diff --git a/sys-utils/libcmt/src/abi.c b/sys-utils/libcmt/src/abi.c
index 0a9cbdd2..db99b9ef 100644
--- a/sys-utils/libcmt/src/abi.c
+++ b/sys-utils/libcmt/src/abi.c
@@ -27,35 +27,39 @@ uint32_t cmt_abi_funsel(uint8_t a, uint8_t b, uint8_t c, uint8_t d) {
 }
 
 int cmt_abi_put_funsel(cmt_buf_t *me, uint32_t funsel) {
-    int rc;
     cmt_buf_t x[1];
-    if ((rc = cmt_buf_split(me, sizeof(funsel), x, me)))
+    int rc = cmt_buf_split(me, sizeof(funsel), x, me);
+    if (rc) {
         return rc;
+    }
+    // NOLINTNEXTLINE(clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling)
     memcpy(x->begin, &funsel, sizeof(funsel));
     return 0;
 }
 
 int cmt_abi_encode_uint_nr(size_t n, const uint8_t *data, uint8_t out[CMT_WORD_LENGTH]) {
-    if (n > CMT_WORD_LENGTH)
+    if (n > CMT_WORD_LENGTH) {
         return EDOM;
-
-    for (size_t i = 0; i < n; ++i)
+    }
+    for (size_t i = 0; i < n; ++i) {
         out[CMT_WORD_LENGTH - 1 - i] = data[i];
-    for (size_t i = n; i < CMT_WORD_LENGTH; ++i)
+    }
+    for (size_t i = n; i < CMT_WORD_LENGTH; ++i) {
         out[CMT_WORD_LENGTH - 1 - i] = 0;
-
+    }
     return 0;
 }
 
 int cmt_abi_encode_uint_nn(size_t n, const uint8_t *data, uint8_t out[CMT_WORD_LENGTH]) {
-    if (n > CMT_WORD_LENGTH)
+    if (n > CMT_WORD_LENGTH) {
         return EDOM;
-
-    for (size_t i = 0; i < CMT_WORD_LENGTH - n; ++i)
+    }
+    for (size_t i = 0; i < CMT_WORD_LENGTH - n; ++i) {
         out[i] = 0;
-    for (size_t i = CMT_WORD_LENGTH - n; i < CMT_WORD_LENGTH; ++i)
+    }
+    for (size_t i = CMT_WORD_LENGTH - n; i < CMT_WORD_LENGTH; ++i) {
         out[i] = data[i - CMT_WORD_LENGTH + n];
-
+    }
     return 0;
 }
 
@@ -68,26 +72,32 @@ int cmt_abi_encode_uint(size_t n, const void *data, uint8_t out[CMT_WORD_LENGTH]
 }
 
 int cmt_abi_decode_uint_nr(const uint8_t data[CMT_WORD_LENGTH], size_t n, uint8_t *out) {
-    if (n > CMT_WORD_LENGTH)
+    if (n > CMT_WORD_LENGTH) {
         return EDOM;
-
-    for (size_t i = 0; i < CMT_WORD_LENGTH - n; ++i)
-        if (data[i])
+    }
+    for (size_t i = 0; i < CMT_WORD_LENGTH - n; ++i) {
+        if (data[i]) {
             return -EDOM;
-    for (size_t i = CMT_WORD_LENGTH - n; i < CMT_WORD_LENGTH; ++i)
+        }
+    }
+    for (size_t i = CMT_WORD_LENGTH - n; i < CMT_WORD_LENGTH; ++i) {
         out[CMT_WORD_LENGTH - 1 - i] = data[i];
+    }
     return 0;
 }
 
 int cmt_abi_decode_uint_nn(const uint8_t data[CMT_WORD_LENGTH], size_t n, uint8_t *out) {
-    if (n > CMT_WORD_LENGTH)
+    if (n > CMT_WORD_LENGTH) {
         return EDOM;
-
-    for (size_t i = 0; i < CMT_WORD_LENGTH - n; ++i)
-        if (data[i])
+    }
+    for (size_t i = 0; i < CMT_WORD_LENGTH - n; ++i) {
+        if (data[i]) {
             return -EDOM;
-    for (size_t i = CMT_WORD_LENGTH - n; i < CMT_WORD_LENGTH; ++i)
+        }
+    }
+    for (size_t i = CMT_WORD_LENGTH - n; i < CMT_WORD_LENGTH; ++i) {
         out[i - CMT_WORD_LENGTH + n] = data[i];
+    }
     return 0;
 }
 
@@ -99,26 +109,26 @@ int cmt_abi_decode_uint(const uint8_t data[CMT_WORD_LENGTH], size_t n, uint8_t *
 #endif
 }
 
-int cmt_abi_put_uint(cmt_buf_t *me, size_t n, const void *data) {
+int cmt_abi_put_uint(cmt_buf_t *me, size_t data_length, const void *data) {
     cmt_buf_t x[1];
-
-    if (n > CMT_WORD_LENGTH)
+    if (data_length > CMT_WORD_LENGTH) {
         return -EDOM;
-    if (cmt_buf_split(me, CMT_WORD_LENGTH, x, me))
+    }
+    if (cmt_buf_split(me, CMT_WORD_LENGTH, x, me)) {
         return -ENOBUFS;
-
-    return cmt_abi_encode_uint(n, data, x->begin);
+    }
+    return cmt_abi_encode_uint(data_length, data, x->begin);
 }
 
-int cmt_abi_put_uint_be(cmt_buf_t *me, size_t n, const void *data) {
+int cmt_abi_put_uint_be(cmt_buf_t *me, size_t data_length, const void *data) {
     cmt_buf_t x[1];
-
-    if (n > CMT_WORD_LENGTH)
+    if (data_length > CMT_WORD_LENGTH) {
         return -EDOM;
-    if (cmt_buf_split(me, CMT_WORD_LENGTH, x, me))
+    }
+    if (cmt_buf_split(me, CMT_WORD_LENGTH, x, me)) {
         return -ENOBUFS;
-
-    return cmt_abi_encode_uint_nn(n, data, x->begin);
+    }
+    return cmt_abi_encode_uint_nn(data_length, data, x->begin);
 }
 
 int cmt_abi_put_bool(cmt_buf_t *me, bool value) {
@@ -126,13 +136,12 @@ int cmt_abi_put_bool(cmt_buf_t *me, bool value) {
     return cmt_abi_put_uint(me, sizeof(boolean), &boolean);
 }
 
-int cmt_abi_put_address(cmt_buf_t *me, const uint8_t data[20]) {
+int cmt_abi_put_address(cmt_buf_t *me, const uint8_t address[20]) {
     cmt_buf_t x[1];
-
-    if (cmt_buf_split(me, CMT_WORD_LENGTH, x, me))
+    if (cmt_buf_split(me, CMT_WORD_LENGTH, x, me)) {
         return -ENOBUFS;
-
-    return cmt_abi_encode_uint_nn(CMT_ADDRESS_LENGTH, data, x->begin);
+    }
+    return cmt_abi_encode_uint_nn(CMT_ADDRESS_LENGTH, address, x->begin);
 }
 
 int cmt_abi_put_bytes_s(cmt_buf_t *me, cmt_buf_t *offset) {
@@ -140,49 +149,62 @@ int cmt_abi_put_bytes_s(cmt_buf_t *me, cmt_buf_t *offset) {
 }
 
 int cmt_abi_reserve_bytes_d(cmt_buf_t *me, cmt_buf_t *of, size_t n, cmt_buf_t *out, const void *start) {
-    int rc;
-    cmt_buf_t tmp[1], sz[1];
+    int rc = 0;
+    cmt_buf_t tmp[1];
+    cmt_buf_t sz[1];
     size_t n32 = align_forward(n, CMT_WORD_LENGTH);
 
-    if ((rc = cmt_buf_split(me, CMT_WORD_LENGTH, sz, tmp)))
+    rc = cmt_buf_split(me, CMT_WORD_LENGTH, sz, tmp);
+    if (rc) {
         return rc;
-    if ((rc = cmt_buf_split(tmp, n32, out, tmp)))
+    }
+    rc = cmt_buf_split(tmp, n32, out, tmp);
+    if (rc) {
         return rc;
+    }
 
     size_t offset = sz->begin - (uint8_t *) start;
-    if ((rc = cmt_abi_encode_uint(sizeof(offset), &offset, of->begin)))
+    rc = cmt_abi_encode_uint(sizeof(offset), &offset, of->begin);
+    if (rc) {
         return rc;
-    if ((rc = cmt_abi_encode_uint(sizeof(n), &n, sz->begin)))
+    }
+    rc = cmt_abi_encode_uint(sizeof(n), &n, sz->begin);
+    if (rc) {
         return rc;
+    }
 
-    *me = *tmp;                         // commit the buffer changes
+    *me = *tmp; // commit the buffer changes
+    // NOLINTNEXTLINE(clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling)
     memset(out->begin + n, 0, n32 - n); // zero out the padding
     return 0;
 }
 
 int cmt_abi_put_bytes_d(cmt_buf_t *me, cmt_buf_t *offset, size_t n, const void *data, const void *start) {
-    int rc;
     cmt_buf_t res[1];
-
-    if ((rc = cmt_abi_reserve_bytes_d(me, offset, n, res, start)))
+    int rc = cmt_abi_reserve_bytes_d(me, offset, n, res, start);
+    if (rc) {
         return rc;
-
+    }
+    // NOLINTNEXTLINE(clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling)
     memcpy(res->begin, data, n);
     return 0;
 }
 
 uint32_t cmt_abi_peek_funsel(cmt_buf_t *me) {
-    if (cmt_buf_length(me) < 4)
+    if (cmt_buf_length(me) < 4) {
         return 0;
+    }
     return CMT_ABI_FUNSEL(me->begin[0], me->begin[1], me->begin[2], me->begin[3]);
 }
 
 int cmt_abi_check_funsel(cmt_buf_t *me, uint32_t expected) {
-    if (cmt_buf_length(me) < 4)
+    if (cmt_buf_length(me) < 4) {
         return -ENOBUFS;
+    }
 
-    if (cmt_abi_peek_funsel(me) != expected)
+    if (cmt_abi_peek_funsel(me) != expected) {
         return -EBADMSG;
+    }
 
     me->begin += 4;
     return 0;
@@ -191,11 +213,13 @@ int cmt_abi_check_funsel(cmt_buf_t *me, uint32_t expected) {
 int cmt_abi_get_uint(cmt_buf_t *me, size_t n, void *data) {
     cmt_buf_t x[1];
 
-    if (n > CMT_WORD_LENGTH)
+    if (n > CMT_WORD_LENGTH) {
         return -EDOM;
+    }
     int rc = cmt_buf_split(me, CMT_WORD_LENGTH, x, me);
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
     return cmt_abi_decode_uint(x->begin, n, data);
 }
@@ -203,11 +227,13 @@ int cmt_abi_get_uint(cmt_buf_t *me, size_t n, void *data) {
 int cmt_abi_get_uint_be(cmt_buf_t *me, size_t n, void *data) {
     cmt_buf_t x[1];
 
-    if (n > CMT_WORD_LENGTH)
+    if (n > CMT_WORD_LENGTH) {
         return -EDOM;
+    }
     int rc = cmt_buf_split(me, CMT_WORD_LENGTH, x, me);
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
     return cmt_abi_decode_uint_nn(x->begin, n, data);
 }
@@ -215,8 +241,9 @@ int cmt_abi_get_uint_be(cmt_buf_t *me, size_t n, void *data) {
 int cmt_abi_get_bool(cmt_buf_t *me, bool *value) {
     uint8_t boolean = 0;
     int rc = cmt_abi_put_uint(me, sizeof(boolean), &boolean);
-    if (rc)
+    if (rc) {
         return rc;
+    }
     *value = boolean;
     return 0;
 }
@@ -225,8 +252,9 @@ int cmt_abi_get_address(cmt_buf_t *me, uint8_t address[CMT_ADDRESS_LENGTH]) {
     cmt_buf_t x[1];
 
     int rc = cmt_buf_split(me, CMT_WORD_LENGTH, x, me);
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
     return cmt_abi_decode_uint_nn(x->begin, CMT_ADDRESS_LENGTH, address);
 }
@@ -236,23 +264,29 @@ int cmt_abi_get_bytes_s(cmt_buf_t *me, cmt_buf_t of[1]) {
 }
 
 int cmt_abi_peek_bytes_d(const cmt_buf_t *start, cmt_buf_t of[1], cmt_buf_t *bytes) {
-    int rc;
-    uint64_t offset, size;
-    if ((rc = cmt_abi_get_uint(of, sizeof(offset), &offset)))
+    int rc = 0;
+    uint64_t offset = 0;
+    uint64_t size = 0;
+    rc = cmt_abi_get_uint(of, sizeof(offset), &offset);
+    if (rc) {
         return rc;
+    }
 
     /* from the beginning, after funsel */
     cmt_buf_t it[1] = {{start->begin + offset, start->end}};
-    if ((rc = cmt_abi_get_uint(it, sizeof(size), &size)))
+    rc = cmt_abi_get_uint(it, sizeof(size), &size);
+    if (rc) {
         return rc;
+    }
     return cmt_buf_split(it, size, bytes, it);
 }
 
-int cmt_abi_get_bytes_d(const cmt_buf_t *me, cmt_buf_t of[1], size_t *n, void **data) {
+int cmt_abi_get_bytes_d(const cmt_buf_t *start, cmt_buf_t of[1], size_t *n, void **data) {
     cmt_buf_t bytes[1];
-    int rc = cmt_abi_peek_bytes_d(me, of, bytes);
-    if (rc)
+    int rc = cmt_abi_peek_bytes_d(start, of, bytes);
+    if (rc) {
         return rc;
+    }
     *n = cmt_buf_length(bytes);
     *data = bytes->begin;
     return 0;
diff --git a/sys-utils/libcmt/src/abi.h b/sys-utils/libcmt/src/abi.h
index 8c6042fd..ff82e839 100644
--- a/sys-utils/libcmt/src/abi.h
+++ b/sys-utils/libcmt/src/abi.h
@@ -66,7 +66,7 @@
  * ## Encoder
  *
  * Lets look at some code starting with a simple case. A function that encodes
- * the function selector and a signle @b address value into the buffer:
+ * the function selector and a single @b address value into the buffer:
  *
  * @includelineno "examples/abi_encode_000.c"
  *
@@ -156,7 +156,7 @@ int cmt_abi_put_funsel(cmt_buf_t *me, uint32_t funsel);
  *
  * @param [in,out] me   a initialized buffer working as iterator
  * @param [in]     n    size of @p data in bytes
- * @param [in]     data poiter to a integer
+ * @param [in]     data pointer to a integer
  *
  * @return
  * |        |                                          |
@@ -173,14 +173,14 @@ int cmt_abi_put_funsel(cmt_buf_t *me, uint32_t funsel);
  * cmt_abi_put_uint(&it, sizeof x, &x);
  * ...
  * @endcode
- * @note This function takes care of endianess conversions */
+ * @note This function takes care of endianness conversions */
 int cmt_abi_put_uint(cmt_buf_t *me, size_t data_length, const void *data);
 
 /** Encode a big-endian value of up to 32bytes of data into the buffer
  *
  * @param [in,out] me     a initialized buffer working as iterator
  * @param [in]     length size of @p data in bytes
- * @param [in]     data   poiter to a integer
+ * @param [in]     data   pointer to a integer
  *
  * @return
  * |        |                                                   |
@@ -208,7 +208,7 @@ int cmt_abi_put_uint(cmt_buf_t *me, size_t data_length, const void *data);
  * };
  * cmt_abi_put_uint(&it, sizeof big, &big);
  * @endcode
- * @note This function takes care of endianess conversions */
+ * @note This function takes care of endianness conversions */
 int cmt_abi_put_uint_be(cmt_buf_t *me, size_t data_length, const void *data);
 
 /** Encode a bool into the buffer
@@ -228,10 +228,10 @@ int cmt_abi_put_uint_be(cmt_buf_t *me, size_t data_length, const void *data);
  * cmt_abi_put_bool(&it, true);
  * ...
  * @endcode
- * @note This function takes care of endianess conversions */
+ * @note This function takes care of endianness conversions */
 int cmt_abi_put_bool(cmt_buf_t *me, bool value);
 
-/** Encode @p address (exacly @ref CMT_ADDRESS_LENGTH bytes) into the buffer
+/** Encode @p address (exactly @ref CMT_ADDRESS_LENGTH bytes) into the buffer
  *
  * @param [in,out] me      initialized buffer
  * @param [in]     address exactly @ref CMT_ADDRESS_LENGTH bytes
@@ -324,7 +324,7 @@ uint32_t cmt_abi_peek_funsel(cmt_buf_t *me);
  * |-------:|------------------------|
  * |       0| success                |
  * |-ENOBUFS| no space left in @p me |
- * |-EBADMSG| funsel missmatch       | */
+ * |-EBADMSG| funsel mismatch       | */
 int cmt_abi_check_funsel(cmt_buf_t *me, uint32_t expected);
 
 /** Decode a unsigned integer of up to 32bytes from the buffer
@@ -384,7 +384,7 @@ int cmt_abi_get_bytes_s(cmt_buf_t *me, cmt_buf_t of[1]);
  * @param [in]  start initialized buffer (from the start after funsel)
  * @param [out]    of    offset to @p bytes data
  * @param [out]    n     amount of data available in @b bytes
- * @param [out]    bytes memory range with contents
+ * @param [out]    data memory range with contents
  *
  * @return
  * |        |                        |
@@ -393,7 +393,7 @@ int cmt_abi_get_bytes_s(cmt_buf_t *me, cmt_buf_t of[1]);
  * |-ENOBUFS| no space left in @p me |
  *
  * @note @p of can be initialized by calling @ref cmt_abi_get_bytes_s */
-int cmt_abi_get_bytes_d(const cmt_buf_t *start, cmt_buf_t of[1], size_t *n, void **bytes);
+int cmt_abi_get_bytes_d(const cmt_buf_t *start, cmt_buf_t of[1], size_t *n, void **data);
 
 /** Decode @b bytes from the buffer by taking a pointer to its contents.
  *
diff --git a/sys-utils/libcmt/src/buf.c b/sys-utils/libcmt/src/buf.c
index 3e090ebf..f6a834ae 100644
--- a/sys-utils/libcmt/src/buf.c
+++ b/sys-utils/libcmt/src/buf.c
@@ -23,20 +23,24 @@ static inline int is_pow2(int l) {
     return !(l & (l - 1));
 }
 
-void cmt_buf_init(cmt_buf_t *me, size_t n, void *data) {
-    if (!me)
+void cmt_buf_init(cmt_buf_t *me, size_t length, void *data) {
+    if (!me) {
         return;
+    }
     me->begin = (uint8_t *) data;
-    me->end = (uint8_t *) data + n;
+    me->end = (uint8_t *) data + length;
 }
 
 int cmt_buf_split(const cmt_buf_t *me, size_t lhs_length, cmt_buf_t *lhs, cmt_buf_t *rhs) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!lhs)
+    }
+    if (!lhs) {
         return -EINVAL;
-    if (!rhs)
+    }
+    if (!rhs) {
         return -EINVAL;
+    }
 
     lhs->begin = me->begin;
     lhs->end = rhs->begin = me->begin + lhs_length;
@@ -48,50 +52,61 @@ int cmt_buf_split(const cmt_buf_t *me, size_t lhs_length, cmt_buf_t *lhs, cmt_bu
 static int comma(const uint8_t *s, const uint8_t *end) {
     return s < end && *s == ',';
 }
+
 static bool cmt_buf_split_by(cmt_buf_t *x, cmt_buf_t *xs, int (*nxt)(const uint8_t *s, const uint8_t *end)) {
-    if (xs->begin == xs->end)
+    if (xs->begin == xs->end) {
         return false;
+    }
     x->begin = xs->begin;
-    for (; *xs->begin && xs->begin < xs->end && !nxt(xs->begin, xs->end); ++xs->begin)
+    for (; *xs->begin && xs->begin < xs->end && !nxt(xs->begin, xs->end); ++xs->begin) {
         ;
+    }
     x->end = xs->begin;
     xs->begin = xs->begin + nxt(xs->begin, xs->end);
     return *x->begin;
 }
+
 bool cmt_buf_split_by_comma(cmt_buf_t *x, cmt_buf_t *xs) {
     return cmt_buf_split_by(x, xs, comma);
 }
 
 size_t cmt_buf_length(const cmt_buf_t *me) {
-    if (!me)
+    if (!me) {
         return 0;
+    }
     return me->end - me->begin;
 }
 
 static void xxd(const uint8_t *p, const uint8_t *q, size_t mask) {
-    if (q < p)
+    if (q < p) {
         return;
+    }
 
-    for (size_t i = 0u, n = q - p; i < n; ++i) {
+    for (size_t i = 0U, n = q - p; i < n; ++i) {
         bool is_line_start = (i & mask) == 0;
         bool is_line_end = (i & mask) == mask || (i + 1 == n);
         char separator = is_line_end ? '\n' : ' ';
 
-        if (is_line_start)
+        if (is_line_start) {
             printf("%p %4zu: ", (void *) (p + i), i);
+        }
         printf("%02x%c", p[i], separator);
     }
 }
 
-void cmt_buf_xxd(void *p, void *q, int l) {
-    if (!p)
+void cmt_buf_xxd(void *begin, void *end, int bytes_per_line) {
+    if (!begin) {
         return;
-    if (!q)
+    }
+    if (!end) {
         return;
-    if (q <= p)
+    }
+    if (end <= begin) {
         return;
-    if (!is_pow2(l))
+    }
+    if (!is_pow2(bytes_per_line)) {
         return;
+    }
 
-    xxd(p, q, l - 1);
+    xxd(begin, end, bytes_per_line - 1);
 }
diff --git a/sys-utils/libcmt/src/buf.h b/sys-utils/libcmt/src/buf.h
index 549d589a..d8259376 100644
--- a/sys-utils/libcmt/src/buf.h
+++ b/sys-utils/libcmt/src/buf.h
@@ -73,7 +73,7 @@ void cmt_buf_xxd(void *begin, void *end, int bytes_per_line);
 
 /** Take the substring @p x from @p xs start to the first @p , (comma).
  * @param [out]    x           substring
- * @param [in,out] xs          string (interator)
+ * @param [in,out] xs          string (iterator)
  *
  * @note @p x points inside @p xs, make a copy if it outlives @p xs. */
 bool cmt_buf_split_by_comma(cmt_buf_t *x, cmt_buf_t *xs);
diff --git a/sys-utils/libcmt/src/io-mock.c b/sys-utils/libcmt/src/io-mock.c
index 44b7f60e..9ca6371d 100644
--- a/sys-utils/libcmt/src/io-mock.c
+++ b/sys-utils/libcmt/src/io-mock.c
@@ -17,7 +17,6 @@
 
 #include <assert.h>
 #include <errno.h>
-#include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -26,12 +25,13 @@ static int read_whole_file(const char *name, size_t max, void *data, size_t *len
 static int write_whole_file(const char *name, size_t length, const void *data);
 
 int cmt_io_init(cmt_io_driver_t *_me) {
-    if (!_me)
+    if (!_me) {
         return -EINVAL;
+    }
     cmt_io_driver_mock_t *me = &_me->mock;
 
-    size_t tx_length = 2 * 1024 * 1024; // 2MB
-    size_t rx_length = 2 * 1024 * 1024; // 2MB
+    size_t tx_length = 2UL * 1024 * 1024; // 2MB
+    size_t rx_length = 2UL * 1024 * 1024; // 2MB
     cmt_buf_init(me->tx, tx_length, malloc(tx_length));
     cmt_buf_init(me->rx, rx_length, malloc(rx_length));
 
@@ -42,10 +42,11 @@ int cmt_io_init(cmt_io_driver_t *_me) {
     }
 
     char *inputs = getenv("CMT_INPUTS");
-    if (inputs)
+    if (inputs) {
         cmt_buf_init(&me->inputs_left, strlen(inputs), inputs);
-    else
+    } else {
         cmt_buf_init(&me->inputs_left, 0, "");
+    }
 
     // in case the user writes something before loading any input
     strcpy(me->input_filename, "none");
@@ -60,8 +61,9 @@ int cmt_io_init(cmt_io_driver_t *_me) {
 }
 
 void cmt_io_fini(cmt_io_driver_t *_me) {
-    if (!_me)
+    if (!_me) {
         return;
+    }
     cmt_io_driver_mock_t *me = &_me->mock;
 
     free(me->tx->begin);
@@ -70,32 +72,42 @@ void cmt_io_fini(cmt_io_driver_t *_me) {
 
 cmt_buf_t cmt_io_get_tx(cmt_io_driver_t *me) {
     cmt_buf_t empty = {NULL, NULL};
-    if (!me)
+    if (!me) {
         return empty;
+    }
     return *me->ioctl.tx;
 }
 
 cmt_buf_t cmt_io_get_rx(cmt_io_driver_t *me) {
     cmt_buf_t empty = {NULL, NULL};
-    if (!me)
+    if (!me) {
         return empty;
+    }
     return *me->ioctl.rx;
 }
 
 static int load_next_input(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
     cmt_buf_t current_input;
     char filepath[128] = {0};
-    if (!cmt_buf_split_by_comma(&current_input, &me->inputs_left) ||
-        sscanf((char *) current_input.begin, "%d:%127[^,]", &me->input_type, filepath) != 2)
+    if (!cmt_buf_split_by_comma(&current_input, &me->inputs_left)) {
         return -EINVAL;
+    }
+    // NOLINTNEXTLINE(cert-err34-c,clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling)
+    if (sscanf((char *) current_input.begin, "%d:%127[^,]", &me->input_type, filepath) != 2) {
+        return -EINVAL;
+    }
 
     size_t file_length = 0;
     int rc = read_whole_file(filepath, cmt_buf_length(me->rx), me->rx->begin, &file_length);
     if (rc) {
-        fprintf(stderr, "failed to load \"%s\". %s\n", filepath, strerror(-rc));
+        (void) fprintf(stderr, "failed to load \"%s\". %s\n", filepath, strerror(-rc));
         return rc;
     }
-    sscanf(filepath, " %127[^.]%15s", me->input_filename, me->input_fileext);
+    // NOLINTNEXTLINE(clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling)
+    if (sscanf(filepath, " %127[^.]%15s", me->input_filename, me->input_fileext) != 2) {
+        (void) fprintf(stderr, "failed to parse filename: \"%s\"\n", filepath);
+        return -EINVAL;
+    }
 
     assert(file_length <= INT32_MAX);
     rr->reason = me->input_type;
@@ -106,25 +118,26 @@ static int load_next_input(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
     me->exception_seq = 0;
 
     if (getenv("CMT_DEBUG")) {
-        fprintf(stderr, "processing filename: \"%s\" (%lu), type: %d\n", filepath, file_length, me->input_type);
+        (void) fprintf(stderr, "processing filename: \"%s\" (%lu), type: %d\n", filepath, file_length, me->input_type);
     }
     return 0;
 }
 
 static int store_output(cmt_io_driver_mock_t *me, const char *filepath, struct cmt_io_yield *rr) {
-    if (rr->data > cmt_buf_length(me->tx))
+    if (rr->data > cmt_buf_length(me->tx)) {
         return -ENOBUFS;
+    }
 
     // char filepath[128 + 1 + 8 + 16];
     // snprintf(filepath, sizeof filepath, "%s.%s%d%s", me->input_filename, ns, *seq, me->input_fileext);
 
     int rc = write_whole_file(filepath, rr->data, me->tx->begin);
     if (rc) {
-        fprintf(stderr, "failed to store \"%s\". %s\n", filepath, strerror(-rc));
+        (void) fprintf(stderr, "failed to store \"%s\". %s\n", filepath, strerror(-rc));
         return rc;
     }
     if (getenv("CMT_DEBUG")) {
-        fprintf(stderr, "wrote filename: \"%s\" (%u)\n", filepath, rr->data);
+        (void) fprintf(stderr, "wrote filename: \"%s\" (%u)\n", filepath, rr->data);
     }
 
     // seq[0] += 1;
@@ -133,6 +146,7 @@ static int store_output(cmt_io_driver_mock_t *me, const char *filepath, struct c
 
 static int store_next_output(cmt_io_driver_mock_t *me, char *ns, int *seq, struct cmt_io_yield *rr) {
     char filepath[128 + 32 + 8 + 16];
+    // NOLINTNEXTLINE(cert-err33-c, clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling)
     snprintf(filepath, sizeof filepath, "%s.%s%d%s", me->input_filename, ns, *seq++, me->input_fileext);
     return store_output(me, filepath, rr);
 }
@@ -140,44 +154,48 @@ static int store_next_output(cmt_io_driver_mock_t *me, char *ns, int *seq, struc
 static int mock_progress(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
     (void) me;
     if (rr->cmd != HTIF_YIELD_CMD_AUTOMATIC) {
-        fprintf(stderr, "Expected cmd to be AUTOMATIC\n");
+        (void) fprintf(stderr, "Expected cmd to be AUTOMATIC\n");
         return -EINVAL;
     }
-    fprintf(stderr, "Progress: %6.2f\n", (double) rr->data / 10);
+    (void) fprintf(stderr, "Progress: %6.2f\n", (double) rr->data / 10);
     return 0;
 }
 
 static int mock_rx_accepted(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
     if (rr->cmd != HTIF_YIELD_CMD_MANUAL) {
-        fprintf(stderr, "Expected cmd to be MANUAL\n");
+        (void) fprintf(stderr, "Expected cmd to be MANUAL\n");
         return -EINVAL;
     }
     if (me->input_seq++) { // skip the first
         char filepath[128 + 32 + 8 + 16];
+        // NOLINTNEXTLINE(cert-err33-c, clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling)
         snprintf(filepath, sizeof filepath, "%s.outputs_root_hash%s", me->input_filename, me->input_fileext);
         int rc = store_output(me, filepath, rr);
-        if (rc)
+        if (rc) {
             return rc;
+        }
     }
-    if (load_next_input(me, rr))
+    if (load_next_input(me, rr)) {
         return -ENODATA;
+    }
     return 0;
 }
 
 static int mock_rx_rejected(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
     if (rr->cmd != HTIF_YIELD_CMD_MANUAL) {
-        fprintf(stderr, "Expected cmd to be MANUAL\n");
+        (void) fprintf(stderr, "Expected cmd to be MANUAL\n");
         return -EINVAL;
     }
-    fprintf(stderr, "%s:%d no revert for the mock implementation\n", __FILE__, __LINE__);
-    if (load_next_input(me, rr))
+    (void) fprintf(stderr, "%s:%d no revert for the mock implementation\n", __FILE__, __LINE__);
+    if (load_next_input(me, rr)) {
         return -1;
+    }
     return 0;
 }
 
 static int mock_tx_output(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
     if (rr->cmd != HTIF_YIELD_CMD_AUTOMATIC) {
-        fprintf(stderr, "Expected cmd to be AUTOMATIC\n");
+        (void) fprintf(stderr, "Expected cmd to be AUTOMATIC\n");
         return -EINVAL;
     }
     return store_next_output(me, "output-", &me->output_seq, rr);
@@ -185,7 +203,7 @@ static int mock_tx_output(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
 
 static int mock_tx_report(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
     if (rr->cmd != HTIF_YIELD_CMD_AUTOMATIC) {
-        fprintf(stderr, "Expected cmd to be AUTOMATIC\n");
+        (void) fprintf(stderr, "Expected cmd to be AUTOMATIC\n");
         return -EINVAL;
     }
     return store_next_output(me, "report-", &me->report_seq, rr);
@@ -193,7 +211,7 @@ static int mock_tx_report(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
 
 static int mock_tx_exception(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr) {
     if (rr->cmd != HTIF_YIELD_CMD_MANUAL) {
-        fprintf(stderr, "Expected cmd to be MANUAL\n");
+        (void) fprintf(stderr, "Expected cmd to be MANUAL\n");
         return -EINVAL;
     }
     return store_next_output(me, "exception-", &me->exception_seq, rr);
@@ -201,12 +219,13 @@ static int mock_tx_exception(cmt_io_driver_mock_t *me, struct cmt_io_yield *rr)
 
 /* These behaviours are defined by the cartesi-machine emulator */
 int cmt_io_yield(cmt_io_driver_t *_me, struct cmt_io_yield *rr) {
-    if (!_me)
+    if (!_me) {
         return -EINVAL;
+    }
     cmt_io_driver_mock_t *me = &_me->mock;
 
     if (getenv("CMT_DEBUG")) {
-        fprintf(stderr,
+        (void) fprintf(stderr,
             "yield {\n"
             "\t.dev = %d,\n"
             "\t.cmd = %d,\n"
@@ -249,13 +268,17 @@ static int read_whole_file(const char *name, size_t max, void *data, size_t *len
     int rc = 0;
 
     FILE *file = fopen(name, "rb");
-    if (!file)
+    if (!file) {
         return -errno;
+    }
 
     *length = fread(data, 1, max, file);
-    if (!feof(file))
+    if (!feof(file)) {
         rc = -ENOBUFS;
-    fclose(file);
+    }
+    if (fclose(file) != 0) {
+        perror("fclose failed");
+    }
     return rc;
 }
 
@@ -263,11 +286,15 @@ static int write_whole_file(const char *name, size_t length, const void *data) {
     int rc = 0;
 
     FILE *file = fopen(name, "wb");
-    if (!file)
+    if (!file) {
         return -errno;
+    }
 
-    if (fwrite(data, 1, length, file) != length)
+    if (fwrite(data, 1, length, file) != length) {
         rc = -errno;
-    fclose(file);
+    }
+    if (fclose(file) != 0) {
+        perror("fclose failed");
+    }
     return rc;
 }
diff --git a/sys-utils/libcmt/src/io.c b/sys-utils/libcmt/src/io.c
index a3476361..9905f8e9 100644
--- a/sys-utils/libcmt/src/io.c
+++ b/sys-utils/libcmt/src/io.c
@@ -31,8 +31,9 @@
 int cmt_io_init(cmt_io_driver_t *_me) {
     int rc = 0;
 
-    if (!_me)
+    if (!_me) {
         return -EINVAL;
+    }
     cmt_io_driver_ioctl_t *me = &_me->ioctl;
     me->fd = open("/dev/cmio", O_RDWR);
 
@@ -74,8 +75,9 @@ int cmt_io_init(cmt_io_driver_t *_me) {
 }
 
 void cmt_io_fini(cmt_io_driver_t *_me) {
-    if (!_me)
+    if (!_me) {
         return;
+    }
     cmt_io_driver_ioctl_t *me = &_me->ioctl;
 
     munmap(me->tx->begin, cmt_buf_length(me->tx));
@@ -88,8 +90,9 @@ void cmt_io_fini(cmt_io_driver_t *_me) {
 
 cmt_buf_t cmt_io_get_tx(cmt_io_driver_t *me) {
     static const cmt_buf_t empty = {NULL, NULL};
-    if (!me)
+    if (!me) {
         return empty;
+    }
     return *me->ioctl.tx;
 }
 
@@ -99,8 +102,9 @@ static uint32_t min(uint32_t a, uint32_t b) {
 
 cmt_buf_t cmt_io_get_rx(cmt_io_driver_t *me) {
     static const cmt_buf_t empty = {NULL, NULL};
-    if (!me)
+    if (!me) {
         return empty;
+    }
     cmt_buf_t rx = *me->ioctl.rx;
     rx.end = rx.begin + min(me->ioctl.rx_max_length, me->ioctl.rx_fromhost_length);
     return rx;
@@ -113,22 +117,25 @@ static uint64_t pack(struct cmt_io_yield *rr) {
 
 static struct cmt_io_yield unpack(uint64_t x) {
     struct cmt_io_yield out = {
-        (uint64_t) x >> 56,
-        (uint64_t) x << 8 >> 56,
-        (uint64_t) x << 16 >> 48,
-        (uint64_t) x << 32 >> 32,
+        x >> 56,
+        x << 8 >> 56,
+        x << 16 >> 48,
+        x << 32 >> 32,
     };
     return out;
 }
 
 int cmt_io_yield(cmt_io_driver_t *_me, struct cmt_io_yield *rr) {
-    if (!_me)
+    if (!_me) {
         return -EINVAL;
-    if (!rr)
+    }
+    if (!rr) {
         return -EINVAL;
+    }
     cmt_io_driver_ioctl_t *me = &_me->ioctl;
 
-    static bool checked = false, enabled = false;
+    static bool checked = false;
+    static bool enabled = false;
 
     if (!checked) {
         enabled = getenv("CMT_DEBUG") != NULL;
@@ -136,7 +143,7 @@ int cmt_io_yield(cmt_io_driver_t *_me, struct cmt_io_yield *rr) {
     }
 
     if (enabled) {
-        fprintf(stderr,
+        (void) fprintf(stderr,
             "tohost {\n"
             "\t.dev = %d,\n"
             "\t.cmd = %d,\n"
@@ -146,14 +153,15 @@ int cmt_io_yield(cmt_io_driver_t *_me, struct cmt_io_yield *rr) {
             rr->dev, rr->cmd, rr->reason, rr->data);
     }
     uint64_t req = pack(rr);
-    if (ioctl(me->fd, IOCTL_CMIO_YIELD, &req))
+    if (ioctl(me->fd, IOCTL_CMIO_YIELD, &req)) {
         return -errno;
+    }
     *rr = unpack(req);
 
     me->rx_fromhost_length = rr->data;
 
     if (enabled) {
-        fprintf(stderr,
+        (void) fprintf(stderr,
             "fromhost {\n"
             "\t.dev = %d,\n"
             "\t.cmd = %d,\n"
diff --git a/sys-utils/libcmt/src/io.h b/sys-utils/libcmt/src/io.h
index b38e8f39..5a0f6101 100644
--- a/sys-utils/libcmt/src/io.h
+++ b/sys-utils/libcmt/src/io.h
@@ -54,7 +54,6 @@
 #ifndef CMT_IO_H
 #define CMT_IO_H
 #include "buf.h"
-#include <stddef.h>
 #include <stdint.h>
 
 /** Device */
@@ -135,13 +134,13 @@ int cmt_io_init(cmt_io_driver_t *me);
 
 /** Release the driver resources and close the io device.
  *
- * @param [in] me A sucessfuly initialized state by @ref cmt_io_init
+ * @param [in] me A successfully initialized state by @ref cmt_io_init
  * @note usage of @p me after this call is a BUG and will cause undefined behaviour */
 void cmt_io_fini(cmt_io_driver_t *me);
 
 /** Retrieve the transmit buffer @p tx
  *
- * @param [in] me A sucessfuly initialized state by @ref cmt_io_init
+ * @param [in] me A successfully initialized state by @ref cmt_io_init
  * @return
  * - writable memory region (check @ref cmt_buf_t)
  * @note memory is valid until @ref cmt_io_fini is called. */
@@ -149,7 +148,7 @@ cmt_buf_t cmt_io_get_tx(cmt_io_driver_t *me);
 
 /** Retrieve the receive buffer @p rx
  *
- * @param [in] me A sucessfuly initialized state by @ref cmt_io_init
+ * @param [in] me A successfully initialized state by @ref cmt_io_init
  * @return
  * - readable memory region (check @ref cmt_buf_t)
  * @note memory is valid until @ref cmt_io_fini is called. */
@@ -157,7 +156,7 @@ cmt_buf_t cmt_io_get_rx(cmt_io_driver_t *me);
 
 /** Perform the yield encoded in @p rr.
  *
- * @param [in] me A sucessfuly initialized state by @ref cmt_io_init
+ * @param [in] me A successfully initialized state by @ref cmt_io_init
  * @param [in,out] rr Request and Reply
  * @return
  * - 0 on success
diff --git a/sys-utils/libcmt/src/keccak.c b/sys-utils/libcmt/src/keccak.c
index 03fd9258..f0d1008b 100644
--- a/sys-utils/libcmt/src/keccak.c
+++ b/sys-utils/libcmt/src/keccak.c
@@ -134,18 +134,21 @@ static void keccakf(uint64_t st[25]) {
 #endif
 
     for (int r = 0; r < 24; r++) {
-        uint64_t t, bc[5];
+        uint64_t t = 0;
+        uint64_t bc[5];
 
         // Theta
         UNROLL_LOOP(5)
-        for (int i = 0; i < 5; i++)
+        for (int i = 0; i < 5; i++) {
             bc[i] = st[i] ^ st[i + 5] ^ st[i + 10] ^ st[i + 15] ^ st[i + 20];
+        }
 
         UNROLL_LOOP(5)
         for (int i = 0; i < 5; i++) {
             t = bc[(i + 4) % 5] ^ ROTL64(bc[(i + 1) % 5], 1);
-            for (int j = 0; j < 25; j += 5)
+            for (int j = 0; j < 25; j += 5) {
                 st[j + i] ^= t;
+            }
         }
 
         // Rho Pi
@@ -161,10 +164,12 @@ static void keccakf(uint64_t st[25]) {
         //  Chi
         UNROLL_LOOP(25)
         for (int j = 0; j < 25; j += 5) {
-            for (int i = 0; i < 5; i++)
+            for (int i = 0; i < 5; i++) {
                 bc[i] = st[j + i];
-            for (int i = 0; i < 5; i++)
+            }
+            for (int i = 0; i < 5; i++) {
                 st[j + i] ^= (~bc[(i + 1) % 5]) & bc[(i + 2) % 5];
+            }
         }
 
         //  Iota
@@ -178,36 +183,36 @@ static void keccakf(uint64_t st[25]) {
 #endif
 }
 
-void cmt_keccak_init(cmt_keccak_t *c) {
-    *c = (cmt_keccak_t) CMT_KECCAK_INIT(c);
+void cmt_keccak_init(cmt_keccak_t *state) {
+    *state = (cmt_keccak_t) CMT_KECCAK_INIT(state);
 }
 
-void cmt_keccak_update(cmt_keccak_t *c, size_t n, const void *data) {
-    int j = c->pt;
+void cmt_keccak_update(cmt_keccak_t *state, size_t n, const void *data) {
+    int j = state->pt;
     for (size_t i = 0; i < n; i++) {
-        c->st.b[j++] ^= ((const uint8_t *) data)[i];
-        if (j >= c->rsiz) {
-            keccakf(c->st.q);
+        state->st.b[j++] ^= ((const uint8_t *) data)[i];
+        if (j >= state->rsiz) {
+            keccakf(state->st.q);
             j = 0;
         }
     }
-    c->pt = j;
+    state->pt = j;
 }
 
-void cmt_keccak_final(cmt_keccak_t *c, void *md) {
-    c->st.b[c->pt] ^= 0x01;
-    c->st.b[c->rsiz - 1] ^= 0x80;
-    keccakf(c->st.q);
+void cmt_keccak_final(cmt_keccak_t *state, void *md) {
+    state->st.b[state->pt] ^= 0x01;
+    state->st.b[state->rsiz - 1] ^= 0x80;
+    keccakf(state->st.q);
 
     for (int i = 0; i < CMT_KECCAK_LENGTH; i++) {
-        ((uint8_t *) md)[i] = c->st.b[i];
+        ((uint8_t *) md)[i] = state->st.b[i];
     }
 }
 
-uint8_t *cmt_keccak_data(size_t n, const void *data, uint8_t md[CMT_KECCAK_LENGTH]) {
+uint8_t *cmt_keccak_data(size_t length, const void *data, uint8_t md[CMT_KECCAK_LENGTH]) {
     cmt_keccak_t c[1];
     cmt_keccak_init(c);
-    cmt_keccak_update(c, n, data);
+    cmt_keccak_update(c, length, data);
     cmt_keccak_final(c, md);
     return md;
 }
diff --git a/sys-utils/libcmt/src/merkle.c b/sys-utils/libcmt/src/merkle.c
index 79d7df55..ae5c079c 100644
--- a/sys-utils/libcmt/src/merkle.c
+++ b/sys-utils/libcmt/src/merkle.c
@@ -127,8 +127,8 @@ void cmt_merkle_fini(cmt_merkle_t *me) {
     (void) me;
 }
 
-int cmt_merkle_load(cmt_merkle_t *me, const char *name) {
-    FILE *fin = fopen(name, "rb");
+int cmt_merkle_load(cmt_merkle_t *me, const char *filepath) {
+    FILE *fin = fopen(filepath, "rb");
     if (!fin) {
         return -errno;
     }
@@ -143,8 +143,8 @@ int cmt_merkle_load(cmt_merkle_t *me, const char *name) {
     return rc;
 }
 
-int cmt_merkle_save(cmt_merkle_t *me, const char *name) {
-    FILE *fout = fopen(name, "wb");
+int cmt_merkle_save(cmt_merkle_t *me, const char *filepath) {
+    FILE *fout = fopen(filepath, "wb");
     if (!fout) {
         return -errno;
     }
@@ -202,11 +202,11 @@ void cmt_merkle_get_root_hash(cmt_merkle_t *me, uint8_t root[CMT_KECCAK_LENGTH])
     }
 }
 
-int cmt_merkle_push_back_data(cmt_merkle_t *me, size_t n, const void *data) {
+int cmt_merkle_push_back_data(cmt_merkle_t *me, size_t length, const void *data) {
     uint8_t hash[CMT_KECCAK_LENGTH];
     cmt_keccak_t c[1];
     cmt_keccak_init(c);
-    cmt_keccak_update(c, n, data);
+    cmt_keccak_update(c, length, data);
     cmt_keccak_final(c, hash);
     return cmt_merkle_push_back(me, hash);
 }
diff --git a/sys-utils/libcmt/src/rollup.c b/sys-utils/libcmt/src/rollup.c
index 7693dd3b..07e18022 100644
--- a/sys-utils/libcmt/src/rollup.c
+++ b/sys-utils/libcmt/src/rollup.c
@@ -15,11 +15,9 @@
  */
 #include "rollup.h"
 #include "abi.h"
-#include "keccak.h"
 #include "merkle.h"
 
 #include <errno.h>
-#include <stdarg.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -38,35 +36,41 @@
 
 #define DBG(X) debug(X, #X, __FILE__, __LINE__)
 static int debug(int rc, const char *expr, const char *file, int line) {
-    static bool checked = false, enabled = false;
+    static bool checked = false;
+    static bool enabled = false;
 
-    if (rc == 0)
+    if (rc == 0) {
         return 0;
+    }
 
     if (!checked) {
         enabled = getenv("CMT_DEBUG") != NULL;
         checked = true;
     }
-    if (enabled)
-        fprintf(stderr, "%s:%d Error %s on `%s'\n", file, line, expr, strerror(-rc));
+    if (enabled) {
+        (void) fprintf(stderr, "%s:%d Error %s on `%s'\n", file, line, expr, strerror(-rc));
+    }
     return rc;
 }
 
 int cmt_rollup_init(cmt_rollup_t *me) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
+    }
 
     int rc = DBG(cmt_io_init(me->io));
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
     cmt_merkle_init(me->merkle);
     return 0;
 }
 
 void cmt_rollup_fini(cmt_rollup_t *me) {
-    if (!me)
+    if (!me) {
         return;
+    }
 
     cmt_io_fini(me->io);
     cmt_merkle_fini(me->merkle);
@@ -74,10 +78,12 @@ void cmt_rollup_fini(cmt_rollup_t *me) {
 
 int cmt_rollup_emit_voucher(cmt_rollup_t *me, uint32_t address_length, const void *address_data, uint32_t value_length,
     const void *value_data, uint32_t length, const void *data, uint64_t *index) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!data && length)
+    }
+    if (!data && length) {
         return -EINVAL;
+    }
 
     cmt_buf_t tx[1] = {cmt_io_get_tx(me->io)};
     cmt_buf_t wr[1] = {*tx};
@@ -86,8 +92,9 @@ int cmt_rollup_emit_voucher(cmt_rollup_t *me, uint32_t address_length, const voi
 
     if (DBG(cmt_abi_put_funsel(wr, VOUCHER)) || DBG(cmt_abi_put_uint_be(wr, address_length, address_data)) ||
         DBG(cmt_abi_put_uint_be(wr, value_length, value_data)) || DBG(cmt_abi_put_bytes_s(wr, of)) ||
-        DBG(cmt_abi_put_bytes_d(wr, of, length, data, params_base)))
+        DBG(cmt_abi_put_bytes_d(wr, of, length, data, params_base))) {
         return -ENOBUFS;
+    }
 
     size_t m = wr->begin - tx->begin;
     struct cmt_io_yield req[1] = {{
@@ -97,26 +104,31 @@ int cmt_rollup_emit_voucher(cmt_rollup_t *me, uint32_t address_length, const voi
         .data = m,
     }};
     int rc = DBG(cmt_io_yield(me->io, req));
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
     uint64_t count = cmt_merkle_get_leaf_count(me->merkle);
 
     rc = cmt_merkle_push_back_data(me->merkle, m, tx->begin);
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
-    if (index)
+    if (index) {
         *index = count;
+    }
 
     return 0;
 }
 
 int cmt_rollup_emit_notice(cmt_rollup_t *me, uint32_t length, const void *data, uint64_t *index) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!data && length)
+    }
+    if (!data && length) {
         return -EINVAL;
+    }
 
     cmt_buf_t tx[1] = {cmt_io_get_tx(me->io)};
     cmt_buf_t wr[1] = {*tx};
@@ -124,8 +136,9 @@ int cmt_rollup_emit_notice(cmt_rollup_t *me, uint32_t length, const void *data,
     void *params_base = tx->begin + 4; // after funsel
 
     if (DBG(cmt_abi_put_funsel(wr, NOTICE)) || DBG(cmt_abi_put_bytes_s(wr, of)) ||
-        DBG(cmt_abi_put_bytes_d(wr, of, length, data, params_base)))
+        DBG(cmt_abi_put_bytes_d(wr, of, length, data, params_base))) {
         return -ENOBUFS;
+    }
 
     size_t m = wr->begin - tx->begin;
     struct cmt_io_yield req[1] = {{
@@ -135,31 +148,37 @@ int cmt_rollup_emit_notice(cmt_rollup_t *me, uint32_t length, const void *data,
         .data = m,
     }};
     int rc = DBG(cmt_io_yield(me->io, req));
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
     uint64_t count = cmt_merkle_get_leaf_count(me->merkle);
 
     rc = cmt_merkle_push_back_data(me->merkle, m, tx->begin);
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
-    if (index)
+    if (index) {
         *index = count;
+    }
 
     return 0;
 }
 
 int cmt_rollup_emit_report(cmt_rollup_t *me, uint32_t length, const void *data) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!data && length)
+    }
+    if (!data && length) {
         return -EINVAL;
+    }
 
     cmt_buf_t tx[1] = {cmt_io_get_tx(me->io)};
     cmt_buf_t wr[1] = {*tx};
-    if (cmt_buf_split(tx, length, wr, tx))
+    if (cmt_buf_split(tx, length, wr, tx)) {
         return -ENOBUFS;
+    }
 
     memcpy(wr->begin, data, length);
     struct cmt_io_yield req[1] = {{
@@ -172,15 +191,18 @@ int cmt_rollup_emit_report(cmt_rollup_t *me, uint32_t length, const void *data)
 }
 
 int cmt_rollup_emit_exception(cmt_rollup_t *me, uint32_t length, const void *data) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!data && length)
+    }
+    if (!data && length) {
         return -EINVAL;
+    }
 
     cmt_buf_t tx[1] = {cmt_io_get_tx(me->io)};
     cmt_buf_t wr[1] = {*tx};
-    if (cmt_buf_split(tx, length, wr, tx))
+    if (cmt_buf_split(tx, length, wr, tx)) {
         return -ENOBUFS;
+    }
 
     memcpy(tx->begin, data, length);
     struct cmt_io_yield req[1] = {{
@@ -193,10 +215,12 @@ int cmt_rollup_emit_exception(cmt_rollup_t *me, uint32_t length, const void *dat
 }
 
 int cmt_rollup_read_advance_state(cmt_rollup_t *me, cmt_rollup_advance_t *advance) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!advance)
+    }
+    if (!advance) {
         return -EINVAL;
+    }
 
     cmt_buf_t rd[1] = {cmt_io_get_rx(me->io)};
     cmt_buf_t st[1] = {{rd->begin + 4, rd->end}}; // EVM offsets are from after funsel
@@ -209,17 +233,20 @@ int cmt_rollup_read_advance_state(cmt_rollup_t *me, cmt_rollup_advance_t *advanc
         DBG(cmt_abi_get_uint(rd, sizeof(advance->block_number), &advance->block_number)) ||
         DBG(cmt_abi_get_uint(rd, sizeof(advance->block_timestamp), &advance->block_timestamp)) ||
         DBG(cmt_abi_get_uint(rd, sizeof(advance->index), &advance->index)) || DBG(cmt_abi_get_bytes_s(rd, of)) ||
-        DBG(cmt_abi_get_bytes_d(st, of, &payload_length, &advance->payload)))
+        DBG(cmt_abi_get_bytes_d(st, of, &payload_length, &advance->payload))) {
         return -ENOBUFS;
+    }
     advance->payload_length = payload_length;
     return 0;
 }
 
 int cmt_rollup_read_inspect_state(cmt_rollup_t *me, cmt_rollup_inspect_t *inspect) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!inspect)
+    }
+    if (!inspect) {
         return -EINVAL;
+    }
     cmt_buf_t rx[1] = {cmt_io_get_rx(me->io)};
     inspect->payload_length = cmt_buf_length(rx);
     inspect->payload = rx->begin;
@@ -234,8 +261,9 @@ static int accepted(union cmt_io_driver *io, uint32_t *n) {
         .data = *n,
     }};
     int rc = DBG(cmt_io_yield(io, req));
-    if (rc)
+    if (rc) {
         return rc;
+    }
 
     *n = req->data;
     return req->reason;
@@ -252,10 +280,12 @@ static int revert(union cmt_io_driver *io) {
 }
 
 int cmt_rollup_finish(cmt_rollup_t *me, cmt_rollup_finish_t *finish) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!finish)
+    }
+    if (!finish) {
         return -EINVAL;
+    }
 
     if (!finish->accept_previous_request) {
         return revert(me->io); /* revert should not return! */
@@ -264,27 +294,32 @@ int cmt_rollup_finish(cmt_rollup_t *me, cmt_rollup_finish_t *finish) {
     cmt_merkle_get_root_hash(me->merkle, cmt_io_get_tx(me->io).begin);
     finish->next_request_payload_length = CMT_WORD_LENGTH;
     int reason = accepted(me->io, &finish->next_request_payload_length);
-    if (reason < 0)
+    if (reason < 0) {
         return reason;
+    }
     finish->next_request_type = reason;
     cmt_merkle_init(me->merkle);
     return 0;
 }
 
 int cmt_gio_request(cmt_rollup_t *me, cmt_gio_request_t *req) {
-    if (!me)
+    if (!me) {
         return -EINVAL;
-    if (!req)
+    }
+    if (!req) {
         return -EINVAL;
+    }
 
     cmt_buf_t tx[1] = {cmt_io_get_tx(me->io)};
     size_t tx_length = tx->end - tx->begin;
-    if (req->id_length > tx_length || req->id_length > UINT32_MAX)
+    if (req->id_length > tx_length || req->id_length > UINT32_MAX) {
         return -ENOBUFS;
+    }
 
     if (req->id_length > 0) {
-        if (!req->id)
+        if (!req->id) {
             return -EINVAL;
+        }
         memcpy(tx->begin, req->id, req->id_length);
     }
 
@@ -296,13 +331,15 @@ int cmt_gio_request(cmt_rollup_t *me, cmt_gio_request_t *req) {
     }};
 
     int rc = DBG(cmt_io_yield(me->io, y));
-    if (rc != 0)
+    if (rc != 0) {
         return rc;
+    }
 
     cmt_buf_t rx[1] = {cmt_io_get_rx(me->io)};
     size_t rx_length = rx->end - rx->begin;
-    if (rx_length != y->data)
+    if (rx_length != y->data) {
         return -EINVAL;
+    }
 
     req->response = rx->begin;
     req->response_code = y->reason;
diff --git a/sys-utils/libcmt/src/rollup.h b/sys-utils/libcmt/src/rollup.h
index aadf59d8..be6babb3 100644
--- a/sys-utils/libcmt/src/rollup.h
+++ b/sys-utils/libcmt/src/rollup.h
@@ -21,7 +21,7 @@
  * encoding/decoding and @ref libcmt_merkle tree handling.
  *
  * Mocked version has support for simulating I/O via environment variables:
- * @p CMT_INPUTS="0:input.bin,..." and verbose ouput with @p CMT_DEBUG=yes.
+ * @p CMT_INPUTS="0:input.bin,..." and verbose output with @p CMT_DEBUG=yes.
  *
  * Lets look at some code:
  *
@@ -32,7 +32,6 @@
 #ifndef CMT_ROLLUP_H
 #define CMT_ROLLUP_H
 #include "abi.h"
-#include "buf.h"
 #include "io.h"
 #include "merkle.h"
 
diff --git a/sys-utils/libcmt/tests/abi-multi.c b/sys-utils/libcmt/tests/abi-multi.c
index 2a5e2ad3..9f04d86a 100644
--- a/sys-utils/libcmt/tests/abi-multi.c
+++ b/sys-utils/libcmt/tests/abi-multi.c
@@ -18,8 +18,6 @@
 #include <assert.h>
 #include <stdint.h>
 #include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 
 // EvmAdvance(address,uint256,uint256,uint256,bytes)
 #define ADVANCE CMT_ABI_FUNSEL(0xd2, 0x0c, 0x60, 0xb4)
@@ -31,13 +29,14 @@
 #define NOTICE CMT_ABI_FUNSEL(0xc2, 0x58, 0xd6, 0xe5)
 
 static int memeq(uint8_t *x, uint8_t *y, size_t n, const char *file, int line) {
-    for (size_t i = 0; i < n; ++i)
+    for (size_t i = 0; i < n; ++i) {
         if (x[i] != y[i]) {
-            fprintf(stderr, "%s:%d Missmatch at offset %zu (0x%02x != 0x%02x)\n", file, line, i, x[i], y[i]);
+            (void) fprintf(stderr, "%s:%d Mismatch at offset %zu (0x%02x != 0x%02x)\n", file, line, i, x[i], y[i]);
             cmt_buf_xxd(x, x + n, 0x20);
             cmt_buf_xxd(y, y + n, 0x20);
             return -1;
         }
+    }
     return 0;
 }
 
@@ -58,7 +57,9 @@ static int advance(void) {
         0x04, 0xde, 0xad, 0xbe, 0xef, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
     uint8_t mem[256];
-    cmt_buf_t bb[1] = {{mem, mem + sizeof mem}}, wr[1] = {*bb}, of[1];
+    cmt_buf_t bb[1] = {{mem, mem + sizeof mem}};
+    cmt_buf_t wr[1] = {*bb};
+    cmt_buf_t of[1];
 
     uint8_t address[20] = {0};
     uint8_t bytes[] = {0xde, 0xad, 0xbe, 0xef};
@@ -88,7 +89,9 @@ static int voucher(void) {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 
     uint8_t mem[256];
-    cmt_buf_t bb[1] = {{mem, mem + sizeof mem}}, wr[1] = {*bb}, of[1];
+    cmt_buf_t bb[1] = {{mem, mem + sizeof mem}};
+    cmt_buf_t wr[1] = {*bb};
+    cmt_buf_t of[1];
 
     uint8_t address[20] = {0};
     uint8_t bytes[] = {0xde, 0xad, 0xbe, 0xef};
@@ -112,7 +115,9 @@ static int notice(void) {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
 
     uint8_t mem[256];
-    cmt_buf_t bb[1] = {{mem, mem + sizeof mem}}, wr[1] = {*bb}, of[1];
+    cmt_buf_t bb[1] = {{mem, mem + sizeof mem}};
+    cmt_buf_t wr[1] = {*bb};
+    cmt_buf_t of[1];
 
     uint8_t bytes[] = {0xde, 0xad, 0xbe, 0xef};
 
diff --git a/sys-utils/libcmt/tests/abi-single.c b/sys-utils/libcmt/tests/abi-single.c
index ebb04cc0..6064e8b0 100644
--- a/sys-utils/libcmt/tests/abi-single.c
+++ b/sys-utils/libcmt/tests/abi-single.c
@@ -23,21 +23,17 @@
  * @param [in] N - size in bytes
  * @note don't port */
 #define CMT_BUF_DECL(S, L)                                                                                             \
-    cmt_buf_t S[1] = {{                                                                                                \
-        .begin = (uint8_t[L]){0},                                                                                      \
-        .end = (S)->begin + L,                                                                                         \
-    }}
+    cmt_buf_t S[1] = {{.begin = (uint8_t[L]){0},                                                                       \
+        .end = (S)->begin + (L)}} // NOLINT(clang-analyzer-core.UndefinedBinaryOperatorResult)
 
 /** Declare a cmt_buf_t with parameters backed memory.
  * @param [in] L - size in bytes
  * @note don't port */
 #define CMT_BUF_DECL3(S, L, P)                                                                                         \
-    cmt_buf_t S[1] = {{                                                                                                \
-        .begin = P,                                                                                                    \
-        .end = (S)->begin + L,                                                                                         \
-    }}
+    cmt_buf_t S[1] = {                                                                                                 \
+        {.begin = (P), .end = (S)->begin + (L)}} // NOLINT(clang-analyzer-core.UndefinedBinaryOperatorResult)
 
-static void encode_u8() {
+static void encode_u8(void) {
     uint8_t x = 0x01;
     uint8_t en[CMT_WORD_LENGTH];
     uint8_t be[CMT_WORD_LENGTH] = {
@@ -78,7 +74,7 @@ static void encode_u8() {
     assert(memcmp(en, be, sizeof(be)) == 0);
 }
 
-static void encode_u16() {
+static void encode_u16(void) {
     uint16_t x = UINT16_C(0x0123);
     uint8_t en[CMT_WORD_LENGTH];
     uint8_t be[CMT_WORD_LENGTH] = {
@@ -119,7 +115,7 @@ static void encode_u16() {
     assert(memcmp(en, be, sizeof(be)) == 0);
 }
 
-static void encode_u32() {
+static void encode_u32(void) {
     uint32_t x = UINT32_C(0x01234567);
     uint8_t en[CMT_WORD_LENGTH];
     uint8_t be[CMT_WORD_LENGTH] = {
@@ -160,7 +156,7 @@ static void encode_u32() {
     assert(memcmp(en, be, sizeof(be)) == 0);
 }
 
-static void encode_u64() {
+static void encode_u64(void) {
     uint64_t x = UINT64_C(0x0123456789abcdef);
     uint8_t en[CMT_WORD_LENGTH];
     uint8_t be[CMT_WORD_LENGTH] = {
@@ -201,7 +197,7 @@ static void encode_u64() {
     assert(memcmp(en, be, sizeof(be)) == 0);
 }
 
-static void encode_u256() {
+static void encode_u256(void) {
     uint8_t x[CMT_WORD_LENGTH] = {
         0x1f,
         0x1e,
@@ -275,7 +271,7 @@ static void encode_u256() {
     assert(memcmp(en, be, sizeof(be)) == 0);
 }
 
-static void encode_edom() {
+static void encode_edom(void) {
     uint8_t x[CMT_WORD_LENGTH + 1] = {
         0x00,
         0x01,
@@ -316,8 +312,9 @@ static void encode_edom() {
     assert(cmt_abi_encode_uint_nn(sizeof(x), x, en) == EDOM);
 }
 
-static void decode_u8() {
-    uint8_t x, ex = 0x01;
+static void decode_u8(void) {
+    uint8_t x = 0;
+    uint8_t ex = 0x01;
     uint8_t be[CMT_WORD_LENGTH] = {
         0x00,
         0x00,
@@ -356,8 +353,9 @@ static void decode_u8() {
     assert(x == ex);
 }
 
-static void decode_u16() {
-    uint16_t x, ex = UINT16_C(0x0123);
+static void decode_u16(void) {
+    uint16_t x = 0;
+    uint16_t ex = UINT16_C(0x0123);
     uint8_t be[CMT_WORD_LENGTH] = {
         0x00,
         0x00,
@@ -396,8 +394,9 @@ static void decode_u16() {
     assert(x == ex);
 }
 
-static void decode_u32() {
-    uint32_t x, ex = UINT32_C(0x01234567);
+static void decode_u32(void) {
+    uint32_t x = 0;
+    uint32_t ex = UINT32_C(0x01234567);
     uint8_t be[CMT_WORD_LENGTH] = {
         0x00,
         0x00,
@@ -436,8 +435,9 @@ static void decode_u32() {
     assert(x == ex);
 }
 
-static void decode_u64() {
-    uint64_t x, ex = UINT64_C(0x0123456789abcdef);
+static void decode_u64(void) {
+    uint64_t x = 0;
+    uint64_t ex = UINT64_C(0x0123456789abcdef);
     uint8_t be[CMT_WORD_LENGTH] = {
         0x00,
         0x00,
@@ -476,42 +476,42 @@ static void decode_u64() {
     assert(x == ex);
 }
 
-static void decode_u256() {
-    uint8_t x[CMT_WORD_LENGTH],
-        ex[CMT_WORD_LENGTH] = {
-            0x1f,
-            0x1e,
-            0x1d,
-            0x1c,
-            0x1b,
-            0x1a,
-            0x19,
-            0x18,
-            0x17,
-            0x16,
-            0x15,
-            0x14,
-            0x13,
-            0x12,
-            0x11,
-            0x10,
-            0x0f,
-            0x0e,
-            0x0d,
-            0x0c,
-            0x0b,
-            0x0a,
-            0x09,
-            0x08,
-            0x07,
-            0x06,
-            0x05,
-            0x04,
-            0x03,
-            0x02,
-            0x01,
-            0x00,
-        };
+static void decode_u256(void) {
+    uint8_t x[CMT_WORD_LENGTH];
+    uint8_t ex[CMT_WORD_LENGTH] = {
+        0x1f,
+        0x1e,
+        0x1d,
+        0x1c,
+        0x1b,
+        0x1a,
+        0x19,
+        0x18,
+        0x17,
+        0x16,
+        0x15,
+        0x14,
+        0x13,
+        0x12,
+        0x11,
+        0x10,
+        0x0f,
+        0x0e,
+        0x0d,
+        0x0c,
+        0x0b,
+        0x0a,
+        0x09,
+        0x08,
+        0x07,
+        0x06,
+        0x05,
+        0x04,
+        0x03,
+        0x02,
+        0x01,
+        0x00,
+    };
     uint8_t be[CMT_WORD_LENGTH] = {
         0x00,
         0x01,
@@ -551,8 +551,8 @@ static void decode_u256() {
 }
 
 /* encoded value can't be represented in a uint64_t. */
-static void decode_edom() {
-    uint64_t x;
+static void decode_edom(void) {
+    uint64_t x = 0;
     uint8_t be[CMT_WORD_LENGTH] = {
         0x00,
         0x00,
@@ -590,7 +590,7 @@ static void decode_edom() {
     assert(cmt_abi_decode_uint(be, sizeof(x), (void *) &x) == -EDOM);
 }
 
-static void put_funsel() {
+static void put_funsel(void) {
     uint8_t data[] = {0xcd, 0xcd, 0x77, 0xc0};
     uint32_t funsel = CMT_ABI_FUNSEL(data[0], data[1], data[2], data[3]);
     CMT_BUF_DECL(b, 64);
@@ -600,7 +600,7 @@ static void put_funsel() {
     assert(memcmp(b->begin, data, 4) == 0);
 }
 
-static void put_uint() {
+static void put_uint(void) {
     uint64_t x = UINT64_C(0x0123456789abcdef);
     uint8_t be[CMT_WORD_LENGTH] = {
         0x00,
@@ -643,7 +643,7 @@ static void put_uint() {
     assert(memcmp(b->begin, be, sizeof(be)) == 0);
 }
 
-static void put_address() {
+static void put_address(void) {
     uint8_t x[20] = {0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
         0x01, 0x23, 0x45, 0x67};
     uint8_t be[CMT_WORD_LENGTH] = {
@@ -687,7 +687,7 @@ static void put_address() {
     assert(memcmp(b->begin, be, sizeof(be)) == 0);
 }
 
-static void put_bytes() {
+static void put_bytes(void) {
     uint64_t x = UINT64_C(0x0123456789abcdef);
     uint8_t be[] = {
         0x00,
@@ -772,16 +772,18 @@ static void put_bytes() {
         0x00,
     };
     CMT_BUF_DECL(b, 128);
-    cmt_buf_t it[1] = {*b}, of[1];
+    cmt_buf_t it[1] = {*b};
+    cmt_buf_t of[1];
 
     assert(cmt_abi_put_bytes_s(it, of) == 0);
     assert(cmt_abi_put_bytes_d(it, of, sizeof(x), &x, b->begin) == 0);
     assert(memcmp(b->begin, be, sizeof(be)) == 0);
 }
 
-static void get_funsel() {
+static void get_funsel(void) {
     CMT_BUF_DECL(b, 64);
-    cmt_buf_t wr[1] = {*b}, rd[1] = {*b};
+    cmt_buf_t wr[1] = {*b};
+    cmt_buf_t rd[1] = {*b};
     uint32_t funsel = CMT_ABI_FUNSEL(1, 2, 3, 4);
 
     assert(cmt_abi_put_funsel(wr, funsel) == 0);
@@ -789,8 +791,9 @@ static void get_funsel() {
     assert(cmt_abi_check_funsel(rd, funsel) == 0);
 }
 
-static void get_uint() {
-    uint64_t x, ex = UINT64_C(0x0123456789abcdef);
+static void get_uint(void) {
+    uint64_t x = 0;
+    uint64_t ex = UINT64_C(0x0123456789abcdef);
     uint8_t be[CMT_WORD_LENGTH] = {
         0x00,
         0x00,
@@ -832,7 +835,7 @@ static void get_uint() {
     assert(x == ex);
 }
 
-static void get_address() {
+static void get_address(void) {
     uint8_t x[20];
     uint8_t ex[20] = {0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
         0x01, 0x23, 0x45, 0x67};
@@ -877,7 +880,7 @@ static void get_address() {
     assert(memcmp(x, ex, sizeof(ex)) == 0);
 }
 
-static void get_bytes() {
+static void get_bytes(void) {
     uint64_t ex = UINT64_C(0x0123456789abcdef);
     uint8_t be[] = {
         0x00,
@@ -962,14 +965,16 @@ static void get_bytes() {
         0x00,
     };
     CMT_BUF_DECL3(b, sizeof(be), be);
-    cmt_buf_t it[1] = {*b}, of[1], bytes[1];
+    cmt_buf_t it[1] = {*b};
+    cmt_buf_t of[1];
+    cmt_buf_t bytes[1];
 
     assert(cmt_abi_get_bytes_s(it, of) == 0);
     assert(cmt_abi_peek_bytes_d(b, of, bytes) == 0);
     assert(memcmp(bytes->begin, &ex, sizeof(ex)) == 0);
 }
 
-int main() {
+int main(void) {
     encode_u8();
     encode_u16();
     encode_u32();
diff --git a/sys-utils/libcmt/tests/io_echo.c b/sys-utils/libcmt/tests/io_echo.c
index 449b239f..39d7b81e 100644
--- a/sys-utils/libcmt/tests/io_echo.c
+++ b/sys-utils/libcmt/tests/io_echo.c
@@ -15,7 +15,6 @@
  */
 #include "io.h"
 
-#include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -28,7 +27,7 @@ int next(union cmt_io_driver *io, uint32_t *n) {
         .data = *n,
     }};
     if (cmt_io_yield(io, req)) {
-        fprintf(stderr, "%s:%d failed to yield\n", __FILE__, __LINE__);
+        (void) fprintf(stderr, "%s:%d failed to yield\n", __FILE__, __LINE__);
         return -1;
     }
     *n = req->data;
@@ -70,16 +69,15 @@ int main(void) {
     union cmt_io_driver io[1];
     int rc = cmt_io_init(io);
     if (rc) {
-        fprintf(stderr, "%s:%d failed to init with: %s\n", __FILE__, __LINE__, strerror(-rc));
+        (void) fprintf(stderr, "%s:%d failed to init with: %s\n", __FILE__, __LINE__, strerror(-rc));
         return EXIT_FAILURE;
     }
 
     cmt_buf_t tx = cmt_io_get_tx(io);
     cmt_buf_t rx = cmt_io_get_rx(io);
 
-    int type;
     uint32_t n = 0;
-    while ((type = next(io, &n)) >= 0) {
+    while (next(io, &n) >= 0) {
         memcpy(tx.begin, rx.begin, n);
         voucher(io, n);
         report(io, n);
diff --git a/sys-utils/libcmt/tests/io_exception.c b/sys-utils/libcmt/tests/io_exception.c
index fed67651..f46919d3 100644
--- a/sys-utils/libcmt/tests/io_exception.c
+++ b/sys-utils/libcmt/tests/io_exception.c
@@ -13,29 +13,28 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+#include "buf.h"
 #include "io.h"
 
-#include <inttypes.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
 int main(void) {
     /* init ------------------------------------------------------------- */
-    struct cmt_io_driver io[1];
+    union cmt_io_driver io[1];
     if (cmt_io_init(io)) {
-        fprintf(stderr, "%s:%d failed to init\n", __FILE__, __LINE__);
+        (void) fprintf(stderr, "%s:%d failed to init\n", __FILE__, __LINE__);
         return EXIT_FAILURE;
     }
 
-    size_t tx_sz, rx_sz;
-    uint8_t *tx, *rx;
-    tx = cmt_io_get_tx(io, &tx_sz), rx = cmt_io_get_rx(io, &rx_sz);
+    cmt_buf_t tx = cmt_io_get_tx(io);
 
     /* prepare exception ------------------------------------------------ */
     const char message[] = "exception contents\n";
     size_t n = strlen(message);
-    memcpy(tx, message, n);
+    tx.begin = (uint8_t *) message;
+    tx.end = tx.begin + n;
 
     /* exception -------------------------------------------------------- */
     struct cmt_io_yield req[1] = {{
@@ -45,7 +44,7 @@ int main(void) {
         .data = n,
     }};
     if (cmt_io_yield(io, req)) {
-        fprintf(stderr, "%s:%d failed to yield\n", __FILE__, __LINE__);
+        (void) fprintf(stderr, "%s:%d failed to yield\n", __FILE__, __LINE__);
         return -1;
     }
 
diff --git a/sys-utils/libcmt/tests/keccak.c b/sys-utils/libcmt/tests/keccak.c
index baf02a13..c1f00156 100644
--- a/sys-utils/libcmt/tests/keccak.c
+++ b/sys-utils/libcmt/tests/keccak.c
@@ -17,11 +17,9 @@
 #include "abi.h"
 
 #include <assert.h>
-#include <errno.h>
-#include <stdio.h>
 #include <string.h>
 
-static void inits() {
+static void inits(void) {
     uint8_t md[3][CMT_KECCAK_LENGTH];
     uint8_t data[] = {
         0x00,
@@ -69,12 +67,12 @@ static void inits() {
     assert(memcmp(md[0], md[1], CMT_KECCAK_LENGTH) == 0);
 }
 
-static void funsel() {
+static void funsel(void) {
     const char s[] = "baz(uint32,bool)";
     assert(cmt_keccak_funsel(s) == CMT_ABI_FUNSEL(0xcd, 0xcd, 0x77, 0xc0));
 }
 
-int main() {
+int main(void) {
     funsel();
     inits();
     return 0;
diff --git a/sys-utils/libcmt/tests/merkle.c b/sys-utils/libcmt/tests/merkle.c
index ee5a335b..11dd5eb7 100644
--- a/sys-utils/libcmt/tests/merkle.c
+++ b/sys-utils/libcmt/tests/merkle.c
@@ -19,7 +19,7 @@
 #include <stdio.h>
 #include <string.h>
 
-#if 0
+#if 0 // NOLINT
 static void print(int m, uint8_t md[CMT_KECCAK_LENGTH])
 {
 	printf("%3d: ", m);
@@ -28,7 +28,7 @@ static void print(int m, uint8_t md[CMT_KECCAK_LENGTH])
 }
 #endif
 
-static int pristine_zero() {
+static int pristine_zero(void) {
     uint8_t md[CMT_KECCAK_LENGTH];
     cmt_merkle_t M[1];
     cmt_merkle_init(M);
@@ -70,15 +70,16 @@ static int pristine_zero() {
 
     for (uint64_t i = 0; i < 64; ++i) {
         cmt_merkle_get_root_hash(M, md);
-        if (memcmp(md, expected, sizeof expected) != 0)
+        if (memcmp(md, expected, sizeof expected) != 0) {
             return -1;
+        }
 
         cmt_merkle_push_back_data(M, 0, NULL);
     }
     return 0;
 }
 
-int main() {
+int main(void) {
     assert(pristine_zero() == 0);
     return 0;
 }
diff --git a/sys-utils/libcmt/tests/rollup_echo.c b/sys-utils/libcmt/tests/rollup_echo.c
index b021897a..325e7434 100644
--- a/sys-utils/libcmt/tests/rollup_echo.c
+++ b/sys-utils/libcmt/tests/rollup_echo.c
@@ -15,7 +15,6 @@
  */
 #include "rollup.h"
 
-#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -35,8 +34,9 @@
 int main(void) {
     cmt_rollup_t rollup;
 
-    if (cmt_rollup_init(&rollup))
+    if (cmt_rollup_init(&rollup)) {
         return EXIT_FAILURE;
+    }
     // cmt_rollup_load_merkle(rollup, "/tmp/merkle.dat");
 
     uint8_t small[] = {
@@ -74,42 +74,46 @@ int main(void) {
         0x01,
     };
     for (;;) {
-        int rc;
+        int rc = 0;
         cmt_rollup_finish_t finish = {.accept_previous_request = true};
         cmt_rollup_advance_t advance;
         // cmt_rollup_inspect_t inspect;
 
-        if (cmt_rollup_finish(&rollup, &finish) < 0)
+        if (cmt_rollup_finish(&rollup, &finish) < 0) {
             goto teardown;
+        }
 
         switch (finish.next_request_type) {
             case HTIF_YIELD_REASON_ADVANCE:
                 rc = cmt_rollup_read_advance_state(&rollup, &advance);
                 if (rc < 0) {
-                    fprintf(stderr, "%s:%d Error on advance %s (%d)\n", __FILE__, __LINE__, strerror(-rc), (-rc));
+                    (void) fprintf(stderr, "%s:%d Error on advance %s (%d)\n", __FILE__, __LINE__, strerror(-rc),
+                        (-rc));
                     break;
                 }
 
                 rc = cmt_rollup_emit_voucher(&rollup, sizeof advance.msg_sender, advance.msg_sender, sizeof small,
                     small, advance.payload_length, advance.payload, NULL);
                 if (rc < 0) {
-                    fprintf(stderr, "%s:%d Error on voucher %s (%d)\n", __FILE__, __LINE__, strerror(-rc), (-rc));
+                    (void) fprintf(stderr, "%s:%d Error on voucher %s (%d)\n", __FILE__, __LINE__, strerror(-rc),
+                        (-rc));
                     break;
                 }
 
                 rc = cmt_rollup_emit_notice(&rollup, advance.payload_length, advance.payload, NULL);
                 if (rc < 0) {
-                    fprintf(stderr, "%s:%d Error on notice %s (%d)\n", __FILE__, __LINE__, strerror(-rc), (-rc));
+                    (void) fprintf(stderr, "%s:%d Error on notice %s (%d)\n", __FILE__, __LINE__, strerror(-rc), (-rc));
                     break;
                 }
 
                 rc = cmt_rollup_emit_report(&rollup, advance.payload_length, advance.payload);
                 if (rc < 0) {
-                    fprintf(stderr, "%s:%d Error on notice %s (%d)\n", __FILE__, __LINE__, strerror(-rc), (-rc));
+                    (void) fprintf(stderr, "%s:%d Error on notice %s (%d)\n", __FILE__, __LINE__, strerror(-rc), (-rc));
                     break;
                 }
                 break;
             case HTIF_YIELD_REASON_INSPECT:
+            default:
                 break;
         }
     }
diff --git a/sys-utils/libcmt/tools/funsel.c b/sys-utils/libcmt/tools/funsel.c
index 95f440a4..2fe43f39 100644
--- a/sys-utils/libcmt/tools/funsel.c
+++ b/sys-utils/libcmt/tools/funsel.c
@@ -20,7 +20,7 @@
 
 int main(int argc, char *argv[]) {
     if (argc < 2) {
-        fprintf(stderr, "usage: %s \"<declaration>\"\n", argv[0]);
+        (void) fprintf(stderr, "usage: %s \"<declaration>\"\n", argv[0]);
         exit(1);
     }