diff --git a/CHANGES b/CHANGES
index d260548a1d..5401e2729f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+4059.	[bug]		Addressed valgrind warnings. [RT #38549]
+
 4058.	[bug]		UDP dispatches could use the wrong psuedorandom
 			number generator context. [RT #38578]
 
diff --git a/bin/named/interfacemgr.c b/bin/named/interfacemgr.c
index 515fb0f92c..034a24324f 100644
--- a/bin/named/interfacemgr.c
+++ b/bin/named/interfacemgr.c
@@ -1053,7 +1053,7 @@ do_scan(ns_interfacemgr_t *mgr, ns_listenlist_t *ext_listen,
 				if (le->dscp != -1 && ifp->dscp == -1)
 					ifp->dscp = le->dscp;
 				else if (le->dscp != ifp->dscp) {
-					isc_sockaddr_format(&listen_addr,
+					isc_sockaddr_format(&listen_sockaddr,
 							    sabuf,
 							    sizeof(sabuf));
 					isc_log_write(IFMGR_COMMON_LOGARGS,
diff --git a/bin/named/server.c b/bin/named/server.c
index 3031fc2efd..7a1a905ecc 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -9858,7 +9858,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t **text) {
 	isc_boolean_t chain = ISC_FALSE;
 	isc_boolean_t setserial = ISC_FALSE;
 	isc_uint32_t serial = 0;
-	char keystr[DNS_SECALG_FORMATSIZE + 7];
+	char keystr[DNS_SECALG_FORMATSIZE + 7]; /* <5-digit keyid>/<alg> */
 	unsigned short hash = 0, flags = 0, iter = 0, saltlen = 0;
 	unsigned char salt[255];
 	const char *ptr;
@@ -9884,7 +9884,7 @@ ns_server_signing(ns_server_t *server, char *args, isc_buffer_t **text) {
 		ptr = next_token(&args, " \t");
 		if (ptr == NULL)
 			return (ISC_R_UNEXPECTEDEND);
-		memmove(keystr, ptr, sizeof(keystr));
+		strlcpy(keystr, ptr, sizeof(keystr));
 	} else if (strcasecmp(ptr, "-nsec3param") == 0) {
 		const char *hashstr, *flagstr, *iterstr;
 		char nbuf[512];
diff --git a/lib/dns/nta.c b/lib/dns/nta.c
index 1e472909c2..14e2f8e475 100644
--- a/lib/dns/nta.c
+++ b/lib/dns/nta.c
@@ -688,7 +688,7 @@ dns_ntatable_save(dns_ntatable_t *ntatable, FILE *fp) {
 				name = dns_fixedname_name(&fn);
 				dns_rbt_fullnamefromnode(node, name);
 
-				isc_buffer_init(&b, nbuf, sizeof(nbuf) - 1);
+				isc_buffer_init(&b, nbuf, sizeof(nbuf));
 				result = dns_name_totext(name, ISC_FALSE, &b);
 				if (result != ISC_R_SUCCESS)
 					goto skip;
@@ -699,6 +699,9 @@ dns_ntatable_save(dns_ntatable_t *ntatable, FILE *fp) {
 				isc_buffer_init(&b, tbuf, sizeof(tbuf));
 				dns_time32_totext(n->expiry, &b);
 
+				/* Zero terminate. */
+				isc_buffer_putuint8(&b, 0);
+
 				fprintf(fp, "%s %s %s\n", nbuf,
 					n->forced ? "forced" : "regular",
 					tbuf);
diff --git a/lib/isc/unix/net.c b/lib/isc/unix/net.c
index 0810e4a003..4b75594d16 100644
--- a/lib/isc/unix/net.c
+++ b/lib/isc/unix/net.c
@@ -519,6 +519,8 @@ cmsgsend(int s, int level, int type, struct addrinfo *res) {
 		return (ISC_FALSE);
 	}
 
+	memset(&control, 0, sizeof(control));
+
 	iovec.iov_base = buf;
 	iovec.iov_len = sizeof(buf);