diff --git a/benchmarks/pthread_benchmark.cpp b/benchmarks/pthread_benchmark.cpp
index bf4d6cb..d3c2de8 100644
--- a/benchmarks/pthread_benchmark.cpp
+++ b/benchmarks/pthread_benchmark.cpp
@@ -56,7 +56,7 @@
 }
 
 static void BM_pthread_once(benchmark::State& state) {
-  pthread_once_t once = PTHREAD_ONCE_INIT;
+  static pthread_once_t once = PTHREAD_ONCE_INIT;
   pthread_once(&once, DummyPthreadOnceInitFunction);
 
   while (state.KeepRunning()) {
diff --git a/libc/bionic/fts.c b/libc/bionic/fts.c
index 31a4b2f..a43c8c9 100644
--- a/libc/bionic/fts.c
+++ b/libc/bionic/fts.c
@@ -32,6 +32,7 @@
 #include <sys/param.h>
 #include <sys/stat.h>
 
+#include <assert.h>
 #include <dirent.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -719,7 +720,8 @@
 			/* Build a file name for fts_stat to stat. */
 			if (ISSET(FTS_NOCHDIR)) {
 				p->fts_accpath = p->fts_path;
-				memmove(cp, p->fts_name, p->fts_namelen + 1);
+				assert(cp && "cp should be non-null if FTS_NOCHDIR is set");
+				memmove(cp, p->fts_name, p->fts_namelen + 1); // NOLINT
 				p->fts_info = fts_stat(sp, p, 0, dirfd(dirp));
 			} else {
 				p->fts_accpath = p->fts_name;
diff --git a/libc/bionic/sched_cpualloc.c b/libc/bionic/sched_cpualloc.c
index 30964bc..345de91 100644
--- a/libc/bionic/sched_cpualloc.c
+++ b/libc/bionic/sched_cpualloc.c
@@ -31,7 +31,10 @@
 
 cpu_set_t* __sched_cpualloc(size_t count)
 {
-    return (cpu_set_t*) malloc(CPU_ALLOC_SIZE(count));
+    // The static analyzer complains that CPU_ALLOC_SIZE eventually expands to
+    // N * sizeof(unsigned long), which is incompatible with cpu_set_t. This is
+    // on purpose.
+    return (cpu_set_t*) malloc(CPU_ALLOC_SIZE(count)); // NOLINT
 }
 
 void __sched_cpufree(cpu_set_t* set)
diff --git a/linker/linker_main.cpp b/linker/linker_main.cpp
index 5dc215f..db36976 100644
--- a/linker/linker_main.cpp
+++ b/linker/linker_main.cpp
@@ -87,6 +87,7 @@
 
   // prev will never be null, because the first entry in solist is
   // always the static libdl_info.
+  CHECK(prev != nullptr);
   prev->next = si->next;
   if (si == sonext) {
     sonext = prev;
@@ -307,6 +308,11 @@
       break;
     }
   }
+
+  if (si->base == 0) {
+    async_safe_fatal("Could not find a PHDR: broken executable?");
+  }
+
   si->dynamic = nullptr;
 
   ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(si->base);
@@ -488,6 +494,15 @@
   static uintptr_t linktime_addr = reinterpret_cast<uintptr_t>(&linktime_addr);
   ElfW(Addr) linker_addr = reinterpret_cast<uintptr_t>(&linktime_addr) - linktime_addr;
 
+#if defined(__clang_analyzer__)
+  // The analyzer assumes that linker_addr will always be null. Make it an
+  // unknown value so we don't have to mark N places with NOLINTs.
+  //
+  // (`+=`, rather than `=`, allows us to sidestep a potential "unused store"
+  // complaint)
+  linker_addr += reinterpret_cast<uintptr_t>(raw_args);
+#endif
+
   ElfW(Addr) entry_point = args.getauxval(AT_ENTRY);
   ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_addr);
   ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_addr + elf_hdr->e_phoff);