diff --git a/CHANGES b/CHANGES
index 2ff6d371de..cde7a5368e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4841.	[bug]		Address -fsanitize=undefined warnings. [RT #46786]
+
 4840.	[test]		Add tests to cover fallback to using ZSK on inactive
 			KSK. [RT #46787]
 
diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh
index 141fa7b3e5..112adf1132 100644
--- a/bin/tests/system/rndc/tests.sh
+++ b/bin/tests/system/rndc/tests.sh
@@ -580,7 +580,7 @@ n=`expr $n + 1`
 echo " I:wait for the zones to be loaded ($n)"
 ret=1
 try=0
-while test $try -lt 45
+while test $try -lt 100
 do
     sleep 1
     sed -n "$cur,"'$p' < ns6/named.run | grep "any newly configured zones are now loaded" > /dev/null && {
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 081952385d..541fafd056 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -4401,8 +4401,10 @@ dns_message_buildopt(dns_message_t *message, dns_rdataset_t **rdatasetp,
 			}
 			isc_buffer_putuint16(buf, ednsopts[i].code);
 			isc_buffer_putuint16(buf, ednsopts[i].length);
-			isc_buffer_putmem(buf, ednsopts[i].value,
-					  ednsopts[i].length);
+			if (ednsopts[i].length != 0) {
+				isc_buffer_putmem(buf, ednsopts[i].value,
+						  ednsopts[i].length);
+			}
 		}
 
 		/* Padding must be the final option */
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 9588c40f58..d42543d57e 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -1044,7 +1044,8 @@ dns_name_fromregion(dns_name_t *name, const isc_region_t *r) {
 		len = (r->length < r2.length) ? r->length : r2.length;
 		if (len > DNS_NAME_MAXWIRE)
 			len = DNS_NAME_MAXWIRE;
-		memmove(r2.base, r->base, len);
+		if (len != 0)
+			memmove(r2.base, r->base, len);
 		name->ndata = r2.base;
 		name->length = len;
 	} else {
@@ -2050,8 +2051,11 @@ dns_name_towire2(const dns_name_t *name, dns_compress_t *cctx,
 	if (gf) {
 		if (ISC_UNLIKELY(target->length - target->used < gp.length))
 			return (ISC_R_NOSPACE);
-		(void)memmove((unsigned char *)target->base + target->used,
-			      gp.ndata, (size_t)gp.length);
+		if (gp.length != 0) {
+			unsigned char *base = target->base;
+			(void)memmove(base + target->used, gp.ndata,
+				      (size_t)gp.length);
+		}
 		isc_buffer_add(target, gp.length);
 		if (ISC_UNLIKELY(target->length - target->used < 2))
 			return (ISC_R_NOSPACE);
@@ -2066,8 +2070,11 @@ dns_name_towire2(const dns_name_t *name, dns_compress_t *cctx,
 	} else {
 		if (ISC_UNLIKELY(target->length - target->used < name->length))
 			return (ISC_R_NOSPACE);
-		(void)memmove((unsigned char *)target->base + target->used,
-			      name->ndata, (size_t)name->length);
+		if (name->length != 0) {
+			unsigned char *base = target->base;
+			(void)memmove(base + target->used, name->ndata,
+				      (size_t)name->length);
+		}
 		isc_buffer_add(target, name->length);
 		dns_compress_add(cctx, name, name, offset);
 		if (comp_offsetp != NULL)
@@ -2542,7 +2549,8 @@ dns_name_copy(const dns_name_t *source, dns_name_t *dest, isc_buffer_t *target)
 	ndata = (unsigned char *)target->base + target->used;
 	dest->ndata = target->base;
 
-	memmove(ndata, source->ndata, source->length);
+	if (source->length != 0)
+		memmove(ndata, source->ndata, source->length);
 
 	dest->ndata = ndata;
 	dest->labels = source->labels;
diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c
index 71e7be2d3d..a124c3dd73 100644
--- a/lib/dns/rdata/generic/opt_41.c
+++ b/lib/dns/rdata/generic/opt_41.c
@@ -98,6 +98,8 @@ fromwire_opt(ARGS_FROMWIRE) {
 	UNUSED(options);
 
 	isc_buffer_activeregion(source, &sregion);
+	if (sregion.length == 0)
+		return (ISC_R_SUCCESS);
 	total = 0;
 	while (sregion.length != 0) {
 		if (sregion.length < 4)
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 2f98e67021..ea3e014fd4 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1866,8 +1866,8 @@ update_quantum(isc_task_t *task, isc_event_t *event) {
 			break;
 		}
 
-		result = dns_db_allrdatasets(rpz->updb, node, rpz->updbversion, 0,
-					     &rdsiter);
+		result = dns_db_allrdatasets(rpz->updb, node, rpz->updbversion,
+					     0, &rdsiter);
 		if (result != ISC_R_SUCCESS) {
 			isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
 				      DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
diff --git a/lib/isc/inet_aton.c b/lib/isc/inet_aton.c
index 83e6334362..403936a52c 100644
--- a/lib/isc/inet_aton.c
+++ b/lib/isc/inet_aton.c
@@ -82,8 +82,8 @@ isc_net_aton(const char *cp, struct in_addr *addr) {
 	int base;
 	ptrdiff_t n;
 	unsigned char c;
-	isc_uint8_t parts[4];
-	isc_uint8_t *pp = parts;
+	isc_uint32_t parts[4];
+	isc_uint32_t *pp = parts;
 	int digit;
 
 	c = *cp;
@@ -135,7 +135,7 @@ isc_net_aton(const char *cp, struct in_addr *addr) {
 			 */
 			if (pp >= parts + 3 || val > 0xffU)
 				return (0);
-			*pp++ = (isc_uint8_t)val;
+			*pp++ = val;
 			c = *++cp;
 		} else
 			break;
diff --git a/lib/isc/random.c b/lib/isc/random.c
index 91441b22ff..f0ff9cfbfb 100644
--- a/lib/isc/random.c
+++ b/lib/isc/random.c
@@ -140,7 +140,8 @@ isc_random_get(isc_uint32_t *val) {
 	 */
 #if RAND_MAX >= 0xfffff
 	/* We have at least 20 bits.  Use lower 16 excluding lower most 4 */
-	*val = ((rand() >> 4) & 0xffff) | ((rand() << 12) & 0xffff0000);
+	*val = ((((unsigned int)rand()) & 0xffff0) >> 4) |
+	       ((((unsigned int)rand()) & 0xffff0) << 12);
 #elif RAND_MAX >= 0x7fff
 	/* We have at least 15 bits.  Use lower 10/11 excluding lower most 4 */
 	*val = ((rand() >> 4) & 0x000007ff) | ((rand() << 7) & 0x003ff800) |
diff --git a/lib/isc/tests/random_test.c b/lib/isc/tests/random_test.c
index fc0b74ad2e..03e38e6f33 100644
--- a/lib/isc/tests/random_test.c
+++ b/lib/isc/tests/random_test.c
@@ -194,14 +194,14 @@ tables_init(void) {
 static isc_uint32_t
 matrix_binaryrank(isc_uint32_t *bits, ssize_t rows, ssize_t cols) {
 	ssize_t i, j, k;
-	int rt = 0;
+	unsigned int rt = 0;
 	isc_uint32_t rank = 0;
 	isc_uint32_t tmp;
 
 	for (k = 0; k < rows; k++) {
 		i = k;
 
-		while (((bits[i] >> rt) & 1) == 0) {
+		while (rt >= cols || ((bits[i] >> rt) & 1) == 0) {
 			i++;
 
 			if (i < rows)