diff --git a/bin/named/config.c b/bin/named/config.c
index c18b0cddf0..58a0a26c07 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -692,9 +692,11 @@ resume:
 				listcount = newlen;
 			}
 			/* Seen? */
-			for (j = 0; j < l; j++)
-				if (strcasecmp(lists[j].name, listname) == 0)
+			for (j = 0; j < l; j++) {
+				if (strcasecmp(lists[j].name, listname) == 0) {
 					break;
+				}
+			}
 			if (j < l)
 				continue;
 			tresult = named_config_getmastersdef(config, listname,
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index 08b9367726..9752f58bd1 100644
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -945,10 +945,13 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 	isc_result_t	   result = ISC_R_SUCCESS;
 
 	for (listener = ISC_LIST_HEAD(cp->listeners); listener != NULL;
-	     listener = ISC_LIST_NEXT(listener, link))
-		if (isc_sockaddr_equal(addr, &listener->address))
+	     listener = ISC_LIST_NEXT(listener, link)) {
+		if (isc_sockaddr_equal(addr, &listener->address)) {
 			break;
 
+		}
+	}
+
 	if (listener == NULL) {
 		*listenerp = NULL;
 		return;
diff --git a/bin/named/server.c b/bin/named/server.c
index aaaa269453..546a0e6d05 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1744,10 +1744,16 @@ check_dbtype(dns_zone_t *zone, unsigned int dbtypec, const char **dbargv,
 	/*
 	 * Check that all the arguments match.
 	 */
-	for (i = 0; i < dbtypec; i++)
-		if (argv[i] == NULL || strcmp(argv[i], dbargv[i]) != 0)
+	for (i = 0; i < dbtypec; i++) {
+		if (argv[i] == NULL || strcmp(argv[i], dbargv[i]) != 0) {
 			CHECK(ISC_R_FAILURE);
 
+	/*
+	 * Check that there are not extra arguments.
+	 */
+		}
+	}
+
 	/*
 	 * Check that there are not extra arguments.
 	 */
@@ -10525,10 +10531,13 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view)
 	 * Prevent duplicate views.
 	 */
 	for (vle = ISC_LIST_HEAD(dctx->viewlist); vle != NULL;
-	     vle = ISC_LIST_NEXT(vle, link))
-		if (vle->view == view)
+	     vle = ISC_LIST_NEXT(vle, link)) {
+		if (vle->view == view) {
 			return (ISC_R_SUCCESS);
 
+		}
+	}
+
 	vle = isc_mem_get(dctx->mctx, sizeof *vle);
 	vle->view = NULL;
 	dns_view_attach(view, &vle->view);
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index 9d39c8a8d7..7d37a1b56d 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -3660,10 +3660,13 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_result_t	      result = ISC_R_SUCCESS;
 
 	for (listener = ISC_LIST_HEAD(server->statschannels); listener != NULL;
-	     listener = ISC_LIST_NEXT(listener, link))
-		if (isc_sockaddr_equal(addr, &listener->address))
+	     listener = ISC_LIST_NEXT(listener, link)) {
+		if (isc_sockaddr_equal(addr, &listener->address)) {
 			break;
 
+		}
+	}
+
 	if (listener == NULL) {
 		*listenerp = NULL;
 		return;
diff --git a/bin/tests/optional/db_test.c b/bin/tests/optional/db_test.c
index 4edd174c2f..66b45f444e 100644
--- a/bin/tests/optional/db_test.c
+++ b/bin/tests/optional/db_test.c
@@ -468,10 +468,12 @@ main(int argc, char *argv[])
 		if (verbose && dbi != NULL) {
 			if (dbi->wversion != NULL)
 				printf("future version (%p)\n", dbi->wversion);
-			for (i = 0; i < dbi->rcount; i++)
-				if (dbi->rversions[i] != NULL)
+			for (i = 0; i < dbi->rcount; i++) {
+				if (dbi->rversions[i] != NULL) {
 					printf("open version %d (%p)\n", i,
 					       dbi->rversions[i]);
+				}
+			}
 		}
 		dns_name_init(&name, offsets);
 		if (strcmp(s, "!R") == 0) {
diff --git a/contrib/dlz/drivers/dlz_odbc_driver.c b/contrib/dlz/drivers/dlz_odbc_driver.c
index 2114e52b63..317bb7cf5a 100644
--- a/contrib/dlz/drivers/dlz_odbc_driver.c
+++ b/contrib/dlz/drivers/dlz_odbc_driver.c
@@ -679,14 +679,16 @@ odbc_getManyFields(SQLHSTMT *stmnt, SQLSMALLINT startField,
 	REQUIRE(startField > 0 && startField <= endField);
 
 	/* determine how large the data is */
-	for (i = startField; i <= endField; i++)
-		if (sqlOK(SQLColAttribute(stmnt, i, SQL_DESC_DISPLAY_SIZE, NULL,
-					  0, NULL, &size)) &&
-		    size > 0) {
+	for (i = startField; i <= endField; i++) {
+		if (sqlOK(SQLColAttribute(stmnt, i, SQL_DESC_DISPLAY_SIZE, NULL, 0, NULL, &size)) && size > 0) {
+			{
 			/* always allow for a " " (space) character */
-			totSize += (size + 1);
+				totSize += (size + 1);
 			/* after the data item */
+			}
+
 		}
+	}
 
 	if (totSize < 1)
 		return ISC_R_FAILURE;
diff --git a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
index e975038492..135d20ba79 100644
--- a/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
+++ b/contrib/dlz/modules/mysql/dlz_mysql_dynamic.c
@@ -383,9 +383,11 @@ mysql_get_resultset(const char *zone, const char *record, const char *client,
 		qres = mysql_query((MYSQL *)dbi->dbconn, querystring);
 		if (qres == 0)
 			break;
-		for (j = 0; j < 4; j++)
-			if (mysql_ping((MYSQL *)dbi->dbconn) == 0)
+		for (j = 0; j < 4; j++) {
+			if (mysql_ping((MYSQL *)dbi->dbconn) == 0) {
 				break;
+			}
+		}
 	}
 
 	if (qres == 0) {
diff --git a/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c b/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
index 5a70b252f9..c2ec7287b2 100644
--- a/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
+++ b/contrib/dlz/modules/mysqldyn/dlz_mysqldyn_mod.c
@@ -437,10 +437,13 @@ build_query(mysql_data_t *state, mysql_instance_t *dbi, const char *command,
 
 	*query = '\0';
 	for (item = DLZ_LIST_HEAD(arglist); item != NULL;
-	     item = DLZ_LIST_NEXT(item, link))
-		if (item->arg != NULL)
+	     item = DLZ_LIST_NEXT(item, link)) {
+		if (item->arg != NULL) {
 			strcat(query, item->arg);
 
+		}
+	}
+
 fail:
 	va_end(ap1);
 
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 926eb12379..e34c88a56b 100644
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -4478,10 +4478,18 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 
 	(void)cfg_map_get(config, "view", &views);
 
-	if (views != NULL && options != NULL)
-		if (check_dual_stack(options, logctx) != ISC_R_SUCCESS)
+	if (views != NULL && options != NULL) {
+		if (check_dual_stack(options, logctx) != ISC_R_SUCCESS) {
 			result = ISC_R_FAILURE;
 
+	/*
+	 * Use case insensitive comparision as not all file systems are
+	 * case sensitive. This will prevent people using FOO.DB and foo.db
+	 * on case sensitive file systems but that shouldn't be a major issue.
+	 */
+		}
+	}
+
 	/*
 	 * Use case insensitive comparision as not all file systems are
 	 * case sensitive. This will prevent people using FOO.DB and foo.db
@@ -4622,15 +4630,20 @@ bind9_check_namedconf(const cfg_obj_t *config, bool check_plugins,
 
 			aclname = cfg_obj_asstring(cfg_tuple_get(acl, "name"));
 			for (i = 0; i < sizeof(builtin) / sizeof(builtin[0]);
-			     i++)
+			     i++) {
 				if (strcasecmp(aclname, builtin[i]) == 0) {
-					cfg_obj_log(acl, logctx, ISC_LOG_ERROR,
-						    "attempt to redefine "
-						    "builtin acl '%s'",
-						    aclname);
-					result = ISC_R_FAILURE;
-					break;
+					{
+						cfg_obj_log(acl, logctx,
+							    ISC_LOG_ERROR,
+							    "attempt to redefine "
+							    "builtin acl '%s'",
+							    aclname);
+						result = ISC_R_FAILURE;
+						break;
+					}
+
 				}
+			}
 
 			for (elt2 = cfg_list_next(elt); elt2 != NULL;
 			     elt2 = cfg_list_next(elt2)) {
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index 6ada67b44d..f843f2ae34 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -610,10 +610,16 @@ grow_entries(isc_task_t *task, isc_event_t *ev)
 	/*
 	 * Are we shutting down?
 	 */
-	for (i = 0; i < adb->nentries; i++)
-		if (adb->entry_sd[i])
+	for (i = 0; i < adb->nentries; i++) {
+		if (adb->entry_sd[i]) {
 			goto cleanup;
 
+	/*
+	 * Grab all the resources we need.
+	 */
+		}
+	}
+
 	/*
 	 * Grab all the resources we need.
 	 */
@@ -764,10 +770,16 @@ grow_names(isc_task_t *task, isc_event_t *ev)
 	/*
 	 * Are we shutting down?
 	 */
-	for (i = 0; i < adb->nnames; i++)
-		if (adb->name_sd[i])
+	for (i = 0; i < adb->nnames; i++) {
+		if (adb->name_sd[i]) {
 			goto cleanup;
 
+	/*
+	 * Grab all the resources we need.
+	 */
+		}
+	}
+
 	/*
 	 * Grab all the resources we need.
 	 */
@@ -963,9 +975,11 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 			link_entry(adb, addr_bucket, entry);
 		} else {
 			for (anh = ISC_LIST_HEAD(*hookhead); anh != NULL;
-			     anh = ISC_LIST_NEXT(anh, plink))
-				if (anh->entry == foundentry)
+			     anh = ISC_LIST_NEXT(anh, plink)) {
+				if (anh->entry == foundentry) {
 					break;
+				}
+			}
 			if (anh == NULL) {
 				foundentry->refcnt++;
 				foundentry->nh++;
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index a993f1d8a3..4fce32e0dc 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -291,9 +291,11 @@ dns_cache_create(isc_mem_t *cmctx, isc_mem_t *hmctx, isc_taskmgr_t *taskmgr,
 cleanup_db:
 	dns_db_detach(&cache->db);
 cleanup_dbargv:
-	for (i = extra; i < cache->db_argc; i++)
-		if (cache->db_argv[i] != NULL)
+	for (i = extra; i < cache->db_argc; i++) {
+		if (cache->db_argv[i] != NULL) {
 			isc_mem_free(cmctx, cache->db_argv[i]);
+		}
+	}
 	if (cache->db_argv != NULL)
 		isc_mem_put(cmctx, cache->db_argv,
 			    cache->db_argc * sizeof(char *));
diff --git a/lib/dns/db.c b/lib/dns/db.c
index f9a8385d50..486d55ffb7 100644
--- a/lib/dns/db.c
+++ b/lib/dns/db.c
@@ -85,9 +85,11 @@ impfind(const char *name)
 	dns_dbimplementation_t *imp;
 
 	for (imp = ISC_LIST_HEAD(implementations); imp != NULL;
-	     imp = ISC_LIST_NEXT(imp, link))
-		if (strcasecmp(name, imp->name) == 0)
+	     imp = ISC_LIST_NEXT(imp, link)) {
+		if (strcasecmp(name, imp->name) == 0) {
 			return (imp);
+		}
+	}
 	return (NULL);
 }
 
diff --git a/lib/dns/dlz.c b/lib/dns/dlz.c
index 61acfbd5c3..c7b39b7a00 100644
--- a/lib/dns/dlz.c
+++ b/lib/dns/dlz.c
@@ -93,9 +93,11 @@ dlz_impfind(const char *name)
 	dns_dlzimplementation_t *imp;
 
 	for (imp = ISC_LIST_HEAD(dlz_implementations); imp != NULL;
-	     imp = ISC_LIST_NEXT(imp, link))
-		if (strcasecmp(name, imp->name) == 0)
+	     imp = ISC_LIST_NEXT(imp, link)) {
+		if (strcasecmp(name, imp->name) == 0) {
 			return (imp);
+		}
+	}
 	return (NULL);
 }
 
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 420a9d7c29..359dd8996c 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -1406,10 +1406,18 @@ dns_dnssec_findmatchingkeys(const dns_name_t *origin, const char *directory,
 		    dir.entry.name[i] != '+')
 			continue;
 
-		for (i++; i < dir.entry.length; i++)
-			if (dir.entry.name[i] < '0' || dir.entry.name[i] > '9')
+		for (i++; i < dir.entry.length; i++) {
+			if (dir.entry.name[i] < '0' || dir.entry.name[i] > '9') {
 				break;
 
+		/*
+		 * Did we not read exactly 5 more digits?
+		 * Did we overflow?
+		 * Did we correctly terminate?
+		 */
+			}
+		}
+
 		/*
 		 * Did we not read exactly 5 more digits?
 		 * Did we overflow?
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index eff3402092..f0cc50f12e 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -257,9 +257,11 @@ dst_lib_destroy(void)
 	RUNTIME_CHECK(dst_initialized == true);
 	dst_initialized = false;
 
-	for (i = 0; i < DST_MAX_ALGS; i++)
-		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL)
+	for (i = 0; i < DST_MAX_ALGS; i++) {
+		if (dst_t_func[i] != NULL && dst_t_func[i]->cleanup != NULL) {
 			dst_t_func[i]->cleanup();
+		}
+	}
 	dst__openssl_destroy();
 #if USE_PKCS11
 	(void)dst__pkcs11_destroy();
diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c
index 2280104fc9..1e41cca49e 100644
--- a/lib/dns/dst_parse.c
+++ b/lib/dns/dst_parse.c
@@ -181,9 +181,11 @@ check_rsa(const dst_private_t *priv, bool external)
 		have[i] = false;
 
 	for (j = 0; j < priv->nelements; j++) {
-		for (i = 0; i < RSA_NTAGS; i++)
-			if (priv->elements[j].tag == TAG(DST_ALG_RSA, i))
+		for (i = 0; i < RSA_NTAGS; i++) {
+			if (priv->elements[j].tag == TAG(DST_ALG_RSA, i)) {
 				break;
+			}
+		}
 		if (i == RSA_NTAGS)
 			return (-1);
 		have[i] = true;
@@ -214,9 +216,11 @@ check_dh(const dst_private_t *priv)
 	if (priv->nelements != DH_NTAGS)
 		return (-1);
 	for (i = 0; i < DH_NTAGS; i++) {
-		for (j = 0; j < priv->nelements; j++)
-			if (priv->elements[j].tag == TAG(DST_ALG_DH, i))
+		for (j = 0; j < priv->nelements; j++) {
+			if (priv->elements[j].tag == TAG(DST_ALG_DH, i)) {
 				break;
+			}
+		}
 		if (j == priv->nelements)
 			return (-1);
 	}
@@ -237,9 +241,11 @@ check_ecdsa(const dst_private_t *priv, bool external)
 	for (i = 0; i < ECDSA_NTAGS; i++)
 		have[i] = false;
 	for (j = 0; j < priv->nelements; j++) {
-		for (i = 0; i < ECDSA_NTAGS; i++)
-			if (priv->elements[j].tag == TAG(DST_ALG_ECDSA256, i))
+		for (i = 0; i < ECDSA_NTAGS; i++) {
+			if (priv->elements[j].tag == TAG(DST_ALG_ECDSA256, i)) {
 				break;
+			}
+		}
 		if (i == ECDSA_NTAGS)
 			return (-1);
 		have[i] = true;
@@ -268,9 +274,11 @@ check_eddsa(const dst_private_t *priv, bool external)
 	for (i = 0; i < EDDSA_NTAGS; i++)
 		have[i] = false;
 	for (j = 0; j < priv->nelements; j++) {
-		for (i = 0; i < EDDSA_NTAGS; i++)
-			if (priv->elements[j].tag == TAG(DST_ALG_ED25519, i))
+		for (i = 0; i < EDDSA_NTAGS; i++) {
+			if (priv->elements[j].tag == TAG(DST_ALG_ED25519, i)) {
 				break;
+			}
+		}
 		if (i == EDDSA_NTAGS)
 			return (-1);
 		have[i] = true;
@@ -304,9 +312,11 @@ check_hmac_md5(const dst_private_t *priv, bool old)
 	 * We must be new format at this point.
 	 */
 	for (i = 0; i < HMACMD5_NTAGS; i++) {
-		for (j = 0; j < priv->nelements; j++)
-			if (priv->elements[j].tag == TAG(DST_ALG_HMACMD5, i))
+		for (j = 0; j < priv->nelements; j++) {
+			if (priv->elements[j].tag == TAG(DST_ALG_HMACMD5, i)) {
 				break;
+			}
+		}
 		if (j == priv->nelements)
 			return (-1);
 	}
@@ -320,9 +330,11 @@ check_hmac_sha(const dst_private_t *priv, unsigned int ntags, unsigned int alg)
 	if (priv->nelements != ntags)
 		return (-1);
 	for (i = 0; i < ntags; i++) {
-		for (j = 0; j < priv->nelements; j++)
-			if (priv->elements[j].tag == TAG(alg, i))
+		for (j = 0; j < priv->nelements; j++) {
+			if (priv->elements[j].tag == TAG(alg, i)) {
 				break;
+			}
+		}
 		if (j == priv->nelements)
 			return (-1);
 	}
diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
index 21aef3158b..8f574df742 100644
--- a/lib/dns/dyndb.c
+++ b/lib/dns/dyndb.c
@@ -76,9 +76,11 @@ impfind(const char *name)
 	dyndb_implementation_t *imp;
 
 	for (imp = ISC_LIST_HEAD(dyndb_implementations); imp != NULL;
-	     imp = ISC_LIST_NEXT(imp, link))
-		if (strcasecmp(name, imp->name) == 0)
+	     imp = ISC_LIST_NEXT(imp, link)) {
+		if (strcasecmp(name, imp->name) == 0) {
 			return (imp);
+		}
+	}
 	return (NULL);
 }
 
@@ -367,10 +369,13 @@ dns_dyndb_load(const char *libname, const char *name, const char *parameters,
 	result = ISC_R_SUCCESS;
 
 cleanup:
-	if (result != ISC_R_SUCCESS)
-		if (implementation != NULL)
+	if (result != ISC_R_SUCCESS) {
+		if (implementation != NULL) {
 			unload_library(&implementation);
 
+		}
+	}
+
 	UNLOCK(&dyndb_lock);
 	return (result);
 }
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index d6d178cbd7..ff141fea14 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -1925,12 +1925,16 @@ dns_diff_subtract(dns_diff_t diff[2], dns_diff_t *r)
 		if (p[0] == NULL && p[1] == NULL)
 			break;
 
-		for (i = 0; i < 2; i++)
+		for (i = 0; i < 2; i++) {
 			if (p[!i] == NULL) {
-				ISC_LIST_UNLINK(diff[i].tuples, p[i], link);
-				ISC_LIST_APPEND(r->tuples, p[i], link);
-				goto next;
+				{
+					ISC_LIST_UNLINK(diff[i].tuples, p[i],
+							link);
+					ISC_LIST_APPEND(r->tuples, p[i], link);
+					goto next;
+				}
 			}
+		}
 		t = rdata_order(&p[0], &p[1]);
 		if (t < 0) {
 			ISC_LIST_UNLINK(diff[0].tuples, p[0], link);
diff --git a/lib/dns/master.c b/lib/dns/master.c
index 2e304d46d5..be8e10c596 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -363,25 +363,27 @@ gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *token, bool eol,
 		}
 		/*NOTREACHED*/
 	}
-	if (eol != true)
-		if (token->type == isc_tokentype_eol ||
-		    token->type == isc_tokentype_eof) {
-			unsigned long int line;
-			const char *	  what;
-			const char *	  file;
-			file = isc_lex_getsourcename(lex);
-			line = isc_lex_getsourceline(lex);
-			if (token->type == isc_tokentype_eol) {
-				line--;
-				what = "line";
-			} else
-				what = "file";
-			(*callbacks->error)(callbacks,
-					    "dns_master_load: %s:%lu: "
-					    "unexpected end of %s",
-					    file, line, what);
-			return (ISC_R_UNEXPECTEDEND);
-		}
+	if (eol != true) {
+		if (token->type == isc_tokentype_eol || token->type == isc_tokentype_eof) {
+			{
+				unsigned long int line;
+				const char *what;
+				const char *file;
+				file = isc_lex_getsourcename(lex);
+				line = isc_lex_getsourceline(lex);
+				if (token->type == isc_tokentype_eol) {
+					line--;
+					what = "line";
+				}else
+					what = "file";
+				(*callbacks->error)(callbacks,
+						    "dns_master_load: %s:%lu: "
+						    "unexpected end of %s",
+						    file, line, what);
+				return (ISC_R_UNEXPECTEDEND);
+			}
+			}
+	}
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 3db49f843c..9d851bd8fd 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -2475,9 +2475,11 @@ dns_name_isdnssd(const dns_name_t *name)
 	if (dns_name_countlabels(name) > 3U) {
 		dns_name_init(&prefix, NULL);
 		dns_name_getlabelsequence(name, 0, 3, &prefix);
-		for (i = 0; i < (sizeof(dns_sd) / sizeof(dns_sd[0])); i++)
-			if (dns_name_equal(&prefix, &dns_sd[i]))
+		for (i = 0; i < (sizeof(dns_sd) / sizeof(dns_sd[0])); i++) {
+			if (dns_name_equal(&prefix, &dns_sd[i])) {
 				return (true);
+			}
+		}
 	}
 
 	return (false);
@@ -2534,9 +2536,11 @@ dns_name_isrfc1918(const dns_name_t *name)
 {
 	size_t i;
 
-	for (i = 0; i < (sizeof(rfc1918names) / sizeof(*rfc1918names)); i++)
-		if (dns_name_issubdomain(name, &rfc1918names[i]))
+	for (i = 0; i < (sizeof(rfc1918names) / sizeof(*rfc1918names)); i++) {
+		if (dns_name_issubdomain(name, &rfc1918names[i])) {
 			return (true);
+		}
+	}
 	return (false);
 }
 
@@ -2553,9 +2557,11 @@ dns_name_isula(const dns_name_t *name)
 {
 	size_t i;
 
-	for (i = 0; i < (sizeof(ulanames) / sizeof(*ulanames)); i++)
-		if (dns_name_issubdomain(name, &ulanames[i]))
+	for (i = 0; i < (sizeof(ulanames) / sizeof(*ulanames)); i++) {
+		if (dns_name_issubdomain(name, &ulanames[i])) {
 			return (true);
+		}
+	}
 	return (false);
 }
 
diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 7766d6ed43..00413feab7 100644
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -75,9 +75,11 @@ dns_nsec_compressbitmap(unsigned char *map, const unsigned char *raw,
 	for (window = 0; window < 256; window++) {
 		if (window * 256 > max_type)
 			break;
-		for (octet = 31; octet >= 0; octet--)
-			if (*(raw + octet) != 0)
+		for (octet = 31; octet >= 0; octet--) {
+			if (*(raw + octet) != 0) {
 				break;
+			}
+		}
 		if (octet < 0) {
 			raw += 32;
 			continue;
diff --git a/lib/dns/peer.c b/lib/dns/peer.c
index 1b264b2ba5..cdacc459d6 100644
--- a/lib/dns/peer.c
+++ b/lib/dns/peer.c
@@ -137,10 +137,13 @@ dns_peerlist_addpeer(dns_peerlist_t *peers, dns_peer_t *peer)
 	 * More specifics to front of list.
 	 */
 	for (p = ISC_LIST_HEAD(peers->elements); p != NULL;
-	     p = ISC_LIST_NEXT(p, next))
-		if (p->prefixlen < peer->prefixlen)
+	     p = ISC_LIST_NEXT(p, next)) {
+		if (p->prefixlen < peer->prefixlen) {
 			break;
 
+		}
+	}
+
 	if (p != NULL)
 		ISC_LIST_INSERTBEFORE(peers->elements, p, peer, next);
 	else
diff --git a/lib/dns/pkcs11ecdsa_link.c b/lib/dns/pkcs11ecdsa_link.c
index 422e7d0390..94091c283b 100644
--- a/lib/dns/pkcs11ecdsa_link.c
+++ b/lib/dns/pkcs11ecdsa_link.c
@@ -249,13 +249,16 @@ err:
 
 	if (hKey != CK_INVALID_HANDLE)
 		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	for (i = 5; i <= 6; i++)
+	for (i = 5; i <= 6; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			memset(keyTemplate[i].pValue, 0,
-			       keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				memset(keyTemplate[i].pValue, 0,
+				       keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
 		}
+	}
 	pk11_return_session(pk11_ctx);
 	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
 	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
@@ -340,13 +343,16 @@ err:
 
 	if (hKey != CK_INVALID_HANDLE)
 		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	for (i = 5; i <= 6; i++)
+	for (i = 5; i <= 6; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			memset(keyTemplate[i].pValue, 0,
-			       keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				memset(keyTemplate[i].pValue, 0,
+				       keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
 		}
+	}
 	pk11_return_session(pk11_ctx);
 	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
 	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
diff --git a/lib/dns/pkcs11eddsa_link.c b/lib/dns/pkcs11eddsa_link.c
index a1ad5e1ba4..234e1b89ef 100644
--- a/lib/dns/pkcs11eddsa_link.c
+++ b/lib/dns/pkcs11eddsa_link.c
@@ -230,13 +230,16 @@ err:
 
 	if (hKey != CK_INVALID_HANDLE)
 		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	for (i = 5; i <= 6; i++)
+	for (i = 5; i <= 6; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			memset(keyTemplate[i].pValue, 0,
-			       keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				memset(keyTemplate[i].pValue, 0,
+				       keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
 		}
+	}
 	pk11_return_session(pk11_ctx);
 	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
 	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
@@ -328,13 +331,16 @@ err:
 
 	if (hKey != CK_INVALID_HANDLE)
 		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	for (i = 5; i <= 6; i++)
+	for (i = 5; i <= 6; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			memset(keyTemplate[i].pValue, 0,
-			       keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				memset(keyTemplate[i].pValue, 0,
+				       keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
 		}
+	}
 	pk11_return_session(pk11_ctx);
 	memset(pk11_ctx, 0, sizeof(*pk11_ctx));
 	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
diff --git a/lib/dns/pkcs11rsa_link.c b/lib/dns/pkcs11rsa_link.c
index 4458fc6bd9..3d6fd18149 100644
--- a/lib/dns/pkcs11rsa_link.c
+++ b/lib/dns/pkcs11rsa_link.c
@@ -233,26 +233,33 @@ token_key:
 
 	dctx->ctxdata.pk11_ctx = pk11_ctx;
 
-	for (i = 6; i <= 13; i++)
+	for (i = 6; i <= 13; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			isc_safe_memwipe(keyTemplate[i].pValue,
-					 keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				isc_safe_memwipe(keyTemplate[i].pValue,
+						 keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
+
 		}
+	}
 
 	return (ISC_R_SUCCESS);
 
 err:
 	if (!pk11_ctx->ontoken && (pk11_ctx->object != CK_INVALID_HANDLE))
 		(void)pkcs_C_DestroyObject(pk11_ctx->session, pk11_ctx->object);
-	for (i = 6; i <= 13; i++)
+	for (i = 6; i <= 13; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			isc_safe_memwipe(keyTemplate[i].pValue,
-					 keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				isc_safe_memwipe(keyTemplate[i].pValue,
+						 keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
 		}
+	}
 	pk11_return_session(pk11_ctx);
 	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
 	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
@@ -374,26 +381,33 @@ pkcs11rsa_createctx_verify(dst_key_t *key, unsigned int maxbits,
 
 	dctx->ctxdata.pk11_ctx = pk11_ctx;
 
-	for (i = 5; i <= 6; i++)
+	for (i = 5; i <= 6; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			isc_safe_memwipe(keyTemplate[i].pValue,
-					 keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				isc_safe_memwipe(keyTemplate[i].pValue,
+						 keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
+
 		}
+	}
 
 	return (ISC_R_SUCCESS);
 
 err:
 	if (!pk11_ctx->ontoken && (pk11_ctx->object != CK_INVALID_HANDLE))
 		(void)pkcs_C_DestroyObject(pk11_ctx->session, pk11_ctx->object);
-	for (i = 5; i <= 6; i++)
+	for (i = 5; i <= 6; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			isc_safe_memwipe(keyTemplate[i].pValue,
-					 keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				isc_safe_memwipe(keyTemplate[i].pValue,
+						 keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
 		}
+	}
 	pk11_return_session(pk11_ctx);
 	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
 	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
@@ -838,13 +852,16 @@ token_key:
 err:
 	if (hKey != CK_INVALID_HANDLE)
 		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	for (i = 6; i <= 13; i++)
+	for (i = 6; i <= 13; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			isc_safe_memwipe(keyTemplate[i].pValue,
-					 keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				isc_safe_memwipe(keyTemplate[i].pValue,
+						 keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
 		}
+	}
 	pk11_return_session(pk11_ctx);
 	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
 	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
@@ -957,13 +974,16 @@ pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig)
 err:
 	if (hKey != CK_INVALID_HANDLE)
 		(void)pkcs_C_DestroyObject(pk11_ctx->session, hKey);
-	for (i = 5; i <= 6; i++)
+	for (i = 5; i <= 6; i++) {
 		if (keyTemplate[i].pValue != NULL) {
-			isc_safe_memwipe(keyTemplate[i].pValue,
-					 keyTemplate[i].ulValueLen);
-			isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
-				    keyTemplate[i].ulValueLen);
+			{
+				isc_safe_memwipe(keyTemplate[i].pValue,
+						 keyTemplate[i].ulValueLen);
+				isc_mem_put(dctx->mctx, keyTemplate[i].pValue,
+					    keyTemplate[i].ulValueLen);
+			}
 		}
+	}
 	pk11_return_session(pk11_ctx);
 	isc_safe_memwipe(pk11_ctx, sizeof(*pk11_ctx));
 	isc_mem_put(dctx->mctx, pk11_ctx, sizeof(*pk11_ctx));
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 73b4dcc848..be9bfec5f2 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -2101,14 +2101,20 @@ restore_locks:
 	/*
 	 * Relock a read lock, or unlock the write lock if no lock was held.
 	 */
-	if (tlock == isc_rwlocktype_none)
-		if (write_locked)
+	if (tlock == isc_rwlocktype_none) {
+		if (write_locked) {
 			RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
 
-	if (tlock == isc_rwlocktype_read)
-		if (write_locked)
+		}
+	}
+
+	if (tlock == isc_rwlocktype_read) {
+		if (write_locked) {
 			isc_rwlock_downgrade(&rbtdb->tree_lock);
 
+		}
+	}
+
 	return (no_reference);
 }
 
@@ -5286,9 +5292,10 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now)
 					      "reprieve by RETAIN() %s",
 					      printname);
 			}
-		} else if (isc_mem_isovermem(rbtdb->common.mctx) && log)
+		} else if (isc_mem_isovermem(rbtdb->common.mctx) && log) {
 			isc_log_write(dns_lctx, category, module, level,
 				      "overmem cache: saved %s", printname);
+		}
 
 	NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock,
 		    isc_rwlocktype_write);
@@ -5829,9 +5836,11 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, rbtdb_version_t *rbtversion,
 			 * type so they can be marked ancient later.
 			 */
 			for (topheader = rbtnode->data; topheader != NULL;
-			     topheader = topheader->next)
-				if (topheader->type == sigtype)
+			     topheader = topheader->next) {
+				if (topheader->type == sigtype) {
 					sigheader = topheader;
+				}
+			}
 			negtype = RBTDB_RDATATYPE_VALUE(covers, 0);
 		} else {
 			/*
@@ -8312,9 +8321,11 @@ cleanup_deadnodes:
 
 cleanup_heaps:
 	if (rbtdb->heaps != NULL) {
-		for (i = 0; i < (int)rbtdb->node_lock_count; i++)
-			if (rbtdb->heaps[i] != NULL)
+		for (i = 0; i < (int)rbtdb->node_lock_count; i++) {
+			if (rbtdb->heaps[i] != NULL) {
 				isc_heap_destroy(&rbtdb->heaps[i]);
+			}
+		}
 		isc_mem_put(hmctx, rbtdb->heaps,
 			    rbtdb->node_lock_count * sizeof(isc_heap_t *));
 	}
@@ -9319,11 +9330,14 @@ setownercase(rdatasetheader_t *header, const dns_name_t *name)
 	 */
 	memset(header->upper, 0, sizeof(header->upper));
 	fully_lower = true;
-	for (i = 0; i < name->length; i++)
+	for (i = 0; i < name->length; i++) {
 		if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a) {
-			header->upper[i / 8] |= 1 << (i % 8);
-			fully_lower = false;
+			{
+				header->upper[i / 8] |= 1 << (i % 8);
+				fully_lower = false;
+			}
 		}
+	}
 	header->attributes |= RDATASET_ATTR_CASESET;
 	if (ISC_LIKELY(fully_lower))
 		header->attributes |= RDATASET_ATTR_CASEFULLYLOWER;
@@ -9785,10 +9799,13 @@ restart:
 	 */
 	RWLOCK(&rbtversion->glue_rwlock, isc_rwlocktype_read);
 
-	for (cur = rbtversion->glue_table[idx]; cur != NULL; cur = cur->next)
-		if (cur->node == node)
+	for (cur = rbtversion->glue_table[idx]; cur != NULL; cur = cur->next) {
+		if (cur->node == node) {
 			break;
 
+		}
+	}
+
 	if (cur == NULL) {
 		goto no_glue;
 	}
diff --git a/lib/dns/rdata/generic/caa_257.c b/lib/dns/rdata/generic/caa_257.c
index 53c0127be9..5475ee05a9 100644
--- a/lib/dns/rdata/generic/caa_257.c
+++ b/lib/dns/rdata/generic/caa_257.c
@@ -302,9 +302,11 @@ static inline isc_result_t fromtext_caa(ARGS_FROMTEXT)
 	RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string,
 				      false));
 	tr = token.value.as_textregion;
-	for (i = 0; i < tr.length; i++)
-		if (!alphanumeric[(unsigned char)tr.base[i]])
+	for (i = 0; i < tr.length; i++) {
+		if (!alphanumeric[(unsigned char)tr.base[i]]) {
 			RETTOK(DNS_R_SYNTAX);
+		}
+	}
 	RETERR(uint8_tobuffer(tr.length, target));
 	RETERR(mem_tobuffer(target, tr.base, tr.length));
 
@@ -388,9 +390,14 @@ static inline isc_result_t fromwire_caa(ARGS_FROMWIRE)
 		RETERR(DNS_R_FORMERR);
 
 	/* Check the Tag's value */
-	for (i = 0; i < len; i++)
-		if (!alphanumeric[sr.base[i]])
+	for (i = 0; i < len; i++) {
+		if (!alphanumeric[sr.base[i]]) {
 			RETERR(DNS_R_FORMERR);
+	/*
+	 * Tag + Value
+	 */
+		}
+	}
 	/*
 	 * Tag + Value
 	 */
@@ -460,9 +467,11 @@ static inline isc_result_t fromstruct_caa(ARGS_FROMSTRUCT)
 	 */
 	region.base = caa->tag;
 	region.length = caa->tag_len;
-	for (i = 0; i < region.length; i++)
-		if (!alphanumeric[region.base[i]])
+	for (i = 0; i < region.length; i++) {
+		if (!alphanumeric[region.base[i]]) {
 			RETERR(DNS_R_SYNTAX);
+		}
+	}
 	RETERR(isc_buffer_copyregion(target, &region));
 
 	/*
diff --git a/lib/dns/rdata/generic/loc_29.c b/lib/dns/rdata/generic/loc_29.c
index 343c0e3213..230f4d7301 100644
--- a/lib/dns/rdata/generic/loc_29.c
+++ b/lib/dns/rdata/generic/loc_29.c
@@ -307,9 +307,11 @@ getalt:
 	 * We don't just multiply out as we will overflow.
 	 */
 	if (m > 0) {
-		for (exp = 0; exp < 7; exp++)
-			if (m < poweroften[exp + 1])
+		for (exp = 0; exp < 7; exp++) {
+			if (m < poweroften[exp + 1]) {
 				break;
+			}
+		}
 		man = m / poweroften[exp];
 		exp += 2;
 	} else {
@@ -360,9 +362,11 @@ getalt:
 	 * We don't just multiply out as we will overflow.
 	 */
 	if (m > 0) {
-		for (exp = 0; exp < 7; exp++)
-			if (m < poweroften[exp + 1])
+		for (exp = 0; exp < 7; exp++) {
+			if (m < poweroften[exp + 1]) {
 				break;
+			}
+		}
 		man = m / poweroften[exp];
 		exp += 2;
 	} else if (cm >= 10) {
@@ -411,9 +415,11 @@ getalt:
 	 * We don't just multiply out as we will overflow.
 	 */
 	if (m > 0) {
-		for (exp = 0; exp < 7; exp++)
-			if (m < poweroften[exp + 1])
+		for (exp = 0; exp < 7; exp++) {
+			if (m < poweroften[exp + 1]) {
 				break;
+			}
+		}
 		man = m / poweroften[exp];
 		exp += 2;
 	} else if (cm >= 10) {
@@ -592,28 +598,39 @@ static inline isc_result_t fromwire_loc(ARGS_FROMWIRE)
 	 * Size.
 	 */
 	c = sr.base[1];
-	if (c != 0)
-		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 ||
-		    ((c >> 4) & 0xf) == 0)
+	if (c != 0) {
+		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 || ((c >> 4) & 0xf) == 0) {
 			return (ISC_R_RANGE);
 
+	/*
+	 * Horizontal precision.
+	 */
+		}
+	}
+
 	/*
 	 * Horizontal precision.
 	 */
 	c = sr.base[2];
-	if (c != 0)
-		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 ||
-		    ((c >> 4) & 0xf) == 0)
+	if (c != 0) {
+		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 || ((c >> 4) & 0xf) == 0) {
 			return (ISC_R_RANGE);
 
+	/*
+	 * Vertical precision.
+	 */
+		}
+	}
+
 	/*
 	 * Vertical precision.
 	 */
 	c = sr.base[3];
-	if (c != 0)
-		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 ||
-		    ((c >> 4) & 0xf) == 0)
+	if (c != 0) {
+		if ((c & 0xf) > 9 || ((c >> 4) & 0xf) > 9 || ((c >> 4) & 0xf) == 0) {
 			return (ISC_R_RANGE);
+		}
+	}
 	isc_region_consume(&sr, 4);
 
 	/*
diff --git a/lib/dns/rdata/generic/nxt_30.c b/lib/dns/rdata/generic/nxt_30.c
index 8c72912d7d..731bba2505 100644
--- a/lib/dns/rdata/generic/nxt_30.c
+++ b/lib/dns/rdata/generic/nxt_30.c
@@ -100,20 +100,22 @@ static inline isc_result_t totext_nxt(ARGS_TOTEXT)
 
 	for (i = 0; i < sr.length; i++) {
 		if (sr.base[i] != 0)
-			for (j = 0; j < 8; j++)
+			for (j = 0; j < 8; j++) {
 				if ((sr.base[i] & (0x80 >> j)) != 0) {
-					dns_rdatatype_t t = i * 8 + j;
-					RETERR(str_totext(" ", target));
-					if (dns_rdatatype_isknown(t)) {
-						RETERR(dns_rdatatype_totext(
-							t, target));
-					} else {
+					{
+						dns_rdatatype_t t = i * 8 + j;
+						RETERR(str_totext(" ", target));
+						if (dns_rdatatype_isknown(t)) {
+							RETERR(dns_rdatatype_totext(t, target));
+						}else {
 						char buf[sizeof("65535")];
-						snprintf(buf, sizeof(buf), "%u",
-							 t);
+						snprintf(buf, sizeof(buf),
+							 "%u", t);
 						RETERR(str_totext(buf, target));
 					}
 				}
+			}
+		}
 	}
 	return (ISC_R_SUCCESS);
 }
diff --git a/lib/dns/rdata/generic/x25_19.c b/lib/dns/rdata/generic/x25_19.c
index 094a12c388..0e7be82f86 100644
--- a/lib/dns/rdata/generic/x25_19.c
+++ b/lib/dns/rdata/generic/x25_19.c
@@ -33,9 +33,11 @@ static inline isc_result_t fromtext_x25(ARGS_FROMTEXT)
 				      false));
 	if (token.value.as_textregion.length < 4)
 		RETTOK(DNS_R_SYNTAX);
-	for (i = 0; i < token.value.as_textregion.length; i++)
-		if (!isdigit(token.value.as_textregion.base[i] & 0xff))
+	for (i = 0; i < token.value.as_textregion.length; i++) {
+		if (!isdigit(token.value.as_textregion.base[i] & 0xff)) {
 			RETTOK(ISC_R_RANGE);
+		}
+	}
 	RETTOK(txt_fromtext(&token.value.as_textregion, target));
 	return (ISC_R_SUCCESS);
 }
@@ -113,10 +115,13 @@ static inline isc_result_t fromstruct_x25(ARGS_FROMSTRUCT)
 	if (x25->x25_len < 4)
 		return (ISC_R_RANGE);
 
-	for (i = 0; i < x25->x25_len; i++)
-		if (!isdigit(x25->x25[i] & 0xff))
+	for (i = 0; i < x25->x25_len; i++) {
+		if (!isdigit(x25->x25[i] & 0xff)) {
 			return (ISC_R_RANGE);
 
+		}
+	}
+
 	RETERR(uint8_tobuffer(x25->x25_len, target));
 	return (mem_tobuffer(target, x25->x25, x25->x25_len));
 }
diff --git a/lib/dns/rdata/in_1/apl_42.c b/lib/dns/rdata/in_1/apl_42.c
index b2e9535444..90d2f55721 100644
--- a/lib/dns/rdata/in_1/apl_42.c
+++ b/lib/dns/rdata/in_1/apl_42.c
@@ -64,9 +64,11 @@ static inline isc_result_t fromtext_in_apl(ARGS_FROMTEXT)
 				RETTOK(DNS_R_BADDOTTEDQUAD);
 			if (prefix > 32)
 				RETTOK(ISC_R_RANGE);
-			for (len = 4; len > 0; len--)
-				if (addr[len - 1] != 0)
+			for (len = 4; len > 0; len--) {
+				if (addr[len - 1] != 0) {
 					break;
+				}
+			}
 			break;
 
 		case 2:
@@ -77,9 +79,11 @@ static inline isc_result_t fromtext_in_apl(ARGS_FROMTEXT)
 				RETTOK(DNS_R_BADAAAA);
 			if (prefix > 128)
 				RETTOK(ISC_R_RANGE);
-			for (len = 16; len > 0; len--)
-				if (addr[len - 1] != 0)
+			for (len = 16; len > 0; len--) {
+				if (addr[len - 1] != 0) {
 					break;
+				}
+			}
 			break;
 
 		default:
diff --git a/lib/dns/rdata/in_1/wks_11.c b/lib/dns/rdata/in_1/wks_11.c
index 61751bafe3..37e0dcf824 100644
--- a/lib/dns/rdata/in_1/wks_11.c
+++ b/lib/dns/rdata/in_1/wks_11.c
@@ -163,10 +163,13 @@ static inline isc_result_t fromtext_in_wks(ARGS_FROMTEXT)
 		 * case sensitive and the database is usually in lowercase.
 		 */
 		strlcpy(service, DNS_AS_STR(token), sizeof(service));
-		for (i = strlen(service) - 1; i >= 0; i--)
-			if (isupper(service[i] & 0xff))
+		for (i = strlen(service) - 1; i >= 0; i--) {
+			if (isupper(service[i] & 0xff)) {
 				service[i] = tolower(service[i] & 0xff);
 
+			}
+		}
+
 		port = strtol(DNS_AS_STR(token), &e, 10);
 		if (*e == 0)
 			;
@@ -222,13 +225,16 @@ static inline isc_result_t totext_in_wks(ARGS_TOTEXT)
 	INSIST(sr.length <= 8 * 1024);
 	for (i = 0; i < sr.length; i++) {
 		if (sr.base[i] != 0)
-			for (j = 0; j < 8; j++)
+			for (j = 0; j < 8; j++) {
 				if ((sr.base[i] & (0x80 >> j)) != 0) {
-					snprintf(buf, sizeof(buf), "%u",
-						 i * 8 + j);
-					RETERR(str_totext(" ", target));
-					RETERR(str_totext(buf, target));
+					{
+						snprintf(buf, sizeof(buf),
+							 "%u", i * 8 + j);
+						RETERR(str_totext(" ", target));
+						RETERR(str_totext(buf, target));
+					}
 				}
+			}
 	}
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c
index e220a29942..d9287ee3ec 100644
--- a/lib/dns/rdatalist.c
+++ b/lib/dns/rdatalist.c
@@ -375,9 +375,14 @@ isc__rdatalist_setownercase(dns_rdataset_t *rdataset, const dns_name_t *name)
 	 */
 	rdatalist = rdataset->private1;
 	memset(rdatalist->upper, 0, sizeof(rdatalist->upper));
-	for (i = 1; i < name->length; i++)
-		if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a)
+	for (i = 1; i < name->length; i++) {
+		if (name->ndata[i] >= 0x41 && name->ndata[i] <= 0x5a) {
 			rdatalist->upper[i / 8] |= 1 << (i % 8);
+	/*
+	 * Record that upper has been set.
+	 */
+		}
+	}
 	/*
 	 * Record that upper has been set.
 	 */
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index f205b05c33..c387e5cff0 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -1314,33 +1314,45 @@ fctx_cancelquery(resquery_t **queryp, dns_dispatchevent_t **deventp,
 	if (finish != NULL || age_untried)
 		for (addrinfo = ISC_LIST_HEAD(fctx->forwaddrs);
 		     addrinfo != NULL;
-		     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
-			if (UNMARKED(addrinfo))
+		     addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
+			if (UNMARKED(addrinfo)) {
 				dns_adb_agesrtt(fctx->adb, addrinfo, now);
 
+			}
+		}
+
 	if ((finish != NULL || age_untried) && TRIEDFIND(fctx))
 		for (find = ISC_LIST_HEAD(fctx->finds); find != NULL;
-		     find = ISC_LIST_NEXT(find, publink))
+		     find = ISC_LIST_NEXT(find, publink)) {
 			for (addrinfo = ISC_LIST_HEAD(find->list);
 			     addrinfo != NULL;
-			     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
-				if (UNMARKED(addrinfo))
+			     addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
+				if (UNMARKED(addrinfo)) {
 					dns_adb_agesrtt(fctx->adb, addrinfo,
-							now);
+						        now);
+
+				}
+			}
+		}
 
 	if ((finish != NULL || age_untried) && TRIEDALT(fctx)) {
 		for (addrinfo = ISC_LIST_HEAD(fctx->altaddrs); addrinfo != NULL;
-		     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
-			if (UNMARKED(addrinfo))
+		     addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
+			if (UNMARKED(addrinfo)) {
 				dns_adb_agesrtt(fctx->adb, addrinfo, now);
+			}
+		}
 		for (find = ISC_LIST_HEAD(fctx->altfinds); find != NULL;
-		     find = ISC_LIST_NEXT(find, publink))
+		     find = ISC_LIST_NEXT(find, publink)) {
 			for (addrinfo = ISC_LIST_HEAD(find->list);
 			     addrinfo != NULL;
-			     addrinfo = ISC_LIST_NEXT(addrinfo, publink))
-				if (UNMARKED(addrinfo))
+			     addrinfo = ISC_LIST_NEXT(addrinfo, publink)) {
+				if (UNMARKED(addrinfo)) {
 					dns_adb_agesrtt(fctx->adb, addrinfo,
-							now);
+						        now);
+				}
+			}
+		}
 	}
 
 	/*
@@ -7199,9 +7211,11 @@ betterreferral(fetchctx_t *fctx)
 		if (!isstrictsubdomain(name, &fctx->domain))
 			continue;
 		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-			if (rdataset->type == dns_rdatatype_ns)
+		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
+			if (rdataset->type == dns_rdatatype_ns) {
 				return (true);
+			}
+		}
 	}
 	return (false);
 }
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index a818975799..c6c23941a0 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -260,9 +260,11 @@ initial_size(unsigned int len)
 {
 	unsigned int size;
 
-	for (size = 1024; size < (64 * 1024); size *= 2)
-		if (len < size)
+	for (size = 1024; size < (64 * 1024); size *= 2) {
+		if (len < size) {
 			return (size);
+		}
+	}
 	return (65535);
 }
 
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index b66217b119..d7f345f55d 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2417,10 +2417,13 @@ zone_registerinclude(const char *filename, void *arg)
 	 * Suppress duplicates.
 	 */
 	for (inc = ISC_LIST_HEAD(zone->newincludes); inc != NULL;
-	     inc = ISC_LIST_NEXT(inc, link))
-		if (strcmp(filename, inc->name) == 0)
+	     inc = ISC_LIST_NEXT(inc, link)) {
+		if (strcmp(filename, inc->name) == 0) {
 			return;
 
+		}
+	}
+
 	inc = isc_mem_get(zone->mctx, sizeof(dns_include_t));
 	inc->name = isc_mem_strdup(zone->mctx, filename);
 	ISC_LINK_INIT(inc, link);
@@ -5869,9 +5872,11 @@ same_addrs(isc_sockaddr_t const *oldlist, isc_sockaddr_t const *newlist,
 {
 	unsigned int i;
 
-	for (i = 0; i < count; i++)
-		if (!isc_sockaddr_equal(&oldlist[i], &newlist[i]))
+	for (i = 0; i < count; i++) {
+		if (!isc_sockaddr_equal(&oldlist[i], &newlist[i])) {
 			return (false);
+		}
+	}
 	return (true);
 }
 
@@ -12377,11 +12382,14 @@ next_master:
 			/*
 			 * Did we get a good answer from all the masters?
 			 */
-			for (j = 0; j < zone->masterscnt; j++)
+			for (j = 0; j < zone->masterscnt; j++) {
 				if (zone->mastersok[j] == false) {
-					done = false;
-					break;
+					{
+						done = false;
+						break;
+					}
 				}
+			}
 		} else
 			done = true;
 		if (!done) {
@@ -12873,11 +12881,14 @@ next_master:
 			/*
 			 * Did we get a good answer from all the masters?
 			 */
-			for (j = 0; j < zone->masterscnt; j++)
+			for (j = 0; j < zone->masterscnt; j++) {
 				if (zone->mastersok[j] == false) {
-					done = false;
-					break;
+					{
+						done = false;
+						break;
+					}
 				}
+			}
 		} else
 			done = true;
 		if (!done) {
@@ -18008,9 +18019,11 @@ dns_zonemgr_getcount(dns_zonemgr_t *zmgr, int state)
 		break;
 	case DNS_ZONESTATE_SOAQUERY:
 		for (zone = ISC_LIST_HEAD(zmgr->zones); zone != NULL;
-		     zone = ISC_LIST_NEXT(zone, link))
-			if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESH))
+		     zone = ISC_LIST_NEXT(zone, link)) {
+			if (DNS_ZONE_FLAG(zone, DNS_ZONEFLG_REFRESH)) {
 				count++;
+			}
+		}
 		break;
 	case DNS_ZONESTATE_ANY:
 		for (zone = ISC_LIST_HEAD(zmgr->zones); zone != NULL;
diff --git a/lib/irs/getnameinfo.c b/lib/irs/getnameinfo.c
index c12008a39d..3a735ba101 100644
--- a/lib/irs/getnameinfo.c
+++ b/lib/irs/getnameinfo.c
@@ -170,11 +170,14 @@ getnameinfo(const struct sockaddr *sa, socklen_t salen, char *host,
 #endif
 
 	family = sa->sa_family;
-	for (i = 0; afdl[i].a_af; i++)
+	for (i = 0; afdl[i].a_af; i++) {
 		if (afdl[i].a_af == family) {
-			afd = &afdl[i];
-			goto found;
+			{
+				afd = &afdl[i];
+				goto found;
+			}
 		}
+	}
 	ERR(EAI_FAMILY);
 
 found:
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index 5f3e03ecca..5d15b288fb 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -520,9 +520,14 @@ have_header(isc_httpd_t *httpd, const char *header, const char *value,
 		 * Terminate token search on NULL or EOL.
 		 */
 		while (*h != 0 && *h != '\r' && *h != '\n') {
-			if (strncasecmp(h, value, vlen) == 0)
-				if (strchr(eov, h[vlen]) != NULL)
+			if (strncasecmp(h, value, vlen) == 0) {
+				if (strchr(eov, h[vlen]) != NULL) {
 					return (true);
+			/*
+			 * Skip to next token.
+			 */
+				}
+			}
 			/*
 			 * Skip to next token.
 			 */
diff --git a/lib/isc/log.c b/lib/isc/log.c
index 1db2d6680e..873b48c52a 100644
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -748,10 +748,13 @@ isc_log_usechannel(isc_logconfig_t *lcfg, const char *name,
 	REQUIRE(module == NULL || module->id < lctx->module_count);
 
 	for (channel = ISC_LIST_HEAD(lcfg->channels); channel != NULL;
-	     channel = ISC_LIST_NEXT(channel, link))
-		if (strcmp(name, channel->name) == 0)
+	     channel = ISC_LIST_NEXT(channel, link)) {
+		if (strcmp(name, channel->name) == 0) {
 			break;
 
+		}
+	}
+
 	if (channel == NULL)
 		return (ISC_R_NOTFOUND);
 
@@ -845,13 +848,14 @@ isc_log_setdebuglevel(isc_log_t *lctx, unsigned int level)
 	 */
 	if (lctx->debug_level == 0)
 		for (channel = ISC_LIST_HEAD(lctx->logconfig->channels);
-		     channel != NULL; channel = ISC_LIST_NEXT(channel, link))
-			if (channel->type == ISC_LOG_TOFILE &&
-			    (channel->flags & ISC_LOG_DEBUGONLY) != 0 &&
-			    FILE_STREAM(channel) != NULL) {
-				(void)fclose(FILE_STREAM(channel));
-				FILE_STREAM(channel) = NULL;
+		     channel != NULL; channel = ISC_LIST_NEXT(channel, link)) {
+			if (channel->type == ISC_LOG_TOFILE && (channel->flags & ISC_LOG_DEBUGONLY) != 0 && FILE_STREAM(channel) != NULL) {
+				{
+					(void)fclose(FILE_STREAM(channel));
+					FILE_STREAM(channel) = NULL;
+				}
 			}
+		}
 	UNLOCK(&lctx->lock);
 }
 
@@ -922,13 +926,15 @@ isc_log_closefilelogs(isc_log_t *lctx)
 
 	LOCK(&lctx->lock);
 	for (channel = ISC_LIST_HEAD(lctx->logconfig->channels);
-	     channel != NULL; channel = ISC_LIST_NEXT(channel, link))
+	     channel != NULL; channel = ISC_LIST_NEXT(channel, link)) {
 
-		if (channel->type == ISC_LOG_TOFILE &&
-		    FILE_STREAM(channel) != NULL) {
-			(void)fclose(FILE_STREAM(channel));
-			FILE_STREAM(channel) = NULL;
+		if (channel->type == ISC_LOG_TOFILE && FILE_STREAM(channel) != NULL) {
+			{
+				(void)fclose(FILE_STREAM(channel));
+				FILE_STREAM(channel) = NULL;
+			}
 		}
+	}
 	UNLOCK(&lctx->lock);
 }
 
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
index 3da38de574..caa269ade8 100644
--- a/lib/isc/pk11.c
+++ b/lib/isc/pk11.c
@@ -291,15 +291,19 @@ pk11_get_session(pk11_context_t *ctx, pk11_optype_t optype, bool need_services,
 	switch (optype) {
 	case OP_ANY:
 		for (token = ISC_LIST_HEAD(tokens); token != NULL;
-		     token = ISC_LIST_NEXT(token, link))
-			if (token->slotid == slot)
+		     token = ISC_LIST_NEXT(token, link)) {
+			if (token->slotid == slot) {
 				break;
+			}
+		}
 		break;
 	default:
 		for (token = ISC_LIST_HEAD(tokens); token != NULL;
-		     token = ISC_LIST_NEXT(token, link))
-			if (token->slotid == slot)
+		     token = ISC_LIST_NEXT(token, link)) {
+			if (token->slotid == slot) {
 				break;
+			}
+		}
 		break;
 	}
 	if (token == NULL)
@@ -698,9 +702,11 @@ pk11_attribute_bytype(const pk11_object_t *obj, CK_ATTRIBUTE_TYPE type)
 	CK_ATTRIBUTE *attr;
 
 	for (attr = pk11_attribute_first(obj); attr != NULL;
-	     attr = pk11_attribute_next(obj, attr))
-		if (attr->type == type)
+	     attr = pk11_attribute_next(obj, attr)) {
+		if (attr->type == type) {
 			return (attr);
+		}
+	}
 	return (NULL);
 }
 
@@ -899,33 +905,41 @@ pk11_parse_uri(pk11_object_t *obj, const char *label, isc_mem_t *mctx,
 			if (token == NULL)
 				for (token = ISC_LIST_HEAD(tokens);
 				     token != NULL;
-				     token = ISC_LIST_NEXT(token, link))
-					if (pk11strcmp(v, l, token->name, 32))
+				     token = ISC_LIST_NEXT(token, link)) {
+					if (pk11strcmp(v, l, token->name, 32)) {
 						break;
+					}
+				}
 		} else if (strcmp(a, "manufacturer") == 0) {
 			/* manufacturer: CK_TOKEN_INFO manufacturerID */
 			if (token == NULL)
 				for (token = ISC_LIST_HEAD(tokens);
 				     token != NULL;
-				     token = ISC_LIST_NEXT(token, link))
-					if (pk11strcmp(v, l, token->manuf, 32))
+				     token = ISC_LIST_NEXT(token, link)) {
+					if (pk11strcmp(v, l, token->manuf, 32)) {
 						break;
+					}
+				}
 		} else if (strcmp(a, "serial") == 0) {
 			/* serial: CK_TOKEN_INFO serialNumber */
 			if (token == NULL)
 				for (token = ISC_LIST_HEAD(tokens);
 				     token != NULL;
-				     token = ISC_LIST_NEXT(token, link))
-					if (pk11strcmp(v, l, token->serial, 16))
+				     token = ISC_LIST_NEXT(token, link)) {
+					if (pk11strcmp(v, l, token->serial, 16)) {
 						break;
+					}
+				}
 		} else if (strcmp(a, "model") == 0) {
 			/* model: CK_TOKEN_INFO model */
 			if (token == NULL)
 				for (token = ISC_LIST_HEAD(tokens);
 				     token != NULL;
-				     token = ISC_LIST_NEXT(token, link))
-					if (pk11strcmp(v, l, token->model, 16))
+				     token = ISC_LIST_NEXT(token, link)) {
+					if (pk11strcmp(v, l, token->model, 16)) {
 						break;
+					}
+				}
 		} else if (strcmp(a, "library-manufacturer") == 0) {
 			/* ignored */
 		} else if (strcmp(a, "library-description") == 0) {
diff --git a/lib/isc/unix/file.c b/lib/isc/unix/file.c
index 76678f7609..9fdba4b5be 100644
--- a/lib/isc/unix/file.c
+++ b/lib/isc/unix/file.c
@@ -297,9 +297,11 @@ isc_file_renameunique(const char *file, char *templet)
 			}
 		}
 	}
-	if (unlink(file) < 0)
-		if (errno != ENOENT)
+	if (unlink(file) < 0) {
+		if (errno != ENOENT) {
 			return (isc__errno2result(errno));
+		}
+	}
 	return (ISC_R_SUCCESS);
 }
 
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index 3e96dfbb39..a3f794405e 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -3039,9 +3039,11 @@ parse_unsupported(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret)
 				braces++;
 			else if (pctx->token.value.as_char == '}')
 				braces--;
-			else if (pctx->token.value.as_char == ';')
-				if (braces == 0)
+			else if (pctx->token.value.as_char == ';') {
+				if (braces == 0) {
 					break;
+				}
+			}
 		}
 		if (pctx->token.type == isc_tokentype_eof || braces < 0) {
 			cfg_parser_error(pctx, CFG_LOG_NEAR,
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 776608b093..7bffe0b8df 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -10535,15 +10535,18 @@ query_glueanswer(query_ctx_t *qctx)
 
 	msg = qctx->client->message;
 	for (name = ISC_LIST_HEAD(msg->sections[section]); name != NULL;
-	     name = ISC_LIST_NEXT(name, link))
+	     name = ISC_LIST_NEXT(name, link)) {
 		if (dns_name_equal(name, qctx->client->query.qname)) {
 			for (rdataset = ISC_LIST_HEAD(name->list);
 			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link))
-				if (rdataset->type == qctx->qtype)
+			     rdataset = ISC_LIST_NEXT(rdataset, link)) {
+				if (rdataset->type == qctx->qtype) {
 					break;
+				}
+			}
 			break;
 		}
+	}
 	if (rdataset != NULL) {
 		ISC_LIST_UNLINK(msg->sections[section], name, link);
 		ISC_LIST_PREPEND(msg->sections[section], name, link);