diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 000000000..ecee84aa4
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,12 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+custom: ['https://nlnetlabs.nl/funding/']
diff --git a/daemon/worker.c b/daemon/worker.c
index 39fe9b078..99026cb57 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -604,8 +604,7 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo,
 
 		if(worker->stats.extended && actinfo.rpz_used) {
 			if(actinfo.rpz_disabled)
-				worker->stats.rpz_action[RPZ_DISABLED_ACTION] +=
-					actinfo.rpz_disabled;
+				worker->stats.rpz_action[RPZ_DISABLED_ACTION]++;
 			if(actinfo.rpz_cname_override)
 				worker->stats.rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
 			else
diff --git a/doc/Changelog b/doc/Changelog
index 5640c44f7..99ebfcb04 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+-3 February 2020: Ralph
+	- Add assertion to please static analyzer
+
 31 January 2020: Wouter
 	- Fix fclose on error in TLS session ticket code.
 
diff --git a/respip/respip.c b/respip/respip.c
index 7147a051c..ec7026add 100644
--- a/respip/respip.c
+++ b/respip/respip.c
@@ -913,6 +913,8 @@ respip_rewrite_reply(const struct query_info* qinfo,
 	view = cinfo->view;
 	ipset = cinfo->respip_set;
 
+	log_assert(ipset);
+
 	/** Try to use response-ip config from the view first; use
 	  * global response-ip config if we don't have the view or we don't
 	  * have the matching per-view config (and the view allows the use
@@ -936,7 +938,7 @@ respip_rewrite_reply(const struct query_info* qinfo,
 		if(!raddr && !view->isfirst)
 			goto done;
 	}
-	if(!raddr && ipset && (raddr = respip_addr_lookup(rep, ipset,
+	if(!raddr && (raddr = respip_addr_lookup(rep, ipset,
 		&rrset_id))) {
 		action = (enum respip_action)local_data_find_tag_action(
 			raddr->taglist, raddr->taglen, ctaglist, ctaglen,
@@ -950,8 +952,6 @@ respip_rewrite_reply(const struct query_info* qinfo,
 			r->taglistlen, ctaglist, ctaglen)) {
 			if((raddr = respip_addr_lookup(rep,
 				r->respip_set, &rrset_id))) {
-			}
-			if(raddr) {
 				if(!respip_use_rpz(raddr, r, &action, &data,
 					&rpz_log, &log_name, &rpz_cname_override,
 					region, &rpz_used)) {
diff --git a/services/mesh.c b/services/mesh.c
index 039eab53a..61127c845 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1191,8 +1191,7 @@ void mesh_query_done(struct mesh_state* mstate)
 			if(mstate->s.env->cfg->stat_extended &&
 				mstate->s.respip_action_info->rpz_used) {
 				if(mstate->s.respip_action_info->rpz_disabled)
-					mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION] +=
-						mstate->s.respip_action_info->rpz_disabled;
+					mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION]++;
 				if(mstate->s.respip_action_info->rpz_cname_override)
 					mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
 				else