diff --git a/lib/eventlog/eventlog.c b/lib/eventlog/eventlog.c
index 401adf289..07280707b 100644
--- a/lib/eventlog/eventlog.c
+++ b/lib/eventlog/eventlog.c
@@ -406,6 +406,7 @@ send_mail(const struct eventlog *evlog, const char *message)
 			strerror(errno));
 		    sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
 		    _exit(EXIT_FAILURE);
+	    	/* NOTREACHED */
 		case 0:
 		    /* Grandchild continues below. */
 		    sudo_debug_enter(__func__, __FILE__, __LINE__, sudo_debug_subsys);
@@ -413,6 +414,7 @@ send_mail(const struct eventlog *evlog, const char *message)
 		default:
 		    /* Parent will wait for us. */
 		    _exit(EXIT_SUCCESS);
+	    	/* NOTREACHED */
 	    }
 	    break;
 	default:
@@ -472,7 +474,7 @@ send_mail(const struct eventlog *evlog, const char *message)
 		"unable to fork");
 	    sudo_debug_exit(__func__, __FILE__, __LINE__, sudo_debug_subsys);
 	    _exit(EXIT_FAILURE);
-		/* NOTREACHED */
+	    /* NOTREACHED */
 	case 0:
 	    /* Child. */
 	    exec_mailer(pfd[0]);
diff --git a/lib/eventlog/regress/eventlog_store/store_json_test.c b/lib/eventlog/regress/eventlog_store/store_json_test.c
index e5b78f997..d237cb483 100644
--- a/lib/eventlog/regress/eventlog_store/store_json_test.c
+++ b/lib/eventlog/regress/eventlog_store/store_json_test.c
@@ -35,7 +35,7 @@
 
 sudo_dso_public int main(int argc, char *argv[]);
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s [-cv] input_file ...\n",
@@ -100,6 +100,7 @@ main(int argc, char *argv[])
 		break;
 	    default:
 		usage();
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
diff --git a/lib/eventlog/regress/eventlog_store/store_sudo_test.c b/lib/eventlog/regress/eventlog_store/store_sudo_test.c
index 64e015dff..2e024db76 100644
--- a/lib/eventlog/regress/eventlog_store/store_sudo_test.c
+++ b/lib/eventlog/regress/eventlog_store/store_sudo_test.c
@@ -34,7 +34,7 @@
 
 sudo_dso_public int main(int argc, char *argv[]);
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s [-cv] input_file ...\n",
@@ -99,6 +99,7 @@ main(int argc, char *argv[])
 		break;
 	    default:
 		usage();
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
diff --git a/lib/eventlog/regress/logwrap/check_wrap.c b/lib/eventlog/regress/logwrap/check_wrap.c
index d14448825..9563ffb8a 100644
--- a/lib/eventlog/regress/logwrap/check_wrap.c
+++ b/lib/eventlog/regress/logwrap/check_wrap.c
@@ -34,7 +34,7 @@
 
 sudo_dso_public int main(int argc, char *argv[]);
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s [-v] inputfile\n", getprogname());
@@ -59,6 +59,7 @@ main(int argc, char *argv[])
 	    break;
 	default:
 	    usage();
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
@@ -110,7 +111,7 @@ main(int argc, char *argv[])
 		    if (len == 0)
 			printf("# word wrap disabled\n");
 		    else
-			printf("# word wrap at %d characters\n", (int)len);
+			printf("# word wrap at %zu characters\n", len);
 		    eventlog_writeln(stdout, lines[0], strlen(lines[0]), len);
 		    len++;
 		}
diff --git a/lib/eventlog/regress/parse_json/check_parse_json.c b/lib/eventlog/regress/parse_json/check_parse_json.c
index 3835a90a8..077fd9b7f 100644
--- a/lib/eventlog/regress/parse_json/check_parse_json.c
+++ b/lib/eventlog/regress/parse_json/check_parse_json.c
@@ -121,7 +121,7 @@ done:
     return ret;
 }
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s [-cv] input_file ...\n",
diff --git a/lib/iolog/regress/iolog_path/check_iolog_path.c b/lib/iolog/regress/iolog_path/check_iolog_path.c
index 959509adf..bb79edcc7 100644
--- a/lib/iolog/regress/iolog_path/check_iolog_path.c
+++ b/lib/iolog/regress/iolog_path/check_iolog_path.c
@@ -44,7 +44,7 @@ static struct iolog_escape_data {
 
 sudo_dso_public int main(int argc, char *argv[]);
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s datafile\n", getprogname());
diff --git a/lib/util/regress/hexchar/hexchar_test.c b/lib/util/regress/hexchar/hexchar_test.c
index a51bf7f01..d86ac9009 100644
--- a/lib/util/regress/hexchar/hexchar_test.c
+++ b/lib/util/regress/hexchar/hexchar_test.c
@@ -77,5 +77,5 @@ main(int argc, char *argv[])
 	printf("%s: %d tests run, %d errors, %d%% success rate\n",
 	    getprogname(), ntests, errors, (ntests - errors) * 100 / ntests);
     }
-    exit(errors);
+    return errors;
 }
diff --git a/lib/util/regress/strsplit/strsplit_test.c b/lib/util/regress/strsplit/strsplit_test.c
index 7f0e071cb..9ba830ba9 100644
--- a/lib/util/regress/strsplit/strsplit_test.c
+++ b/lib/util/regress/strsplit/strsplit_test.c
@@ -113,5 +113,5 @@ main(int argc, char *argv[])
 	printf("%s: %d tests run, %d errors, %d%% success rate\n",
 	    getprogname(), ntests, errors, (ntests - errors) * 100 / ntests);
     }
-    exit(errors);
+    return errors;
 }
diff --git a/lib/util/regress/sudo_conf/conf_test.c b/lib/util/regress/sudo_conf/conf_test.c
index 1d9c1b684..dc96146df 100644
--- a/lib/util/regress/sudo_conf/conf_test.c
+++ b/lib/util/regress/sudo_conf/conf_test.c
@@ -38,7 +38,7 @@ sudo_dso_public int main(int argc, char *argv[]);
 # define GROUP_SOURCE_ADAPTIVE GROUP_SOURCE_DYNAMIC
 #endif
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s [-v] conf_file\n", getprogname());
@@ -64,6 +64,7 @@ main(int argc, char *argv[])
 	    break;
 	default:
 	    usage();
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
diff --git a/logsrvd/logsrvd.c b/logsrvd/logsrvd.c
index 6062860d7..9fc93c777 100644
--- a/logsrvd/logsrvd.c
+++ b/logsrvd/logsrvd.c
@@ -1973,7 +1973,7 @@ main(int argc, char *argv[])
 	    break;
 	case 'h':
 	    help();
-	    break;
+	    /* NOTREACHED */
 	case 'n':
 	    nofork = true;
 	    break;
diff --git a/logsrvd/regress/logsrvd_conf/logsrvd_conf_test.c b/logsrvd/regress/logsrvd_conf/logsrvd_conf_test.c
index 84e66edb6..be13abac8 100644
--- a/logsrvd/regress/logsrvd_conf/logsrvd_conf_test.c
+++ b/logsrvd/regress/logsrvd_conf/logsrvd_conf_test.c
@@ -38,7 +38,7 @@
 
 sudo_dso_public int main(int argc, char *argv[]);
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s [-v] conf_file\n", getprogname());
@@ -64,6 +64,7 @@ main(int argc, char *argv[])
 	    break;
 	default:
 	    usage();
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
diff --git a/logsrvd/sendlog.c b/logsrvd/sendlog.c
index 7f4d767ae..2517b6a49 100644
--- a/logsrvd/sendlog.c
+++ b/logsrvd/sendlog.c
@@ -1703,7 +1703,7 @@ main(int argc, char *argv[])
 
     /* Read sudo.conf and initialize the debug subsystem. */
     if (sudo_conf_read(NULL, SUDO_CONF_DEBUG) == -1)
-        exit(EXIT_FAILURE);
+        return EXIT_FAILURE;
     sudo_debug_register(getprogname(), NULL, NULL,
         sudo_conf_debug_files(getprogname()), -1);
 
@@ -1746,7 +1746,7 @@ main(int argc, char *argv[])
 	    break;
 	case 1:
 	    help();
-	    break;
+	    /* NOTREACHED */
 #if defined(HAVE_OPENSSL)
 	case 'b':
 	    ca_bundle = optarg;
@@ -1767,6 +1767,7 @@ main(int argc, char *argv[])
 	    return 0;
 	default:
 	    usage(true);
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
diff --git a/plugins/group_file/plugin_test.c b/plugins/group_file/plugin_test.c
index 9b638b707..66c1089e9 100644
--- a/plugins/group_file/plugin_test.c
+++ b/plugins/group_file/plugin_test.c
@@ -21,15 +21,16 @@
  * PVS-Studio Static Code Analyzer for C, C++ and C#: http://www.viva64.com
  */
 
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <unistd.h>
+#include <config.h>
 #include <ctype.h>
 #include <dlfcn.h>
 #include <errno.h>
 #include <limits.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
 
 #include "sudo_plugin.h"
 
diff --git a/plugins/sudoers/cvtsudoers.c b/plugins/sudoers/cvtsudoers.c
index e754918d5..115ca3818 100644
--- a/plugins/sudoers/cvtsudoers.c
+++ b/plugins/sudoers/cvtsudoers.c
@@ -195,7 +195,7 @@ main(int argc, char *argv[])
 	    break;
 	case 'h':
 	    help();
-	    break;
+	    /* NOTREACHED */
 	case 'i':
 	    free(conf->input_format);
 	    conf->input_format = strdup(optarg);
@@ -258,6 +258,7 @@ main(int argc, char *argv[])
 	    break;
 	default:
 	    usage();
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
diff --git a/plugins/sudoers/regress/check_symbols/check_symbols.c b/plugins/sudoers/regress/check_symbols/check_symbols.c
index 41c9081f5..9d1b339ce 100644
--- a/plugins/sudoers/regress/check_symbols/check_symbols.c
+++ b/plugins/sudoers/regress/check_symbols/check_symbols.c
@@ -31,7 +31,7 @@
 
 sudo_dso_public int main(int argc, char *argv[]);
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s plugin.so symbols_file\n", getprogname());
diff --git a/plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c b/plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c
index e4cc14166..fd6b1f76f 100644
--- a/plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c
+++ b/plugins/sudoers/regress/iolog_plugin/check_iolog_plugin.c
@@ -44,7 +44,7 @@ struct sudo_plugin_event * (*plugin_event_alloc)(void);
 
 sudo_dso_public int main(int argc, char *argv[], char *envp[]);
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s pathname\n", getprogname());
diff --git a/plugins/sudoers/regress/parser/check_addr.c b/plugins/sudoers/regress/parser/check_addr.c
index 5fb6f53d8..28fd22ac9 100644
--- a/plugins/sudoers/regress/parser/check_addr.c
+++ b/plugins/sudoers/regress/parser/check_addr.c
@@ -65,7 +65,7 @@ check_addr(char *input)
     return 0;
 }
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     fprintf(stderr, "usage: %s datafile\n", getprogname());
diff --git a/plugins/sudoers/testsudoers.c b/plugins/sudoers/testsudoers.c
index daaf21339..aed5d0ae5 100644
--- a/plugins/sudoers/testsudoers.c
+++ b/plugins/sudoers/testsudoers.c
@@ -201,7 +201,7 @@ main(int argc, char *argv[])
 		break;
 	    default:
 		usage();
-		break;
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
@@ -731,7 +731,7 @@ testsudoers_error(const char *buf)
     return fputs(buf, stderr);
 }
 
-static void
+sudo_noreturn static void
 usage(void)
 {
     (void) fprintf(stderr, "usage: %s [-dt] [-G sudoers_gid] [-g group] [-h host] [-i input_format] [-P grfile] [-p pwfile] [-U sudoers_uid] [-u user] <user> <command> [args]\n", getprogname());
diff --git a/plugins/sudoers/visudo.c b/plugins/sudoers/visudo.c
index 5b2612bdf..f25bf35db 100644
--- a/plugins/sudoers/visudo.c
+++ b/plugins/sudoers/visudo.c
@@ -197,7 +197,7 @@ main(int argc, char *argv[])
 		break;
 	    case 'h':
 		help();
-		break;
+	    /* NOTREACHED */
 	    case 'I':
 		edit_includes = false;
 		break;
diff --git a/src/exec_monitor.c b/src/exec_monitor.c
index 7a7974e24..49ab6369c 100644
--- a/src/exec_monitor.c
+++ b/src/exec_monitor.c
@@ -614,6 +614,7 @@ exec_monitor(struct command_details *details, sigset_t *oset,
 	if (write(errpipe[1], &errno, sizeof(int)) == -1)
 	    sudo_warn(U_("unable to execute %s"), details->command);
 	_exit(EXIT_FAILURE);
+	/* NOTREACHED */
     }
     close(errpipe[1]);
     if (intercept_fd != -1)
@@ -702,6 +703,7 @@ exec_monitor(struct command_details *details, sigset_t *oset,
 #endif
     sudo_debug_exit_int(__func__, __FILE__, __LINE__, sudo_debug_subsys, 1);
     _exit(EXIT_FAILURE);
+	/* NOTREACHED */
 
 bad:
     debug_return_int(-1);
diff --git a/src/exec_nopty.c b/src/exec_nopty.c
index db9a21487..4eb82ba8b 100644
--- a/src/exec_nopty.c
+++ b/src/exec_nopty.c
@@ -633,6 +633,7 @@ exec_nopty(struct command_details *details,
 	}
 	sudo_debug_exit_int(__func__, __FILE__, __LINE__, sudo_debug_subsys, 1);
 	_exit(EXIT_FAILURE);
+	/* NOTREACHED */
     }
     sudo_debug_printf(SUDO_DEBUG_INFO, "executed %s, pid %d", details->command,
 	(int)ec.cmnd_pid);
diff --git a/src/exec_pty.c b/src/exec_pty.c
index 2cc1d15c7..ebd4f9f7d 100644
--- a/src/exec_pty.c
+++ b/src/exec_pty.c
@@ -1333,6 +1333,7 @@ exec_pty(struct command_details *details,
                 "%s: unable to send status to parent", __func__);
 	}
 	_exit(EXIT_FAILURE);
+	/* NOTREACHED */
     }
 
     /*
diff --git a/src/sesh.c b/src/sesh.c
index 0415e7b5f..1fea9c70c 100644
--- a/src/sesh.c
+++ b/src/sesh.c
@@ -148,6 +148,7 @@ main(int argc, char *argv[], char *envp[])
 	    break;
 	default:
 	    usage();
+	    /* NOTREACHED */
 	}
     }
     argc -= optind;
diff --git a/src/sudo.c b/src/sudo.c
index 7d3d9d149..168134df3 100644
--- a/src/sudo.c
+++ b/src/sudo.c
@@ -1118,7 +1118,7 @@ format_plugin_settings(struct plugin_container *plugin)
 		goto bad;
 	}
     }
-    plugin_settings[i + 1] = NULL;
+    plugin_settings[++i] = NULL;
 
     /* Add to list of vectors to be garbage collected at exit. */
     if (!gc_add(GC_VECTOR, plugin_settings))
@@ -1167,12 +1167,10 @@ policy_open(void)
     sudo_debug_set_active_instance(sudo_debug_instance);
 
     if (ok != 1) {
-	if (ok == -2)
+	    if (ok == -2)
 	    usage();
-	else {
 	    /* XXX - audit */
 	    sudo_fatalx("%s", U_("unable to initialize policy plugin"));
-	}
     }
 
     debug_return;
@@ -1258,7 +1256,7 @@ policy_check(int argc, char * const argv[], char *env_add[],
 	    break;
 	case -2:
 	    usage();
-	    break;
+	    /* NOTREACHED */
 	}
 	debug_return_bool(false);
     }
@@ -1488,7 +1486,7 @@ iolog_open(char * const command_info[], int argc, char * const argv[],
 	    break;
 	case -2:
 	    usage();
-	    break;
+	    /* NOTREACHED */
 	default:
 	    sudo_warnx(U_("error initializing I/O plugin %s"),
 		plugin->name);
@@ -1639,7 +1637,7 @@ audit_open(void)
 	    break;
 	case -2:
 	    usage();
-	    break;
+	    /* NOTREACHED */
 	default:
 	    /* TODO: pass error message to other audit plugins */
 	    sudo_fatalx(U_("error initializing audit plugin %s"),
@@ -1852,7 +1850,7 @@ approval_open_int(struct plugin_container *plugin)
 	break;
     case -2:
 	usage();
-	break;
+	/* NOTREACHED */
     default:
 	/* XXX - audit */
 	sudo_fatalx(U_("error initializing approval plugin %s"),
@@ -1940,7 +1938,6 @@ approval_check(char * const command_info[], char * const run_argv[],
 	    break;
 	case -2:
 	    usage();
-	    break;
 	}
 
 	/* Close approval plugin now that errstr has been consumed. */