diff --git a/CHANGES b/CHANGES
index c1a5d04cc9..8920efbb61 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3567.	[bug]		Silence clang static analyzer warnings. [RT #33365]
+
 3566.	[func]		Log when forwarding updates to master. [RT #33240]
 
 3564.	[bug]		Improved handling of corrupted map files. [RT #33380]
diff --git a/bin/dnssec/dnssec-keygen.c b/bin/dnssec/dnssec-keygen.c
index 5a30ca55b7..1e61ca392e 100644
--- a/bin/dnssec/dnssec-keygen.c
+++ b/bin/dnssec/dnssec-keygen.c
@@ -535,6 +535,7 @@ main(int argc, char **argv) {
 					"recommended.\nIf you still wish to "
 					"use RSA (RSAMD5) please specify "
 					"\"-a RSAMD5\"\n");
+			INSIST(freeit == NULL);
 			return (1);
 		} else if (strcasecmp(algname, "HMAC-MD5") == 0)
 			alg = DST_ALG_HMACMD5;
diff --git a/bin/named/server.c b/bin/named/server.c
index 766602e647..b6c1d7aade 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -6605,6 +6605,7 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
 	dns_rdataclass_t rdclass;
 
 	REQUIRE(zonep != NULL && *zonep == NULL);
+	REQUIRE(zonename == NULL || *zonename == NULL);
 
 	input = args;
 
@@ -6620,7 +6621,7 @@ zone_from_args(ns_server_t *server, char *args, const char *zonetxt,
 		zonetxt = next_token(&input, " \t");
 	if (zonetxt == NULL)
 		return (ISC_R_SUCCESS);
-	if (zonename)
+	if (zonename != NULL)
 		*zonename = zonetxt;
 
 	/* Look for the optional class name. */
@@ -8510,8 +8511,8 @@ ns_server_del_zone(ns_server_t *server, char *args, isc_buffer_t *text) {
 		goto cleanup;
 	}
 
-	if (zonename != NULL)
-		znamelen = strlen(zonename);
+	INSIST(zonename != NULL);
+	znamelen = strlen(zonename);
 
 	/* Dig out configuration for this zone */
 	view = dns_zone_getview(zone);
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 2dd147e17d..889e6e4b8c 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2628,6 +2628,10 @@ isspf(const dns_rdata_t *rdata) {
 		data += tl;
 		rdl -= tl;
 	}
+
+	if (i < 6U)
+		return(ISC_FALSE);
+
 	buf[i] = 0;
 	if (strncmp(buf, "v=spf1", 6) == 0 && (buf[6] == 0 || buf[6] == ' '))
 		return (ISC_TRUE);
diff --git a/lib/isc/unix/app.c b/lib/isc/unix/app.c
index e9fce14e8c..f4a121489e 100644
--- a/lib/isc/unix/app.c
+++ b/lib/isc/unix/app.c
@@ -375,10 +375,10 @@ isc__app_ctxstart(isc_appctx_t *ctx0) {
  cleanup:
 #ifdef ISC_PLATFORM_USETHREADS
  cleanup_rcond:
-	isc_condition_destroy(&ctx->ready);
+	(void)isc_condition_destroy(&ctx->ready);
 
  cleanup_rlock:
-	isc_mutex_destroy(&ctx->readylock);
+	(void)isc_mutex_destroy(&ctx->readylock);
 #endif /* ISC_PLATFORM_USETHREADS */
 	return (result);
 }