracting rdataset %s '%s'",
-		   name, rdatastr);
+	if (state->log != NULL)
+		state->log(ISC_LOG_INFO, "dlz_example: subtracting rdataset "
+			   "%s '%s'", name, rdatastr);
 
 	return (modrdataset(state, name, rdatastr, &state->deletes[0]));
 }
@@ -613,9 +630,9 @@ dlz_delrdataset(const char *name, const char *type,
 	if (version != (void *) &state->transaction_started)
 		return (ISC_R_FAILURE);
 
-	state->log(ISC_LOG_INFO,
-		   "dlz_example: deleting rdataset %s of type %s",
-		   name, type);
+	if (state->log != NULL)
+		state->log(ISC_LOG_INFO, "dlz_example: deleting rdataset %s "
+			   "of type %s", name, type);
 
 	return (ISC_R_SUCCESS);
 }
diff --git a/bin/tests/system/lwresd/lwtest.c b/bin/tests/system/lwresd/lwtest.c
index 534e9992c0..ed49c69ec8 100644
--- a/bin/tests/system/lwresd/lwtest.c
+++ b/bin/tests/system/lwresd/lwtest.c
@@ -400,7 +400,7 @@ test_gethostbyaddr(const char *address, int af, const char *name) {
 			return;
 		}
 	} else {
-		if (strcmp(hp->h_name, name) != 0) {
+		if (name != NULL && strcmp(hp->h_name, name) != 0) {
 			printf("I:gethostbyname(%s) returned %s, "
 			       "expected %s\n", address, hp->h_name, name);
 			fails++;
@@ -440,7 +440,7 @@ test_getipnodebyaddr(const char *address, int af, const char *name) {
 			return;
 		}
 	} else {
-		if (strcmp(hp->h_name, name) != 0) {
+		if (name != NULL && strcmp(hp->h_name, name) != 0) {
 			printf("I:getipnodebyaddr(%s) returned %s, "
 			       "expected %s\n", address, hp->h_name, name);
 			freehostent(hp);
diff --git a/contrib/dlz/drivers/sdlz_helper.c b/contrib/dlz/drivers/sdlz_helper.c
index 2447d5df09..85ad3b1c75 100644
--- a/contrib/dlz/drivers/sdlz_helper.c
+++ b/contrib/dlz/drivers/sdlz_helper.c
@@ -312,22 +312,18 @@ sdlzh_build_querystring(isc_mem_t *mctx, query_list_t *querylist)
 	if (qs == NULL)
 		return NULL;
 
+	*qs = 0;
 	/* start at the top of the list again */
 	tseg = ISC_LIST_HEAD(*querylist);
-	/* copy the first item in the list to the query string */
-	if (tseg->direct == isc_boolean_true)	/* query segment */
-		strcpy(qs, tseg->sql);
-	else
-		strcpy(qs, * (char**) tseg->sql); /* dynamic segment */
-
-	/* concatonate the rest of the segments */
-	while ((tseg = ISC_LIST_NEXT(tseg, link)) != NULL) {
+	while (tseg != NULL) {
 		if (tseg->direct == isc_boolean_true)
 			/* query segments */
 			strcat(qs, tseg->sql);
 		else
 			/* dynamic segments */
 			strcat(qs, * (char**) tseg->sql);
+		/* get the next segment */
+		tseg = ISC_LIST_NEXT(tseg, link);
 	}
 
 	return qs;
diff --git a/lib/dns/gssapictx.c b/lib/dns/gssapictx.c
index 9702dc5c5c..2c32d8cde2 100644
--- a/lib/dns/gssapictx.c
+++ b/lib/dns/gssapictx.c
@@ -541,7 +541,7 @@ gss_err_message(isc_mem_t *mctx, isc_uint32_t major, isc_uint32_t minor,
 	}
 
 	estr = gss_error_tostring(major, minor, buf, sizeof(buf));
-	if (estr)
+	if (estr != NULL)
 		(*err_message) = isc_mem_strdup(mctx, estr);
 }
 #endif
@@ -597,8 +597,12 @@ dst_gssapi_initctx(dns_name_t *name, isc_buffer_t *intoken,
 
 	if (gret != GSS_S_COMPLETE && gret != GSS_S_CONTINUE_NEEDED) {
 		gss_err_message(mctx, gret, minor, err_message);
-		gss_log(3, "Failure initiating security context: %s",
-			*err_message);
+		if (err_message != NULL && *err_message != NULL)
+			gss_log(3, "Failure initiating security context: %s",
+				*err_message);
+		else
+			gss_log(3, "Failure initiating security context");
+			
 		result = ISC_R_FAILURE;
 		goto out;
 	}
diff --git a/lib/dns/include/dns/name.h b/lib/dns/include/dns/name.h
index bef8693187..ffbc836943 100644
--- a/lib/dns/include/dns/name.h
+++ b/lib/dns/include/dns/name.h
@@ -1299,15 +1299,17 @@ ISC_LANG_ENDDECLS
 
 #define DNS_NAME_INIT(n, o) \
 do { \
-	(n)->magic = DNS_NAME_MAGIC; \
-	(n)->ndata = NULL; \
-	(n)->length = 0; \
-	(n)->labels = 0; \
-	(n)->attributes = 0; \
-	(n)->offsets = (o); \
-	(n)->buffer = NULL; \
-	ISC_LINK_INIT((n), link); \
-	ISC_LIST_INIT((n)->list); \
+	dns_name_t *_n = (n); \
+	/* memset(_n, 0, sizeof(*_n)); */ \
+	_n->magic = DNS_NAME_MAGIC; \
+	_n->ndata = NULL; \
+	_n->length = 0; \
+	_n->labels = 0; \
+	_n->attributes = 0; \
+	_n->offsets = (o); \
+	_n->buffer = NULL; \
+	ISC_LINK_INIT(_n, link); \
+	ISC_LIST_INIT(_n->list); \
 } while (0)
 
 #define DNS_NAME_RESET(n) \
diff --git a/lib/dns/name.c b/lib/dns/name.c
index fab1f33458..97a7a6293c 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -584,11 +584,13 @@ dns_name_fullcompare(const dns_name_t *name1, const dns_name_t *name2,
 	nlabels = 0;
 	l1 = name1->labels;
 	l2 = name2->labels;
-	ldiff = (int)l1 - (int)l2;
-	if (ldiff < 0)
+	if (l2 > l1) {
 		l = l1;
-	else
+		ldiff = 0 - (l2 - l1);
+	} else {
 		l = l2;
+		ldiff = l1 - l2;
+	}
 
 	while (l > 0) {
 		l--;
@@ -2240,6 +2242,7 @@ dns_name_digest(dns_name_t *name, dns_digestfunc_t digest, void *arg) {
 	REQUIRE(digest != NULL);
 
 	DNS_NAME_INIT(&downname, NULL);
+
 	isc_buffer_init(&buffer, data, sizeof(data));
 
 	result = dns_name_downcase(name, &downname, &buffer);
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index b80a0c7e53..116f4ac99c 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -6357,7 +6357,8 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader,
 cleanup:
 	dns_rdataset_disassociate(&neg);
 	dns_rdataset_disassociate(&negsig);
-	free_noqname(mctx, &noqname);
+	if (noqname != NULL)
+		free_noqname(mctx, &noqname);
 	return(result);
 }
 
diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
index 0486a722c7..acfa5e4a54 100644
--- a/lib/dns/spnego.c
+++ b/lib/dns/spnego.c
@@ -846,10 +846,13 @@ der_get_octet_string(const unsigned char *p, size_t len,
 		     octet_string *data, size_t *size)
 {
 	data->length = len;
-	data->data = malloc(len);
-	if (data->data == NULL && data->length != 0U)
-		return (ENOMEM);
-	memcpy(data->data, p, len);
+	if (len != 0) {
+		data->data = malloc(len);
+		if (data->data == NULL)
+			return (ENOMEM);
+		memcpy(data->data, p, len);
+	} else
+		data->data = NULL;
 	if (size)
 		*size = len;
 	return (0);
diff --git a/lib/isc/tests/parse_test.c b/lib/isc/tests/parse_test.c
index e6333d3c89..010768b07a 100644
--- a/lib/isc/tests/parse_test.c
+++ b/lib/isc/tests/parse_test.c
@@ -45,6 +45,7 @@ ATF_TC_BODY(parse_overflow, tc) {
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	result = isc_parse_uint32(&output, "1234567890", 10);
+	ATF_CHECK_EQ(ISC_R_SUCCESS, result);
 	ATF_CHECK_EQ(1234567890, output);
 
 	result = isc_parse_uint32(&output, "123456789012345", 10);
diff --git a/lib/isccc/cc.c b/lib/isccc/cc.c
index e4998a2413..07f8157b0a 100644
--- a/lib/isccc/cc.c
+++ b/lib/isccc/cc.c
@@ -610,7 +610,7 @@ isc_result_t
 isccc_cc_createresponse(isccc_sexpr_t *message, isccc_time_t now,
 		      isccc_time_t expires, isccc_sexpr_t **alistp)
 {
-	char *_frm, *_to, *type;
+	char *_frm, *_to, *type = NULL;
 	isc_uint32_t serial;
 	isccc_sexpr_t *alist, *_ctrl, *_data;
 	isc_result_t result;
@@ -700,6 +700,8 @@ isccc_cc_lookupstring(isccc_sexpr_t *alist, const char *key, char **strp)
 {
 	isccc_sexpr_t *kv, *v;
 
+	REQUIRE(strp == NULL || *strp == NULL);
+
 	kv = isccc_alist_assq(alist, key);
 	if (kv != NULL) {
 		v = ISCCC_SEXPR_CDR(kv);
@@ -798,7 +800,7 @@ isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message,
 {
 	const char *_frm;
 	const char *_to;
-	char *_ser, *_tim, *tmp;
+	char *_ser = NULL, *_tim = NULL, *tmp;
 	isc_result_t result;
 	char *key;
 	size_t len;
@@ -810,13 +812,19 @@ isccc_cc_checkdup(isccc_symtab_t *symtab, isccc_sexpr_t *message,
 	    isccc_cc_lookupstring(_ctrl, "_ser", &_ser) != ISC_R_SUCCESS ||
 	    isccc_cc_lookupstring(_ctrl, "_tim", &_tim) != ISC_R_SUCCESS)
 		return (ISC_R_FAILURE);
+
+	INSIST(_ser != NULL);
+	INSIST(_tim != NULL);
+
 	/*
 	 * _frm and _to are optional.
 	 */
+	tmp = NULL;
 	if (isccc_cc_lookupstring(_ctrl, "_frm", &tmp) != ISC_R_SUCCESS)
 		_frm = "";
 	else
 		_frm = tmp;
+	tmp = NULL;
 	if (isccc_cc_lookupstring(_ctrl, "_to", &tmp) != ISC_R_SUCCESS)
 		_to = "";
 	else
diff --git a/lib/lwres/getaddrinfo.c b/lib/lwres/getaddrinfo.c
index 811a2fee5e..7d5f2fb04c 100644
--- a/lib/lwres/getaddrinfo.c
+++ b/lib/lwres/getaddrinfo.c
@@ -573,10 +573,8 @@ add_ipv4(const char *hostname, int flags, struct addrinfo **aip,
 	(void) lwres_conf_parse(lwrctx, lwres_resolv_conf);
 	if (hostname == NULL && (flags & AI_PASSIVE) == 0) {
 		ai = ai_clone(*aip, AF_INET);
-		if (ai == NULL) {
-			lwres_freeaddrinfo(*aip);
+		if (ai == NULL)
 			SETERROR(EAI_MEMORY);
-		}
 
 		*aip = ai;
 		ai->ai_socktype = socktype;
@@ -594,10 +592,8 @@ add_ipv4(const char *hostname, int flags, struct addrinfo **aip,
 		addr = LWRES_LIST_HEAD(by->addrs);
 		while (addr != NULL) {
 			ai = ai_clone(*aip, AF_INET);
-			if (ai == NULL) {
-				lwres_freeaddrinfo(*aip);
+			if (ai == NULL)
 				SETERROR(EAI_MEMORY);
-			}
 			*aip = ai;
 			ai->ai_socktype = socktype;
 			SIN(ai->ai_addr)->sin_port = port;
@@ -641,10 +637,8 @@ add_ipv6(const char *hostname, int flags, struct addrinfo **aip,
 
 	if (hostname == NULL && (flags & AI_PASSIVE) == 0) {
 		ai = ai_clone(*aip, AF_INET6);
-		if (ai == NULL) {
-			lwres_freeaddrinfo(*aip);
+		if (ai == NULL)
 			SETERROR(EAI_MEMORY);
-		}
 
 		*aip = ai;
 		ai->ai_socktype = socktype;
@@ -662,10 +656,8 @@ add_ipv6(const char *hostname, int flags, struct addrinfo **aip,
 		addr = LWRES_LIST_HEAD(by->addrs);
 		while (addr != NULL) {
 			ai = ai_clone(*aip, AF_INET6);
-			if (ai == NULL) {
-				lwres_freeaddrinfo(*aip);
+			if (ai == NULL)
 				SETERROR(EAI_MEMORY);
-			}
 			*aip = ai;
 			ai->ai_socktype = socktype;
 			SIN6(ai->ai_addr)->sin6_port = port;
diff --git a/lib/lwres/getipnode.c b/lib/lwres/getipnode.c
index 3b82c700cc..517f5b42f9 100644
--- a/lib/lwres/getipnode.c
+++ b/lib/lwres/getipnode.c
@@ -466,6 +466,9 @@ lwres_freehostent(struct hostent *he) {
 	int names = 1;
 	int addresses = 1;
 
+	if (he == NULL)
+		return;
+
 	free(he->h_name);
 
 	cpp = he->h_addr_list;
diff --git a/lib/lwres/getrrset.c b/lib/lwres/getrrset.c
index d8b6cc3fd9..bcc307460f 100644
--- a/lib/lwres/getrrset.c
+++ b/lib/lwres/getrrset.c
@@ -271,18 +271,22 @@ lwres_getrrsetbyname(const char *hostname, unsigned int rdclass,
 void
 lwres_freerrset(struct rrsetinfo *rrset) {
 	unsigned int i;
-	for (i = 0; i < rrset->rri_nrdatas; i++) {
-		if (rrset->rri_rdatas[i].rdi_data == NULL)
-			break;
-		free(rrset->rri_rdatas[i].rdi_data);
+	if (rrset->rri_rdatas != NULL) {
+		for (i = 0; i < rrset->rri_nrdatas; i++) {
+			if (rrset->rri_rdatas[i].rdi_data == NULL)
+				break;
+			free(rrset->rri_rdatas[i].rdi_data);
+		}
+		free(rrset->rri_rdatas);
 	}
-	free(rrset->rri_rdatas);
-	for (i = 0; i < rrset->rri_nsigs; i++) {
-		if (rrset->rri_sigs[i].rdi_data == NULL)
-			break;
-		free(rrset->rri_sigs[i].rdi_data);
+	if (rrset->rri_sigs != NULL) {
+		for (i = 0; i < rrset->rri_nsigs; i++) {
+			if (rrset->rri_sigs[i].rdi_data == NULL)
+				break;
+			free(rrset->rri_sigs[i].rdi_data);
+		}
+		free(rrset->rri_sigs);
 	}
-	free(rrset->rri_sigs);
 	free(rrset->rri_name);
 	free(rrset);
 }