diff --git a/zebra/zebra_cli.c b/zebra/zebra_cli.c
index 8fedcfedc0..00e0a49cb8 100644
--- a/zebra/zebra_cli.c
+++ b/zebra/zebra_cli.c
@@ -437,13 +437,19 @@ DEFPY_YANG (link_params_admin_grp,
 	char value_str[YANG_VALUE_MAXLEN];
 
 	if (!no) {
+		assert(bitpattern);
+
 		if (bitpattern[0] != '0' || bitpattern[1] != 'x' ||
 		    strlen(bitpattern) > 10) {
 			vty_out(vty, "Invalid bitpattern value\n");
 			return CMD_WARNING_CONFIG_FAILED;
 		}
 
-		sscanf(bitpattern, "%x", &value);
+		if (sscanf(bitpattern, "%x", &value) != 1) {
+			vty_out(vty, "Invalid bitpattern value\n");
+			return CMD_WARNING_CONFIG_FAILED;
+		}
+
 		snprintf(value_str, sizeof(value_str), "%u", value);
 
 		nb_cli_enqueue_change(vty, "./legacy-admin-group", NB_OP_MODIFY,
@@ -610,6 +616,8 @@ DEFPY_YANG (link_params_res_bw,
 	float bw;
 
 	if (!no) {
+		assert(bandwidth);
+
 		if (sscanf(bandwidth, "%g", &bw) != 1) {
 			vty_out(vty, "Invalid bandwidth value\n");
 			return CMD_WARNING_CONFIG_FAILED;
@@ -647,6 +655,8 @@ DEFPY_YANG (link_params_ava_bw,
 	float bw;
 
 	if (!no) {
+		assert(bandwidth);
+
 		if (sscanf(bandwidth, "%g", &bw) != 1) {
 			vty_out(vty, "Invalid bandwidth value\n");
 			return CMD_WARNING_CONFIG_FAILED;
@@ -684,6 +694,8 @@ DEFPY_YANG (link_params_use_bw,
 	float bw;
 
 	if (!no) {
+		assert(bandwidth);
+
 		if (sscanf(bandwidth, "%g", &bw) != 1) {
 			vty_out(vty, "Invalid bandwidth value\n");
 			return CMD_WARNING_CONFIG_FAILED;
@@ -817,6 +829,7 @@ DEFPY_YANG (ip_address,
 	strlcpy(ip, address_str, sizeof(ip));
 
 	mask = strchr(ip, '/');
+	assert(mask);
 	*mask = 0;
 	mask++;
 
@@ -886,6 +899,7 @@ DEFPY_YANG (ip_address_peer,
 	strlcpy(peer_ip, peer_str, sizeof(peer_ip));
 
 	peer_mask = strchr(peer_ip, '/');
+	assert(peer_mask);
 	*peer_mask = 0;
 	peer_mask++;
 
@@ -934,6 +948,7 @@ DEFPY_YANG (ipv6_address,
 	strlcpy(ip, address_str, sizeof(ip));
 
 	mask = strchr(ip, '/');
+	assert(mask);
 	*mask = 0;
 	mask++;
 
diff --git a/zebra/zebra_nb_config.c b/zebra/zebra_nb_config.c
index f24af16a2e..46c95e6c0f 100644
--- a/zebra/zebra_nb_config.c
+++ b/zebra/zebra_nb_config.c
@@ -2220,7 +2220,8 @@ int lib_interface_zebra_link_params_packet_loss_destroy(
 static bool evpn_mh_dnode_to_esi(const struct lyd_node *dnode, esi_t *esi)
 {
 	if (yang_dnode_exists(dnode, "type-0/esi")) {
-		str_to_esi(yang_dnode_get_string(dnode, "type-0/esi"), esi);
+		if (!str_to_esi(yang_dnode_get_string(dnode, "type-0/esi"), esi))
+			assert(false);
 	} else if (yang_dnode_exists(dnode, "type-3/system-mac") &&
 		   yang_dnode_exists(dnode, "type-3/local-discriminator")) {
 		struct ethaddr mac;
@@ -2301,7 +2302,8 @@ int lib_interface_zebra_evpn_mh_type_0_esi_modify(struct nb_cb_modify_args *args
 		break;
 	case NB_EV_APPLY:
 		ifp = nb_running_get_entry(args->dnode, NULL, true);
-		str_to_esi(yang_dnode_get_string(args->dnode, NULL), &esi);
+		if (!str_to_esi(yang_dnode_get_string(args->dnode, NULL), &esi))
+			assert(false);
 		zebra_evpn_es_type0_esi_update(ifp->info, &esi);
 		break;
 	}
@@ -3031,7 +3033,7 @@ int lib_interface_zebra_ipv6_router_advertisements_rdnss_rdnss_address_create(
 	struct nb_cb_create_args *args)
 {
 	struct interface *ifp;
-	struct rtadv_rdnss rdnss, *p;
+	struct rtadv_rdnss rdnss = {0}, *p;
 
 	if (args->event != NB_EV_APPLY)
 		return NB_OK;
@@ -3110,7 +3112,7 @@ int lib_interface_zebra_ipv6_router_advertisements_dnssl_dnssl_domain_create(
 	struct nb_cb_create_args *args)
 {
 	struct interface *ifp;
-	struct rtadv_dnssl dnssl, *p;
+	struct rtadv_dnssl dnssl = {0}, *p;
 	int ret;
 
 	strlcpy(dnssl.name, yang_dnode_get_string(args->dnode, "domain"),