diff --git a/src/basic/memory-util.h b/src/basic/memory-util.h
index 915c24a5dd..0e8957b783 100644
--- a/src/basic/memory-util.h
+++ b/src/basic/memory-util.h
@@ -37,8 +37,8 @@ static inline int memcmp_nn(const void *s1, size_t n1, const void *s2, size_t n2
 #define memzero(x,l)                                            \
         ({                                                      \
                 size_t _l_ = (l);                               \
-                void *_x_ = (x);                                \
-                _l_ == 0 ? _x_ : memset(_x_, 0, _l_);           \
+                if (_l_ > 0)                                    \
+                        memset(x, 0, _l_);                      \
         })
 
 #define zero(x) (memzero(&(x), sizeof(x)))
diff --git a/src/journal/sd-journal.c b/src/journal/sd-journal.c
index 82e7d59fbb..40baf2b374 100644
--- a/src/journal/sd-journal.c
+++ b/src/journal/sd-journal.c
@@ -1734,7 +1734,7 @@ static void remove_directory(sd_journal *j, Directory *d) {
                 hashmap_remove(j->directories_by_wd, INT_TO_PTR(d->wd));
 
                 if (j->inotify_fd >= 0)
-                        inotify_rm_watch(j->inotify_fd, d->wd);
+                        (void) inotify_rm_watch(j->inotify_fd, d->wd);
         }
 
         hashmap_remove(j->directories_by_path, d->path);
diff --git a/src/network/netdev/macsec.c b/src/network/netdev/macsec.c
index 740d885339..a4967e817b 100644
--- a/src/network/netdev/macsec.c
+++ b/src/network/netdev/macsec.c
@@ -852,15 +852,13 @@ int config_parse_macsec_key_id(
 
         r = unhexmem(rvalue, strlen(rvalue), &p, &l);
         if (r < 0) {
-                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse key id. Ignoring assignment: %s", rvalue);
-                return 0;
-        }
-        if (l > MACSEC_KEYID_LEN) {
-                log_syntax(unit, LOG_ERR, filename, line, 0,
-                           "The size of key id is too large (%zu), maximum of %zu permitted. "
-                           "Ignoring assignment: %s", l, (size_t) MACSEC_KEYID_LEN, rvalue);
+                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse KeyId \"%s\": %m", rvalue);
                 return 0;
         }
+        if (l > MACSEC_KEYID_LEN)
+                return log_syntax(unit, LOG_ERR, filename, line, 0,
+                                  "Specified KeyId is larger then the allowed maximum (%zu > %u), ignoring: %s",
+                                  l, MACSEC_KEYID_LEN, rvalue);
 
         dest = a ? a->sa.key_id : b->sa.key_id;
         memcpy_safe(dest, p, l);
diff --git a/src/network/networkd-link.c b/src/network/networkd-link.c
index 9486329b9a..6613992a09 100644
--- a/src/network/networkd-link.c
+++ b/src/network/networkd-link.c
@@ -965,7 +965,8 @@ void link_check_ready(Link *link) {
                 return;
 
         if ((link_dhcp4_enabled(link) || link_dhcp6_enabled(link)) &&
-            !(link->dhcp4_configured || link->dhcp6_configured) &&
+            !link->dhcp4_configured &&
+            !link->dhcp6_configured &&
             !(link_ipv4ll_enabled(link, ADDRESS_FAMILY_FALLBACK_IPV4) && link->ipv4ll_address && link->ipv4ll_route))
                 /* When DHCP is enabled, at least one protocol must provide an address, or
                  * an IPv4ll fallback address must be configured. */
diff --git a/src/shared/json.c b/src/shared/json.c
index 782d80af16..baea31fed9 100644
--- a/src/shared/json.c
+++ b/src/shared/json.c
@@ -1555,6 +1555,9 @@ int json_variant_format(JsonVariant *v, JsonFormatFlags flags, char **ret) {
         size_t sz = 0;
         int r;
 
+        /* Returns the length of the generated string (without the terminating NUL),
+         * or negative on error. */
+
         assert_return(v, -EINVAL);
         assert_return(ret, -EINVAL);
 
@@ -1567,6 +1570,9 @@ int json_variant_format(JsonVariant *v, JsonFormatFlags flags, char **ret) {
 
                 json_variant_dump(v, flags, f, NULL);
 
+                /* Add terminating 0, so that the output buffer is a valid string. */
+                fputc('\0', f);
+
                 r = fflush_and_check(f);
         }
         if (r < 0)
@@ -1574,8 +1580,8 @@ int json_variant_format(JsonVariant *v, JsonFormatFlags flags, char **ret) {
 
         assert(s);
         *ret = TAKE_PTR(s);
-
-        return (int) sz;
+        assert(sz > 0);
+        return (int) sz - 1;
 }
 
 void json_variant_dump(JsonVariant *v, JsonFormatFlags flags, FILE *f, const char *prefix) {
diff --git a/src/shared/varlink.c b/src/shared/varlink.c
index 3256a93490..dea8e4363f 100644
--- a/src/shared/varlink.c
+++ b/src/shared/varlink.c
@@ -246,8 +246,7 @@ static int varlink_new(Varlink **ret) {
 
         assert(ret);
 
-        /* Here use new0 as the below structured initializer is nested. */
-        v = new0(Varlink, 1);
+        v = new(Varlink, 1);
         if (!v)
                 return -ENOMEM;
 
@@ -1212,6 +1211,7 @@ static int varlink_enqueue_json(Varlink *v, JsonVariant *m) {
         r = json_variant_format(m, 0, &text);
         if (r < 0)
                 return r;
+        assert(text[r] == '\0');
 
         if (v->output_buffer_size + r + 1 > VARLINK_BUFFER_MAX)
                 return -ENOBUFS;
@@ -2304,7 +2304,7 @@ int varlink_server_bind_method(VarlinkServer *s, const char *method, VarlinkMeth
 
 int varlink_server_bind_method_many_internal(VarlinkServer *s, ...) {
         va_list ap;
-        int r;
+        int r = 0;
 
         assert_return(s, -EINVAL);
 
@@ -2321,10 +2321,11 @@ int varlink_server_bind_method_many_internal(VarlinkServer *s, ...) {
 
                 r = varlink_server_bind_method(s, method, callback);
                 if (r < 0)
-                        return r;
+                        break;
         }
+        va_end(ap);
 
-        return 0;
+        return r;
 }
 
 int varlink_server_bind_connect(VarlinkServer *s, VarlinkConnect callback) {
diff --git a/src/test/test-json.c b/src/test/test-json.c
index 8bd6a7221c..a6613043b9 100644
--- a/src/test/test-json.c
+++ b/src/test/test-json.c
@@ -89,6 +89,7 @@ static void test_variant(const char *data, Test test) {
         r = json_variant_format(v, 0, &s);
         assert_se(r >= 0);
         assert_se(s);
+        assert_se((size_t) r == strlen(s));
 
         log_info("formatted normally: %s\n", s);
 
@@ -105,6 +106,7 @@ static void test_variant(const char *data, Test test) {
         r = json_variant_format(v, JSON_FORMAT_PRETTY, &s);
         assert_se(r >= 0);
         assert_se(s);
+        assert_se((size_t) r == strlen(s));
 
         log_info("formatted prettily:\n%s", s);
 
@@ -120,12 +122,14 @@ static void test_variant(const char *data, Test test) {
         r = json_variant_format(v, JSON_FORMAT_COLOR, &s);
         assert_se(r >= 0);
         assert_se(s);
+        assert_se((size_t) r == strlen(s));
         printf("Normal with color: %s\n", s);
 
         s = mfree(s);
         r = json_variant_format(v, JSON_FORMAT_COLOR|JSON_FORMAT_PRETTY, &s);
         assert_se(r >= 0);
         assert_se(s);
+        assert_se((size_t) r == strlen(s));
         printf("Pretty with color:\n%s\n", s);
 
         if (test)
diff --git a/src/test/test-user-util.c b/src/test/test-user-util.c
index 1a507bc00a..fd7878fde2 100644
--- a/src/test/test-user-util.c
+++ b/src/test/test-user-util.c
@@ -191,6 +191,20 @@ static void test_get_group_creds_one(const char *id, const char *name, gid_t gid
         assert_se(rgid == gid);
 }
 
+static void test_make_salt(void) {
+        log_info("/* %s */", __func__);
+
+        _cleanup_free_ char *s, *t;
+
+        assert_se(make_salt(&s) == 0);
+        log_info("got %s", s);
+
+        assert_se(make_salt(&t) == 0);
+        log_info("got %s", t);
+
+        assert(!streq(s, t));
+}
+
 int main(int argc, char *argv[]) {
         test_uid_to_name_one(0, "root");
         test_uid_to_name_one(UID_NOBODY, NOBODY_USER_NAME);
@@ -221,5 +235,7 @@ int main(int argc, char *argv[]) {
         test_valid_gecos();
         test_valid_home();
 
+        test_make_salt();
+
         return 0;
 }