diff --git a/libc/include/bits/fortify/unistd.h b/libc/include/bits/fortify/unistd.h
index 335d0b5..bbc228d 100644
--- a/libc/include/bits/fortify/unistd.h
+++ b/libc/include/bits/fortify/unistd.h
@@ -29,24 +29,24 @@
 #error "Never include this file directly; instead, include <unistd.h>"
 #endif
 
-char* __getcwd_chk(char*, size_t, size_t) __INTRODUCED_IN(24);
+char* _Nullable __getcwd_chk(char* _Nullable, size_t, size_t) __INTRODUCED_IN(24);
 
-ssize_t __pread_chk(int, void*, size_t, off_t, size_t) __INTRODUCED_IN(23);
-ssize_t __pread_real(int, void*, size_t, off_t) __RENAME(pread);
+ssize_t __pread_chk(int, void* _Nonnull, size_t, off_t, size_t) __INTRODUCED_IN(23);
+ssize_t __pread_real(int, void* _Nonnull, size_t, off_t) __RENAME(pread);
 
-ssize_t __pread64_chk(int, void*, size_t, off64_t, size_t) __INTRODUCED_IN(23);
-ssize_t __pread64_real(int, void*, size_t, off64_t) __RENAME(pread64);
+ssize_t __pread64_chk(int, void* _Nonnull, size_t, off64_t, size_t) __INTRODUCED_IN(23);
+ssize_t __pread64_real(int, void* _Nonnull, size_t, off64_t) __RENAME(pread64);
 
-ssize_t __pwrite_chk(int, const void*, size_t, off_t, size_t) __INTRODUCED_IN(24);
-ssize_t __pwrite_real(int, const void*, size_t, off_t) __RENAME(pwrite);
+ssize_t __pwrite_chk(int, const void* _Nonnull, size_t, off_t, size_t) __INTRODUCED_IN(24);
+ssize_t __pwrite_real(int, const void* _Nonnull, size_t, off_t) __RENAME(pwrite);
 
-ssize_t __pwrite64_chk(int, const void*, size_t, off64_t, size_t) __INTRODUCED_IN(24);
-ssize_t __pwrite64_real(int, const void*, size_t, off64_t) __RENAME(pwrite64);
+ssize_t __pwrite64_chk(int, const void* _Nonnull, size_t, off64_t, size_t) __INTRODUCED_IN(24);
+ssize_t __pwrite64_real(int, const void* _Nonnull, size_t, off64_t) __RENAME(pwrite64);
 
-ssize_t __read_chk(int, void*, size_t, size_t) __INTRODUCED_IN(21);
-ssize_t __write_chk(int, const void*, size_t, size_t) __INTRODUCED_IN(24);
-ssize_t __readlink_chk(const char*, char*, size_t, size_t) __INTRODUCED_IN(23);
-ssize_t __readlinkat_chk(int dirfd, const char*, char*, size_t, size_t) __INTRODUCED_IN(23);
+ssize_t __read_chk(int, void* __BIONIC_COMPLICATED_NULLNESS, size_t, size_t) __INTRODUCED_IN(21);
+ssize_t __write_chk(int, const void* __BIONIC_COMPLICATED_NULLNESS, size_t, size_t) __INTRODUCED_IN(24);
+ssize_t __readlink_chk(const char* _Nonnull, char* _Nonnull, size_t, size_t) __INTRODUCED_IN(23);
+ssize_t __readlinkat_chk(int dirfd, const char* _Nonnull, char* _Nonnull, size_t, size_t) __INTRODUCED_IN(23);
 
 #if defined(__BIONIC_FORTIFY)
 
@@ -70,7 +70,7 @@
         __builtin_constant_p(index) && (index) <= SSIZE_MAX))
 
 __BIONIC_FORTIFY_INLINE
-char* getcwd(char* const __pass_object_size buf, size_t size)
+char* _Nullable getcwd(char* const _Nullable __pass_object_size buf, size_t size)
         __overloadable
         __error_if_overflows_objectsize(size, __bos(buf), getcwd) {
 #if __ANDROID_API__ >= 24 && __BIONIC_FORTIFY_RUNTIME_CHECKS_ENABLED
@@ -85,7 +85,7 @@
 
 #if !defined(__USE_FILE_OFFSET64)
 __BIONIC_FORTIFY_INLINE
-ssize_t pread(int fd, void* const __pass_object_size0 buf, size_t count, off_t offset)
+ssize_t pread(int fd, void* const _Nonnull __pass_object_size0 buf, size_t count, off_t offset)
         __overloadable
         __error_if_overflows_ssizet(count, pread)
         __error_if_overflows_objectsize(count, __bos0(buf), pread) {
@@ -101,7 +101,7 @@
 #endif /* !defined(__USE_FILE_OFFSET64) */
 
 __BIONIC_FORTIFY_INLINE
-ssize_t pread64(int fd, void* const __pass_object_size0 buf, size_t count, off64_t offset)
+ssize_t pread64(int fd, void* const _Nonnull __pass_object_size0 buf, size_t count, off64_t offset)
         __overloadable
         __error_if_overflows_ssizet(count, pread64)
         __error_if_overflows_objectsize(count, __bos0(buf), pread64) {
@@ -117,7 +117,7 @@
 
 #if !defined(__USE_FILE_OFFSET64)
 __BIONIC_FORTIFY_INLINE
-ssize_t pwrite(int fd, const void* const __pass_object_size0 buf, size_t count, off_t offset)
+ssize_t pwrite(int fd, const void* const _Nonnull __pass_object_size0 buf, size_t count, off_t offset)
         __overloadable
         __error_if_overflows_ssizet(count, pwrite)
         __error_if_overflows_objectsize(count, __bos0(buf), pwrite) {
@@ -133,7 +133,7 @@
 #endif /* !defined(__USE_FILE_OFFSET64) */
 
 __BIONIC_FORTIFY_INLINE
-ssize_t pwrite64(int fd, const void* const __pass_object_size0 buf, size_t count, off64_t offset)
+ssize_t pwrite64(int fd, const void* const _Nonnull __pass_object_size0 buf, size_t count, off64_t offset)
         __overloadable
         __error_if_overflows_ssizet(count, pwrite64)
         __error_if_overflows_objectsize(count, __bos0(buf), pwrite64) {
@@ -148,7 +148,7 @@
 }
 
 __BIONIC_FORTIFY_INLINE
-ssize_t read(int fd, void* const __pass_object_size0 buf, size_t count)
+ssize_t read(int fd, void* const __BIONIC_COMPLICATED_NULLNESS __pass_object_size0 buf, size_t count)
         __overloadable
         __error_if_overflows_ssizet(count, read)
         __error_if_overflows_objectsize(count, __bos0(buf), read) {
@@ -163,7 +163,7 @@
 }
 
 __BIONIC_FORTIFY_INLINE
-ssize_t write(int fd, const void* const __pass_object_size0 buf, size_t count)
+ssize_t write(int fd, const void* const __BIONIC_COMPLICATED_NULLNESS __pass_object_size0 buf, size_t count)
         __overloadable
         __error_if_overflows_ssizet(count, write)
         __error_if_overflows_objectsize(count, __bos0(buf), write) {
@@ -178,7 +178,7 @@
 }
 
 __BIONIC_FORTIFY_INLINE
-ssize_t readlink(const char* path, char* const __pass_object_size buf, size_t size)
+ssize_t readlink(const char* _Nonnull path, char* _Nonnull const __pass_object_size buf, size_t size)
         __overloadable
         __error_if_overflows_ssizet(size, readlink)
         __error_if_overflows_objectsize(size, __bos(buf), readlink) {
@@ -193,7 +193,7 @@
 }
 
 __BIONIC_FORTIFY_INLINE
-ssize_t readlinkat(int dirfd, const char* path, char* const __pass_object_size buf, size_t size)
+ssize_t readlinkat(int dirfd, const char* _Nonnull path, char* const _Nonnull __pass_object_size buf, size_t size)
         __overloadable
         __error_if_overflows_ssizet(size, readlinkat)
         __error_if_overflows_objectsize(size, __bos(buf), readlinkat) {
diff --git a/libc/include/fenv.h b/libc/include/fenv.h
index 6e8ea57..f7dcc8e 100644
--- a/libc/include/fenv.h
+++ b/libc/include/fenv.h
@@ -29,6 +29,11 @@
 
 #pragma once
 
+/**
+ * @file fenv.h
+ * @brief Floating-point environment.
+ */
+
 #include <sys/cdefs.h>
 
 #if defined(__aarch64__) || defined(__arm__)
@@ -43,33 +48,135 @@
 
 __BEGIN_DECLS
 
-int feclearexcept(int __exceptions) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int fegetexceptflag(fexcept_t* _Nonnull __flag_ptr, int __exceptions) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int feraiseexcept(int __exceptions) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int fesetexceptflag(const fexcept_t* _Nonnull __flag_ptr, int __exceptions) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int fetestexcept(int __exceptions) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
+/**
+ * [feclearexcept(3)](http://man7.org/linux/man-pages/man3/feclearexcept.3.html)
+ * clears the given `exceptions` in hardware.
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int feclearexcept(int __exceptions);
 
-int fegetround(void) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int fesetround(int __rounding_mode) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
+/**
+ * [fegetexceptflag(3)](http://man7.org/linux/man-pages/man3/fegetexceptflag.3.html)
+ * copies the state of the given `exceptions` from hardware into `*flag_ptr`.
+ * See fesetexceptflag().
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int fegetexceptflag(fexcept_t* _Nonnull __flag_ptr, int __exceptions);
 
-int fegetenv(fenv_t* _Nonnull __env) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int feholdexcept(fenv_t* _Nonnull __env) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int fesetenv(const fenv_t* _Nonnull __env) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int feupdateenv(const fenv_t* _Nonnull __env) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
+/**
+ * [feraiseexcept(3)](http://man7.org/linux/man-pages/man3/feraiseexcept.3.html)
+ * raises the given `exceptions` in hardware.
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int feraiseexcept(int __exceptions);
 
-int feenableexcept(int __exceptions) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int fedisableexcept(int __exceptions) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
-int fegetexcept(void) __INTRODUCED_IN_ARM(21) __INTRODUCED_IN_X86(9);
+/**
+ * [fesetexceptflag(3)](http://man7.org/linux/man-pages/man3/fesetexceptflag.3.html)
+ * copies the state of the given `exceptions` from `*flag_ptr` into hardware.
+ * See fesetexceptflag().
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int fesetexceptflag(const fexcept_t* _Nonnull __flag_ptr, int __exceptions);
 
-/*
- * The following constant represents the default floating-point environment
- * (that is, the one installed at program startup) and has type pointer to
- * const-qualified fenv_t.
+/**
+ * [fetestexcept(3)](http://man7.org/linux/man-pages/man3/fetestexcept.3.html)
+ * tests whether the given `exceptions` are set in hardware.
+ *
+ * Returns the currently-set subset of `exceptions`.
+ */
+int fetestexcept(int __exceptions);
+
+/**
+ * [fegetround(3)](http://man7.org/linux/man-pages/man3/fegetround.3.html)
+ * returns the current rounding mode.
+ *
+ * Returns the rounding mode on success, and returns a negative value on failure.
+ */
+int fegetround(void);
+
+/**
+ * [fesetround(3)](http://man7.org/linux/man-pages/man3/fesetround.3.html)
+ * sets the current rounding mode.
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int fesetround(int __rounding_mode);
+
+/**
+ * [fegetenv(3)](http://man7.org/linux/man-pages/man3/fegetenv.3.html)
+ * gets the current floating-point environment. See fesetenv().
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int fegetenv(fenv_t* _Nonnull __env);
+
+/**
+ * [feholdexcept(3)](http://man7.org/linux/man-pages/man3/feholdexcept.3.html)
+ * gets the current floating-point environment, clears the status flags, and
+ * ignores floating point exceptions. See fesetenv()/feupdateenv().
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int feholdexcept(fenv_t* _Nonnull __env);
+
+/**
+ * [fesetenv(3)](http://man7.org/linux/man-pages/man3/fesetenv.3.html)
+ * sets the current floating-point environment. See fegetenv().
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int fesetenv(const fenv_t* _Nonnull __env);
+
+/**
+ * [feupdateenv(3)](http://man7.org/linux/man-pages/man3/feupdateenv.3.html)
+ * sets the current floating-point environment to `*env` but with currently-raised
+ * exceptions still raised. See fesetenv().
+ *
+ * Returns 0 on success, and returns non-zero on failure.
+ */
+int feupdateenv(const fenv_t* _Nonnull __env);
+
+/**
+ * [feenableexcept(3)](http://man7.org/linux/man-pages/man3/feenableexcept.3.html)
+ * sets the given `exceptions` to trap, if the hardware supports it. This is not
+ * generally useful on Android, because only x86/x86-64 can trap.
+ *
+ * Returns the previous set of enabled exceptions on success, and returns -1 on failure.
+ */
+int feenableexcept(int __exceptions);
+
+/**
+ * [fedisableexcept(3)](http://man7.org/linux/man-pages/man3/fedisableexcept.3.html)
+ * sets the given `exceptions` to not trap, if the hardware supports it. This is not
+ * generally useful on Android, because only x86/x86-64 can trap.
+ *
+ * Returns the previous set of enabled exceptions on success, and returns -1 on failure.
+ */
+int fedisableexcept(int __exceptions);
+
+/**
+ * [fegetexcept(3)](http://man7.org/linux/man-pages/man3/fegetexcept.3.html)
+ * returns the exceptions that currently trap. This is not generally useful on
+ * Android, because only x86/x86-64 can trap.
+ *
+ * Returns the exceptions that currently trap.
+ */
+int fegetexcept(void);
+
+/** See FE_DFL_ENV. */
+extern const fenv_t __fe_dfl_env;
+
+/**
+ * Constant representing the default floating-point environment
+ * (that is, the one installed at program startup).
  *
  * It can be used as an argument to the functions that manage the floating-point
  * environment, namely fesetenv() and feupdateenv().
  */
-extern const fenv_t __fe_dfl_env;
 #define FE_DFL_ENV (&__fe_dfl_env)
 
 __END_DECLS
diff --git a/libc/include/math.h b/libc/include/math.h
index a5fa7c3..d3b4a33 100644
--- a/libc/include/math.h
+++ b/libc/include/math.h
@@ -177,10 +177,9 @@
 float scalbnf(float __x, int __exponent);
 long double scalbnl(long double __x, int __exponent) __RENAME_LDBL(scalbn, 3, 3);
 
-/* TODO: once the NDK only supports >= 18, use __RENAME_LDBL here too. */
-double scalbln(double __x, long __exponent) __INTRODUCED_IN_X86_NO_GUARD_FOR_NDK(18);
-float scalblnf(float __x, long __exponent) __INTRODUCED_IN_X86_NO_GUARD_FOR_NDK(18);
-long double scalblnl(long double __x, long __exponent) __INTRODUCED_IN_X86_NO_GUARD_FOR_NDK(18);
+double scalbln(double __x, long __exponent);
+float scalblnf(float __x, long __exponent);
+long double scalblnl(long double __x, long __exponent) __RENAME_LDBL(scalbln, 9, 18);
 
 double cbrt(double __x);
 float cbrtf(float __x);
@@ -282,7 +281,7 @@
 float nextafterf(float __x, float __y);
 long double nextafterl(long double __x, long double __y) __RENAME_LDBL_NO_GUARD_FOR_NDK(nextafter, 3, 21);
 
-double nexttoward(double __x, long double __y) __INTRODUCED_IN_NO_GUARD_FOR_NDK(18);
+double nexttoward(double __x, long double __y);
 float nexttowardf(float __x, long double __y);
 long double nexttowardl(long double __x, long double __y) __RENAME_LDBL_NO_GUARD_FOR_NDK(nexttoward, 18, 18);
 
diff --git a/libc/include/sched.h b/libc/include/sched.h
index 26bc742..d11fddf 100644
--- a/libc/include/sched.h
+++ b/libc/include/sched.h
@@ -172,7 +172,7 @@
  * Returns the pid of the child to the caller on success and
  * returns -1 and sets `errno` on failure.
  */
-int clone(int (* __BIONIC_COMPLICATED_NULLNESS __fn)(void* __BIONIC_COMPLICATED_NULLNESS ), void* __BIONIC_COMPLICATED_NULLNESS __child_stack, int __flags, void* _Nullable __arg, ...) __INTRODUCED_IN_ARM(9) __INTRODUCED_IN_X86(17);
+int clone(int (* __BIONIC_COMPLICATED_NULLNESS __fn)(void* __BIONIC_COMPLICATED_NULLNESS ), void* __BIONIC_COMPLICATED_NULLNESS __child_stack, int __flags, void* _Nullable __arg, ...);
 
 /**
  * [unshare(2)](http://man7.org/linux/man-pages/man2/unshare.2.html)