diff --git a/src/basic/efivars.c b/src/basic/efivars.c
index 86544d1de2..99c47e8ce2 100644
--- a/src/basic/efivars.c
+++ b/src/basic/efivars.c
@@ -155,9 +155,8 @@ int efi_get_variable(
 }
 
 int efi_get_variable_string(const char *variable, char **ret) {
-        _cleanup_free_ void *s = NULL;
+        _cleanup_free_ void *s = NULL, *x = NULL;
         size_t ss = 0;
-        char *x;
         int r;
 
         assert(variable);
@@ -171,7 +170,7 @@ int efi_get_variable_string(const char *variable, char **ret) {
                 return -ENOMEM;
 
         if (ret)
-                *ret = x;
+                *ret = TAKE_PTR(x);
 
         return 0;
 }
diff --git a/src/shared/blockdev-list.c b/src/shared/blockdev-list.c
index 16a0e2bb25..57f80bb111 100644
--- a/src/shared/blockdev-list.c
+++ b/src/shared/blockdev-list.c
@@ -111,7 +111,8 @@ int blockdev_list(BlockDevListFlags flags, BlockDevice **ret_devices, size_t *re
                         if (r < 0)
                                 log_debug_errno(r, "Failed to acquire size of device '%s', ignoring: %m", node);
                         else
-                                size *= 512; /* the 'size' sysattr is always in multiples of 512, even on 4K sector block devices! */
+                                /* the 'size' sysattr is always in multiples of 512, even on 4K sector block devices! */
+                                assert_se(MUL_ASSIGN_SAFE(&size, 512)); /* Overflow check for coverity */
 
                         if (size == 0 && FLAGS_SET(flags, BLOCKDEV_LIST_IGNORE_EMPTY)) {
                                 log_debug("Device '%s' has a zero size, assuming drive without a medium, skipping.", node);
diff --git a/src/shared/bpf-dlopen.c b/src/shared/bpf-dlopen.c
index e84b435f48..1c64498044 100644
--- a/src/shared/bpf-dlopen.c
+++ b/src/shared/bpf-dlopen.c
@@ -49,6 +49,8 @@ DLSYM_PROTOTYPE(ring_buffer__free) = NULL;
 DLSYM_PROTOTYPE(ring_buffer__new) = NULL;
 DLSYM_PROTOTYPE(ring_buffer__poll) = NULL;
 
+static void* bpf_dl = NULL;
+
 /* new symbols available from libbpf 0.7.0 */
 int (*sym_bpf_map_create)(enum bpf_map_type,  const char *, __u32, __u32, __u32, const struct bpf_map_create_opts *);
 struct bpf_map* (*sym_bpf_object__next_map)(const struct bpf_object *obj, const struct bpf_map *map);
@@ -71,8 +73,8 @@ static int bpf_print_func(enum libbpf_print_level level, const char *fmt, va_lis
 }
 
 int dlopen_bpf_full(int log_level) {
+        _cleanup_(dlclosep) void *dl = NULL;
         static int cached = 0;
-        void *dl;
         int r;
 
         if (cached != 0)
@@ -177,6 +179,8 @@ int dlopen_bpf_full(int log_level) {
 
         REENABLE_WARNING;
 
+        bpf_dl = TAKE_PTR(dl);
+
         return cached = true;
 }
 
diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index b597ee263a..f5f3c8dfe8 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -4555,8 +4555,6 @@ int verity_dissect_and_mount(
                 _cleanup_strv_free_ char **extension_release = NULL;
                 ImageClass class = IMAGE_SYSEXT;
 
-                assert(!isempty(extension_release_data->os_release_id));
-
                 r = load_extension_release_pairs(dest, required_class >= 0 ? required_class : IMAGE_SYSEXT, dissected_image->image_name, relax_extension_release_check, &extension_release);
                 if (r == -ENOENT) {
                         if (required_class >= 0)
diff --git a/src/test/test-json.c b/src/test/test-json.c
index 91e14a4726..a3e0c88e40 100644
--- a/src/test/test-json.c
+++ b/src/test/test-json.c
@@ -667,6 +667,7 @@ static void test_float_match(sd_json_variant *v) {
         assert_se(fabs(1.0 - (DBL_MIN / 2 / sd_json_variant_real(sd_json_variant_by_index(v, 9)))) <= delta);
         assert_se(sd_json_variant_is_real(sd_json_variant_by_index(v, 10)) &&
                   !sd_json_variant_is_integer(sd_json_variant_by_index(v, 10)));
+        assert_se(!iszero_safe(sd_json_variant_real(sd_json_variant_by_index(v, 10))));
         assert_se(fabs(1.0 - (-DBL_MIN / 2 / sd_json_variant_real(sd_json_variant_by_index(v, 10)))) <= delta);
 }