diff --git a/bgpd/bgp_fsm.c b/bgpd/bgp_fsm.c
index cdd9b7ae4d51..567af5bb7577 100644
--- a/bgpd/bgp_fsm.c
+++ b/bgpd/bgp_fsm.c
@@ -2776,99 +2776,72 @@ int bgp_gr_update_all(struct bgp *bgp, enum global_gr_command global_gr_cmd)
 
 const char *print_peer_gr_mode(enum peer_mode pr_mode)
 {
-	const char *peer_gr_mode = NULL;
-
 	switch (pr_mode) {
 	case PEER_HELPER:
-		peer_gr_mode = "PEER_HELPER";
-		break;
+		return "PEER_HELPER";
 	case PEER_GR:
-		peer_gr_mode = "PEER_GR";
-		break;
+		return "PEER_GR";
 	case PEER_DISABLE:
-		peer_gr_mode = "PEER_DISABLE";
-		break;
+		return "PEER_DISABLE";
 	case PEER_INVALID:
-		peer_gr_mode = "PEER_INVALID";
-		break;
+		return "PEER_INVALID";
 	case PEER_GLOBAL_INHERIT:
-		peer_gr_mode = "PEER_GLOBAL_INHERIT";
-		break;
+		return "PEER_GLOBAL_INHERIT";
 	}
 
-	return peer_gr_mode;
+	return NULL;
 }
 
 const char *print_peer_gr_cmd(enum peer_gr_command pr_gr_cmd)
 {
-	const char *peer_gr_cmd = NULL;
-
 	switch (pr_gr_cmd) {
 	case PEER_GR_CMD:
-		peer_gr_cmd = "PEER_GR_CMD";
-		break;
+		return "PEER_GR_CMD";
 	case NO_PEER_GR_CMD:
-		peer_gr_cmd = "NO_PEER_GR_CMD";
-		break;
+		return "NO_PEER_GR_CMD";
 	case PEER_DISABLE_CMD:
-		peer_gr_cmd = "PEER_DISABLE_GR_CMD";
-		break;
+		return "PEER_DISABLE_GR_CMD";
 	case NO_PEER_DISABLE_CMD:
-		peer_gr_cmd = "NO_PEER_DISABLE_GR_CMD";
-		break;
+		return "NO_PEER_DISABLE_GR_CMD";
 	case PEER_HELPER_CMD:
-		peer_gr_cmd = "PEER_HELPER_CMD";
-		break;
+		return "PEER_HELPER_CMD";
 	case NO_PEER_HELPER_CMD:
-		peer_gr_cmd = "NO_PEER_HELPER_CMD";
-		break;
+		return "NO_PEER_HELPER_CMD";
 	}
 
-	return peer_gr_cmd;
+	return NULL;
 }
 
 const char *print_global_gr_mode(enum global_mode gl_mode)
 {
-	const char *global_gr_mode = "???";
-
 	switch (gl_mode) {
 	case GLOBAL_HELPER:
-		global_gr_mode = "GLOBAL_HELPER";
-		break;
+		return "GLOBAL_HELPER";
 	case GLOBAL_GR:
-		global_gr_mode = "GLOBAL_GR";
-		break;
+		return "GLOBAL_GR";
 	case GLOBAL_DISABLE:
-		global_gr_mode = "GLOBAL_DISABLE";
-		break;
+		return "GLOBAL_DISABLE";
 	case GLOBAL_INVALID:
-		global_gr_mode = "GLOBAL_INVALID";
-		break;
+		return "GLOBAL_INVALID";
 	}
 
-	return global_gr_mode;
+	return "???";
 }
 
 const char *print_global_gr_cmd(enum global_gr_command gl_gr_cmd)
 {
-	const char *global_gr_cmd = NULL;
-
 	switch (gl_gr_cmd) {
 	case GLOBAL_GR_CMD:
-		global_gr_cmd = "GLOBAL_GR_CMD";
-		break;
+		return "GLOBAL_GR_CMD";
 	case NO_GLOBAL_GR_CMD:
-		global_gr_cmd = "NO_GLOBAL_GR_CMD";
-		break;
+		return "NO_GLOBAL_GR_CMD";
 	case GLOBAL_DISABLE_CMD:
-		global_gr_cmd = "GLOBAL_DISABLE_CMD";
-		break;
+		return "GLOBAL_DISABLE_CMD";
 	case NO_GLOBAL_DISABLE_CMD:
-		global_gr_cmd = "NO_GLOBAL_DISABLE_CMD";
-		break;
+		return "NO_GLOBAL_DISABLE_CMD";
 	}
 
-	return global_gr_cmd;
+	return NULL;
 }
 
 enum global_mode bgp_global_gr_mode_get(struct bgp *bgp)
diff --git a/bgpd/bgp_io.c b/bgpd/bgp_io.c
index b07e69ac31bb..9e9251c85459 100644
--- a/bgpd/bgp_io.c
+++ b/bgpd/bgp_io.c
@@ -512,7 +512,13 @@ static uint16_t bgp_read(struct peer_connection *connection, int *code_p)
 
 	readsize = MIN(ibuf_work_space, sizeof(ibuf_scratch));
 
+#ifdef __clang_analyzer__
+	/* clang-SA doesn't want you to call read() while holding a mutex */
+	(void)readsize;
+	nbytes = 0;
+#else
 	nbytes = read(connection->fd, ibuf_scratch, readsize);
+#endif
 
 	/* EAGAIN or EWOULDBLOCK; come back later */
 	if (nbytes < 0 && ERRNO_IO_RETRY(errno)) {
diff --git a/ldpd/ldpe.c b/ldpd/ldpe.c
index 6e844c0aa18d..0a3a03bc38de 100644
--- a/ldpd/ldpe.c
+++ b/ldpd/ldpe.c
@@ -459,6 +459,8 @@ static void ldpe_dispatch_main(struct event *thread)
 			tnbr_update_all(AF_UNSPEC);
 			break;
 		case IMSG_RECONF_CONF:
+			if (nconf)
+				ldp_clear_config(nconf);
 			if ((nconf = malloc(sizeof(struct ldpd_conf))) == NULL)
 				fatal(NULL);
 			memcpy(nconf, imsg.data, sizeof(struct ldpd_conf));
diff --git a/lib/defun_lex.l b/lib/defun_lex.l
index 3104e48063b5..9528e448521a 100644
--- a/lib/defun_lex.l
+++ b/lib/defun_lex.l
@@ -157,6 +157,9 @@ SPECIAL		[(),]
 
 %%
 
+#else
+extern int def_yylex(void);
+extern int def_yylex_destroy(void);
 #endif /* __clang_analyzer__ */
 
 static int yylex_clr(char **retbuf)
diff --git a/lib/netns_linux.c b/lib/netns_linux.c
index 8fa4bc6fe0f7..82162abfd4ba 100644
--- a/lib/netns_linux.c
+++ b/lib/netns_linux.c
@@ -258,7 +258,7 @@ static void ns_disable_internal(struct ns *ns)
 		if (ns_master.ns_disable_hook)
 			(*ns_master.ns_disable_hook)(ns);
 
-		if (have_netns())
+		if (have_netns() && ns->fd >= 0)
 			close(ns->fd);
 
 		ns->fd = -1;
diff --git a/lib/ptm_lib.c b/lib/ptm_lib.c
index ac800be0a5ef..737c60775f64 100644
--- a/lib/ptm_lib.c
+++ b/lib/ptm_lib.c
@@ -308,22 +308,18 @@ static int _ptm_lib_read_ptm_socket(int fd, char *buf, int len)
 	while (bytes_read != len) {
 		rc = recv(fd, (void *)(buf + bytes_read), (len - bytes_read),
 			  MSG_DONTWAIT);
-		if (rc <= 0) {
-			if (errno && (errno != EAGAIN)
-			    && (errno != EWOULDBLOCK)) {
-				ERRLOG("fatal recv error(%s), closing connection, rc %d\n",
-				       strerror(errno), rc);
-				return (rc);
-			} else {
-				if (retries++ < 2) {
-					usleep(10000);
-					continue;
-				}
-				DLOG("max retries - recv error(%d - %s) bytes read %d (%d)\n",
-				     errno, strerror(errno), bytes_read, len);
-				return (bytes_read);
+		if (rc < 0 && (errno != EAGAIN) && (errno != EWOULDBLOCK)) {
+			ERRLOG("fatal recv error(%s), closing connection, rc %d\n", strerror(errno),
+			       rc);
+			return (rc);
+		} else if (rc <= 0) {
+			if (retries++ < 2) {
+				usleep(10000);
+				continue;
 			}
-			break;
+			DLOG("max retries - recv error(%d - %s) bytes read %d (%d)\n", errno,
+			     strerror(errno), bytes_read, len);
+			return (bytes_read);
 		} else {
 			bytes_read += rc;
 		}
diff --git a/lib/zclient.h b/lib/zclient.h
index 91c0c9ed6d3d..6da9558aa560 100644
--- a/lib/zclient.h
+++ b/lib/zclient.h
@@ -251,21 +251,16 @@ enum zebra_error_types {
 
 static inline const char *zebra_error_type2str(enum zebra_error_types type)
 {
-	const char *ret = "UNKNOWN";
-
 	switch (type) {
 	case ZEBRA_UNKNOWN_ERROR:
-		ret = "ZEBRA_UNKNOWN_ERROR";
-		break;
+		return "ZEBRA_UNKNOWN_ERROR";
 	case ZEBRA_NO_VRF:
-		ret = "ZEBRA_NO_VRF";
-		break;
+		return "ZEBRA_NO_VRF";
 	case ZEBRA_INVALID_MSG_TYPE:
-		ret = "ZEBRA_INVALID_MSG_TYPE";
-		break;
+		return "ZEBRA_INVALID_MSG_TYPE";
 	}
 
-	return ret;
+	return "UNKNOWN";
 }
 
 struct redist_proto {
@@ -780,69 +775,51 @@ enum zclient_send_status {
 static inline const char *
 zapi_nhg_notify_owner2str(enum zapi_nhg_notify_owner note)
 {
-	const char *ret = "UNKNOWN";
-
 	switch (note) {
 	case ZAPI_NHG_FAIL_INSTALL:
-		ret = "ZAPI_NHG_FAIL_INSTALL";
-		break;
+		return "ZAPI_NHG_FAIL_INSTALL";
 	case ZAPI_NHG_INSTALLED:
-		ret = "ZAPI_NHG_INSTALLED";
-		break;
+		return "ZAPI_NHG_INSTALLED";
 	case ZAPI_NHG_REMOVE_FAIL:
-		ret = "ZAPI_NHG_REMOVE_FAIL";
-		break;
+		return "ZAPI_NHG_REMOVE_FAIL";
 	case ZAPI_NHG_REMOVED:
-		ret = "ZAPI_NHG_REMOVED";
-		break;
+		return "ZAPI_NHG_REMOVED";
 	}
 
-	return ret;
+	return "UNKNOWN";
 }
 
 static inline const char *
 zapi_rule_notify_owner2str(enum zapi_rule_notify_owner note)
 {
-	const char *ret = "UNKNOWN";
-
 	switch (note) {
 	case ZAPI_RULE_FAIL_INSTALL:
-		ret = "ZAPI_RULE_FAIL_INSTALL";
-		break;
+		return "ZAPI_RULE_FAIL_INSTALL";
 	case ZAPI_RULE_INSTALLED:
-		ret = "ZAPI_RULE_INSTALLED";
-		break;
+		return "ZAPI_RULE_INSTALLED";
 	case ZAPI_RULE_FAIL_REMOVE:
-		ret = "ZAPI_RULE_FAIL_REMOVE";
-		break;
+		return "ZAPI_RULE_FAIL_REMOVE";
 	case ZAPI_RULE_REMOVED:
-		ret = "ZAPI_RULE_REMOVED";
-		break;
+		return "ZAPI_RULE_REMOVED";
 	}
 
-	return ret;
+	return "UNKNOWN";
 }
 
 static inline const char *zapi_srv6_sid_notify2str(enum zapi_srv6_sid_notify note)
 {
-	const char *ret = "UNKNOWN";
-
 	switch (note) {
 	case ZAPI_SRV6_SID_FAIL_ALLOC:
-		ret = "ZAPI_SRV6_SID_FAIL_ALLOC";
-		break;
+		return "ZAPI_SRV6_SID_FAIL_ALLOC";
 	case ZAPI_SRV6_SID_ALLOCATED:
-		ret = "ZAPI_SRV6_SID_ALLOCATED";
-		break;
+		return "ZAPI_SRV6_SID_ALLOCATED";
 	case ZAPI_SRV6_SID_FAIL_RELEASE:
-		ret = "ZAPI_SRV6_SID_FAIL_RELEASE";
-		break;
+		return "ZAPI_SRV6_SID_FAIL_RELEASE";
 	case ZAPI_SRV6_SID_RELEASED:
-		ret = "ZAPI_SRV6_SID_RELEASED";
-		break;
+		return "ZAPI_SRV6_SID_RELEASED";
 	}
 
-	return ret;
+	return "UNKNOWN";
 }
 
 /* Zebra MAC types */
diff --git a/lib/zlog_5424_cli.c b/lib/zlog_5424_cli.c
index 3003df542f58..f97c42646371 100644
--- a/lib/zlog_5424_cli.c
+++ b/lib/zlog_5424_cli.c
@@ -674,6 +674,7 @@ static int log_5424_config_write(struct vty *vty)
 
 		vty_out(vty, "log extended %s\n", cfg->name);
 
+		(void)fmt_str; /* clang-SA */
 		switch (cfg->cfg.fmt) {
 		case ZLOG_FMT_5424:
 			fmt_str = " format rfc5424";
diff --git a/pimd/pim6_mld.c b/pimd/pim6_mld.c
index a871837701a4..59cd9aea5f53 100644
--- a/pimd/pim6_mld.c
+++ b/pimd/pim6_mld.c
@@ -468,6 +468,8 @@ static void gm_sg_update(struct gm_sg *sg, bool has_expired)
 
 static void gm_packet_free(struct gm_packet_state *pkt)
 {
+	assert(pkt->iface);
+
 	gm_packet_expires_del(pkt->iface->expires, pkt);
 	gm_packets_del(pkt->subscriber->packets, pkt);
 	gm_subscriber_drop(&pkt->subscriber);
diff --git a/pimd/pim_autorp.c b/pimd/pim_autorp.c
index 35347a2790c8..3fc30347a63c 100644
--- a/pimd/pim_autorp.c
+++ b/pimd/pim_autorp.c
@@ -308,7 +308,7 @@ static bool pim_autorp_discovery(struct pim_autorp *autorp, uint8_t rpcnt,
 	struct autorp_pkt_grp *grp;
 	size_t offset = 0;
 	pim_addr rp_addr;
-	struct prefix grppfix;
+	struct prefix grppfix = {};
 	char plname[32];
 	struct prefix_list *pl;
 	struct prefix_list_entry *ple;
diff --git a/pimd/pim_bsr_rpdb.c b/pimd/pim_bsr_rpdb.c
index 3ec9f99cd198..6e93b65f4b99 100644
--- a/pimd/pim_bsr_rpdb.c
+++ b/pimd/pim_bsr_rpdb.c
@@ -502,6 +502,9 @@ int pim_crp_process(struct interface *ifp, pim_sgaddr *src_dst, uint8_t *buf,
 	buf += sizeof(*crp_hdr);
 	remain -= sizeof(*crp_hdr);
 
+	/* ignore trailing data */
+	(void)buf;
+
 	size_t ngroups = crp_hdr->prefix_cnt;
 
 	if (remain < ngroups * sizeof(struct pim_encoded_group_ipv4)) {
diff --git a/vtysh/vtysh.c b/vtysh/vtysh.c
index 2d80feef6c97..5a54c60c6b11 100644
--- a/vtysh/vtysh.c
+++ b/vtysh/vtysh.c
@@ -280,9 +280,6 @@ static int vtysh_client_run(struct vtysh_client *vclient, const char *line,
 		nread = vtysh_client_receive(
 			vclient, bufvalid, buf + bufsz - bufvalid - 1, pass_fd);
 
-		if (nread < 0 && (errno == EINTR || errno == EAGAIN))
-			continue;
-
 		if (nread <= 0) {
 			if (vty->of)
 				vty_out(vty,
@@ -698,7 +695,7 @@ static char *trim(char *s)
 int vtysh_mark_file(const char *filename)
 {
 	struct vty *vty;
-	FILE *confp = NULL;
+	FILE *confp = NULL, *closefp = NULL;
 	int ret;
 	vector vline;
 	int tried = 0;
@@ -711,7 +708,7 @@ int vtysh_mark_file(const char *filename)
 	if (strncmp("-", filename, 1) == 0)
 		confp = stdin;
 	else
-		confp = fopen(filename, "r");
+		confp = closefp = fopen(filename, "r");
 
 	if (confp == NULL) {
 		fprintf(stderr, "%% Can't open config file %s due to '%s'.\n",
@@ -851,9 +848,8 @@ int vtysh_mark_file(const char *filename)
 	vty_close(vty);
 	XFREE(MTYPE_VTYSH_CMD, vty_buf_copy);
 
-	if (confp != stdin)
-		fclose(confp);
-
+	if (closefp)
+		fclose(closefp);
 	return 0;
 }
 
diff --git a/zebra/ipforward_proc.c b/zebra/ipforward_proc.c
index 08fbfede42af..0eae221e1e11 100644
--- a/zebra/ipforward_proc.c
+++ b/zebra/ipforward_proc.c
@@ -17,10 +17,15 @@ extern struct zebra_privs_t zserv_privs;
 
 static const char proc_net_snmp[] = "/proc/net/snmp";
 
-static void dropline(FILE *fp)
+static bool dropline(FILE *fp)
 {
-	while (getc(fp) != '\n')
-		;
+	int ch;
+
+	do {
+		ch = getc(fp);
+	} while (ch != EOF && ch != '\n');
+
+	return ch != EOF;
 }
 
 int ipforward(void)
@@ -36,7 +41,10 @@ int ipforward(void)
 		return -1;
 
 	/* We don't care about the first line. */
-	dropline(fp);
+	if (!dropline(fp)) {
+		fclose(fp);
+		return 0;
+	}
 
 	/* Get ip_statistics.IpForwarding :
 	   1 => ip forwarding enabled
diff --git a/zebra/zebra_dplane.c b/zebra/zebra_dplane.c
index dd2d212dc98d..88c1a049382b 100644
--- a/zebra/zebra_dplane.c
+++ b/zebra/zebra_dplane.c
@@ -1046,144 +1046,102 @@ enum dplane_op_e dplane_ctx_get_op(const struct zebra_dplane_ctx *ctx)
 
 const char *dplane_op2str(enum dplane_op_e op)
 {
-	const char *ret = "UNKNOWN";
-
 	switch (op) {
 	case DPLANE_OP_NONE:
-		ret = "NONE";
-		break;
+		return "NONE";
 
 	/* Route update */
 	case DPLANE_OP_ROUTE_INSTALL:
-		ret = "ROUTE_INSTALL";
-		break;
+		return "ROUTE_INSTALL";
 	case DPLANE_OP_ROUTE_UPDATE:
-		ret = "ROUTE_UPDATE";
-		break;
+		return "ROUTE_UPDATE";
 	case DPLANE_OP_ROUTE_DELETE:
-		ret = "ROUTE_DELETE";
-		break;
+		return "ROUTE_DELETE";
 	case DPLANE_OP_ROUTE_NOTIFY:
-		ret = "ROUTE_NOTIFY";
-		break;
+		return "ROUTE_NOTIFY";
 
 	/* Nexthop update */
 	case DPLANE_OP_NH_INSTALL:
-		ret = "NH_INSTALL";
-		break;
+		return "NH_INSTALL";
 	case DPLANE_OP_NH_UPDATE:
-		ret = "NH_UPDATE";
-		break;
+		return "NH_UPDATE";
 	case DPLANE_OP_NH_DELETE:
-		ret = "NH_DELETE";
-		break;
+		return "NH_DELETE";
 
 	case DPLANE_OP_LSP_INSTALL:
-		ret = "LSP_INSTALL";
-		break;
+		return "LSP_INSTALL";
 	case DPLANE_OP_LSP_UPDATE:
-		ret = "LSP_UPDATE";
-		break;
+		return "LSP_UPDATE";
 	case DPLANE_OP_LSP_DELETE:
-		ret = "LSP_DELETE";
-		break;
+		return "LSP_DELETE";
 	case DPLANE_OP_LSP_NOTIFY:
-		ret = "LSP_NOTIFY";
-		break;
+		return "LSP_NOTIFY";
 
 	case DPLANE_OP_PW_INSTALL:
-		ret = "PW_INSTALL";
-		break;
+		return "PW_INSTALL";
 	case DPLANE_OP_PW_UNINSTALL:
-		ret = "PW_UNINSTALL";
-		break;
+		return "PW_UNINSTALL";
 
 	case DPLANE_OP_SYS_ROUTE_ADD:
-		ret = "SYS_ROUTE_ADD";
-		break;
+		return "SYS_ROUTE_ADD";
 	case DPLANE_OP_SYS_ROUTE_DELETE:
-		ret = "SYS_ROUTE_DEL";
-		break;
+		return "SYS_ROUTE_DEL";
 
 	case DPLANE_OP_BR_PORT_UPDATE:
-		ret = "BR_PORT_UPDATE";
-		break;
+		return "BR_PORT_UPDATE";
 
 	case DPLANE_OP_ADDR_INSTALL:
-		ret = "ADDR_INSTALL";
-		break;
+		return "ADDR_INSTALL";
 	case DPLANE_OP_ADDR_UNINSTALL:
-		ret = "ADDR_UNINSTALL";
-		break;
+		return "ADDR_UNINSTALL";
 
 	case DPLANE_OP_MAC_INSTALL:
-		ret = "MAC_INSTALL";
-		break;
+		return "MAC_INSTALL";
 	case DPLANE_OP_MAC_DELETE:
-		ret = "MAC_DELETE";
-		break;
+		return "MAC_DELETE";
 
 	case DPLANE_OP_NEIGH_INSTALL:
-		ret = "NEIGH_INSTALL";
-		break;
+		return "NEIGH_INSTALL";
 	case DPLANE_OP_NEIGH_UPDATE:
-		ret = "NEIGH_UPDATE";
-		break;
+		return "NEIGH_UPDATE";
 	case DPLANE_OP_NEIGH_DELETE:
-		ret = "NEIGH_DELETE";
-		break;
+		return "NEIGH_DELETE";
 	case DPLANE_OP_VTEP_ADD:
-		ret = "VTEP_ADD";
-		break;
+		return "VTEP_ADD";
 	case DPLANE_OP_VTEP_DELETE:
-		ret = "VTEP_DELETE";
-		break;
+		return "VTEP_DELETE";
 
 	case DPLANE_OP_RULE_ADD:
-		ret = "RULE_ADD";
-		break;
+		return "RULE_ADD";
 	case DPLANE_OP_RULE_DELETE:
-		ret = "RULE_DELETE";
-		break;
+		return "RULE_DELETE";
 	case DPLANE_OP_RULE_UPDATE:
-		ret = "RULE_UPDATE";
-		break;
+		return "RULE_UPDATE";
 
 	case DPLANE_OP_NEIGH_DISCOVER:
-		ret = "NEIGH_DISCOVER";
-		break;
+		return "NEIGH_DISCOVER";
 
 	case DPLANE_OP_IPTABLE_ADD:
-		ret = "IPTABLE_ADD";
-		break;
+		return "IPTABLE_ADD";
 	case DPLANE_OP_IPTABLE_DELETE:
-		ret = "IPTABLE_DELETE";
-		break;
+		return "IPTABLE_DELETE";
 	case DPLANE_OP_IPSET_ADD:
-		ret = "IPSET_ADD";
-		break;
+		return "IPSET_ADD";
 	case DPLANE_OP_IPSET_DELETE:
-		ret = "IPSET_DELETE";
-		break;
+		return "IPSET_DELETE";
 	case DPLANE_OP_IPSET_ENTRY_ADD:
-		ret = "IPSET_ENTRY_ADD";
-		break;
+		return "IPSET_ENTRY_ADD";
 	case DPLANE_OP_IPSET_ENTRY_DELETE:
-		ret = "IPSET_ENTRY_DELETE";
-		break;
+		return "IPSET_ENTRY_DELETE";
 	case DPLANE_OP_NEIGH_IP_INSTALL:
-		ret = "NEIGH_IP_INSTALL";
-		break;
+		return "NEIGH_IP_INSTALL";
 	case DPLANE_OP_NEIGH_IP_DELETE:
-		ret = "NEIGH_IP_DELETE";
-		break;
+		return "NEIGH_IP_DELETE";
 	case DPLANE_OP_NEIGH_TABLE_UPDATE:
-		ret = "NEIGH_TABLE_UPDATE";
-		break;
+		return "NEIGH_TABLE_UPDATE";
 
 	case DPLANE_OP_GRE_SET:
-		ret = "GRE_SET";
-		break;
+		return "GRE_SET";
 
 	case DPLANE_OP_INTF_ADDR_ADD:
 		return "INTF_ADDR_ADD";
@@ -1195,72 +1153,53 @@ const char *dplane_op2str(enum dplane_op_e op)
 		return "INTF_NETCONFIG";
 
 	case DPLANE_OP_INTF_INSTALL:
-		ret = "INTF_INSTALL";
-		break;
+		return "INTF_INSTALL";
 	case DPLANE_OP_INTF_UPDATE:
-		ret = "INTF_UPDATE";
-		break;
+		return "INTF_UPDATE";
 	case DPLANE_OP_INTF_DELETE:
-		ret = "INTF_DELETE";
-		break;
+		return "INTF_DELETE";
 
 	case DPLANE_OP_TC_QDISC_INSTALL:
-		ret = "TC_QDISC_INSTALL";
-		break;
+		return "TC_QDISC_INSTALL";
 	case DPLANE_OP_TC_QDISC_UNINSTALL:
-		ret = "TC_QDISC_UNINSTALL";
-		break;
+		return "TC_QDISC_UNINSTALL";
 	case DPLANE_OP_TC_CLASS_ADD:
-		ret = "TC_CLASS_ADD";
-		break;
+		return "TC_CLASS_ADD";
 	case DPLANE_OP_TC_CLASS_DELETE:
-		ret = "TC_CLASS_DELETE";
-		break;
+		return "TC_CLASS_DELETE";
 	case DPLANE_OP_TC_CLASS_UPDATE:
-		ret = "TC_CLASS_UPDATE";
-		break;
+		return "TC_CLASS_UPDATE";
 	case DPLANE_OP_TC_FILTER_ADD:
-		ret = "TC_FILTER_ADD";
-		break;
+		return "TC_FILTER_ADD";
 	case DPLANE_OP_TC_FILTER_DELETE:
-		ret = "TC_FILTER_DELETE";
-		break;
+		return "TC_FILTER_DELETE";
 	case DPLANE_OP_TC_FILTER_UPDATE:
-		ret = "TC__FILTER_UPDATE";
-		break;
+		return "TC__FILTER_UPDATE";
 	case DPLANE_OP_STARTUP_STAGE:
-		ret = "STARTUP_STAGE";
-		break;
+		return "STARTUP_STAGE";
 
 	case DPLANE_OP_SRV6_ENCAP_SRCADDR_SET:
-		ret = "SRV6_ENCAP_SRCADDR_SET";
-		break;
+		return "SRV6_ENCAP_SRCADDR_SET";
 
 	case DPLANE_OP_VLAN_INSTALL:
-		ret = "NEW_VLAN";
-		break;
+		return "NEW_VLAN";
 	}
 
-	return ret;
+	return "UNKNOWN";
 }
 
 const char *dplane_res2str(enum zebra_dplane_result res)
 {
-	const char *ret = "<Unknown>";
-
 	switch (res) {
 	case ZEBRA_DPLANE_REQUEST_FAILURE:
-		ret = "FAILURE";
-		break;
+		return "FAILURE";
 	case ZEBRA_DPLANE_REQUEST_QUEUED:
-		ret = "QUEUED";
-		break;
+		return "QUEUED";
 	case ZEBRA_DPLANE_REQUEST_SUCCESS:
-		ret = "SUCCESS";
-		break;
+		return "SUCCESS";
 	}
 
-	return ret;
+	return "<Unknown>";
 }
 
 void dplane_ctx_set_dest(struct zebra_dplane_ctx *ctx,
diff --git a/zebra/zebra_nb_state.c b/zebra/zebra_nb_state.c
index 63ac7877d0f9..6ed11f75f173 100644
--- a/zebra/zebra_nb_state.c
+++ b/zebra/zebra_nb_state.c
@@ -900,6 +900,7 @@ lib_vrf_zebra_ribs_rib_route_route_entry_nexthop_group_nexthop_bh_type_get_elem(
 	if (nexthop->type != NEXTHOP_TYPE_BLACKHOLE)
 		return NULL;
 
+	(void)type_str; /* clang-SA */
 	switch (nexthop->bh_type) {
 	case BLACKHOLE_NULL:
 		type_str = "null";
diff --git a/zebra/zebra_netns_id.c b/zebra/zebra_netns_id.c
index 4cee3b89f198..3da79e249e66 100644
--- a/zebra/zebra_netns_id.c
+++ b/zebra/zebra_netns_id.c
@@ -159,6 +159,7 @@ ns_id_t zebra_ns_id_get(const char *netnspath, int fd_param)
 	int fd = -1, sock, ret;
 	unsigned int seq;
 	ns_id_t return_nsid = NS_UNKNOWN;
+	int nl_errno;
 
 	/* netns path check */
 	if (!netnspath && fd_param == -1)
@@ -231,32 +232,31 @@ ns_id_t zebra_ns_id_get(const char *netnspath, int fd_param)
 
 			ret = -1;
 			if (err->error < 0)
-				errno = -err->error;
+				nl_errno = -err->error;
 			else
-				errno = err->error;
-			if (errno == 0) {
+				nl_errno = err->error;
+			if (nl_errno == 0) {
 				/* request NEWNSID was successfull
 				 * return EEXIST error to get GETNSID
 				 */
-				errno = EEXIST;
+				nl_errno = EEXIST;
 			}
 		} else {
 			/* other errors ignored
 			 * attempt to get nsid
 			 */
 			ret = -1;
-			errno = EEXIST;
+			nl_errno = EEXIST;
 		}
 	}
 
-	if (errno != EEXIST && ret != 0) {
-		flog_err(EC_LIB_SOCKET,
-			 "netlink( %u) recvfrom() error 2 when reading: %s", fd,
-			 safe_strerror(errno));
+	if (ret != 0 && nl_errno != EEXIST) {
+		flog_err(EC_LIB_SOCKET, "netlink( %u) recvfrom() error 2 when reading: %s", fd,
+			 safe_strerror(nl_errno));
 		close(sock);
 		if (netnspath)
 			close(fd);
-		if (errno == ENOTSUP) {
+		if (nl_errno == ENOTSUP) {
 			zlog_debug("NEWNSID locally generated");
 			return zebra_ns_id_get_fallback(netnspath);
 		}
diff --git a/zebra/zebra_netns_notify.c b/zebra/zebra_netns_notify.c
index 3ac4fdd73716..52b94e040566 100644
--- a/zebra/zebra_netns_notify.c
+++ b/zebra/zebra_netns_notify.c
@@ -378,19 +378,28 @@ void zebra_ns_notify_parse(void)
 {
 	struct dirent *dent;
 	DIR *srcdir = opendir(NS_RUN_DIR);
+	int srcdirfd;
 
 	if (srcdir == NULL) {
 		flog_err_sys(EC_LIB_SYSTEM_CALL,
 			     "NS parsing init: failed to parse %s", NS_RUN_DIR);
 		return;
 	}
+
+	srcdirfd = dirfd(srcdir);
+	if (srcdirfd < 0) {
+		closedir(srcdir);
+		flog_err_sys(EC_LIB_SYSTEM_CALL, "NS parsing init: failed to parse %s", NS_RUN_DIR);
+		return;
+	}
+
 	while ((dent = readdir(srcdir)) != NULL) {
 		struct stat st;
 
 		if (strcmp(dent->d_name, ".") == 0
 		    || strcmp(dent->d_name, "..") == 0)
 			continue;
-		if (fstatat(dirfd(srcdir), dent->d_name, &st, 0) < 0) {
+		if (fstatat(srcdirfd, dent->d_name, &st, 0) < 0) {
 			flog_err_sys(
 				EC_LIB_SYSTEM_CALL,
 				"NS parsing init: failed to parse entry %s",