diff --git a/zkey/cca.c b/zkey/cca.c
index 411a276c..cb4502ed 100644
--- a/zkey/cca.c
+++ b/zkey/cca.c
@@ -554,7 +554,8 @@ static int get_cca_adapter_version(struct cca_lib *cca,
  *          because the zcrypt kernel module is on an older level. -ENODEV is
  *          returned if the APQN is not available.
  */
-int select_cca_adapter(struct cca_lib *cca, int card, int domain, bool verbose)
+int select_cca_adapter(struct cca_lib *cca, unsigned int card,
+		       unsigned int domain, bool verbose)
 {
 	unsigned int adapters, adapter;
 	char adapter_serialnr[9];
@@ -633,12 +634,12 @@ struct find_mkvp_info {
 	u8		mkvp[MKVP_LENGTH];
 	unsigned int	flags;
 	bool		found;
-	int		card;
-	int		domain;
+	unsigned int	card;
+	unsigned int	domain;
 	bool		verbose;
 };
 
-static int find_mkvp(int card, int domain, void *handler_data)
+static int find_mkvp(unsigned int card, unsigned int domain, void *handler_data)
 {
 	struct find_mkvp_info *info = (struct find_mkvp_info *)handler_data;
 	struct mk_info mk_info;
@@ -711,7 +712,7 @@ int select_cca_adapter_by_mkvp(struct cca_lib *cca, u8 *mkvp, const char *apqns,
 
 	pr_verbose(verbose, "Select mkvp %s in APQNs %s for the CCA host "
 		   "library", printable_mkvp(CARD_TYPE_CCA, mkvp),
-		   apqns == 0 ? "ANY" : apqns);
+		   apqns == NULL ? "ANY" : apqns);
 
 	memcpy(info.mkvp, mkvp, sizeof(info.mkvp));
 	info.flags = flags;
diff --git a/zkey/cca.h b/zkey/cca.h
index c4761d58..daebb2ab 100644
--- a/zkey/cca.h
+++ b/zkey/cca.h
@@ -123,7 +123,8 @@ int key_token_change(struct cca_lib *cca,
 		     u8 *secure_key, unsigned int secure_key_size,
 		     char *method, bool verbose);
 
-int select_cca_adapter(struct cca_lib *cca, int card, int domain, bool verbose);
+int select_cca_adapter(struct cca_lib *cca, unsigned int card,
+		       unsigned int domain, bool verbose);
 
 #define FLAG_SEL_CCA_MATCH_CUR_MKVP	0x01
 #define FLAG_SEL_CCA_MATCH_OLD_MKVP	0x02
diff --git a/zkey/ekmfweb/zkey-ekmfweb.c b/zkey/ekmfweb/zkey-ekmfweb.c
index e209903e..336933e6 100644
--- a/zkey/ekmfweb/zkey-ekmfweb.c
+++ b/zkey/ekmfweb/zkey-ekmfweb.c
@@ -227,7 +227,7 @@ out:
  * @returns the encoded passphrase or NULL in case of an error.
  * The caller must free the string when no longer needed.
  */
-char *_encode_passphrase(const char *passphrase)
+static char *_encode_passphrase(const char *passphrase)
 {
 	int inlen, outlen, len;
 	char *out;
@@ -259,7 +259,7 @@ char *_encode_passphrase(const char *passphrase)
  * @returns the decoded passphrase or NULL in case of an error.
  * The caller must free the string when no longer needed.
  */
-char *_decode_passphrase(const char *passphrase)
+static char *_decode_passphrase(const char *passphrase)
 {
 	int inlen, outlen, len;
 	char *out;
@@ -528,9 +528,9 @@ static void _unload_cca_library(struct plugin_handle *ph)
 static int _select_cca_adapter(struct plugin_handle *ph)
 {
 	struct cca_lib cca = { 0 };
+	unsigned int card, domain;
 	char **apqn_list = NULL;
 	bool selected = false;
-	int card, domain;
 	int rc = 0, i;
 	char *apqns;
 
@@ -1040,7 +1040,7 @@ int kms_display_info(const kms_handle_t handle)
 #define OPT_KT_RSA_PSS_SIGNATURE		264
 #endif
 
-const struct util_opt configure_options[] = {
+static const struct util_opt configure_options[] = {
 	{
 		.flags = UTIL_OPT_FLAG_SECTION,
 		.desc = "EKMFWEB SPECIFIC OPTIONS FOR THE SERVER CONNECTION",
@@ -1313,7 +1313,7 @@ const struct util_opt configure_options[] = {
 	UTIL_OPT_END,
 };
 
-const struct util_opt generate_options[] = {
+static const struct util_opt generate_options[] = {
 	{
 		.flags = UTIL_OPT_FLAG_SECTION,
 		.desc = "EKMFWEB SPECIFIC OPTIONS",
@@ -1334,7 +1334,7 @@ const struct util_opt generate_options[] = {
 	UTIL_OPT_END,
 };
 
-const struct util_opt remove_options[] = {
+static const struct util_opt remove_options[] = {
 	{
 		.flags = UTIL_OPT_FLAG_SECTION,
 		.desc = "EKMFWEB SPECIFIC OPTIONS",
@@ -1356,7 +1356,7 @@ const struct util_opt remove_options[] = {
 	UTIL_OPT_END,
 };
 
-const struct util_opt list_options[] = {
+static const struct util_opt list_options[] = {
 	{
 		.flags = UTIL_OPT_FLAG_SECTION,
 		.desc = "EKMFWEB SPECIFIC OPTIONS",
diff --git a/zkey/ep11.c b/zkey/ep11.c
index 22f81f7e..e0c80cbd 100644
--- a/zkey/ep11.c
+++ b/zkey/ep11.c
@@ -182,8 +182,9 @@ int load_ep11_library(struct ep11_lib *ep11, bool verbose)
  *
  * @returns 0 on success, a negative errno in case of errors
  */
-int get_ep11_target_for_apqn(struct ep11_lib *ep11, int card, int domain,
-			     target_t *target, bool verbose)
+int get_ep11_target_for_apqn(struct ep11_lib *ep11, unsigned int card,
+		             unsigned int domain, target_t *target,
+			     bool verbose)
 {
 	ep11_target_t *target_list;
 	struct XCP_Module module;
@@ -248,12 +249,12 @@ struct find_mkvp_info {
 	u8		mkvp[MKVP_LENGTH];
 	unsigned int	flags;
 	bool		found;
-	int		card;
-	int		domain;
+	unsigned int	card;
+	unsigned int	domain;
 	bool		verbose;
 };
 
-static int find_mkvp(int card, int domain, void *handler_data)
+static int find_mkvp(unsigned int card, unsigned int domain, void *handler_data)
 {
 	struct find_mkvp_info *info = (struct find_mkvp_info *)handler_data;
 	struct mk_info mk_info;
@@ -312,8 +313,8 @@ static int find_mkvp(int card, int domain, void *handler_data)
  */
 int select_ep11_apqn_by_mkvp(struct ep11_lib *ep11, u8 *mkvp,
 			     const char *apqns,  unsigned int flags,
-			     target_t *target, int *card, int *domain,
-			     bool verbose)
+			     target_t *target, unsigned int *card,
+			     unsigned int *domain, bool verbose)
 {
 	struct find_mkvp_info info;
 	int rc;
@@ -323,7 +324,7 @@ int select_ep11_apqn_by_mkvp(struct ep11_lib *ep11, u8 *mkvp,
 
 	pr_verbose(verbose, "Select mkvp %s in APQNs %s for the EP11 host "
 		   "library", printable_mkvp(CARD_TYPE_EP11, mkvp),
-		   apqns == 0 ? "ANY" : apqns);
+		   apqns == NULL ? "ANY" : apqns);
 
 	memcpy(info.mkvp, mkvp, sizeof(info.mkvp));
 	info.flags = flags;
@@ -369,8 +370,9 @@ int select_ep11_apqn_by_mkvp(struct ep11_lib *ep11, u8 *mkvp,
  *
  * @returns 0 on success, a negative errno in case of errors
  */
-static int ep11_adm_reencrypt(struct ep11_lib *ep11, target_t target, int card,
-			      int domain, struct ep11keytoken *ep11key,
+static int ep11_adm_reencrypt(struct ep11_lib *ep11, target_t target,
+			      unsigned int card, unsigned int domain,
+			      struct ep11keytoken *ep11key,
 			      unsigned int ep11key_size, bool verbose)
 {
 	CK_BYTE resp[MAX_BLOBSIZE];
@@ -406,8 +408,8 @@ static int ep11_adm_reencrypt(struct ep11_lib *ep11, target_t target, int card,
 		return -EIO;
 	}
 
-	rv = ep11->dll_m_admin(resp, &resp_len, NULL, 0, req, req_len, NULL, 0,
-			       target);
+	rv = ep11->dll_m_admin(resp, &resp_len, NULL, NULL, req, req_len, NULL,
+			       0, target);
 	if (rv != CKR_OK || resp_len == 0) {
 		pr_verbose(verbose, "Command XCP_ADM_REENCRYPT failed. "
 			   "rc = 0x%lx, resp_len = %ld", rv, resp_len);
@@ -461,8 +463,8 @@ static int ep11_adm_reencrypt(struct ep11_lib *ep11, target_t target, int card,
  *
  * @returns 0 on success, a negative errno in case of errors
  */
-int reencipher_ep11_key(struct ep11_lib *ep11, target_t target, int card,
-			int domain, u8 *secure_key,
+int reencipher_ep11_key(struct ep11_lib *ep11, target_t target,
+			unsigned int card, unsigned int domain, u8 *secure_key,
 			unsigned int secure_key_size, bool verbose)
 {
 	struct ep11keytoken *ep11key = (struct ep11keytoken *)secure_key;
diff --git a/zkey/ep11.h b/zkey/ep11.h
index 3a0c2b59..fe90cfd4 100644
--- a/zkey/ep11.h
+++ b/zkey/ep11.h
@@ -158,8 +158,9 @@ struct ep11_lib {
 
 int load_ep11_library(struct ep11_lib *ep11, bool verbose);
 
-int get_ep11_target_for_apqn(struct ep11_lib *ep11, int card, int domain,
-			     target_t *target, bool verbose);
+int get_ep11_target_for_apqn(struct ep11_lib *ep11, unsigned int card,
+			     unsigned int domain, target_t *target,
+			     bool verbose);
 
 void free_ep11_target_for_apqn(struct ep11_lib *ep11, target_t target);
 
@@ -168,11 +169,11 @@ void free_ep11_target_for_apqn(struct ep11_lib *ep11, target_t target);
 
 int select_ep11_apqn_by_mkvp(struct ep11_lib *ep11, u8 *mkvp,
 			     const char *apqns,  unsigned int flags,
-			     target_t *target, int *card, int *domain,
-			     bool verbose);
+			     target_t *target, unsigned int *card,
+			     unsigned int *domain, bool verbose);
 
-int reencipher_ep11_key(struct ep11_lib *ep11, target_t target, int card,
-			int domain, u8 *secure_key,
+int reencipher_ep11_key(struct ep11_lib *ep11, target_t target,
+			unsigned int card, unsigned int domain, u8 *secure_key,
 			unsigned int secure_key_size, bool verbose);
 
 #endif
diff --git a/zkey/keystore.c b/zkey/keystore.c
index d3ea3db6..038e2fcb 100644
--- a/zkey/keystore.c
+++ b/zkey/keystore.c
@@ -702,11 +702,11 @@ static int _keystore_change_association(struct properties *key_props,
 static int _keystore_apqn_match(const char *pattern, const char *apqn,
 				int UNUSED(flags))
 {
-	char *modified;
+	unsigned int card, domain;
 	char *pattern_domain;
 	char *pattern_card;
+	char *modified;
 	char *copy;
-	int card, domain;
 	size_t i;
 	char *ch;
 	int rc;
@@ -996,8 +996,10 @@ static int _keystore_process_filtered(struct keystore *keystore,
 	int len;
 
 	pr_verbose(keystore, "Process_filtered: name_filter = '%s', "
-		   "volume_filter = '%s', apqn_filter = '%s'", name_filter,
-		   volume_filter, apqn_filter);
+		   "volume_filter = '%s', apqn_filter = '%s'",
+		   name_filter ? name_filter : "(null)",
+		   volume_filter ? volume_filter : "(null)",
+		   apqn_filter ? apqn_filter : "(null)");
 
 	if (volume_filter != NULL)
 		vol_filter_list = str_list_split(volume_filter);
@@ -1145,10 +1147,11 @@ static int _keystore_apqn_check(const char *apqn, bool remove, bool UNUSED(set),
 				char **normalized, void *private)
 {
 	struct apqn_check *info = (struct apqn_check *)private;
-	int rc, card, domain;
+	unsigned int card, domain;
 	regmatch_t pmatch[1];
-	regex_t reg_buf;
 	unsigned int num;
+	regex_t reg_buf;
+	int rc;
 
 	*normalized = NULL;
 
@@ -1163,9 +1166,8 @@ static int _keystore_apqn_check(const char *apqn, bool remove, bool UNUSED(set),
 		goto out;
 	}
 
-	if (sscanf(apqn, "%x.%x%n", &card, &domain, &num) != 2 ||
-	    num != strlen(apqn) || card < 0 || card > 0xff ||
-	    domain < 0 || domain > 0xFFFF) {
+	if (sscanf(apqn, "%x.%x%n", &card, &domain, (int *)&num) != 2 ||
+	    num != strlen(apqn) || card > 0xff || domain > 0xFFFF) {
 		warnx("the APQN '%s' is not valid", apqn);
 		rc = -EINVAL;
 		goto out;
@@ -3791,7 +3793,8 @@ static int _keystore_display_key(struct keystore *keystore,
 			       file_names->skey_filename, secure_key_size,
 			       is_xts_key(secure_key, secure_key_size),
 			       clear_key_bitsize, 0, 0,
-			       _keystore_reencipher_key_exists(file_names), 0);
+			       _keystore_reencipher_key_exists(file_names),
+			       NULL);
 
 out:
 	free(secure_key);
@@ -5015,7 +5018,6 @@ prompt_alt_name:
 	key_type = get_key_type(secure_key, secure_key_size);
 	if (key_type == NULL) {
 		warnx("Key '%s' is not a valid secure key", key_name);
-		free(secure_key);
 		rc = -EINVAL;
 		goto out;
 	}
diff --git a/zkey/kms.c b/zkey/kms.c
index aeb2ce30..46427e6e 100644
--- a/zkey/kms.c
+++ b/zkey/kms.c
@@ -1041,11 +1041,12 @@ static int _parse_and_check_apqn(const char *apqn, struct kms_apqn *kms_apqn,
 {
 	struct card_info *card_info = NULL;
 	struct fw_version fw_version;
-	int rc, card, domain, level;
+	unsigned int card, domain;
 	enum card_type type;
 	regmatch_t pmatch[1];
-	regex_t reg_buf;
 	unsigned int num;
+	regex_t reg_buf;
+	int rc, level;
 	size_t i;
 
 	rc = regcomp(&reg_buf, "[[:xdigit:]]+\\.[[:xdigit:]]", REG_EXTENDED);
@@ -1059,9 +1060,8 @@ static int _parse_and_check_apqn(const char *apqn, struct kms_apqn *kms_apqn,
 		goto out;
 	}
 
-	if (sscanf(apqn, "%x.%x%n", &card, &domain, &num) != 2 ||
-	    num != strlen(apqn) || card < 0 || card > 0xff ||
-	    domain < 0 || domain > 0xFFFF) {
+	if (sscanf(apqn, "%x.%x%n", &card, &domain, (int *)&num) != 2 ||
+	    num != strlen(apqn) || card > 0xff || domain > 0xFFFF) {
 		warnx("The APQN '%s' is not valid", apqn);
 		rc = -EINVAL;
 		goto out;
@@ -3224,7 +3224,7 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props,
 		str = _find_property(properties, num_properties,
 				     KMS_KEY_PROP_SECTOR_SIZE);
 		if (str != NULL)
-			sscanf(str, "%lu", sector_size);
+			sscanf(str, "%lu", (long unsigned int *)sector_size);
 	}
 
 	key_blob_size = sizeof(key_blob);
diff --git a/zkey/misc.h b/zkey/misc.h
index 554365ef..bce22b5e 100644
--- a/zkey/misc.h
+++ b/zkey/misc.h
@@ -37,7 +37,7 @@ static inline void misc_print_missing_sub_command(void)
 /**
  * Invalid command specified (for 'git' like tools)
  */
-void misc_print_invalid_command(const char *command)
+static void misc_print_invalid_command(const char *command)
 {
 	warnx("Invalid command '%s'", command);
 	util_prg_print_parse_error();
@@ -48,7 +48,7 @@ void misc_print_invalid_command(const char *command)
  *
  * @param[in] parm_name  Parameter string
  */
-void misc_print_required_parm(const char *parm_name)
+static void misc_print_required_parm(const char *parm_name)
 {
 	warnx("Parameter '%s' is required", parm_name);
 	util_prg_print_parse_error();
diff --git a/zkey/pkey.c b/zkey/pkey.c
index bec0fb75..4fde88ab 100644
--- a/zkey/pkey.c
+++ b/zkey/pkey.c
@@ -1392,7 +1392,7 @@ int generate_key_verification_pattern(const u8 *key, size_t key_size,
 		goto out;
 	}
 
-	opfd = accept(tfmfd, NULL, 0);
+	opfd = accept(tfmfd, NULL, NULL);
 	if (opfd < 0) {
 		rc = -errno;
 		pr_verbose(verbose, "Failed to accept on the AF_ALG socket");
@@ -1923,8 +1923,8 @@ static int reencipher_ep11_secure_key(struct ep11_lib *ep11, u8 *secure_key,
 				      u8 *mkvp, bool *apqn_selected,
 				      bool verbose)
 {
+	unsigned int card, domain;
 	unsigned int flags;
-	int card, domain;
 	target_t target;
 	int rc;
 
diff --git a/zkey/pkey.h b/zkey/pkey.h
index 35392b8d..5a5bc3c5 100644
--- a/zkey/pkey.h
+++ b/zkey/pkey.h
@@ -115,10 +115,14 @@ struct ep11keytoken {
 #define AESCIPHER_KEY_SIZE	sizeof(struct aescipherkeytoken)
 #define EP11_KEY_SIZE		sizeof(struct ep11keytoken)
 
-#define MAX_SECURE_KEY_SIZE	MAX(EP11_KEY_SIZE, \
-				    MAX(AESDATA_KEY_SIZE, AESCIPHER_KEY_SIZE))
-#define MIN_SECURE_KEY_SIZE	MIN(EP11_KEY_SIZE, \
-				    MIN(AESDATA_KEY_SIZE, AESCIPHER_KEY_SIZE))
+/* MAX/MIN from zt_common.h produces warnings for variable length arrays */
+#define _MIN(a, b)  ((a) < (b) ? (a) : (b))
+#define _MAX(a, b)  ((a) > (b) ? (a) : (b))
+
+#define MAX_SECURE_KEY_SIZE	_MAX(EP11_KEY_SIZE, \
+				     _MAX(AESDATA_KEY_SIZE, AESCIPHER_KEY_SIZE))
+#define MIN_SECURE_KEY_SIZE	_MIN(EP11_KEY_SIZE, \
+				     _MIN(AESDATA_KEY_SIZE, AESCIPHER_KEY_SIZE))
 
 struct pkey_seckey {
 	u8  seckey[AESDATA_KEY_SIZE];  /* the secure key blob */
diff --git a/zkey/utils.c b/zkey/utils.c
index a2d1c376..39b35533 100644
--- a/zkey/utils.c
+++ b/zkey/utils.c
@@ -45,7 +45,7 @@
  *          0 if offline,
  *          -1 if its not the specified type.
  */
-int sysfs_is_card_online(int card, enum card_type cardtype)
+int sysfs_is_card_online(unsigned int card, enum card_type cardtype)
 {
 	long int online;
 	char *dev_path;
@@ -106,7 +106,8 @@ out:
  *          0 if offline,
  *          -1 if its not the specified type.
  */
-int sysfs_is_apqn_online(int card, int domain, enum card_type cardtype)
+int sysfs_is_apqn_online(unsigned int card, unsigned int domain,
+			 enum card_type cardtype)
 {
 	long int online;
 	char *dev_path;
@@ -144,7 +145,7 @@ out:
  *
  * @returns The card level, or -1 of the level can not be determined.
  */
-int sysfs_get_card_level(int card)
+int sysfs_get_card_level(unsigned int card)
 {
 	char *dev_path;
 	char type[20];
@@ -187,7 +188,7 @@ out:
  *
  * @returns The card type, or -1 of the type can not be determined.
  */
-enum card_type sysfs_get_card_type(int card)
+enum card_type sysfs_get_card_type(unsigned int card)
 {
 	char *dev_path;
 	char type[20];
@@ -235,7 +236,7 @@ out:
  *          -ENOTSUP if the serialnr sysfs attribute is not available, because
  *          the zcrypt kernel module is on an older level.
  */
-int sysfs_get_serialnr(int card, char *serialnr, bool verbose)
+int sysfs_get_serialnr(unsigned int card, char *serialnr, bool verbose)
 {
 	char *dev_path;
 	int rc = 0;
@@ -286,7 +287,7 @@ out:
  *          the zcrypt kernel module is on an older level, or because the card
  *          type does not provide this information.
  */
-int sysfs_get_firmware_version(int card, struct fw_version *fw_version,
+int sysfs_get_firmware_version(unsigned int card, struct fw_version *fw_version,
 			       bool verbose)
 {
 	char *dev_path;
@@ -310,7 +311,7 @@ int sysfs_get_firmware_version(int card, struct fw_version *fw_version,
 		goto out;
 	}
 
-	if (sscanf(buf, "%d.%d", &fw_version->major, &fw_version->minor) != 2) {
+	if (sscanf(buf, "%u.%u", &fw_version->major, &fw_version->minor) != 2) {
 		rc = -ENODEV;
 		goto out;
 	}
@@ -321,7 +322,7 @@ int sysfs_get_firmware_version(int card, struct fw_version *fw_version,
 		goto out;
 	}
 
-	if (sscanf(buf, "%d", &fw_version->api_ordinal) != 1) {
+	if (sscanf(buf, "%u", &fw_version->api_ordinal) != 1) {
 		rc = -ENODEV;
 		goto out;
 	}
@@ -477,7 +478,8 @@ static int parse_ep11_mk_info(char *line, struct mk_info *mk_info)
  *          -ENOTSUP if the mkvps sysfs attribute is not available, because the
  *          zcrypt kernel module is on an older level.
  */
-int sysfs_get_mkvps(int card, int domain, struct mk_info *mk_info, bool verbose)
+int sysfs_get_mkvps(unsigned int card, unsigned int domain,
+		    struct mk_info *mk_info, bool verbose)
 {
 	enum card_type cardtype;
 	char *dev_path;
@@ -572,13 +574,14 @@ out:
 	return rc;
 }
 
-static int scan_for_domains(int card, enum card_type cardtype,
+static int scan_for_domains(unsigned int card, enum card_type cardtype,
 			    apqn_handler_t handler, void *handler_data,
 			    bool verbose)
 {
 	struct dirent **namelist;
 	char fname[290];
-	int i, n, domain, rc = 0;
+	int i, n, rc = 0;
+	unsigned int domain;
 
 	sprintf(fname, "/sys/devices/ap/card%02x/", card);
 	n = util_scandir(&namelist, alphasort, fname,
@@ -613,7 +616,8 @@ static int scan_for_apqns(enum card_type cardtype, apqn_handler_t handler,
 			  void *handler_data, bool verbose)
 {
 	struct dirent **namelist;
-	int i, n, card, rc = 0;
+	int i, n, rc = 0;
+	unsigned int card;
 
 	if (handler == NULL)
 		return -EINVAL;
@@ -663,7 +667,7 @@ static int scan_for_apqns(enum card_type cardtype, apqn_handler_t handler,
 int handle_apqns(const char *apqns, enum card_type cardtype,
 		 apqn_handler_t handler, void *handler_data, bool verbose)
 {
-	int card, domain;
+	unsigned int card, domain;
 	char *copy, *tok;
 	char *save;
 	int rc = 0;
@@ -702,7 +706,8 @@ struct print_apqn_info {
 	bool verbose;
 };
 
-static int print_apqn_mk_info(int card, int domain, void *handler_data)
+static int print_apqn_mk_info(unsigned int card, unsigned int domain,
+			      void *handler_data)
 {
 	struct print_apqn_info *info = (struct print_apqn_info *)handler_data;
 	struct mk_info mk_info;
@@ -819,7 +824,8 @@ struct cross_check_info {
 	bool	verbose;
 };
 
-static int cross_check_mk_info(int card, int domain, void *handler_data)
+static int cross_check_mk_info(unsigned int card, unsigned int domain,
+			       void *handler_data)
 {
 	struct cross_check_info *info = (struct cross_check_info *)handler_data;
 	struct fw_version fw_version;
@@ -1050,7 +1056,7 @@ int cross_check_apqns(const char *apqns, u8 *mkvp, int min_level,
 		      enum card_type cardtype, bool print_mks, bool verbose)
 {
 	struct cross_check_info info;
-	char temp[200];
+	char temp[250];
 	int rc;
 
 	memset(&info, 0, sizeof(info));
diff --git a/zkey/utils.h b/zkey/utils.h
index dd743f61..a39f367a 100644
--- a/zkey/utils.h
+++ b/zkey/utils.h
@@ -16,17 +16,18 @@
 
 #include "pkey.h"
 
-int sysfs_is_card_online(int card, enum card_type cardtype);
+int sysfs_is_card_online(unsigned int card, enum card_type cardtype);
 
-int sysfs_is_apqn_online(int card, int domain, enum card_type cardtype);
+int sysfs_is_apqn_online(unsigned int card, unsigned int domain,
+			 enum card_type cardtype);
 
-int sysfs_get_card_level(int card);
+int sysfs_get_card_level(unsigned int card);
 
-enum card_type sysfs_get_card_type(int card);
+enum card_type sysfs_get_card_type(unsigned int card);
 
 #define SERIALNR_LENGTH		17
 
-int sysfs_get_serialnr(int card, char *serialnr, bool verbose);
+int sysfs_get_serialnr(unsigned int card, char *serialnr, bool verbose);
 
 struct fw_version {
 	unsigned int	major;
@@ -34,7 +35,7 @@ struct fw_version {
 	unsigned int	api_ordinal;
 };
 
-int sysfs_get_firmware_version(int card, struct fw_version *fw_version,
+int sysfs_get_firmware_version(unsigned int card, struct fw_version *fw_version,
 			       bool verbose);
 
 #define MK_STATE_EMPTY		0
@@ -57,10 +58,11 @@ struct mk_info {
 	struct mk_info_reg	old_mk; /* only available on CCA cards */
 };
 
-int sysfs_get_mkvps(int card, int domain, struct mk_info *mk_info,
-		    bool verbose);
+int sysfs_get_mkvps(unsigned int card, unsigned int domain,
+		    struct mk_info *mk_info, bool verbose);
 
-typedef int(*apqn_handler_t) (int card, int domain, void *handler_data);
+typedef int(*apqn_handler_t) (unsigned int card, unsigned int domain,
+			      void *handler_data);
 
 int handle_apqns(const char *apqns, enum card_type cardtype,
 		 apqn_handler_t handler, void *handler_data, bool verbose);
diff --git a/zkey/zkey-cryptsetup.c b/zkey/zkey-cryptsetup.c
index e3c4eea3..4b7c9294 100644
--- a/zkey/zkey-cryptsetup.c
+++ b/zkey/zkey-cryptsetup.c
@@ -73,7 +73,7 @@ static void misc_print_required_parms(const char *parm_name1,
 /*
  * Program configuration
  */
-const struct util_prg prg = {
+static const struct util_prg prg = {
 	.desc = "Manage secure volume keys of volumes encrypted with LUKS2 and "
 		"the 'paes' cipher",
 	.command_args = "COMMAND DEVICE",
@@ -368,8 +368,8 @@ static void set_int_handler(void)
 	pr_verbose("Installing SIGINT/SIGTERM handler");
 	memset(&sigaction_open, 0, sizeof(struct sigaction));
 	sigaction_open.sa_handler = int_handler;
-	sigaction(SIGINT, &sigaction_open, 0);
-	sigaction(SIGTERM, &sigaction_open, 0);
+	sigaction(SIGINT, &sigaction_open, NULL);
+	sigaction(SIGTERM, &sigaction_open, NULL);
 }
 
 static void print_usage_command(const struct zkey_cryptsetup_command *command)
@@ -2256,7 +2256,7 @@ static bool is_command(struct zkey_cryptsetup_command *command, const char *str)
 /*
  * Find the command in the command table
  */
-struct zkey_cryptsetup_command *find_command(const char *command)
+static struct zkey_cryptsetup_command *find_command(const char *command)
 {
 	struct zkey_cryptsetup_command *cmd = zkey_cryptsetup_commands;
 
diff --git a/zkey/zkey.c b/zkey/zkey.c
index 3a1aee75..e22d7ead 100644
--- a/zkey/zkey.c
+++ b/zkey/zkey.c
@@ -38,7 +38,7 @@
 /*
  * Program configuration
  */
-const struct util_prg prg = {
+static const struct util_prg prg = {
 	.desc = "Manage secure AES keys",
 	.command_args = "COMMAND [SECURE-KEY-FILE]",
 	.args = "",
@@ -2769,8 +2769,8 @@ static bool is_command(struct zkey_command *command, const char *str)
 /*
  * Find the command in the command table
  */
-struct zkey_command *find_command(const struct zkey_command *commands,
-				  const char *command)
+static struct zkey_command *find_command(const struct zkey_command *commands,
+				         const char *command)
 {
 	struct zkey_command *cmd = (struct zkey_command *)commands;