diff --git a/armsrc/Standalone/hf_cardhopper.c b/armsrc/Standalone/hf_cardhopper.c
index cfad35605..0a154f66b 100644
--- a/armsrc/Standalone/hf_cardhopper.c
+++ b/armsrc/Standalone/hf_cardhopper.c
@@ -275,16 +275,16 @@ static void cook_ats(packet_t *ats, uint8_t fwi, uint8_t sfgi) {
         ats->dat[0] = 0x04;
         ats->dat[1] = 0x78;
         ats->dat[2] = 0x77;
-        ats->dat[3] = 0x80;
+        // ats->dat[3] = 0x80;
     } else if (ats->len == 2) {
         ats->len = 4;
         ats->dat[0] = 0x04;
         ats->dat[2] = 0x77;
-        ats->dat[3] = 0x80;
+        // ats->dat[3] = 0x80;
     } else if (ats->len == 3) {
         ats->len = 4;
         ats->dat[0] = 0x04;
-        ats->dat[3] = 0x80;
+        // ats->dat[3] = 0x80;
     }
 
     // Set the SFGI as well as the FWI - needed for some older readers (firmware revs?)
@@ -293,7 +293,7 @@ static void cook_ats(packet_t *ats, uint8_t fwi, uint8_t sfgi) {
 }
 
 
-static bool try_use_canned_response(uint8_t *dat, int len, tag_response_info_t *canned) {
+static bool try_use_canned_response(const uint8_t *dat, int len, tag_response_info_t *canned) {
     if ((dat[0] == ISO14443A_CMD_REQA || dat[0] == ISO14443A_CMD_WUPA) && len == 1) {
         EmSendPrecompiledCmd(canned + RESP_INDEX_ATQA);
         return true;
diff --git a/armsrc/iso14443a.c b/armsrc/iso14443a.c
index 410a83308..346669398 100644
--- a/armsrc/iso14443a.c
+++ b/armsrc/iso14443a.c
@@ -2529,7 +2529,7 @@ static int GetATQA(uint8_t *resp, uint8_t *resp_par, iso14a_polling_parameters_t
 
     bool first_try = true;
     uint32_t retry_timeout = WUPA_RETRY_TIMEOUT * polling_parameters->frame_count + polling_parameters->extra_timeout;
-    uint32_t start_time;
+    uint32_t start_time = 0;
     int len;
 
     uint8_t current_frame = 0;
@@ -2584,7 +2584,7 @@ int iso14443a_select_cardEx(uint8_t *uid_ptr, iso14a_card_select_t *p_card, uint
     uint8_t resp[MAX_FRAME_SIZE] = {0}; // theoretically. A usual RATS will be much smaller
     uint8_t resp_par[MAX_PARITY_SIZE] = {0};
 
-    uint8_t sak; // cascade uid
+    uint8_t sak = 0; // cascade uid
     bool do_cascade = 1;
     int cascade_level = 0;
 
diff --git a/armsrc/mifaresim.c b/armsrc/mifaresim.c
index a44220209..eddb59dc0 100644
--- a/armsrc/mifaresim.c
+++ b/armsrc/mifaresim.c
@@ -523,7 +523,7 @@ void Mifare1ksim(uint16_t flags, uint8_t exitAfterNReads, uint8_t *datain, uint1
     uint8_t rAUTH_NT_keystream[4];
     uint32_t nonce = 0;
 
-    tUart14a *uart = GetUart14a();
+    const tUart14a *uart = GetUart14a();
 
     // free eventually allocated BigBuf memory but keep Emulator Memory
     BigBuf_free_keep_EM();
diff --git a/client/deps/hardnested/hardnested_bruteforce.c b/client/deps/hardnested/hardnested_bruteforce.c
index e4b203f4d..f55d8885a 100644
--- a/client/deps/hardnested/hardnested_bruteforce.c
+++ b/client/deps/hardnested/hardnested_bruteforce.c
@@ -304,12 +304,13 @@ static bool ensure_buckets_alloc(size_t need_buckets) {
         while (need_buckets > alloc_sz) {
             alloc_sz *= 2;
         }
-
-        buckets = realloc(buckets, sizeof(statelist_t *) * alloc_sz);
-        if (buckets == NULL) {
+        statelist_t **new_buckets = realloc(buckets, sizeof(statelist_t *) * alloc_sz);
+        if (new_buckets == NULL) {
+            free(buckets);
             buckets_allocated = 0;
             return false;
         }
+        buckets = new_buckets;
         memset(buckets + buckets_allocated, 0, (alloc_sz - buckets_allocated) * sizeof(statelist_t *));
         buckets_allocated = alloc_sz;
     }
diff --git a/client/src/cmddata.c b/client/src/cmddata.c
index 4c8200ee6..6eb3fcb85 100644
--- a/client/src/cmddata.c
+++ b/client/src/cmddata.c
@@ -2224,7 +2224,7 @@ int CmdNorm(const char *Cmd) {
         if (g_GraphBuffer[i] < min) min = g_GraphBuffer[i];
     }
 
-    if (max != min) {
+    if ((g_GraphTraceLen > 10) && (max != min)) {
         for (uint32_t i = 0; i < g_GraphTraceLen; ++i) {
             g_GraphBuffer[i] = ((long)(g_GraphBuffer[i] - ((max + min) / 2)) * 256) / (max - min);
             //marshmelow: adjusted *1000 to *256 to make +/- 128 so demod commands still work
@@ -3218,12 +3218,12 @@ static int CmdNumCon(const char *Cmd) {
     int hlen = 256;
     char hex[256];
     memset(hex, 0, sizeof(hex));
-    res = CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)hex, sizeof(hex), &hlen);
+    res |= CLIParamStrToBuf(arg_get_str(ctx, 2), (uint8_t *)hex, sizeof(hex), &hlen);
 
     int blen = 256;
     char bin[256];
     memset(bin, 0, sizeof(bin));
-    res = CLIParamStrToBuf(arg_get_str(ctx, 3), (uint8_t *)bin, sizeof(bin), &blen);
+    res |= CLIParamStrToBuf(arg_get_str(ctx, 3), (uint8_t *)bin, sizeof(bin), &blen);
 
     bool shall_invert = arg_get_lit(ctx, 4);
     CLIParserFree(ctx);
@@ -3236,6 +3236,7 @@ static int CmdNumCon(const char *Cmd) {
 
     // results for MPI actions
     bool ret = false;
+    (void) ret;
 
     // container of big number
     mbedtls_mpi N;
diff --git a/client/src/cmdhflist.c b/client/src/cmdhflist.c
index 8e605b91f..bf67a2b0b 100644
--- a/client/src/cmdhflist.c
+++ b/client/src/cmdhflist.c
@@ -1362,8 +1362,8 @@ void annotateMfPlus(char *exp, size_t size, uint8_t *cmd, uint8_t cmdsize) {
                     if (data_size > 2) {
                         uint16_t uBlockNum = MemLeToUint2byte(data) ;
                         uint8_t uQty = data[2] ;
-                        if (uQty != 1) {
-                            snprintf(exp, size, "READ %s(%u-%u) %s_%s", encrypted, uBlockNum, uBlockNum + uQty - 1, responseMaced, commandMaced);
+                        if (uQty > 1) {
+                            snprintf(exp, size, "READ %s(%u-%i) %s_%s", encrypted, uBlockNum, uBlockNum + uQty - 1, responseMaced, commandMaced);
                         } else {
                             snprintf(exp, size, "READ %s(%u) %s_%s", encrypted, uBlockNum, responseMaced, commandMaced);
                         }
diff --git a/client/src/cmdhfvas.c b/client/src/cmdhfvas.c
index 9d04b7477..4e4a305e5 100644
--- a/client/src/cmdhfvas.c
+++ b/client/src/cmdhfvas.c
@@ -28,8 +28,8 @@
 #include "util.h"
 #include "util_posix.h"
 #include "iso7816/iso7816core.h"
-#include "stddef.h"
-#include "stdbool.h"
+#include <stddef.h>
+#include <stdbool.h>
 #include "mifare.h"
 #include <stdlib.h>
 #include <string.h>
@@ -59,10 +59,10 @@ uint8_t aid[] = { 0x4f, 0x53, 0x45, 0x2e, 0x56, 0x41, 0x53, 0x2e, 0x30, 0x31 };
 uint8_t getVasUrlOnlyP2 = 0x00;
 uint8_t getVasFullReqP2 = 0x01;
 
-static int ParseSelectVASResponse(uint8_t *response, size_t resLen, bool verbose) {
+static int ParseSelectVASResponse(const uint8_t *response, size_t resLen, bool verbose) {
     struct tlvdb *tlvRoot = tlvdb_parse_multi(response, resLen);
 
-    struct tlvdb *versionTlv = tlvdb_find_full(tlvRoot, 0x9F21);
+    const struct tlvdb *versionTlv = tlvdb_find_full(tlvRoot, 0x9F21);
     if (versionTlv == NULL) {
         tlvdb_free(tlvRoot);
         return PM3_ECARDEXCHANGE;
@@ -80,7 +80,7 @@ static int ParseSelectVASResponse(uint8_t *response, size_t resLen, bool verbose
         return PM3_ECARDEXCHANGE;
     }
 
-    struct tlvdb *capabilitiesTlv = tlvdb_find_full(tlvRoot, 0x9F23);
+    const struct tlvdb *capabilitiesTlv = tlvdb_find_full(tlvRoot, 0x9F23);
     if (capabilitiesTlv == NULL) {
         tlvdb_free(tlvRoot);
         return PM3_ECARDEXCHANGE;
@@ -99,7 +99,7 @@ static int ParseSelectVASResponse(uint8_t *response, size_t resLen, bool verbose
     return PM3_SUCCESS;
 }
 
-static int CreateGetVASDataCommand(uint8_t *pidHash, const char *url, size_t urlLen, uint8_t *out, int *outLen) {
+static int CreateGetVASDataCommand(const uint8_t *pidHash, const char *url, size_t urlLen, uint8_t *out, int *outLen) {
     if (pidHash == NULL && url == NULL) {
         PrintAndLogEx(FAILED, "Must provide a Pass Type ID or a URL");
         return PM3_EINVARG;
@@ -154,10 +154,10 @@ static int CreateGetVASDataCommand(uint8_t *pidHash, const char *url, size_t url
     return PM3_SUCCESS;
 }
 
-static int ParseGetVASDataResponse(uint8_t *res, size_t resLen, uint8_t *cryptogram, size_t *cryptogramLen) {
+static int ParseGetVASDataResponse(const uint8_t *res, size_t resLen, uint8_t *cryptogram, size_t *cryptogramLen) {
     struct tlvdb *tlvRoot = tlvdb_parse_multi(res, resLen);
 
-    struct tlvdb *cryptogramTlvdb = tlvdb_find_full(tlvRoot, 0x9F27);
+    const struct tlvdb *cryptogramTlvdb = tlvdb_find_full(tlvRoot, 0x9F27);
     if (cryptogramTlvdb == NULL) {
         tlvdb_free(tlvRoot);
         return PM3_ECARDEXCHANGE;
@@ -171,10 +171,10 @@ static int ParseGetVASDataResponse(uint8_t *res, size_t resLen, uint8_t *cryptog
     return PM3_SUCCESS;
 }
 
-static int LoadReaderPrivateKey(uint8_t *buf, size_t bufLen, mbedtls_ecp_keypair *privKey) {
+static int LoadReaderPrivateKey(const uint8_t *buf, size_t bufLen, mbedtls_ecp_keypair *privKey) {
     struct tlvdb *derRoot = tlvdb_parse_multi(buf, bufLen);
 
-    struct tlvdb *privkeyTlvdb = tlvdb_find_full(derRoot, 0x04);
+    const struct tlvdb *privkeyTlvdb = tlvdb_find_full(derRoot, 0x04);
     if (privkeyTlvdb == NULL) {
         tlvdb_free(derRoot);
         return PM3_EINVARG;
@@ -187,7 +187,7 @@ static int LoadReaderPrivateKey(uint8_t *buf, size_t bufLen, mbedtls_ecp_keypair
         return PM3_EINVARG;
     }
 
-    struct tlvdb *pubkeyCoordsTlvdb = tlvdb_find_full(derRoot, 0x03);
+    const struct tlvdb *pubkeyCoordsTlvdb = tlvdb_find_full(derRoot, 0x03);
     if (pubkeyCoordsTlvdb == NULL) {
         tlvdb_free(derRoot);
         PrintAndLogEx(FAILED, "Private key file should include public key component");
@@ -229,7 +229,7 @@ static int GetPrivateKeyHint(mbedtls_ecp_keypair *privKey, uint8_t *keyHint) {
     return PM3_SUCCESS;
 }
 
-static int LoadMobileEphemeralKey(uint8_t *xcoordBuf, mbedtls_ecp_keypair *pubKey) {
+static int LoadMobileEphemeralKey(const uint8_t *xcoordBuf, mbedtls_ecp_keypair *pubKey) {
     uint8_t compressedEcKey[33] = {0};
     compressedEcKey[0] = 0x02;
     memcpy(compressedEcKey + 1, xcoordBuf, 32);
@@ -249,7 +249,7 @@ static int LoadMobileEphemeralKey(uint8_t *xcoordBuf, mbedtls_ecp_keypair *pubKe
 
 static int internalVasDecrypt(uint8_t *cipherText, size_t cipherTextLen, uint8_t *sharedSecret,
                               uint8_t *ansiSharedInfo, size_t ansiSharedInfoLen,
-                              uint8_t *gcmAad, size_t gcmAadLen, uint8_t *out, size_t *outLen) {
+                              const uint8_t *gcmAad, size_t gcmAadLen, uint8_t *out, size_t *outLen) {
     uint8_t key[32] = {0};
     if (ansi_x963_sha256(sharedSecret, 32, ansiSharedInfo, ansiSharedInfoLen, sizeof(key), key)) {
         PrintAndLogEx(FAILED, "ANSI X9.63 key derivation failed");
diff --git a/client/src/emv/cmdemv.c b/client/src/emv/cmdemv.c
index c322f6406..5462f6eed 100644
--- a/client/src/emv/cmdemv.c
+++ b/client/src/emv/cmdemv.c
@@ -2646,7 +2646,7 @@ static int CmdEMVReader(const char *Cmd) {
         res = EMVSelectPSE(channel, true, true, 2, buf, sizeof(buf), &len, &sw);
 
         // search PSE / PPSE
-        res = EMVSearchPSE(channel, false, true, psenum, false, tlvSelect);
+        res |= EMVSearchPSE(channel, false, true, psenum, false, tlvSelect);
         if (res) {
             // EMV SEARCH with AID list
             DropFieldEx(channel);
diff --git a/client/src/proxmark3.c b/client/src/proxmark3.c
index 3e924a1c7..a91f74179 100644
--- a/client/src/proxmark3.c
+++ b/client/src/proxmark3.c
@@ -606,7 +606,7 @@ static void show_help(bool showFullHelp, char *exec_name) {
     }
 }
 
-static int flash_pm3(char *serial_port_name, uint8_t num_files, char *filenames[FLASH_MAX_FILES], bool can_write_bl, bool force) {
+static int flash_pm3(char *serial_port_name, uint8_t num_files, const char *filenames[FLASH_MAX_FILES], bool can_write_bl, bool force) {
 
     int ret = PM3_EUNDEF;
     flash_file_t files[FLASH_MAX_FILES];
@@ -756,7 +756,7 @@ int main(int argc, char *argv[]) {
     bool flash_force = false;
     bool debug_mode_forced = false;
     int flash_num_files = 0;
-    char *flash_filenames[FLASH_MAX_FILES];
+    const char *flash_filenames[FLASH_MAX_FILES];
 
     // color management:
     // 1. default = no color
diff --git a/common/lfdemod.c b/common/lfdemod.c
index f7f734eb4..9ed6f4e28 100644
--- a/common/lfdemod.c
+++ b/common/lfdemod.c
@@ -1025,7 +1025,7 @@ int DetectNRZClock(uint8_t *dest, size_t size, int clock, size_t *clockStartIdx)
     }
 
     uint8_t best = 0;
-    for (int m = ARRAYLEN(peaksdet); m > 0; m--) {
+    for (int m = ARRAYLEN(peaksdet) - 1; m >= 0; m--) {
         if ((peaksdet[m] >= (peaksdet[best] - 1)) && (peaksdet[m] <= peaksdet[best] + 1) && lowestTransition) {
             if (clk[m] > (lowestTransition - (clk[m] / 8)) && clk[m] < (lowestTransition + (clk[m] / 8))) {
                 best = m;
diff --git a/tools/hitag2crack/crack3/ht2crack3.c b/tools/hitag2crack/crack3/ht2crack3.c
index a81d33d40..f50ea6af4 100644
--- a/tools/hitag2crack/crack3/ht2crack3.c
+++ b/tools/hitag2crack/crack3/ht2crack3.c
@@ -386,13 +386,14 @@ int main(int argc, char *argv[]) {
         // debug mode only runs one thread from klowerstart
         tdata[0].klowerstart = klowerstart;
         crack(tdata);
-    } else {
-        // run full threaded mode
-        for (i = 0; i < NUM_THREADS; i++) {
-            if (pthread_create(&(threads[i]), NULL, crack, (void *)(tdata + i))) {
-                printf("cannot start thread %d\n", i);
-                exit(1);
-            }
+        return 0;
+    }
+
+    // run full threaded mode
+    for (i = 0; i < NUM_THREADS; i++) {
+        if (pthread_create(&(threads[i]), NULL, crack, (void *)(tdata + i))) {
+            printf("cannot start thread %d\n", i);
+            exit(1);
         }
     }
 
diff --git a/tools/mf_nonce_brute/mf_nonce_brute.c b/tools/mf_nonce_brute/mf_nonce_brute.c
index 161f1c749..2491c502d 100644
--- a/tools/mf_nonce_brute/mf_nonce_brute.c
+++ b/tools/mf_nonce_brute/mf_nonce_brute.c
@@ -533,7 +533,7 @@ static int usage(void) {
     return 1;
 }
 
-int main(int argc, char *argv[]) {
+int main(int argc, const char *argv[]) {
     printf("\nMifare classic nested auth key recovery\n\n");
 
     if (argc < 9) return usage();
diff --git a/tools/mf_nonce_brute/mf_trace_brute.c b/tools/mf_nonce_brute/mf_trace_brute.c
index 1d8a7c6fb..c416c006f 100644
--- a/tools/mf_nonce_brute/mf_trace_brute.c
+++ b/tools/mf_nonce_brute/mf_trace_brute.c
@@ -247,7 +247,7 @@ static int usage(void) {
     return 1;
 }
 
-int main(int argc, char *argv[]) {
+int main(int argc, const char *argv[]) {
     printf("Mifare classic nested auth key recovery Phase 2\n");
     if (argc < 3) return usage();