diff --git a/src/core/execute.c b/src/core/execute.c
index d27adbbba54..e5c80fb183a 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -3202,11 +3202,16 @@ static int apply_mount_namespace(
 
         if (MANAGER_IS_SYSTEM(u->manager)) {
                 propagate_dir = path_join("/run/systemd/propagate/", u->id);
-                if (!propagate_dir)
-                        return -ENOMEM;
+                if (!propagate_dir) {
+                        r = -ENOMEM;
+                        goto finalize;
+                }
+
                 incoming_dir = strdup("/run/systemd/incoming");
-                if (!incoming_dir)
-                        return -ENOMEM;
+                if (!incoming_dir) {
+                        r = -ENOMEM;
+                        goto finalize;
+                }
         }
 
         r = setup_namespace(root_dir, root_image, context->root_image_options,
diff --git a/src/libsystemd-network/icmp6-util.c b/src/libsystemd-network/icmp6-util.c
index d079ad40e99..67c6b55d841 100644
--- a/src/libsystemd-network/icmp6-util.c
+++ b/src/libsystemd-network/icmp6-util.c
@@ -162,7 +162,7 @@ int icmp6_receive(int fd, void *buffer, size_t size, struct in6_addr *ret_dst,
         };
         struct cmsghdr *cmsg;
         struct in6_addr addr = {};
-        triple_timestamp t;
+        triple_timestamp t = {};
         ssize_t len;
 
         iov = IOVEC_MAKE(buffer, size);
diff --git a/src/resolve/resolved-dns-transaction.c b/src/resolve/resolved-dns-transaction.c
index e3370123513..590652e5d35 100644
--- a/src/resolve/resolved-dns-transaction.c
+++ b/src/resolve/resolved-dns-transaction.c
@@ -121,10 +121,10 @@ DnsTransaction* dns_transaction_free(DnsTransaction *t) {
                 }
 
                 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
-        }
 
-        if (t->id != 0)
-                hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
+                if (t->id != 0)
+                        hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
+        }
 
         while ((c = set_steal_first(t->notify_query_candidates)))
                 set_remove(c->transactions, t);
diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
index ae46d2dcd85..34a9ce9711b 100644
--- a/src/resolve/resolved-manager.c
+++ b/src/resolve/resolved-manager.c
@@ -548,7 +548,13 @@ static int manager_watch_hostname(Manager *m) {
 
         r = determine_hostname(&m->full_hostname, &m->llmnr_hostname, &m->mdns_hostname);
         if (r < 0) {
-                log_info("Defaulting to hostname '%s'.", fallback_hostname());
+                _cleanup_free_ char *d = NULL;
+
+                d = fallback_hostname();
+                if (!d)
+                        return log_oom();
+
+                log_info("Defaulting to hostname '%s'.", d);
 
                 r = make_fallback_hostnames(&m->full_hostname, &m->llmnr_hostname, &m->mdns_hostname);
                 if (r < 0)
diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index 791d747136e..6ad68584e5d 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -2280,8 +2280,11 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
                 log_debug("No image name available, will skip extension-release metadata");
 
         for (; n_meta_initialized < _META_MAX; n_meta_initialized ++) {
-                if (!paths[n_meta_initialized])
+                if (!paths[n_meta_initialized]) {
+                        fds[2*n_meta_initialized] = fds[2*n_meta_initialized+1] = -1;
                         continue;
+                }
+
                 if (pipe2(fds + 2*n_meta_initialized, O_CLOEXEC) < 0) {
                         r = -errno;
                         goto finish;
@@ -2435,11 +2438,8 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
         strv_free_and_replace(m->extension_release, extension_release);
 
 finish:
-        for (k = 0; k < n_meta_initialized; k++) {
-                if (!paths[k])
-                        continue;
+        for (k = 0; k < n_meta_initialized; k++)
                 safe_close_pair(fds + 2*k);
-        }
 
         return r;
 }
diff --git a/src/shared/serialize.c b/src/shared/serialize.c
index 42fe5db3faf..23aac3ef527 100644
--- a/src/shared/serialize.c
+++ b/src/shared/serialize.c
@@ -175,7 +175,7 @@ int deserialize_dual_timestamp(const char *value, dual_timestamp *t) {
 }
 
 int deserialize_environment(const char *value, char ***list) {
-        char *unescaped;
+        _cleanup_free_ char *unescaped = NULL;
         int r;
 
         assert(value);
@@ -187,9 +187,10 @@ int deserialize_environment(const char *value, char ***list) {
         if (r < 0)
                 return log_error_errno(r, "Failed to unescape: %m");
 
-        r = strv_env_replace_consume(list, unescaped);
+        r = strv_env_replace_consume(list, TAKE_PTR(unescaped));
         if (r < 0)
                 return log_error_errno(r, "Failed to append environment variable: %m");
+
         return 0;
 }