diff --git a/bin/delv/delv.c b/bin/delv/delv.c
index eb0ad59407..c06115b5ae 100644
--- a/bin/delv/delv.c
+++ b/bin/delv/delv.c
@@ -946,8 +946,7 @@ addserver(dns_client_t *client) {
 			    cur->ai_family != AF_INET6) {
 				continue;
 			}
-			sa = isc_mem_get(mctx, sizeof(*sa));
-			memset(sa, 0, sizeof(*sa));
+			sa = isc_mem_getx(mctx, sizeof(*sa), ISC_MEM_ZERO);
 			ISC_LINK_INIT(sa, link);
 			memmove(&sa->type, cur->ai_addr, cur->ai_addrlen);
 			sa->length = (unsigned int)cur->ai_addrlen;
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 827461cb76..affac1693a 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -963,8 +963,7 @@ parse_netprefix(isc_sockaddr_t **sap, const char *value) {
 		fatal("invalid prefix '%s'\n", value);
 	}
 
-	sa = isc_mem_allocate(mctx, sizeof(*sa));
-	memset(sa, 0, sizeof(*sa));
+	sa = isc_mem_allocatex(mctx, sizeof(*sa), ISC_MEM_ZERO);
 
 	if (strcmp(buf, "0") == 0) {
 		sa->type.sa.sa_family = AF_UNSPEC;
diff --git a/bin/dnssec/dnssec-cds.c b/bin/dnssec/dnssec-cds.c
index b68972fa08..cc68928d98 100644
--- a/bin/dnssec/dnssec-cds.c
+++ b/bin/dnssec/dnssec-cds.c
@@ -594,8 +594,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	dns_secalg_t *algo;
 	int i;
 
-	algo = isc_mem_get(mctx, nkey);
-	memset(algo, 0, nkey);
+	algo = isc_mem_getx(mctx, nkey, ISC_MEM_ZERO);
 
 	for (result = dns_rdataset_first(sigset); result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(sigset))
diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 4c615b52eb..774376000e 100644
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -4036,8 +4036,8 @@ main(int argc, char *argv[]) {
 		 * There is more work to do.  Spread it out over multiple
 		 * processors if possible.
 		 */
-		tasks = isc_mem_get(mctx, ntasks * sizeof(isc_task_t *));
-		memset(tasks, 0, ntasks * sizeof(isc_task_t *));
+		tasks = isc_mem_getx(mctx, ntasks * sizeof(isc_task_t *),
+				     ISC_MEM_ZERO);
 
 		isc_loopmgr_setup(loopmgr, startworker, tasks);
 		isc_loopmgr_teardown(loopmgr, workerdone, tasks);
diff --git a/bin/named/config.c b/bin/named/config.c
index 83e8bd39fc..67ef953119 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -695,21 +695,20 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		oldlen = newlen + 16;                              \
 	}
 
-#define shrink_array(mctx, array, newlen, oldlen)           \
-	if (newlen < oldlen) {                              \
-		void *tmp = NULL;                           \
-		size_t newsize = newlen * sizeof(array[0]); \
-		size_t oldsize = oldlen * sizeof(array[0]); \
-		if (newlen != 0) {                          \
-			tmp = isc_mem_get(mctx, newsize);   \
-			memset(tmp, 0, newsize);            \
-			memmove(tmp, array, newsize);       \
-		} else {                                    \
-			tmp = NULL;                         \
-		}                                           \
-		isc_mem_put(mctx, array, oldsize);          \
-		array = tmp;                                \
-		oldlen = newlen;                            \
+#define shrink_array(mctx, array, newlen, oldlen)                        \
+	if (newlen < oldlen) {                                           \
+		void *tmp = NULL;                                        \
+		size_t newsize = newlen * sizeof(array[0]);              \
+		size_t oldsize = oldlen * sizeof(array[0]);              \
+		if (newlen != 0) {                                       \
+			tmp = isc_mem_getx(mctx, newsize, ISC_MEM_ZERO); \
+			memmove(tmp, array, newsize);                    \
+		} else {                                                 \
+			tmp = NULL;                                      \
+		}                                                        \
+		isc_mem_put(mctx, array, oldsize);                       \
+		array = tmp;                                             \
+		oldlen = newlen;                                         \
 	}
 
 isc_result_t
diff --git a/bin/named/dlz_dlopen_driver.c b/bin/named/dlz_dlopen_driver.c
index bd96882b64..a18f22a456 100644
--- a/bin/named/dlz_dlopen_driver.c
+++ b/bin/named/dlz_dlopen_driver.c
@@ -224,8 +224,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	}
 
 	isc_mem_create(&mctx);
-	cd = isc_mem_get(mctx, sizeof(*cd));
-	memset(cd, 0, sizeof(*cd));
+	cd = isc_mem_getx(mctx, sizeof(*cd), ISC_MEM_ZERO);
 
 	cd->mctx = mctx;
 
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 8444e32f67..b63b578e55 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -1594,9 +1594,8 @@ evaluate_server(char *cmdline) {
 
 	ns_alloc = MAX_SERVERADDRS;
 	ns_inuse = 0;
-	servers = isc_mem_get(gmctx, ns_alloc * sizeof(isc_sockaddr_t));
-
-	memset(servers, 0, ns_alloc * sizeof(isc_sockaddr_t));
+	servers = isc_mem_getx(gmctx, ns_alloc * sizeof(isc_sockaddr_t),
+			       ISC_MEM_ZERO);
 	ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
 	if (ns_total == 0) {
 		return (STATUS_SYNTAX);
@@ -2854,9 +2853,7 @@ lookforsoa:
 		}
 		primary_alloc = MAX_SERVERADDRS;
 		size = primary_alloc * sizeof(isc_sockaddr_t);
-		primary_servers = isc_mem_get(gmctx, size);
-
-		memset(primary_servers, 0, size);
+		primary_servers = isc_mem_getx(gmctx, size, ISC_MEM_ZERO);
 		primary_total = get_addresses(serverstr, dnsport,
 					      primary_servers, primary_alloc);
 		if (primary_total == 0) {
diff --git a/bin/plugins/filter-a.c b/bin/plugins/filter-a.c
index ac05305e18..b2a495cc24 100644
--- a/bin/plugins/filter-a.c
+++ b/bin/plugins/filter-a.c
@@ -338,8 +338,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
 
-	inst = isc_mem_get(mctx, sizeof(*inst));
-	memset(inst, 0, sizeof(*inst));
+	inst = isc_mem_getx(mctx, sizeof(*inst), ISC_MEM_ZERO);
 	isc_mem_attach(mctx, &inst->mctx);
 
 	if (parameters != NULL) {
diff --git a/bin/plugins/filter-aaaa.c b/bin/plugins/filter-aaaa.c
index a83f0f5dde..1a895ecf95 100644
--- a/bin/plugins/filter-aaaa.c
+++ b/bin/plugins/filter-aaaa.c
@@ -341,8 +341,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
 
-	inst = isc_mem_get(mctx, sizeof(*inst));
-	memset(inst, 0, sizeof(*inst));
+	inst = isc_mem_getx(mctx, sizeof(*inst), ISC_MEM_ZERO);
 	isc_mem_attach(mctx, &inst->mctx);
 
 	if (parameters != NULL) {
diff --git a/cocci/isc_mem_zero.spatch b/cocci/isc_mem_zero.spatch
new file mode 100644
index 0000000000..319c26b6e3
--- /dev/null
+++ b/cocci/isc_mem_zero.spatch
@@ -0,0 +1,17 @@
+@@
+expression ptr, ctx, size;
+@@
+
+- ptr = isc_mem_get(ctx, size);
++ ptr = isc_mem_getx(ctx, size, ISC_MEM_ZERO);
+...
+- memset(ptr, 0, size);
+
+@@
+expression ptr, ctx, size;
+@@
+
+- ptr = isc_mem_allocate(ctx, size);
++ ptr = isc_mem_allocatex(ctx, size, ISC_MEM_ZERO);
+...
+- memset(ptr, 0, size);
diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index cea74f72d5..2030f75a72 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -70,9 +70,9 @@ dns_acl_create(isc_mem_t *mctx, int n, dns_acl_t **target) {
 	 */
 	acl->magic = DNS_ACL_MAGIC;
 
-	acl->elements = isc_mem_get(mctx, n * sizeof(dns_aclelement_t));
+	acl->elements = isc_mem_getx(mctx, n * sizeof(dns_aclelement_t),
+				     ISC_MEM_ZERO);
 	acl->alloc = n;
-	memset(acl->elements, 0, n * sizeof(dns_aclelement_t));
 	ISC_LIST_INIT(acl->ports_and_transports);
 	acl->port_proto_entries = 0;
 
@@ -318,11 +318,9 @@ dns_acl_merge(dns_acl_t *dest, dns_acl_t *source, bool pos) {
 			newalloc = 4;
 		}
 
-		newmem = isc_mem_get(dest->mctx,
-				     newalloc * sizeof(dns_aclelement_t));
-
-		/* Zero. */
-		memset(newmem, 0, newalloc * sizeof(dns_aclelement_t));
+		newmem = isc_mem_getx(dest->mctx,
+				      newalloc * sizeof(dns_aclelement_t),
+				      ISC_MEM_ZERO);
 
 		/* Copy in the original elements */
 		memmove(newmem, dest->elements,
diff --git a/lib/dns/badcache.c b/lib/dns/badcache.c
index 7c724686d3..f5a8a62fdf 100644
--- a/lib/dns/badcache.c
+++ b/lib/dns/badcache.c
@@ -74,8 +74,7 @@ dns_badcache_init(isc_mem_t *mctx, unsigned int size, dns_badcache_t **bcp) {
 	REQUIRE(bcp != NULL && *bcp == NULL);
 	REQUIRE(mctx != NULL);
 
-	bc = isc_mem_get(mctx, sizeof(dns_badcache_t));
-	memset(bc, 0, sizeof(dns_badcache_t));
+	bc = isc_mem_getx(mctx, sizeof(dns_badcache_t), ISC_MEM_ZERO);
 
 	isc_mem_attach(mctx, &bc->mctx);
 	isc_rwlock_init(&bc->lock, 0, 0);
@@ -164,8 +163,8 @@ badcache_resize(dns_badcache_t *bc, isc_time_t *now) {
 	}
 	RUNTIME_CHECK(newsize > 0);
 
-	newtable = isc_mem_get(bc->mctx, sizeof(dns_bcentry_t *) * newsize);
-	memset(newtable, 0, sizeof(dns_bcentry_t *) * newsize);
+	newtable = isc_mem_getx(bc->mctx, sizeof(dns_bcentry_t *) * newsize,
+				ISC_MEM_ZERO);
 
 	newlocks = isc_mem_get(bc->mctx, sizeof(isc_mutex_t) * newsize);
 
diff --git a/lib/dns/catz.c b/lib/dns/catz.c
index 5c12874983..1b0128dbd0 100644
--- a/lib/dns/catz.c
+++ b/lib/dns/catz.c
@@ -736,8 +736,7 @@ dns_catz_new_zones(dns_catz_zones_t **catzsp, dns_catz_zonemodmethods_t *zmm,
 	REQUIRE(catzsp != NULL && *catzsp == NULL);
 	REQUIRE(zmm != NULL);
 
-	new_zones = isc_mem_get(mctx, sizeof(*new_zones));
-	memset(new_zones, 0, sizeof(*new_zones));
+	new_zones = isc_mem_getx(mctx, sizeof(*new_zones), ISC_MEM_ZERO);
 
 	isc_mutex_init(&new_zones->lock);
 
@@ -787,9 +786,7 @@ dns_catz_new_zone(dns_catz_zones_t *catzs, dns_catz_zone_t **zonep,
 	REQUIRE(zonep != NULL && *zonep == NULL);
 	REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC));
 
-	new_zone = isc_mem_get(catzs->mctx, sizeof(*new_zone));
-
-	memset(new_zone, 0, sizeof(*new_zone));
+	new_zone = isc_mem_getx(catzs->mctx, sizeof(*new_zone), ISC_MEM_ZERO);
 
 	dns_name_init(&new_zone->name, NULL);
 	dns_name_dup(name, catzs->mctx, &new_zone->name);
diff --git a/lib/dns/dlz.c b/lib/dns/dlz.c
index bf76190249..4a2e2bf9e2 100644
--- a/lib/dns/dlz.c
+++ b/lib/dns/dlz.c
@@ -199,10 +199,7 @@ dns_dlzcreate(isc_mem_t *mctx, const char *dlzname, const char *drivername,
 	}
 
 	/* Allocate memory to hold the DLZ database driver */
-	db = isc_mem_get(mctx, sizeof(dns_dlzdb_t));
-
-	/* Make sure memory region is set to all 0's */
-	memset(db, 0, sizeof(dns_dlzdb_t));
+	db = isc_mem_getx(mctx, sizeof(dns_dlzdb_t), ISC_MEM_ZERO);
 
 	ISC_LINK_INIT(db, link);
 	db->implementation = impinfo;
@@ -320,10 +317,8 @@ dns_dlzregister(const char *drivername, const dns_dlzmethods_t *methods,
 	 * Allocate memory for a dlz_implementation object.  Error if
 	 * we cannot.
 	 */
-	dlz_imp = isc_mem_get(mctx, sizeof(dns_dlzimplementation_t));
-
-	/* Make sure memory region is set to all 0's */
-	memset(dlz_imp, 0, sizeof(dns_dlzimplementation_t));
+	dlz_imp = isc_mem_getx(mctx, sizeof(dns_dlzimplementation_t),
+			       ISC_MEM_ZERO);
 
 	/* Store the data passed into this method */
 	dlz_imp->name = drivername;
diff --git a/lib/dns/dnsrps.c b/lib/dns/dnsrps.c
index 30b7052b3e..2bee924261 100644
--- a/lib/dns/dnsrps.c
+++ b/lib/dns/dnsrps.c
@@ -257,8 +257,7 @@ dns_dnsrps_rewrite_init(librpz_emsg_t *emsg, dns_rpz_st_t *st,
 			isc_mem_t *mctx, bool have_rd) {
 	rpsdb_t *rpsdb;
 
-	rpsdb = isc_mem_get(mctx, sizeof(*rpsdb));
-	memset(rpsdb, 0, sizeof(*rpsdb));
+	rpsdb = isc_mem_getx(mctx, sizeof(*rpsdb), ISC_MEM_ZERO);
 
 	if (!librpz->rsp_create(emsg, &rpsdb->rsp, NULL, rpzs->rps_client,
 				have_rd, false))
@@ -631,9 +630,8 @@ rpsdb_allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	REQUIRE(VALID_RPSDB(rpsdb));
 	REQUIRE(node == &rpsdb->origin_node || node == &rpsdb->data_node);
 
-	rpsdb_iter = isc_mem_get(rpsdb->common.mctx, sizeof(*rpsdb_iter));
-
-	memset(rpsdb_iter, 0, sizeof(*rpsdb_iter));
+	rpsdb_iter = isc_mem_getx(rpsdb->common.mctx, sizeof(*rpsdb_iter),
+				  ISC_MEM_ZERO);
 	rpsdb_iter->common.magic = DNS_RDATASETITER_MAGIC;
 	rpsdb_iter->common.methods = &rpsdb_rdatasetiter_methods;
 	rpsdb_iter->common.db = db;
diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index 71525fa88d..d3f4c7c4bc 100644
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -161,9 +161,7 @@ dns_dt_create(isc_mem_t *mctx, dns_dtmode_t mode, const char *path,
 
 	atomic_fetch_add_release(&global_generation, 1);
 
-	env = isc_mem_get(mctx, sizeof(dns_dtenv_t));
-
-	memset(env, 0, sizeof(dns_dtenv_t));
+	env = isc_mem_getx(mctx, sizeof(dns_dtenv_t), ISC_MEM_ZERO);
 	isc_mem_attach(mctx, &env->mctx);
 	env->reopen_task = reopen_task;
 	isc_mutex_init(&env->reopen_lock);
@@ -1064,9 +1062,7 @@ dns_dt_parse(isc_mem_t *mctx, isc_region_t *src, dns_dtdata_t **destp) {
 	REQUIRE(src != NULL);
 	REQUIRE(destp != NULL && *destp == NULL);
 
-	d = isc_mem_get(mctx, sizeof(*d));
-
-	memset(d, 0, sizeof(*d));
+	d = isc_mem_getx(mctx, sizeof(*d), ISC_MEM_ZERO);
 	isc_mem_attach(mctx, &d->mctx);
 
 	d->frame = dnstap__dnstap__unpack(NULL, src->length, src->base);
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 8f230eef36..2464c64709 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -283,8 +283,7 @@ dst_context_create(dst_key_t *key, isc_mem_t *mctx, isc_logcategory_t *category,
 		return (DST_R_NULLKEY);
 	}
 
-	dctx = isc_mem_get(mctx, sizeof(dst_context_t));
-	memset(dctx, 0, sizeof(*dctx));
+	dctx = isc_mem_getx(mctx, sizeof(*dctx), ISC_MEM_ZERO);
 	dst_key_attach(key, &dctx->key);
 	isc_mem_attach(mctx, &dctx->mctx);
 	dctx->category = category;
@@ -1524,9 +1523,7 @@ get_key_struct(const dns_name_t *name, unsigned int alg, unsigned int flags,
 	dst_key_t *key;
 	int i;
 
-	key = isc_mem_get(mctx, sizeof(dst_key_t));
-
-	memset(key, 0, sizeof(dst_key_t));
+	key = isc_mem_getx(mctx, sizeof(dst_key_t), ISC_MEM_ZERO);
 
 	key->key_name = isc_mem_get(mctx, sizeof(dns_name_t));
 
diff --git a/lib/dns/dyndb.c b/lib/dns/dyndb.c
index 08ff0ffba0..626b451f31 100644
--- a/lib/dns/dyndb.c
+++ b/lib/dns/dyndb.c
@@ -126,8 +126,7 @@ load_library(isc_mem_t *mctx, const char *filename, const char *instname,
 		      ISC_LOG_INFO, "loading DynDB instance '%s' driver '%s'",
 		      instname, filename);
 
-	imp = isc_mem_get(mctx, sizeof(*imp));
-	memset(imp, 0, sizeof(*imp));
+	imp = isc_mem_getx(mctx, sizeof(*imp), ISC_MEM_ZERO);
 	isc_mem_attach(mctx, &imp->mctx);
 
 	imp->name = isc_mem_strdup(imp->mctx, instname);
@@ -273,9 +272,7 @@ dns_dyndb_createctx(isc_mem_t *mctx, const void *hashinit, isc_log_t *lctx,
 
 	REQUIRE(dctxp != NULL && *dctxp == NULL);
 
-	dctx = isc_mem_get(mctx, sizeof(*dctx));
-
-	memset(dctx, 0, sizeof(*dctx));
+	dctx = isc_mem_getx(mctx, sizeof(*dctx), ISC_MEM_ZERO);
 	if (view != NULL) {
 		dns_view_attach(view, &dctx->view);
 	}
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 80fe9c54d3..ff8e37d69b 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -591,8 +591,7 @@ journal_file_create(isc_mem_t *mctx, bool downgrade, const char *filename) {
 	size = sizeof(journal_rawheader_t) +
 	       index_size * sizeof(journal_rawpos_t);
 
-	mem = isc_mem_get(mctx, size);
-	memset(mem, 0, size);
+	mem = isc_mem_getx(mctx, size, ISC_MEM_ZERO);
 	memmove(mem, &rawheader, sizeof(rawheader));
 
 	result = isc_stdio_write(mem, 1, (size_t)size, fp, NULL);
diff --git a/lib/dns/rbt.c b/lib/dns/rbt.c
index 77ab08b14e..77de2b650c 100644
--- a/lib/dns/rbt.c
+++ b/lib/dns/rbt.c
@@ -1504,8 +1504,7 @@ create_node(isc_mem_t *mctx, const dns_name_t *name, dns_rbtnode_t **nodep) {
 	 * Allocate space for the node structure, the name, and the offsets.
 	 */
 	nodelen = sizeof(dns_rbtnode_t) + region.length + labels + 1;
-	node = isc_mem_get(mctx, nodelen);
-	memset(node, 0, nodelen);
+	node = isc_mem_getx(mctx, nodelen, ISC_MEM_ZERO);
 
 	node->is_root = 0;
 	node->parent = NULL;
@@ -1589,8 +1588,7 @@ hashtable_new(dns_rbt_t *rbt, uint8_t index, uint8_t bits) {
 	rbt->hashbits[index] = bits;
 
 	size = ISC_HASHSIZE(rbt->hashbits[index]) * sizeof(dns_rbtnode_t *);
-	rbt->hashtable[index] = isc_mem_get(rbt->mctx, size);
-	memset(rbt->hashtable[index], 0, size);
+	rbt->hashtable[index] = isc_mem_getx(rbt->mctx, size, ISC_MEM_ZERO);
 }
 
 static void
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 53fbb2822f..975214c4b1 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -1246,8 +1246,7 @@ allocate_version(isc_mem_t *mctx, rbtdb_serial_t serial,
 
 	size = ISC_HASHSIZE(version->glue_table_bits) *
 	       sizeof(version->glue_table[0]);
-	version->glue_table = isc_mem_get(mctx, size);
-	memset(version->glue_table, 0, size);
+	version->glue_table = isc_mem_getx(mctx, size, ISC_MEM_ZERO);
 
 	version->writer = writer;
 	version->commit_ok = false;
@@ -8113,7 +8112,7 @@ dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	/* Keep the compiler happy. */
 	UNUSED(driverarg);
 
-	rbtdb = isc_mem_get(mctx, sizeof(*rbtdb));
+	rbtdb = isc_mem_getx(mctx, sizeof(*rbtdb), ISC_MEM_ZERO);
 
 	/*
 	 * If argv[0] exists, it points to a memory context to use for heap
@@ -8122,7 +8121,6 @@ dns_rbtdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 		hmctx = (isc_mem_t *)argv[0];
 	}
 
-	memset(rbtdb, '\0', sizeof(*rbtdb));
 	dns_name_init(&rbtdb->common.origin, NULL);
 	rbtdb->common.attributes = 0;
 	if (type == dns_dbtype_cache) {
@@ -9507,9 +9505,9 @@ rehash_gluetable(rbtdb_version_t *version) {
 	newbits = rehash_bits(version, version->glue_table_nodecount);
 	newsize = ISC_HASHSIZE(newbits) * sizeof(version->glue_table[0]);
 
-	version->glue_table = isc_mem_get(version->rbtdb->common.mctx, newsize);
+	version->glue_table = isc_mem_getx(version->rbtdb->common.mctx, newsize,
+					   ISC_MEM_ZERO);
 	version->glue_table_bits = newbits;
-	memset(version->glue_table, 0, newsize);
 
 	for (i = 0; i < oldcount; i++) {
 		rbtdb_glue_table_node_t *gluenode;
diff --git a/lib/dns/rdataslab.c b/lib/dns/rdataslab.c
index 74d9b5aa7f..c45cb8aa2e 100644
--- a/lib/dns/rdataslab.c
+++ b/lib/dns/rdataslab.c
@@ -269,18 +269,17 @@ dns_rdataslab_fromrdataset(dns_rdataset_t *rdataset, isc_mem_t *mctx,
 	 * Allocate the memory, set up a buffer, start copying in
 	 * data.
 	 */
-	rawbuf = isc_mem_get(mctx, buflen);
+	rawbuf = isc_mem_getx(mctx, buflen, ISC_MEM_ZERO);
 
 #if DNS_RDATASET_FIXED
 	/* Allocate temporary offset table. */
-	offsettable = isc_mem_get(mctx, nalloc * sizeof(unsigned int));
-	memset(offsettable, 0, nalloc * sizeof(unsigned int));
+	offsettable = isc_mem_getx(mctx, nalloc * sizeof(unsigned int),
+				   ISC_MEM_ZERO);
 #endif /* if DNS_RDATASET_FIXED */
 
 	region->base = rawbuf;
 	region->length = buflen;
 
-	memset(rawbuf, 0, buflen);
 	rawbuf += reservelen;
 
 #if DNS_RDATASET_FIXED
@@ -625,9 +624,8 @@ dns_rdataslab_merge(unsigned char *oslab, unsigned char *nslab,
 	 */
 	tcurrent += (tcount * 4);
 
-	offsettable = isc_mem_get(mctx,
-				  (ocount + oncount) * sizeof(unsigned int));
-	memset(offsettable, 0, (ocount + oncount) * sizeof(unsigned int));
+	offsettable = isc_mem_getx(
+		mctx, (ocount + oncount) * sizeof(unsigned int), ISC_MEM_ZERO);
 #endif /* if DNS_RDATASET_FIXED */
 
 	/*
@@ -849,8 +847,8 @@ dns_rdataslab_subtract(unsigned char *mslab, unsigned char *sslab,
 #if DNS_RDATASET_FIXED
 	offsetbase = tcurrent;
 
-	offsettable = isc_mem_get(mctx, mcount * sizeof(unsigned int));
-	memset(offsettable, 0, mcount * sizeof(unsigned int));
+	offsettable = isc_mem_getx(mctx, mcount * sizeof(unsigned int),
+				   ISC_MEM_ZERO);
 #endif /* if DNS_RDATASET_FIXED */
 
 	/*
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 9c89e9f084..e2da3ae5bb 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -10302,9 +10302,8 @@ dns_resolver_create(dns_view_t *view, isc_loopmgr_t *loopmgr,
 		goto cleanup_res;
 	}
 
-	res->tasks = isc_mem_get(view->mctx,
-				 res->ntasks * sizeof(res->tasks[0]));
-	memset(res->tasks, 0, res->ntasks * sizeof(res->tasks[0]));
+	res->tasks = isc_mem_getx(
+		view->mctx, res->ntasks * sizeof(res->tasks[0]), ISC_MEM_ZERO);
 	for (uint32_t i = 0; i < res->ntasks; i++) {
 		/*
 		 * Since we have a pool of tasks we bind them to task
@@ -11153,8 +11152,7 @@ dns_resolver_disable_algorithm(dns_resolver_t *resolver, const dns_name_t *name,
 			 * bitfield and copy the old (smaller) bitfield
 			 * into it if one exists.
 			 */
-			tmp = isc_mem_get(resolver->mctx, len);
-			memset(tmp, 0, len);
+			tmp = isc_mem_getx(resolver->mctx, len, ISC_MEM_ZERO);
 			if (algorithms != NULL) {
 				memmove(tmp, algorithms, *algorithms);
 			}
@@ -11273,8 +11271,7 @@ dns_resolver_disable_ds_digest(dns_resolver_t *resolver, const dns_name_t *name,
 			 * bitfield and copy the old (smaller) bitfield
 			 * into it if one exists.
 			 */
-			tmp = isc_mem_get(resolver->mctx, len);
-			memset(tmp, 0, len);
+			tmp = isc_mem_getx(resolver->mctx, len, ISC_MEM_ZERO);
 			if (digests != NULL) {
 				memmove(tmp, digests, *digests);
 			}
diff --git a/lib/dns/rrl.c b/lib/dns/rrl.c
index 9ecc6c5dc5..40fea40d38 100644
--- a/lib/dns/rrl.c
+++ b/lib/dns/rrl.c
@@ -260,8 +260,7 @@ expand_entries(dns_rrl_t *rrl, int newsize) {
 
 	bsize = sizeof(dns_rrl_block_t) +
 		(newsize - 1) * sizeof(dns_rrl_entry_t);
-	b = isc_mem_get(rrl->mctx, bsize);
-	memset(b, 0, bsize);
+	b = isc_mem_getx(rrl->mctx, bsize, ISC_MEM_ZERO);
 	b->size = bsize;
 
 	e = b->entries;
@@ -325,8 +324,7 @@ expand_rrl_hash(dns_rrl_t *rrl, isc_stdtime_t now) {
 	new_bins = hash_divisor(new_bins);
 
 	hsize = sizeof(dns_rrl_hash_t) + (new_bins - 1) * sizeof(hash->bins[0]);
-	hash = isc_mem_get(rrl->mctx, hsize);
-	memset(hash, 0, hsize);
+	hash = isc_mem_getx(rrl->mctx, hsize, ISC_MEM_ZERO);
 	hash->length = new_bins;
 	rrl->hash_gen ^= 1;
 	hash->gen = rrl->hash_gen;
@@ -935,9 +933,9 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e, const char *str1,
 			if (qbuf != NULL) {
 				ISC_LIST_UNLINK(rrl->qname_free, qbuf, link);
 			} else if (rrl->num_qnames < DNS_RRL_QNAMES) {
-				qbuf = isc_mem_get(rrl->mctx, sizeof(*qbuf));
+				qbuf = isc_mem_getx(rrl->mctx, sizeof(*qbuf),
+						    ISC_MEM_ZERO);
 				{
-					memset(qbuf, 0, sizeof(*qbuf));
 					ISC_LINK_INIT(qbuf, link);
 					qbuf->index = rrl->num_qnames;
 					rrl->qnames[rrl->num_qnames++] = qbuf;
@@ -1337,8 +1335,7 @@ dns_rrl_init(dns_rrl_t **rrlp, dns_view_t *view, int min_entries) {
 
 	*rrlp = NULL;
 
-	rrl = isc_mem_get(view->mctx, sizeof(*rrl));
-	memset(rrl, 0, sizeof(*rrl));
+	rrl = isc_mem_getx(view->mctx, sizeof(*rrl), ISC_MEM_ZERO);
 	isc_mem_attach(view->mctx, &rrl->mctx);
 	isc_mutex_init(&rrl->lock);
 	isc_stdtime_get(&rrl->ts_bases[0]);
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index edf4bd7565..085bdc68e5 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -1319,8 +1319,7 @@ dns_sdb_create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 		return (ISC_R_NOTIMPLEMENTED);
 	}
 
-	sdb = isc_mem_get(mctx, sizeof(dns_sdb_t));
-	memset(sdb, 0, sizeof(dns_sdb_t));
+	sdb = isc_mem_getx(mctx, sizeof(dns_sdb_t), ISC_MEM_ZERO);
 
 	dns_name_init(&sdb->common.origin, NULL);
 	sdb->common.attributes = 0;
diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
index 28ee82fb6f..ca33d5ba2f 100644
--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
@@ -1454,8 +1454,7 @@ dns_sdlzcreateDBP(isc_mem_t *mctx, void *driverarg, void *dbdata,
 	imp = (dns_sdlzimplementation_t *)driverarg;
 
 	/* allocate and zero memory for driver structure */
-	sdlzdb = isc_mem_get(mctx, sizeof(dns_sdlz_db_t));
-	memset(sdlzdb, 0, sizeof(dns_sdlz_db_t));
+	sdlzdb = isc_mem_getx(mctx, sizeof(dns_sdlz_db_t), ISC_MEM_ZERO);
 
 	/* initialize and set origin */
 	dns_name_init(&sdlzdb->common.origin, NULL);
@@ -1973,10 +1972,8 @@ dns_sdlzregister(const char *drivername, const dns_sdlzmethods_t *methods,
 	 * Allocate memory for a sdlz_implementation object.  Error if
 	 * we cannot.
 	 */
-	imp = isc_mem_get(mctx, sizeof(dns_sdlzimplementation_t));
-
-	/* Make sure memory region is set to all 0's */
-	memset(imp, 0, sizeof(dns_sdlzimplementation_t));
+	imp = isc_mem_getx(mctx, sizeof(dns_sdlzimplementation_t),
+			   ISC_MEM_ZERO);
 
 	/* Store the data passed into this method */
 	imp->methods = methods;
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 08e0000bd8..8cd9765895 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -18701,8 +18701,8 @@ zonemgr_keymgmt_resize(dns_zonemgr_t *zmgr) {
 
 	RWLOCK(&mgmt->lock, isc_rwlocktype_write);
 
-	newtable = isc_mem_get(mgmt->mctx, sizeof(dns_keyfileio_t *) * newsize);
-	memset(newtable, 0, sizeof(dns_keyfileio_t *) * newsize);
+	newtable = isc_mem_getx(mgmt->mctx, sizeof(dns_keyfileio_t *) * newsize,
+				ISC_MEM_ZERO);
 
 	for (unsigned int i = 0; i < size; i++) {
 		dns_keyfileio_t *kfio, *next;
@@ -18905,9 +18905,9 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
 	isc_ratelimiter_create(loop, &zmgr->startupnotifyrl);
 	isc_ratelimiter_create(loop, &zmgr->startuprefreshrl);
 
-	zmgr->zonetasks = isc_mem_get(
-		zmgr->mctx, zmgr->workers * sizeof(zmgr->zonetasks[0]));
-	memset(zmgr->zonetasks, 0, zmgr->workers * sizeof(zmgr->zonetasks[0]));
+	zmgr->zonetasks = isc_mem_getx(
+		zmgr->mctx, zmgr->workers * sizeof(zmgr->zonetasks[0]),
+		ISC_MEM_ZERO);
 	for (size_t i = 0; i < zmgr->workers; i++) {
 		result = isc_task_create(zmgr->taskmgr, &zmgr->zonetasks[i], i);
 		INSIST(result == ISC_R_SUCCESS);
@@ -18918,9 +18918,9 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
 		isc_task_setname(zmgr->zonetasks[i], "zonemgr-zonetasks", NULL);
 	}
 
-	zmgr->loadtasks = isc_mem_get(
-		zmgr->mctx, zmgr->workers * sizeof(zmgr->loadtasks[0]));
-	memset(zmgr->loadtasks, 0, zmgr->workers * sizeof(zmgr->loadtasks[0]));
+	zmgr->loadtasks = isc_mem_getx(
+		zmgr->mctx, zmgr->workers * sizeof(zmgr->loadtasks[0]),
+		ISC_MEM_ZERO);
 	for (size_t i = 0; i < zmgr->workers; i++) {
 		result = isc_task_create(zmgr->taskmgr, &zmgr->loadtasks[i], i);
 		INSIST(result == ISC_R_SUCCESS);
@@ -18930,9 +18930,9 @@ dns_zonemgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
 		isc_task_setname(zmgr->loadtasks[i], "zonemgr-loadtasks", NULL);
 	}
 
-	zmgr->mctxpool = isc_mem_get(zmgr->mctx,
-				     zmgr->workers * sizeof(zmgr->mctxpool[0]));
-	memset(zmgr->mctxpool, 0, zmgr->workers * sizeof(zmgr->mctxpool[0]));
+	zmgr->mctxpool = isc_mem_getx(zmgr->mctx,
+				      zmgr->workers * sizeof(zmgr->mctxpool[0]),
+				      ISC_MEM_ZERO);
 	for (size_t i = 0; i < zmgr->workers; i++) {
 		isc_mem_create(&zmgr->mctxpool[i]);
 		isc_mem_setname(zmgr->mctxpool[i], "zonemgr-mctxpool");
diff --git a/lib/dns/zoneverify.c b/lib/dns/zoneverify.c
index ab7f70b73d..ff2943113e 100644
--- a/lib/dns/zoneverify.c
+++ b/lib/dns/zoneverify.c
@@ -404,8 +404,7 @@ record_nsec3(const vctx_t *vctx, const unsigned char *rawhash,
 
 	len = sizeof(*element) + nsec3->next_length * 2 + nsec3->salt_length;
 
-	element = isc_mem_get(vctx->mctx, len);
-	memset(element, 0, len);
+	element = isc_mem_getx(vctx->mctx, len, ISC_MEM_ZERO);
 	element->hash = nsec3->hash;
 	element->salt_length = nsec3->salt_length;
 	element->next_length = nsec3->next_length;
diff --git a/lib/isc/ht.c b/lib/isc/ht.c
index cc2b139531..f1bfa0d989 100644
--- a/lib/isc/ht.c
+++ b/lib/isc/ht.c
@@ -210,8 +210,7 @@ hashtable_new(isc_ht_t *ht, const uint8_t idx, const uint8_t bits) {
 
 	size = ht->size[idx] * sizeof(isc_ht_node_t *);
 
-	ht->table[idx] = isc_mem_get(ht->mctx, size);
-	memset(ht->table[idx], 0, size);
+	ht->table[idx] = isc_mem_getx(ht->mctx, size, ISC_MEM_ZERO);
 }
 
 static void
diff --git a/lib/isc/log.c b/lib/isc/log.c
index 22c647ac47..011d027a12 100644
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -990,9 +990,7 @@ sync_channellist(isc_logconfig_t *lcfg) {
 
 	bytes = lctx->category_count * sizeof(ISC_LIST(isc_logchannellist_t));
 
-	lists = isc_mem_get(lctx->mctx, bytes);
-
-	memset(lists, 0, bytes);
+	lists = isc_mem_getx(lctx->mctx, bytes, ISC_MEM_ZERO);
 
 	if (lcfg->channellist_count != 0) {
 		bytes = lcfg->channellist_count *
diff --git a/lib/isc/netmgr/tcp.c b/lib/isc/netmgr/tcp.c
index 19a49f884f..052ec47d79 100644
--- a/lib/isc/netmgr/tcp.c
+++ b/lib/isc/netmgr/tcp.c
@@ -407,8 +407,8 @@ isc_nm_listentcp(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
 	sock->nchildren = (workers == ISC_NM_LISTEN_ALL) ? (uint32_t)mgr->nloops
 							 : workers;
 	children_size = sock->nchildren * sizeof(sock->children[0]);
-	sock->children = isc_mem_get(worker->mctx, children_size);
-	memset(sock->children, 0, children_size);
+	sock->children = isc_mem_getx(worker->mctx, children_size,
+				      ISC_MEM_ZERO);
 
 	isc_barrier_init(&sock->barrier, sock->nchildren);
 
diff --git a/lib/isc/netmgr/tcpdns.c b/lib/isc/netmgr/tcpdns.c
index a63eba001e..fa42f8e233 100644
--- a/lib/isc/netmgr/tcpdns.c
+++ b/lib/isc/netmgr/tcpdns.c
@@ -395,8 +395,8 @@ isc_nm_listentcpdns(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
 	sock->nchildren = (workers == ISC_NM_LISTEN_ALL) ? (uint32_t)mgr->nloops
 							 : workers;
 	children_size = sock->nchildren * sizeof(sock->children[0]);
-	sock->children = isc_mem_get(worker->mctx, children_size);
-	memset(sock->children, 0, children_size);
+	sock->children = isc_mem_getx(worker->mctx, children_size,
+				      ISC_MEM_ZERO);
 
 	isc_barrier_init(&sock->barrier, sock->nchildren);
 
diff --git a/lib/isc/netmgr/tlsdns.c b/lib/isc/netmgr/tlsdns.c
index 960bcefac3..47c21dbd4d 100644
--- a/lib/isc/netmgr/tlsdns.c
+++ b/lib/isc/netmgr/tlsdns.c
@@ -508,8 +508,8 @@ isc_nm_listentlsdns(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
 	sock->nchildren = (workers == ISC_NM_LISTEN_ALL) ? (uint32_t)mgr->nloops
 							 : workers;
 	children_size = sock->nchildren * sizeof(sock->children[0]);
-	sock->children = isc_mem_get(worker->mctx, children_size);
-	memset(sock->children, 0, children_size);
+	sock->children = isc_mem_getx(worker->mctx, children_size,
+				      ISC_MEM_ZERO);
 
 	isc_barrier_init(&sock->barrier, sock->nchildren);
 
diff --git a/lib/isc/netmgr/udp.c b/lib/isc/netmgr/udp.c
index 587e368203..cd5513fc58 100644
--- a/lib/isc/netmgr/udp.c
+++ b/lib/isc/netmgr/udp.c
@@ -152,8 +152,8 @@ isc_nm_listenudp(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
 	sock->nchildren = (workers == ISC_NM_LISTEN_ALL) ? (uint32_t)mgr->nloops
 							 : workers;
 	children_size = sock->nchildren * sizeof(sock->children[0]);
-	sock->children = isc_mem_get(worker->mctx, children_size);
-	memset(sock->children, 0, children_size);
+	sock->children = isc_mem_getx(worker->mctx, children_size,
+				      ISC_MEM_ZERO);
 
 	isc_barrier_init(&sock->barrier, sock->nchildren);
 
diff --git a/lib/isc/portset.c b/lib/isc/portset.c
index 52b96f5191..ee1de234b6 100644
--- a/lib/isc/portset.c
+++ b/lib/isc/portset.c
@@ -61,10 +61,7 @@ isc_portset_create(isc_mem_t *mctx, isc_portset_t **portsetp) {
 
 	REQUIRE(portsetp != NULL && *portsetp == NULL);
 
-	portset = isc_mem_get(mctx, sizeof(*portset));
-
-	/* Make the set 'empty' by default */
-	memset(portset, 0, sizeof(*portset));
+	portset = isc_mem_getx(mctx, sizeof(*portset), ISC_MEM_ZERO);
 	*portsetp = portset;
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/isc/tls.c b/lib/isc/tls.c
index aa81068fd1..71b21f4677 100644
--- a/lib/isc/tls.c
+++ b/lib/isc/tls.c
@@ -185,8 +185,8 @@ isc__tls_initialize(void) {
 	RUNTIME_CHECK(OPENSSL_init_ssl(opts, NULL) == 1);
 #else
 	nlocks = CRYPTO_num_locks();
-	locks = isc_mem_get(isc__tls_mctx, nlocks * sizeof(locks[0]));
-	memset(locks, 0, nlocks * sizeof(locks[0]));
+	locks = isc_mem_getx(isc__tls_mctx, nlocks * sizeof(locks[0]),
+			     ISC_MEM_ZERO);
 	isc_mutexblock_init(locks, nlocks);
 	CRYPTO_set_locking_callback(isc__tls_lock_callback);
 	CRYPTO_THREADID_set_callback(isc__tls_set_thread_id);
@@ -1337,9 +1337,7 @@ isc_tlsctx_cache_add(
 		 * The hash table entry does not exist, let's create one.
 		 */
 		INSIST(result != ISC_R_SUCCESS);
-		entry = isc_mem_get(cache->mctx, sizeof(*entry));
-		/* Oracle/Red Hat Linux, GCC bug #53119 */
-		memset(entry, 0, sizeof(*entry));
+		entry = isc_mem_getx(cache->mctx, sizeof(*entry), ISC_MEM_ZERO);
 		entry->ctx[tr_offset][ipv6] = ctx;
 		entry->client_sess_cache[tr_offset][ipv6] = client_sess_cache;
 		entry->ca_store = store;
diff --git a/lib/isc/uv.c b/lib/isc/uv.c
index deb5252874..79c4362479 100644
--- a/lib/isc/uv.c
+++ b/lib/isc/uv.c
@@ -124,8 +124,7 @@ isc__uv_calloc(size_t count, size_t size) {
 	REQUIRE(count == 0 || res / count == size);
 #endif
 
-	ptr = isc_mem_allocate(isc__uv_mctx, res);
-	memset(ptr, 0, res);
+	ptr = isc_mem_allocatex(isc__uv_mctx, res, ISC_MEM_ZERO);
 
 	return (ptr);
 }
diff --git a/lib/ns/hooks.c b/lib/ns/hooks.c
index 702d020840..0e1be71bf4 100644
--- a/lib/ns/hooks.c
+++ b/lib/ns/hooks.c
@@ -125,8 +125,7 @@ load_plugin(isc_mem_t *mctx, const char *modpath, ns_plugin_t **pluginp) {
 
 	REQUIRE(pluginp != NULL && *pluginp == NULL);
 
-	plugin = isc_mem_get(mctx, sizeof(*plugin));
-	memset(plugin, 0, sizeof(*plugin));
+	plugin = isc_mem_getx(mctx, sizeof(*plugin), ISC_MEM_ZERO);
 	isc_mem_attach(mctx, &plugin->mctx);
 
 	plugin->modpath = isc_mem_strdup(plugin->mctx, modpath);
@@ -318,8 +317,7 @@ ns_hook_add(ns_hooktable_t *hooktable, isc_mem_t *mctx,
 	REQUIRE(hookpoint < NS_HOOKPOINTS_COUNT);
 	REQUIRE(hook != NULL);
 
-	copy = isc_mem_get(mctx, sizeof(*copy));
-	memset(copy, 0, sizeof(*copy));
+	copy = isc_mem_getx(mctx, sizeof(*copy), ISC_MEM_ZERO);
 
 	copy->action = hook->action;
 	copy->action_data = hook->action_data;
@@ -335,8 +333,7 @@ ns_plugins_create(isc_mem_t *mctx, ns_plugins_t **listp) {
 
 	REQUIRE(listp != NULL && *listp == NULL);
 
-	plugins = isc_mem_get(mctx, sizeof(*plugins));
-	memset(plugins, 0, sizeof(*plugins));
+	plugins = isc_mem_getx(mctx, sizeof(*plugins), ISC_MEM_ZERO);
 	ISC_LIST_INIT(*plugins);
 
 	*listp = plugins;
diff --git a/lib/ns/server.c b/lib/ns/server.c
index 4a738118b1..f2ee999c04 100644
--- a/lib/ns/server.c
+++ b/lib/ns/server.c
@@ -43,9 +43,7 @@ ns_server_create(isc_mem_t *mctx, ns_matchview_t matchingview,
 
 	REQUIRE(sctxp != NULL && *sctxp == NULL);
 
-	sctx = isc_mem_get(mctx, sizeof(*sctx));
-
-	memset(sctx, 0, sizeof(*sctx));
+	sctx = isc_mem_getx(mctx, sizeof(*sctx), ISC_MEM_ZERO);
 
 	isc_mem_attach(mctx, &sctx->mctx);
 
diff --git a/lib/ns/update.c b/lib/ns/update.c
index cd446df6b6..ad7c561c9d 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -2810,8 +2810,8 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (ssutable != NULL) {
 		ruleslen = request->counts[DNS_SECTION_UPDATE];
-		rules = isc_mem_get(mctx, sizeof(*rules) * ruleslen);
-		memset(rules, 0, sizeof(*rules) * ruleslen);
+		rules = isc_mem_getx(mctx, sizeof(*rules) * ruleslen,
+				     ISC_MEM_ZERO);
 	}
 
 	for (rule = 0,