diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 58d64f4325..7cedd80e42 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -720,6 +720,10 @@ cross-version-config-tests:
     # also from the $BIND_BASELINE_VERSION.
     - find bin/tests/system/ -mindepth 1 -maxdepth 1 -type d -exec sh -c 'test -e ../"$0" || rm -rfv -- "$0"' {} \;
     - cd bin/tests/system
+    # System tests that employ binary drivers will fail on ABI change and
+    # should not be run.
+    - rm -r dlzexternal
+    - rm -r dyndb
     # Run the setup phase of all system tests in the most recently tagged BIND 9
     # release using the binaries built for the current BIND 9 version.  This
     # intends to detect obvious backward compatibility issues with the latter.
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index e5bac5257a..dcc418f955 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -325,7 +325,6 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 		 * Digest the length of the rdata.
 		 */
 		isc_buffer_init(&lenbuf, &len, sizeof(len));
-		INSIST(rdatas[i].length < 65536);
 		isc_buffer_putuint16(&lenbuf, (uint16_t)rdatas[i].length);
 		isc_buffer_usedregion(&lenbuf, &lenr);
 		ret = dst_context_adddata(ctx, &lenr);
@@ -537,7 +536,6 @@ again:
 		 * Digest the rdata length.
 		 */
 		isc_buffer_init(&lenbuf, &len, sizeof(len));
-		INSIST(rdatas[i].length < 65536);
 		isc_buffer_putuint16(&lenbuf, (uint16_t)rdatas[i].length);
 		isc_buffer_usedregion(&lenbuf, &lenr);
 
diff --git a/lib/dns/include/dns/name.h b/lib/dns/include/dns/name.h
index b9c4164bf9..d79fe445bd 100644
--- a/lib/dns/include/dns/name.h
+++ b/lib/dns/include/dns/name.h
@@ -96,10 +96,9 @@ ISC_LANG_BEGINDECLS
  * for whatever purpose the client desires.
  */
 struct dns_name {
-	unsigned int   magic;
-	unsigned char *ndata;
-	unsigned int   length;
-	unsigned int   labels;
+	unsigned int magic;
+	uint8_t	     length;
+	uint8_t	     labels;
 	struct dns_name_attrs {
 		bool absolute	  : 1; /*%< Used by name.c */
 		bool readonly	  : 1; /*%< Used by name.c */
@@ -116,6 +115,7 @@ struct dns_name {
 		bool update	  : 1; /*%< Used by client. */
 		bool hasupdaterec : 1; /*%< Used by client. */
 	} attributes;
+	unsigned char *ndata;
 	unsigned char *offsets;
 	isc_buffer_t  *buffer;
 	ISC_LINK(dns_name_t) link;
diff --git a/lib/dns/include/dns/rdata.h b/lib/dns/include/dns/rdata.h
index 36f79c8edd..02ac4eef22 100644
--- a/lib/dns/include/dns/rdata.h
+++ b/lib/dns/include/dns/rdata.h
@@ -110,16 +110,17 @@ ISC_LANG_BEGINDECLS
  */
 struct dns_rdata {
 	unsigned char	*data;
-	unsigned int	 length;
 	dns_rdataclass_t rdclass;
 	dns_rdatatype_t	 type;
-	unsigned int	 flags;
+	uint16_t	 length;
+	uint16_t	 flags;
 	ISC_LINK(dns_rdata_t) link;
 };
 
-#define DNS_RDATA_INIT                                           \
-	{                                                        \
-		NULL, 0, 0, 0, 0, { (void *)(-1), (void *)(-1) } \
+#define DNS_RDATA_INIT                        \
+	{                                     \
+		.data = NULL,                 \
+		.link = ISC_LINK_INITIALIZER, \
 	}
 
 #define DNS_RDATA_CHECKINITIALIZED
diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h
index 4a0d58a542..e5ecbebf33 100644
--- a/lib/dns/include/dns/rdataslab.h
+++ b/lib/dns/include/dns/rdataslab.h
@@ -68,31 +68,32 @@ struct dns_slabheader_proof {
 };
 
 struct dns_slabheader {
+	_Atomic(uint16_t) attributes;
+
 	/*%
 	 * Locked by the owning node's lock.
 	 */
-	uint32_t	      serial;
-	dns_ttl_t	      ttl;
-	dns_typepair_t	      type;
-	atomic_uint_least16_t attributes;
-	dns_trust_t	      trust;
+	dns_trust_t    trust;
+	uint32_t       serial;
+	dns_ttl_t      ttl;
+	dns_typepair_t type;
 
-	unsigned int heap_index;
-	/*%<
-	 * Used for TTL-based cache cleaning.
-	 */
-
-	isc_stdtime_t resign;
-	unsigned int  resign_lsb : 1;
-
-	atomic_uint_fast16_t count;
+	_Atomic(uint16_t) count;
 	/*%<
 	 * Monotonically increased every time this rdataset is bound so that
 	 * it is used as the base of the starting point in DNS responses
 	 * when the "cyclic" rrset-order is required.
 	 */
 
-	atomic_uint_fast32_t last_refresh_fail_ts;
+	unsigned int  resign_lsb : 1;
+	isc_stdtime_t resign;
+	unsigned int  heap_index;
+	/*%<
+	 * Used for TTL-based cache cleaning.
+	 */
+
+	isc_stdtime_t	  last_used;
+	_Atomic(uint32_t) last_refresh_fail_ts;
 
 	dns_slabheader_proof_t *noqname;
 	dns_slabheader_proof_t *closest;
@@ -122,7 +123,6 @@ struct dns_slabheader {
 	 * this rdataset, if any.
 	 */
 
-	isc_stdtime_t last_used;
 	ISC_LINK(struct dns_slabheader) link;
 
 	/*%
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 19d5f6e34a..b6f4d1901b 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -1255,7 +1255,6 @@ dns_journal_writediff(dns_journal_t *j, dns_diff_t *diff) {
 		isc_buffer_putuint16(&buffer, t->rdata.type);
 		isc_buffer_putuint16(&buffer, t->rdata.rdclass);
 		isc_buffer_putuint32(&buffer, t->ttl);
-		INSIST(t->rdata.length < 65536);
 		isc_buffer_putuint16(&buffer, (uint16_t)t->rdata.length);
 		INSIST(isc_buffer_availablelength(&buffer) >= t->rdata.length);
 		isc_buffer_putmem(&buffer, t->rdata.data, t->rdata.length);
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 2b2f1aacd8..4ac40ae0de 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -107,9 +107,7 @@ dns_name_isvalid(const dns_name_t *name) {
 		return false;
 	}
 
-	if (name->length > DNS_NAME_MAXWIRE ||
-	    name->labels > DNS_NAME_MAXLABELS)
-	{
+	if (name->labels > DNS_NAME_MAXLABELS) {
 		return false;
 	}
 
@@ -616,7 +614,7 @@ dns_name_getlabel(const dns_name_t *name, unsigned int n, dns_label_t *label) {
 	SETUP_OFFSETS(name, offsets, odata);
 
 	label->base = &name->ndata[offsets[n]];
-	if (n == name->labels - 1) {
+	if (n == (unsigned int)name->labels - 1) {
 		label->length = name->length - offsets[n];
 	} else {
 		label->length = offsets[n + 1] - offsets[n];
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index e8567f7d43..a4942b3a5b 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -995,7 +995,7 @@ void
 dns_nsec3param_toprivate(dns_rdata_t *src, dns_rdata_t *target,
 			 dns_rdatatype_t privatetype, unsigned char *buf,
 			 size_t buflen) {
-	REQUIRE(buflen >= src->length + 1);
+	REQUIRE(buflen >= (unsigned int)src->length + 1);
 
 	REQUIRE(DNS_RDATA_INITIALIZED(target));
 
diff --git a/lib/dns/qpcache.c b/lib/dns/qpcache.c
index e2235d4a3b..aadfaf2bb8 100644
--- a/lib/dns/qpcache.c
+++ b/lib/dns/qpcache.c
@@ -169,9 +169,10 @@ struct qpcnode {
 	unsigned int nsec	: 2; /*%< range is 0..3 */
 	uint8_t			: 0;
 
+	uint16_t locknum;
+
 	isc_refcount_t references;
 	isc_refcount_t erefs;
-	uint16_t locknum;
 	void *data;
 
 	/*%
diff --git a/lib/dns/qpzone.c b/lib/dns/qpzone.c
index 5d59f3fdc3..bfff5f116a 100644
--- a/lib/dns/qpzone.c
+++ b/lib/dns/qpzone.c
@@ -153,11 +153,11 @@ struct qpznode {
 	isc_refcount_t references;
 	isc_refcount_t erefs;
 	uint16_t locknum;
-	void *data;
 	atomic_uint_fast8_t nsec;
 	atomic_bool wild;
 	atomic_bool delegating;
 	atomic_bool dirty;
+	void *data;
 };
 
 struct qpzonedb {
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 7889c25952..ddb7ae2927 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -17203,7 +17203,8 @@ getprivate:
 			{
 				next = ISC_LIST_NEXT(nsec3p, link);
 
-				if (nsec3p->length == rdata.length + 1 &&
+				if (nsec3p->length ==
+					    (unsigned int)rdata.length + 1 &&
 				    memcmp(rdata.data, nsec3p->data + 1,
 					   nsec3p->length - 1) == 0)
 				{
@@ -23774,7 +23775,7 @@ rss_post(void *arg) {
 			dns_rdata_init(&rdata);
 			dns_rdataset_current(&nrdataset, &rdata);
 
-			if (np->length == (rdata.length + 1) &&
+			if (np->length == ((unsigned int)rdata.length + 1) &&
 			    memcmp(rdata.data, np->data + 1, np->length - 1) ==
 				    0)
 			{