diff --git a/libs/avb/Android.bp b/libs/avb/Android.bp
index 7bfea3f..3a671e2 100644
--- a/libs/avb/Android.bp
+++ b/libs/avb/Android.bp
@@ -11,7 +11,9 @@
     source_stem: "bindings",
     bindgen_flags: [
         "--size_t-is-usize",
+        "--constified-enum-module AvbDescriptorTag",
         "--default-enum-style rust",
+        "--allowlist-type=AvbDescriptorTag",
         "--allowlist-function=.*",
         "--allowlist-var=AVB.*",
         "--use-core",
diff --git a/libs/devicemapper/src/loopdevice/sys.rs b/libs/devicemapper/src/loopdevice/sys.rs
index 98b5085..a35eaa9 100644
--- a/libs/devicemapper/src/loopdevice/sys.rs
+++ b/libs/devicemapper/src/loopdevice/sys.rs
@@ -61,6 +61,8 @@
 unsafe impl DataInit for loop_info64 {}
 
 bitflags! {
+    #[repr(transparent)]
+    #[derive(Copy, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
     pub struct Flag: u32 {
         const LO_FLAGS_READ_ONLY = 1 << 0;
         const LO_FLAGS_AUTOCLEAR = 1 << 2;
diff --git a/libs/devicemapper/src/sys.rs b/libs/devicemapper/src/sys.rs
index e709bf0..3cecde3 100644
--- a/libs/devicemapper/src/sys.rs
+++ b/libs/devicemapper/src/sys.rs
@@ -72,6 +72,8 @@
 pub const DM_MAX_TYPE_NAME: usize = 16;
 
 bitflags! {
+    #[repr(transparent)]
+    #[derive(Copy, Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
     pub struct Flag: u32 {
         const DM_READONLY_FLAG = 1 << 0;
         const DM_SUSPEND_FLAG = 1 << 1;
diff --git a/libs/vbmeta/src/descriptor.rs b/libs/vbmeta/src/descriptor.rs
index 10484ff..caf1356 100644
--- a/libs/vbmeta/src/descriptor.rs
+++ b/libs/vbmeta/src/descriptor.rs
@@ -14,7 +14,8 @@
 
 use avb_bindgen::{
     avb_descriptor_foreach, avb_descriptor_validate_and_byteswap,
-    avb_hashtree_descriptor_validate_and_byteswap, AvbDescriptor, AvbHashtreeDescriptor,
+    avb_hashtree_descriptor_validate_and_byteswap, AvbDescriptor, AvbDescriptorTag,
+    AvbHashtreeDescriptor,
 };
 use std::ffi::c_void;
 use std::mem::{size_of, MaybeUninit};
@@ -22,13 +23,6 @@
 
 use super::VbMetaImageParseError;
 
-// TODO: import these with bindgen
-const AVB_DESCRIPTOR_TAG_PROPERTY: u64 = 0;
-const AVB_DESCRIPTOR_TAG_HASHTREE: u64 = 1;
-const AVB_DESCRIPTOR_TAG_HASH: u64 = 2;
-const AVB_DESCRIPTOR_TAG_KERNEL_CMDLINE: u64 = 3;
-const AVB_DESCRIPTOR_TAG_CHAIN_PARTITION: u64 = 4;
-
 /// The descriptors from a VBMeta image.
 pub struct Descriptors<'a> {
     descriptors: Vec<Descriptor<'a>>,
@@ -72,12 +66,16 @@
             };
             // SAFETY: this cast gets a reference to the Vec passed as the user_data below.
             let descriptors = unsafe { &mut *(user_data as *mut Vec<Descriptor>) };
-            descriptors.push(match desc.tag {
-                AVB_DESCRIPTOR_TAG_PROPERTY => Descriptor::Property(data),
-                AVB_DESCRIPTOR_TAG_HASHTREE => Descriptor::Hashtree(data),
-                AVB_DESCRIPTOR_TAG_HASH => Descriptor::Hash(data),
-                AVB_DESCRIPTOR_TAG_KERNEL_CMDLINE => Descriptor::KernelCmdline(data),
-                AVB_DESCRIPTOR_TAG_CHAIN_PARTITION => Descriptor::ChainPartition(data),
+            descriptors.push(match desc.tag.try_into() {
+                Ok(AvbDescriptorTag::AVB_DESCRIPTOR_TAG_PROPERTY) => Descriptor::Property(data),
+                Ok(AvbDescriptorTag::AVB_DESCRIPTOR_TAG_HASHTREE) => Descriptor::Hashtree(data),
+                Ok(AvbDescriptorTag::AVB_DESCRIPTOR_TAG_HASH) => Descriptor::Hash(data),
+                Ok(AvbDescriptorTag::AVB_DESCRIPTOR_TAG_KERNEL_CMDLINE) => {
+                    Descriptor::KernelCmdline(data)
+                }
+                Ok(AvbDescriptorTag::AVB_DESCRIPTOR_TAG_CHAIN_PARTITION) => {
+                    Descriptor::ChainPartition(data)
+                }
                 _ => Descriptor::Unknown,
             });
             true
diff --git a/pvmfw/src/dice.rs b/pvmfw/src/dice.rs
index 4e303ac..0aa1273 100644
--- a/pvmfw/src/dice.rs
+++ b/pvmfw/src/dice.rs
@@ -17,7 +17,6 @@
 use crate::cstr;
 use crate::helpers::flushed_zeroize;
 use core::ffi::c_void;
-use core::ffi::CStr;
 use core::mem::size_of;
 use core::slice;
 
diff --git a/pvmfw/src/entry.rs b/pvmfw/src/entry.rs
index 8e3e47b..d172474 100644
--- a/pvmfw/src/entry.rs
+++ b/pvmfw/src/entry.rs
@@ -64,6 +64,9 @@
     // - can't access non-pvmfw memory (only statically-mapped memory)
     // - can't access MMIO (therefore, no logging)
 
+    // SAFETY - This function should and will only be called once, here.
+    unsafe { heap::init() };
+
     match main_wrapper(fdt_address as usize, payload_start as usize, payload_size as usize) {
         Ok((entry, bcc)) => jump_to_payload(fdt_address, entry.try_into().unwrap(), bcc),
         Err(_) => reboot(), // TODO(b/220071963) propagate the reason back to the host.
@@ -188,9 +191,6 @@
     // - only perform logging once the logger has been initialized
     // - only access non-pvmfw memory once (and while) it has been mapped
 
-    // SAFETY - This function should and will only be called once, here.
-    unsafe { heap::init() };
-
     logger::init(LevelFilter::Info).map_err(|_| RebootReason::InternalError)?;
 
     // Use debug!() to avoid printing to the UART if we failed to configure it as only local
diff --git a/pvmfw/src/exceptions.rs b/pvmfw/src/exceptions.rs
index 462a9cc..a6ac4fe 100644
--- a/pvmfw/src/exceptions.rs
+++ b/pvmfw/src/exceptions.rs
@@ -86,7 +86,7 @@
 }
 
 #[no_mangle]
-extern "C" fn sync_exception_current(_elr: u64, _spsr: u64) {
+extern "C" fn sync_exception_current(elr: u64, _spsr: u64) {
     // Disable logging in exception handler to prevent unsafe writes to UART.
     let _guard = logger::suppress();
     let esr: Esr = read_sysreg!("esr_el1").into();
@@ -97,7 +97,7 @@
         if !handling_uart_exception(esr, far) {
             eprintln!("sync_exception_current");
             eprintln!("{e}");
-            eprintln!("{esr}, far={far:#08x}");
+            eprintln!("{esr}, far={far:#08x}, elr={elr:#08x}");
         }
         reboot()
     }
diff --git a/pvmfw/src/fdt.rs b/pvmfw/src/fdt.rs
index 5ecb038..98802b4 100644
--- a/pvmfw/src/fdt.rs
+++ b/pvmfw/src/fdt.rs
@@ -742,7 +742,7 @@
     set_or_clear_chosen_flag(fdt, cstr!("avf,strict-boot"), strict_boot)?;
     set_or_clear_chosen_flag(fdt, cstr!("avf,new-instance"), new_instance)?;
 
-    if debuggable {
+    if !debuggable {
         if let Some(bootargs) = read_bootargs_from(fdt)? {
             filter_out_dangerous_bootargs(fdt, &bootargs)?;
         }
diff --git a/pvmfw/src/helpers.rs b/pvmfw/src/helpers.rs
index c230784..403c7e4 100644
--- a/pvmfw/src/helpers.rs
+++ b/pvmfw/src/helpers.rs
@@ -31,6 +31,7 @@
     ($sysreg:literal) => {{
         let mut r: usize;
         // Safe because it reads a system register and does not affect Rust.
+        #[allow(unused_unsafe)] // In case the macro is used within an unsafe block.
         unsafe {
             core::arch::asm!(
                 concat!("mrs {}, ", $sysreg),
@@ -182,6 +183,6 @@
 #[macro_export]
 macro_rules! cstr {
     ($str:literal) => {{
-        CStr::from_bytes_with_nul(concat!($str, "\0").as_bytes()).unwrap()
+        core::ffi::CStr::from_bytes_with_nul(concat!($str, "\0").as_bytes()).unwrap()
     }};
 }
diff --git a/vmbase/src/logger.rs b/vmbase/src/logger.rs
index 94dc880..c30adad 100644
--- a/vmbase/src/logger.rs
+++ b/vmbase/src/logger.rs
@@ -18,8 +18,6 @@
 //! Note: may not work if the VM is in an inconsistent state. Exception handlers
 //! should avoid using this logger and instead print with eprintln!.
 
-extern crate log;
-
 use crate::console::println;
 use core::sync::atomic::{AtomicBool, Ordering};
 use log::{LevelFilter, Log, Metadata, Record, SetLoggerError};