diff --git a/TODO b/TODO
index aa4c37f3c9..c8e964a688 100644
--- a/TODO
+++ b/TODO
@@ -27,6 +27,8 @@ F15:
 
 * ply should do mkdir before writing pid file
 
+* ConditionDirectoryNotEmpty= needs to be documented
+
 Features:
 
 * teach dbus to activate all services it finds in /etc/systemd/services/org-*.service
diff --git a/src/condition.c b/src/condition.c
index 61812c2570..b404b49c92 100644
--- a/src/condition.c
+++ b/src/condition.c
@@ -30,7 +30,9 @@
 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
         Condition *c;
 
-        c = new0(Condition, 1);
+        if (!(c = new0(Condition, 1)))
+                return NULL;
+
         c->type = type;
         c->trigger = trigger;
         c->negate = negate;
diff --git a/src/dbus-manager.c b/src/dbus-manager.c
index 92a602219b..2f755bcc64 100644
--- a/src/dbus-manager.c
+++ b/src/dbus-manager.c
@@ -1020,8 +1020,10 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
                 if (!e)
                         goto oom;
 
-                if (!(reply = dbus_message_new_method_return(message)))
+                if (!(reply = dbus_message_new_method_return(message))) {
+                        strv_free(e);
                         goto oom;
+                }
 
                 strv_free(m->environment);
                 m->environment = e;
@@ -1108,8 +1110,6 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
                         goto oom;
         }
 
-        free(path);
-
         if (reply) {
                 if (!dbus_connection_send(connection, reply, NULL))
                         goto oom;
@@ -1117,6 +1117,8 @@ static DBusHandlerResult bus_manager_message_handler(DBusConnection *connection,
                 dbus_message_unref(reply);
         }
 
+        free(path);
+
         return DBUS_HANDLER_RESULT_HANDLED;
 
 oom:
diff --git a/src/dbus-unit.c b/src/dbus-unit.c
index 563ef7079a..b5daa66b5d 100644
--- a/src/dbus-unit.c
+++ b/src/dbus-unit.c
@@ -455,8 +455,6 @@ static DBusHandlerResult bus_unit_message_dispatch(Unit *u, DBusConnection *conn
                         goto oom;
         }
 
-        free(path);
-
         if (reply) {
                 if (!dbus_connection_send(connection, reply, NULL))
                         goto oom;
@@ -464,6 +462,8 @@ static DBusHandlerResult bus_unit_message_dispatch(Unit *u, DBusConnection *conn
                 dbus_message_unref(reply);
         }
 
+        free(path);
+
         return DBUS_HANDLER_RESULT_HANDLED;
 
 oom:
diff --git a/src/dbus.c b/src/dbus.c
index 31b1ce6ee0..6f43c4108e 100644
--- a/src/dbus.c
+++ b/src/dbus.c
@@ -176,8 +176,8 @@ static dbus_bool_t bus_add_watch(DBusWatch *bus_watch, void *data) {
                 }
 
                 if (epoll_ctl(m->epoll_fd, EPOLL_CTL_ADD, w->fd, &ev) < 0) {
-                        free(w);
                         close_nointr_nofail(w->fd);
+                        free(w);
                         return FALSE;
                 }
 
@@ -236,7 +236,7 @@ static int bus_timeout_arm(Manager *m, Watch *w) {
 
         if (dbus_timeout_get_enabled(w->data.bus_timeout)) {
                 timespec_store(&its.it_value, dbus_timeout_get_interval(w->data.bus_timeout) * USEC_PER_MSEC);
-                its.it_interval = its.it_interval;
+                its.it_interval = its.it_value;
         }
 
         if (timerfd_settime(w->fd, 0, &its, NULL) < 0)
@@ -269,7 +269,7 @@ static dbus_bool_t bus_add_timeout(DBusTimeout *timeout, void *data) {
         if (!(w = new0(Watch, 1)))
                 return FALSE;
 
-        if (!(w->fd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK|TFD_CLOEXEC)) < 0)
+        if ((w->fd = timerfd_create(CLOCK_MONOTONIC, TFD_NONBLOCK|TFD_CLOEXEC)) < 0)
                 goto fail;
 
         w->type = WATCH_DBUS_TIMEOUT;
diff --git a/src/execute.c b/src/execute.c
index cd44640a53..b7ae522692 100644
--- a/src/execute.c
+++ b/src/execute.c
@@ -646,7 +646,7 @@ static int enforce_groups(const ExecContext *context, const char *username, gid_
                 char **i;
 
                 /* Final step, initialize any manually set supplementary groups */
-                ngroups_max = (int) sysconf(_SC_NGROUPS_MAX);
+                assert_se((ngroups_max = (int) sysconf(_SC_NGROUPS_MAX)) > 0);
 
                 if (!(gids = new(gid_t, ngroups_max)))
                         return -ENOMEM;
diff --git a/src/manager.c b/src/manager.c
index fdb5beda21..dae746cae5 100644
--- a/src/manager.c
+++ b/src/manager.c
@@ -2615,7 +2615,7 @@ int manager_open_serialization(Manager *m, FILE **_f) {
         log_debug("Serializing state to %s", path);
         free(path);
 
-        if (!(f = fdopen(fd, "w+")) < 0)
+        if (!(f = fdopen(fd, "w+")))
                 return -errno;
 
         *_f = f;
diff --git a/src/modules-load.c b/src/modules-load.c
index 2dd432695f..3824b57de7 100644
--- a/src/modules-load.c
+++ b/src/modules-load.c
@@ -99,17 +99,21 @@ int main(int argc, char *argv[]) {
                 }
 
                 f = fopen(fn, "re");
-                free(fn);
 
                 if (!f) {
-                        if (errno == ENOENT)
+                        if (errno == ENOENT) {
+                                free(fn);
                                 continue;
+                        }
 
                         log_error("Failed to open %s: %m", fn);
+                        free(fn);
                         r = EXIT_FAILURE;
                         continue;
                 }
 
+                free(fn);
+
                 for (;;) {
                         char line[LINE_MAX], *l, *t;
 
diff --git a/src/mount.c b/src/mount.c
index 209e19c175..2d8542d9df 100644
--- a/src/mount.c
+++ b/src/mount.c
@@ -785,6 +785,7 @@ static void mount_enter_signal(Mount *m, MountState state, bool success) {
                                 wait_for_exit = true;
 
                         set_free(pid_set);
+                        pid_set = NULL;
                 }
         }
 
diff --git a/src/readahead-replay.c b/src/readahead-replay.c
index fee2171dd2..0b84528b0e 100644
--- a/src/readahead-replay.c
+++ b/src/readahead-replay.c
@@ -122,7 +122,8 @@ static int replay(const char *root) {
         FILE *pack = NULL;
         char line[LINE_MAX];
         int r = 0;
-        char *pack_fn = NULL, c;
+        char *pack_fn = NULL;
+        int c;
         bool on_ssd, ready = false;
         int prio;
         int inotify_fd = -1;
diff --git a/src/service.c b/src/service.c
index c74e8a009f..728ca0b018 100644
--- a/src/service.c
+++ b/src/service.c
@@ -406,7 +406,7 @@ static int sysv_fix_order(Service *s) {
 
                 /* FIXME: Maybe we should compare the name here lexicographically? */
 
-                if (!(r = unit_add_dependency(UNIT(s), d, UNIT(t), true)) < 0)
+                if ((r = unit_add_dependency(UNIT(s), d, UNIT(t), true)) < 0)
                         return r;
         }
 
@@ -1024,7 +1024,7 @@ static int fsck_fix_order(Service *s) {
                 else
                         continue;
 
-                if (!(r = unit_add_dependency(UNIT(s), d, UNIT(t), true)) < 0)
+                if ((r = unit_add_dependency(UNIT(s), d, UNIT(t), true)) < 0)
                         return r;
         }
 
@@ -1882,6 +1882,7 @@ static void service_enter_signal(Service *s, ServiceState state, bool success) {
                                 wait_for_exit = true;
 
                         set_free(pid_set);
+                        pid_set = NULL;
                 }
         }
 
diff --git a/src/shutdownd.c b/src/shutdownd.c
index 143fa8d825..6b92ceeb1e 100644
--- a/src/shutdownd.c
+++ b/src/shutdownd.c
@@ -227,7 +227,7 @@ int main(int argc, char *argv[]) {
 
                 if ((pollfd[i].fd = timerfd_create(CLOCK_REALTIME, TFD_NONBLOCK|TFD_CLOEXEC)) < 0) {
                         log_error("timerfd_create(): %m");
-                        failed = false;
+                        failed = true;
                 }
         }
 
diff --git a/src/socket.c b/src/socket.c
index 72be0e2235..beb328657f 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -1066,6 +1066,7 @@ static void socket_enter_signal(Socket *s, SocketState state, bool success) {
                                 wait_for_exit = true;
 
                         set_free(pid_set);
+                        pid_set = NULL;
                 }
         }
 
@@ -1695,6 +1696,7 @@ static void socket_timer_event(Unit *u, uint64_t elapsed, Watch *w) {
         case SOCKET_START_PRE:
                 log_warning("%s starting timed out. Terminating.", u->meta.id);
                 socket_enter_signal(s, SOCKET_FINAL_SIGTERM, false);
+                break;
 
         case SOCKET_START_POST:
                 log_warning("%s starting timed out. Stopping.", u->meta.id);
diff --git a/src/strv.c b/src/strv.c
index c8ff5745e8..c5f8df06da 100644
--- a/src/strv.c
+++ b/src/strv.c
@@ -78,9 +78,11 @@ char **strv_copy(char **l) {
         return r;
 
 fail:
-        for (k--, l--; k >= r; k--, l--)
+        for (k--; k >= r; k--)
                 free(*k);
 
+        free(r);
+
         return NULL;
 }
 
@@ -435,6 +437,8 @@ char **strv_env_merge(unsigned n_lists, ...) {
         return r;
 
 fail:
+        va_end(ap);
+
         for (k--; k >= r; k--)
                 free(*k);
 
diff --git a/src/swap.c b/src/swap.c
index 66bf5c2bfb..c32f60810c 100644
--- a/src/swap.c
+++ b/src/swap.c
@@ -687,6 +687,7 @@ static void swap_enter_signal(Swap *s, SwapState state, bool success) {
                                 wait_for_exit = true;
 
                         set_free(pid_set);
+                        pid_set = NULL;
                 }
         }
 
diff --git a/src/unit.c b/src/unit.c
index 4f83778c53..6fd4dc6cb0 100644
--- a/src/unit.c
+++ b/src/unit.c
@@ -2035,8 +2035,7 @@ char **unit_full_printf_strv(Unit *u, char **l) {
         return r;
 
 fail:
-        j--;
-        while (j >= r)
+        for (j--; j >= r; j--)
                 free(*j);
 
         free(r);
diff --git a/src/util.c b/src/util.c
index a44fea09cf..5a5cdceab4 100644
--- a/src/util.c
+++ b/src/util.c
@@ -3582,7 +3582,6 @@ char *normalize_env_assignment(const char *s) {
         free(p);
 
         if (!value) {
-                free(p);
                 free(name);
                 return NULL;
         }