diff --git a/src/backlight/backlight.c b/src/backlight/backlight.c
index e66477f328..a384208879 100644
--- a/src/backlight/backlight.c
+++ b/src/backlight/backlight.c
@@ -47,7 +47,6 @@ static int help(void) {
 
 static int has_multiple_graphics_cards(void) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *dev;
         bool found = false;
         int r;
 
@@ -173,7 +172,7 @@ static int same_device(sd_device *a, sd_device *b) {
 static int validate_device(sd_device *device) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *enumerate = NULL;
         const char *v, *sysname, *subsystem;
-        sd_device *parent, *other;
+        sd_device *parent;
         int r;
 
         assert(device);
diff --git a/src/basic/terminal-util.h b/src/basic/terminal-util.h
index 1723de34fa..0fa01dbdf8 100644
--- a/src/basic/terminal-util.h
+++ b/src/basic/terminal-util.h
@@ -49,6 +49,7 @@
 
 /* Underlined */
 #define ANSI_GREY_UNDERLINE              "\x1B[0;4;38;5;245m"
+#define ANSI_BRIGHT_BLACK_UNDERLINE      "\x1B[0;4;90m"
 #define ANSI_HIGHLIGHT_RED_UNDERLINE     "\x1B[0;1;4;31m"
 #define ANSI_HIGHLIGHT_GREEN_UNDERLINE   "\x1B[0;1;4;32m"
 #define ANSI_HIGHLIGHT_YELLOW_UNDERLINE  "\x1B[0;1;4;38;5;185m"
@@ -62,8 +63,10 @@
 #define ANSI_HIGHLIGHT_UNDERLINE "\x1B[0;1;4m"
 
 /* Fallback colors: 256 -> 16 */
-#define ANSI_HIGHLIGHT_GREY_FALLBACK   "\x1B[0;1;90m"
-#define ANSI_HIGHLIGHT_YELLOW_FALLBACK "\x1B[0;1;33m"
+#define ANSI_HIGHLIGHT_GREY_FALLBACK             "\x1B[0;1;90m"
+#define ANSI_HIGHLIGHT_GREY_FALLBACK_UNDERLINE   "\x1B[0;1;4;90m"
+#define ANSI_HIGHLIGHT_YELLOW_FALLBACK           "\x1B[0;1;33m"
+#define ANSI_HIGHLIGHT_YELLOW_FALLBACK_UNDERLINE "\x1B[0;1;4;33m"
 
 /* Reset/clear ANSI styles */
 #define ANSI_NORMAL "\x1B[0m"
@@ -177,9 +180,13 @@ static inline bool colors_enabled(void) {
                 }                                              \
         }
 
+static inline const char *ansi_underline(void) {
+        return underline_enabled() ? ANSI_UNDERLINE : ANSI_NORMAL;
+}
+
 #define DEFINE_ANSI_FUNC_UNDERLINE(name, NAME)                            \
         static inline const char *ansi_##name(void) {                     \
-                return underline_enabled() ? ANSI_##NAME ANSI_UNDERLINE : \
+                return underline_enabled() ? ANSI_##NAME##_UNDERLINE : \
                         colors_enabled() ? ANSI_##NAME : "";              \
         }
 
@@ -188,8 +195,8 @@ static inline bool colors_enabled(void) {
         static inline const char *ansi_##name(void) {                                                                  \
                 switch (get_color_mode()) {                                                                            \
                         case COLOR_OFF: return "";                                                                     \
-                        case COLOR_16: return underline_enabled() ? ANSI_##FALLBACK ANSI_UNDERLINE : ANSI_##FALLBACK;  \
-                        default : return underline_enabled() ? ANSI_##NAME ANSI_UNDERLINE: ANSI_##NAME;                \
+                        case COLOR_16: return underline_enabled() ? ANSI_##FALLBACK##_UNDERLINE : ANSI_##FALLBACK;  \
+                        default : return underline_enabled() ? ANSI_##NAME##_UNDERLINE: ANSI_##NAME;                \
                 }                                                                                                      \
         }
 
@@ -229,7 +236,6 @@ static inline const char* _ansi_highlight_yellow(void) {
         return colors_enabled() ? _ANSI_HIGHLIGHT_YELLOW : "";
 }
 
-DEFINE_ANSI_FUNC_UNDERLINE(underline,                       NORMAL);
 DEFINE_ANSI_FUNC_UNDERLINE(highlight_underline,             HIGHLIGHT);
 DEFINE_ANSI_FUNC_UNDERLINE_256(grey_underline,              GREY, BRIGHT_BLACK);
 DEFINE_ANSI_FUNC_UNDERLINE(highlight_red_underline,         HIGHLIGHT_RED);
diff --git a/src/busctl/busctl.c b/src/busctl/busctl.c
index eab0c72707..748902093d 100644
--- a/src/busctl/busctl.c
+++ b/src/busctl/busctl.c
@@ -1679,34 +1679,26 @@ static int json_transform_array_or_struct(sd_bus_message *m, JsonVariant **ret)
         assert(m);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n_elements, json_variant_unref_many);
+
         for (;;) {
                 r = sd_bus_message_at_end(m, false);
-                if (r < 0) {
-                        bus_log_parse_error(r);
-                        goto finish;
-                }
+                if (r < 0)
+                        return bus_log_parse_error(r);
                 if (r > 0)
                         break;
 
-                if (!GREEDY_REALLOC(elements, n_elements + 1)) {
-                        r = log_oom();
-                        goto finish;
-                }
+                if (!GREEDY_REALLOC(elements, n_elements + 1))
+                        return log_oom();
 
                 r = json_transform_one(m, elements + n_elements);
                 if (r < 0)
-                        goto finish;
+                        return r;
 
                 n_elements++;
         }
 
-        r = json_variant_new_array(ret, elements, n_elements);
-
-finish:
-        json_variant_unref_many(elements, n_elements);
-        free(elements);
-
-        return r;
+        return json_variant_new_array(ret, elements, n_elements);
 }
 
 static int json_transform_variant(sd_bus_message *m, const char *contents, JsonVariant **ret) {
@@ -1737,15 +1729,15 @@ static int json_transform_dict_array(sd_bus_message *m, JsonVariant **ret) {
         assert(m);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n_elements, json_variant_unref_many);
+
         for (;;) {
                 const char *contents;
                 char type;
 
                 r = sd_bus_message_at_end(m, false);
-                if (r < 0) {
-                        bus_log_parse_error(r);
-                        goto finish;
-                }
+                if (r < 0)
+                        return bus_log_parse_error(r);
                 if (r > 0)
                         break;
 
@@ -1755,43 +1747,31 @@ static int json_transform_dict_array(sd_bus_message *m, JsonVariant **ret) {
 
                 assert(type == 'e');
 
-                if (!GREEDY_REALLOC(elements, n_elements + 2)) {
-                        r = log_oom();
-                        goto finish;
-                }
+                if (!GREEDY_REALLOC(elements, n_elements + 2))
+                        return log_oom();
 
                 r = sd_bus_message_enter_container(m, type, contents);
-                if (r < 0) {
-                        bus_log_parse_error(r);
-                        goto finish;
-                }
+                if (r < 0)
+                        return bus_log_parse_error(r);
 
                 r = json_transform_one(m, elements + n_elements);
                 if (r < 0)
-                        goto finish;
+                        return r;
 
                 n_elements++;
 
                 r = json_transform_one(m, elements + n_elements);
                 if (r < 0)
-                        goto finish;
+                        return r;
 
                 n_elements++;
 
                 r = sd_bus_message_exit_container(m);
-                if (r < 0) {
-                        bus_log_parse_error(r);
-                        goto finish;
-                }
+                if (r < 0)
+                        return bus_log_parse_error(r);
         }
 
-        r = json_variant_new_object(ret, elements, n_elements);
-
-finish:
-        json_variant_unref_many(elements, n_elements);
-        free(elements);
-
-        return r;
+        return json_variant_new_object(ret, elements, n_elements);
 }
 
 static int json_transform_one(sd_bus_message *m, JsonVariant **ret) {
diff --git a/src/core/device.c b/src/core/device.c
index 60ab59c53b..fd87b40306 100644
--- a/src/core/device.c
+++ b/src/core/device.c
@@ -800,7 +800,7 @@ static int device_setup_devlink_unit_one(Manager *m, const char *devlink, Set **
 
 static int device_setup_extra_units(Manager *m, sd_device *dev, Set **ready_units, Set **not_ready_units) {
         _cleanup_strv_free_ char **aliases = NULL;
-        const char *devlink, *syspath, *devname = NULL;
+        const char *syspath, *devname = NULL;
         Device *l;
         int r;
 
@@ -1017,7 +1017,6 @@ static void device_shutdown(Manager *m) {
 
 static void device_enumerate(Manager *m) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *dev;
         int r;
 
         assert(m);
diff --git a/src/core/swap.c b/src/core/swap.c
index 73cf320bfd..6fc5782bc8 100644
--- a/src/core/swap.c
+++ b/src/core/swap.c
@@ -491,7 +491,7 @@ fail:
 
 static void swap_process_new(Manager *m, const char *device, int prio, bool set_flags) {
         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
-        const char *dn, *devlink;
+        const char *dn;
         struct stat st, st_link;
         int r;
 
@@ -1405,7 +1405,7 @@ fail:
 
 int swap_process_device_new(Manager *m, sd_device *dev) {
         _cleanup_free_ char *e = NULL;
-        const char *dn, *devlink;
+        const char *dn;
         Unit *u;
         int r;
 
diff --git a/src/dissect/dissect.c b/src/dissect/dissect.c
index 253e732404..893fa4f034 100644
--- a/src/dissect/dissect.c
+++ b/src/dissect/dissect.c
@@ -1699,7 +1699,6 @@ static int action_detach(const char *path) {
 
         } else if (S_ISREG(st.st_mode)) {
                 _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-                sd_device *d;
 
                 /* If a regular file is specified, search for a loopback block device that is backed by it */
 
diff --git a/src/home/homed-manager.c b/src/home/homed-manager.c
index 9db8b9ee06..addea113b4 100644
--- a/src/home/homed-manager.c
+++ b/src/home/homed-manager.c
@@ -1337,7 +1337,6 @@ static int manager_watch_devices(Manager *m) {
 
 static int manager_enumerate_devices(Manager *m) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
         int r;
 
         assert(m);
diff --git a/src/journal/journald-kmsg.c b/src/journal/journald-kmsg.c
index 83082c4e94..de94dc6041 100644
--- a/src/journal/journald-kmsg.c
+++ b/src/journal/journald-kmsg.c
@@ -237,12 +237,12 @@ void dev_kmsg_record(Server *s, char *p, size_t l) {
                         }
 
                         j = 0;
-                        FOREACH_DEVICE_DEVLINK(d, g) {
+                        FOREACH_DEVICE_DEVLINK(d, link) {
 
                                 if (j >= N_IOVEC_UDEV_FIELDS)
                                         break;
 
-                                b = strjoin("_UDEV_DEVLINK=", g);
+                                b = strjoin("_UDEV_DEVLINK=", link);
                                 if (b) {
                                         iovec[n++] = IOVEC_MAKE_STRING(b);
                                         z++;
diff --git a/src/libsystemd/sd-device/device-enumerator.c b/src/libsystemd/sd-device/device-enumerator.c
index f3f59e2ac3..e072d976d3 100644
--- a/src/libsystemd/sd-device/device-enumerator.c
+++ b/src/libsystemd/sd-device/device-enumerator.c
@@ -471,9 +471,7 @@ static bool match_property(sd_device_enumerator *enumerator, sd_device *device)
         if (hashmap_isempty(enumerator->match_property))
                 return true;
 
-        HASHMAP_FOREACH_KEY(value_patterns, property_pattern, enumerator->match_property) {
-                const char *property, *value;
-
+        HASHMAP_FOREACH_KEY(value_patterns, property_pattern, enumerator->match_property)
                 FOREACH_DEVICE_PROPERTY(device, property, value) {
                         if (fnmatch(property_pattern, property, 0) != 0)
                                 continue;
@@ -481,7 +479,6 @@ static bool match_property(sd_device_enumerator *enumerator, sd_device *device)
                         if (strv_fnmatch(value_patterns, value))
                                 return true;
                 }
-        }
 
         return false;
 }
diff --git a/src/libsystemd/sd-device/device-monitor.c b/src/libsystemd/sd-device/device-monitor.c
index a23b5e7847..10d455888f 100644
--- a/src/libsystemd/sd-device/device-monitor.c
+++ b/src/libsystemd/sd-device/device-monitor.c
@@ -681,8 +681,8 @@ int device_monitor_send_device(
 
         /* add tag bloom filter */
         tag_bloom_bits = 0;
-        FOREACH_DEVICE_TAG(device, val)
-                tag_bloom_bits |= string_bloom64(val);
+        FOREACH_DEVICE_TAG(device, tag)
+                tag_bloom_bits |= string_bloom64(tag);
 
         if (tag_bloom_bits > 0) {
                 nlh.filter_tag_bloom_hi = htobe32(tag_bloom_bits >> 32);
diff --git a/src/libsystemd/sd-device/device-private.c b/src/libsystemd/sd-device/device-private.c
index 52cf9f2ab8..0edabfbfbb 100644
--- a/src/libsystemd/sd-device/device-private.c
+++ b/src/libsystemd/sd-device/device-private.c
@@ -525,7 +525,6 @@ int device_new_from_nulstr(sd_device **ret, char *nulstr, size_t len) {
 static int device_update_properties_bufs(sd_device *device) {
         _cleanup_free_ char **buf_strv = NULL, *buf_nulstr = NULL;
         size_t nulstr_len = 0, num = 0;
-        const char *val, *prop;
 
         assert(device);
 
@@ -728,7 +727,6 @@ static int device_tag(sd_device *device, const char *tag, bool add) {
 }
 
 int device_tag_index(sd_device *device, sd_device *device_old, bool add) {
-        const char *tag;
         int r = 0, k;
 
         if (add && device_old)
@@ -819,11 +817,9 @@ int device_update_db(sd_device *device) {
         }
 
         if (has_info) {
-                const char *property, *value, *tag;
+                const char *property, *value, *ct;
 
                 if (major(device->devnum) > 0) {
-                        const char *devlink;
-
                         FOREACH_DEVICE_DEVLINK(device, devlink)
                                 fprintf(f, "S:%s\n", devlink + STRLEN("/dev/"));
 
@@ -840,8 +836,8 @@ int device_update_db(sd_device *device) {
                 FOREACH_DEVICE_TAG(device, tag)
                         fprintf(f, "G:%s\n", tag); /* Any tag */
 
-                SET_FOREACH(tag, device->current_tags)
-                        fprintf(f, "Q:%s\n", tag); /* Current tag */
+                SET_FOREACH(ct, device->current_tags)
+                        fprintf(f, "Q:%s\n", ct); /* Current tag */
 
                 /* Always write the latest database version here, instead of the value stored in
                  * device->database_version, as which may be 0. */
diff --git a/src/libsystemd/sd-device/device-util.h b/src/libsystemd/sd-device/device-util.h
index a1b5e91edf..0316a60033 100644
--- a/src/libsystemd/sd-device/device-util.h
+++ b/src/libsystemd/sd-device/device-util.h
@@ -14,32 +14,32 @@
         unref_and_replace_full(a, b, sd_device_ref, sd_device_unref)
 
 #define FOREACH_DEVICE_PROPERTY(device, key, value)                \
-        for (key = sd_device_get_property_first(device, &(value)); \
+        for (const char *value, *key = sd_device_get_property_first(device, &(value)); \
              key;                                                  \
              key = sd_device_get_property_next(device, &(value)))
 
 #define FOREACH_DEVICE_TAG(device, tag)             \
-        for (tag = sd_device_get_tag_first(device); \
+        for (const char *tag = sd_device_get_tag_first(device); \
              tag;                                   \
              tag = sd_device_get_tag_next(device))
 
 #define FOREACH_DEVICE_CURRENT_TAG(device, tag)             \
-        for (tag = sd_device_get_current_tag_first(device); \
+        for (const char *tag = sd_device_get_current_tag_first(device); \
              tag;                                   \
              tag = sd_device_get_current_tag_next(device))
 
 #define FOREACH_DEVICE_SYSATTR(device, attr)             \
-        for (attr = sd_device_get_sysattr_first(device); \
+        for (const char *attr = sd_device_get_sysattr_first(device); \
              attr;                                       \
              attr = sd_device_get_sysattr_next(device))
 
 #define FOREACH_DEVICE_DEVLINK(device, devlink)             \
-        for (devlink = sd_device_get_devlink_first(device); \
+        for (const char *devlink = sd_device_get_devlink_first(device); \
              devlink;                                   \
              devlink = sd_device_get_devlink_next(device))
 
 #define _FOREACH_DEVICE_CHILD(device, child, suffix_ptr)                \
-        for (child = sd_device_get_child_first(device, suffix_ptr);     \
+        for (sd_device *child = sd_device_get_child_first(device, suffix_ptr);     \
              child;                                                     \
              child = sd_device_get_child_next(device, suffix_ptr))
 
@@ -50,12 +50,12 @@
         _FOREACH_DEVICE_CHILD(device, child, &suffix)
 
 #define FOREACH_DEVICE(enumerator, device)                               \
-        for (device = sd_device_enumerator_get_device_first(enumerator); \
+        for (sd_device *device = sd_device_enumerator_get_device_first(enumerator); \
              device;                                                     \
              device = sd_device_enumerator_get_device_next(enumerator))
 
 #define FOREACH_SUBSYSTEM(enumerator, device)                               \
-        for (device = sd_device_enumerator_get_subsystem_first(enumerator); \
+        for (sd_device *device = sd_device_enumerator_get_subsystem_first(enumerator); \
              device;                                                        \
              device = sd_device_enumerator_get_subsystem_next(enumerator))
 
diff --git a/src/libsystemd/sd-device/test-sd-device-monitor.c b/src/libsystemd/sd-device/test-sd-device-monitor.c
index 4654ef709d..e124e0021c 100644
--- a/src/libsystemd/sd-device/test-sd-device-monitor.c
+++ b/src/libsystemd/sd-device/test-sd-device-monitor.c
@@ -53,7 +53,7 @@ static void test_receive_device_fail(void) {
 
 static void test_send_receive_one(sd_device *device, bool subsystem_filter, bool tag_filter, bool use_bpf) {
         _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *monitor_server = NULL, *monitor_client = NULL;
-        const char *syspath, *subsystem, *tag, *devtype = NULL;
+        const char *syspath, *subsystem, *devtype = NULL;
 
         log_device_info(device, "/* %s(subsystem_filter=%s, tag_filter=%s, use_bpf=%s) */", __func__,
                         true_false(subsystem_filter), true_false(tag_filter), true_false(use_bpf));
@@ -90,7 +90,6 @@ static void test_subsystem_filter(sd_device *device) {
         _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *monitor_server = NULL, *monitor_client = NULL;
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         const char *syspath, *subsystem;
-        sd_device *d;
 
         log_device_info(device, "/* %s */", __func__);
 
@@ -131,7 +130,6 @@ static void test_tag_filter(sd_device *device) {
         _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *monitor_server = NULL, *monitor_client = NULL;
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         const char *syspath;
-        sd_device *d;
 
         log_device_info(device, "/* %s */", __func__);
 
@@ -170,7 +168,6 @@ static void test_sysattr_filter(sd_device *device, const char *sysattr) {
         _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *monitor_server = NULL, *monitor_client = NULL;
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         const char *syspath, *sysattr_value;
-        sd_device *d;
 
         log_device_info(device, "/* %s(%s) */", __func__, sysattr);
 
@@ -216,7 +213,7 @@ static void test_parent_filter(sd_device *device) {
         _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *monitor_server = NULL, *monitor_client = NULL;
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         const char *syspath, *parent_syspath;
-        sd_device *parent, *d;
+        sd_device *parent;
         int r;
 
         log_device_info(device, "/* %s */", __func__);
diff --git a/src/libsystemd/sd-device/test-sd-device-thread.c b/src/libsystemd/sd-device/test-sd-device-thread.c
index 644f3c2aee..c99d179b33 100644
--- a/src/libsystemd/sd-device/test-sd-device-thread.c
+++ b/src/libsystemd/sd-device/test-sd-device-thread.c
@@ -27,7 +27,6 @@ static void* thread(void *p) {
 int main(int argc, char *argv[]) {
         sd_device *loopback;
         pthread_t t;
-        const char *key, *value;
         int r;
 
         r = sd_device_new_from_syspath(&loopback, "/sys/class/net/lo");
diff --git a/src/libsystemd/sd-device/test-sd-device.c b/src/libsystemd/sd-device/test-sd-device.c
index fb3ae9f329..43376a2036 100644
--- a/src/libsystemd/sd-device/test-sd-device.c
+++ b/src/libsystemd/sd-device/test-sd-device.c
@@ -194,7 +194,6 @@ static void test_sd_device_one(sd_device *d) {
 
 TEST(sd_device_enumerator_devices) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
 
         assert_se(sd_device_enumerator_new(&e) >= 0);
         assert_se(sd_device_enumerator_allow_uninitialized(e) >= 0);
@@ -211,7 +210,6 @@ TEST(sd_device_enumerator_devices) {
 
 TEST(sd_device_enumerator_subsystems) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
 
         assert_se(sd_device_enumerator_new(&e) >= 0);
         assert_se(sd_device_enumerator_allow_uninitialized(e) >= 0);
@@ -227,7 +225,7 @@ static void test_sd_device_enumerator_filter_subsystem_one(
 
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         unsigned n_new_dev = 0, n_removed_dev = 0;
-        sd_device *d;
+        sd_device *dev;
 
         assert_se(sd_device_enumerator_new(&e) >= 0);
         assert_se(sd_device_enumerator_add_match_subsystem(e, subsystem, true) >= 0);
@@ -248,14 +246,14 @@ static void test_sd_device_enumerator_filter_subsystem_one(
                 assert_se(!sd_device_unref(t));
         }
 
-        HASHMAP_FOREACH(d, h) {
+        HASHMAP_FOREACH(dev, h) {
                 const char *syspath;
 
-                assert_se(sd_device_get_syspath(d, &syspath) >= 0);
+                assert_se(sd_device_get_syspath(dev, &syspath) >= 0);
                 log_warning("Device removed: subsystem:%s syspath:%s", subsystem, syspath);
                 n_removed_dev++;
 
-                assert_se(!sd_device_unref(d));
+                assert_se(!sd_device_unref(dev));
         }
 
         hashmap_free(h);
@@ -268,7 +266,6 @@ static bool test_sd_device_enumerator_filter_subsystem_trial(void) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         _cleanup_hashmap_free_ Hashmap *subsystems = NULL;
         unsigned n_new_dev = 0, n_removed_dev = 0;
-        sd_device *d;
         Hashmap *h;
         char *s;
 
@@ -405,7 +402,6 @@ TEST(sd_device_enumerator_add_match_property) {
 static void check_parent_match(sd_device_enumerator *e, sd_device *dev) {
         const char *syspath;
         bool found = false;
-        sd_device *d;
 
         assert_se(sd_device_get_syspath(dev, &syspath) >= 0);
 
@@ -429,7 +425,6 @@ static void check_parent_match(sd_device_enumerator *e, sd_device *dev) {
 
 TEST(sd_device_enumerator_add_match_parent) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *dev;
         int r;
 
         assert_se(sd_device_enumerator_new(&e) >= 0);
@@ -475,7 +470,6 @@ TEST(sd_device_enumerator_add_match_parent) {
 
 TEST(sd_device_get_child) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *dev;
         int r;
 
         assert_se(sd_device_enumerator_new(&e) >= 0);
@@ -490,7 +484,7 @@ TEST(sd_device_get_child) {
 
         FOREACH_DEVICE(e, dev) {
                 const char *syspath, *parent_syspath, *expected_suffix, *suffix;
-                sd_device *parent, *child;
+                sd_device *parent;
                 bool found = false;
 
                 assert_se(sd_device_get_syspath(dev, &syspath) >= 0);
@@ -580,7 +574,6 @@ TEST(sd_device_new_from_nulstr) {
 TEST(sd_device_new_from_path) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         _cleanup_(rm_rf_physical_and_freep) char *tmpdir = NULL;
-        sd_device *dev;
         int r;
 
         assert_se(mkdtemp_malloc("/tmp/test-sd-device.XXXXXXX", &tmpdir) >= 0);
diff --git a/src/libudev/libudev-device.c b/src/libudev/libudev-device.c
index 8091ff1d61..7b9f54c976 100644
--- a/src/libudev/libudev-device.c
+++ b/src/libudev/libudev-device.c
@@ -635,8 +635,6 @@ _public_ struct udev_list_entry *udev_device_get_devlinks_list_entry(struct udev
 
         if (device_get_devlinks_generation(udev_device->device) != udev_device->devlinks_generation ||
             !udev_device->devlinks_read) {
-                const char *devlink;
-
                 udev_list_cleanup(udev_device->devlinks);
 
                 FOREACH_DEVICE_DEVLINK(udev_device->device, devlink)
@@ -667,8 +665,6 @@ _public_ struct udev_list_entry *udev_device_get_properties_list_entry(struct ud
 
         if (device_get_properties_generation(udev_device->device) != udev_device->properties_generation ||
             !udev_device->properties_read) {
-                const char *key, *value;
-
                 udev_list_cleanup(udev_device->properties);
 
                 FOREACH_DEVICE_PROPERTY(udev_device->device, key, value)
@@ -787,8 +783,6 @@ _public_ struct udev_list_entry *udev_device_get_sysattr_list_entry(struct udev_
         assert_return_errno(udev_device, NULL, EINVAL);
 
         if (!udev_device->sysattrs_read) {
-                const char *sysattr;
-
                 udev_list_cleanup(udev_device->sysattrs);
 
                 FOREACH_DEVICE_SYSATTR(udev_device->device, sysattr)
@@ -842,8 +836,6 @@ _public_ struct udev_list_entry *udev_device_get_tags_list_entry(struct udev_dev
 
         if (device_get_tags_generation(udev_device->device) != udev_device->all_tags_generation ||
             !udev_device->all_tags_read) {
-                const char *tag;
-
                 udev_list_cleanup(udev_device->all_tags);
 
                 FOREACH_DEVICE_TAG(udev_device->device, tag)
@@ -862,8 +854,6 @@ _public_ struct udev_list_entry *udev_device_get_current_tags_list_entry(struct
 
         if (device_get_tags_generation(udev_device->device) != udev_device->current_tags_generation ||
             !udev_device->current_tags_read) {
-                const char *tag;
-
                 udev_list_cleanup(udev_device->current_tags);
 
                 FOREACH_DEVICE_CURRENT_TAG(udev_device->device, tag)
diff --git a/src/login/logind-core.c b/src/login/logind-core.c
index df67e5509b..af86e92c01 100644
--- a/src/login/logind-core.c
+++ b/src/login/logind-core.c
@@ -565,7 +565,6 @@ static bool manager_is_docked(Manager *m) {
 
 static int manager_count_external_displays(Manager *m) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
         int r, n = 0;
 
         r = sd_device_enumerator_new(&e);
diff --git a/src/login/logind-dbus.c b/src/login/logind-dbus.c
index 0d4ab28b4d..b3a36d0d05 100644
--- a/src/login/logind-dbus.c
+++ b/src/login/logind-dbus.c
@@ -1296,7 +1296,7 @@ static int method_set_user_linger(sd_bus_message *message, void *userdata, sd_bu
         return sd_bus_reply_method_return(message, NULL);
 }
 
-static int trigger_device(Manager *m, sd_device *d) {
+static int trigger_device(Manager *m, sd_device *parent) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         int r;
 
@@ -1310,8 +1310,8 @@ static int trigger_device(Manager *m, sd_device *d) {
         if (r < 0)
                 return r;
 
-        if (d) {
-                r = sd_device_enumerator_add_match_parent(e, d);
+        if (parent) {
+                r = sd_device_enumerator_add_match_parent(e, parent);
                 if (r < 0)
                         return r;
         }
diff --git a/src/login/logind.c b/src/login/logind.c
index 8323bcc0cb..f30f7f9370 100644
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -190,7 +190,6 @@ static Manager* manager_free(Manager *m) {
 
 static int manager_enumerate_devices(Manager *m) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
         int r;
 
         assert(m);
@@ -219,7 +218,6 @@ static int manager_enumerate_devices(Manager *m) {
 
 static int manager_enumerate_buttons(Manager *m) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
         int r;
 
         assert(m);
diff --git a/src/mount/mount-tool.c b/src/mount/mount-tool.c
index dd07e16c72..89bf7fd80d 100644
--- a/src/mount/mount-tool.c
+++ b/src/mount/mount-tool.c
@@ -779,7 +779,6 @@ static int find_mount_points(const char *what, char ***list) {
 
 static int find_loop_device(const char *backing_file, sd_device **ret) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *dev;
         int r;
 
         assert(backing_file);
@@ -1366,7 +1365,6 @@ enum {
 static int list_devices(void) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         _cleanup_(table_unrefp) Table *table = NULL;
-        sd_device *d;
         unsigned c;
         int r;
 
diff --git a/src/network/networkd-json.c b/src/network/networkd-json.c
index d967971993..c32642205e 100644
--- a/src/network/networkd-json.c
+++ b/src/network/networkd-json.c
@@ -67,13 +67,15 @@ static int address_build_json(Address *address, JsonVariant **ret) {
 }
 
 static int addresses_build_json(Set *addresses, JsonVariant **ret) {
-        JsonVariant **elements;
+        JsonVariant **elements = NULL;
         Address *address;
         size_t n = 0;
         int r;
 
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (set_isempty(addresses)) {
                 *ret = NULL;
                 return 0;
@@ -86,16 +88,11 @@ static int addresses_build_json(Set *addresses, JsonVariant **ret) {
         SET_FOREACH(address, addresses) {
                 r = address_build_json(address, elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
                 n++;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("Addresses", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("Addresses", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int neighbor_build_json(Neighbor *n, JsonVariant **ret) {
@@ -124,13 +121,15 @@ static int neighbor_build_json(Neighbor *n, JsonVariant **ret) {
 }
 
 static int neighbors_build_json(Set *neighbors, JsonVariant **ret) {
-        JsonVariant **elements;
+        JsonVariant **elements = NULL;
         Neighbor *neighbor;
         size_t n = 0;
         int r;
 
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (set_isempty(neighbors)) {
                 *ret = NULL;
                 return 0;
@@ -143,20 +142,15 @@ static int neighbors_build_json(Set *neighbors, JsonVariant **ret) {
         SET_FOREACH(neighbor, neighbors) {
                 r = neighbor_build_json(neighbor, elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
                 n++;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("Neighbors", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("Neighbors", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int nexthop_group_build_json(NextHop *nexthop, JsonVariant **ret) {
-        JsonVariant **elements;
+        JsonVariant **elements = NULL;
         struct nexthop_grp *g;
         size_t n = 0;
         int r;
@@ -164,6 +158,8 @@ static int nexthop_group_build_json(NextHop *nexthop, JsonVariant **ret) {
         assert(nexthop);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (hashmap_isempty(nexthop->group)) {
                 *ret = NULL;
                 return 0;
@@ -178,17 +174,12 @@ static int nexthop_group_build_json(NextHop *nexthop, JsonVariant **ret) {
                                         JSON_BUILD_PAIR_UNSIGNED("ID", g->id),
                                         JSON_BUILD_PAIR_UNSIGNED("Weight", g->weight+1)));
                 if (r < 0)
-                        goto failure;
+                        return r;
 
                 n++;
         }
 
-        r = json_variant_new_array(ret, elements, n);
-
-failure:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_variant_new_array(ret, elements, n);
 }
 
 static int nexthop_build_json(NextHop *n, JsonVariant **ret) {
@@ -234,13 +225,15 @@ static int nexthop_build_json(NextHop *n, JsonVariant **ret) {
 }
 
 static int nexthops_build_json(Set *nexthops, JsonVariant **ret) {
-        JsonVariant **elements;
+        JsonVariant **elements = NULL;
         NextHop *nexthop;
         size_t n = 0;
         int r;
 
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (set_isempty(nexthops)) {
                 *ret = NULL;
                 return 0;
@@ -253,16 +246,11 @@ static int nexthops_build_json(Set *nexthops, JsonVariant **ret) {
         SET_FOREACH(nexthop, nexthops) {
                 r = nexthop_build_json(nexthop, elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
                 n++;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("NextHops", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("NextHops", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int route_build_json(Route *route, JsonVariant **ret) {
@@ -332,13 +320,15 @@ static int route_build_json(Route *route, JsonVariant **ret) {
 }
 
 static int routes_build_json(Set *routes, JsonVariant **ret) {
-        JsonVariant **elements;
+        JsonVariant **elements = NULL;
         Route *route;
         size_t n = 0;
         int r;
 
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (set_isempty(routes)) {
                 *ret = NULL;
                 return 0;
@@ -351,16 +341,11 @@ static int routes_build_json(Set *routes, JsonVariant **ret) {
         SET_FOREACH(route, routes) {
                 r = route_build_json(route, elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
                 n++;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("Routes", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("Routes", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int routing_policy_rule_build_json(RoutingPolicyRule *rule, JsonVariant **ret) {
@@ -427,13 +412,15 @@ static int routing_policy_rule_build_json(RoutingPolicyRule *rule, JsonVariant *
 }
 
 static int routing_policy_rules_build_json(Set *rules, JsonVariant **ret) {
-        JsonVariant **elements;
+        JsonVariant **elements = NULL;
         RoutingPolicyRule *rule;
         size_t n = 0;
         int r;
 
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (set_isempty(rules)) {
                 *ret = NULL;
                 return 0;
@@ -446,16 +433,11 @@ static int routing_policy_rules_build_json(Set *rules, JsonVariant **ret) {
         SET_FOREACH(rule, rules) {
                 r = routing_policy_rule_build_json(rule, elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
                 n++;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("RoutingPolicyRules", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("RoutingPolicyRules", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int network_build_json(Network *network, JsonVariant **ret) {
@@ -551,6 +533,8 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
         assert(link);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (!link->network) {
                 *ret = NULL;
                 return 0;
@@ -558,27 +542,23 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
 
         if (link->n_dns != UINT_MAX) {
                 for (unsigned i = 0; i < link->n_dns; i++) {
-                        if (!GREEDY_REALLOC(elements, n + 1)) {
-                                r = -ENOMEM;
-                                goto finalize;
-                        }
+                        if (!GREEDY_REALLOC(elements, n + 1))
+                                return -ENOMEM;
 
                         r = dns_build_json_one(link, link->dns[i], NETWORK_CONFIG_SOURCE_RUNTIME, NULL, elements + n);
                         if (r < 0)
-                                goto finalize;
+                                return r;
                         if (r > 0)
                                 n++;
                 }
         } else {
                 for (unsigned i = 0; i < link->network->n_dns; i++) {
-                        if (!GREEDY_REALLOC(elements, n + 1)) {
-                                r = -ENOMEM;
-                                goto finalize;
-                        }
+                        if (!GREEDY_REALLOC(elements, n + 1))
+                                return -ENOMEM;
 
                         r = dns_build_json_one(link, link->network->dns[i], NETWORK_CONFIG_SOURCE_STATIC, NULL, elements + n);
                         if (r < 0)
-                                goto finalize;
+                                return r;
                         if (r > 0)
                                 n++;
                 }
@@ -590,14 +570,12 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
 
                         r = sd_dhcp_lease_get_server_identifier(link->dhcp_lease, &s.in);
                         if (r < 0)
-                                goto finalize;
+                                return r;
 
                         n_dns = sd_dhcp_lease_get_dns(link->dhcp_lease, &dns);
                         for (int i = 0; i < n_dns; i++) {
-                                if (!GREEDY_REALLOC(elements, n + 1)) {
-                                        r = -ENOMEM;
-                                        goto finalize;
-                                }
+                                if (!GREEDY_REALLOC(elements, n + 1))
+                                        return -ENOMEM;
 
                                 r = dns_build_json_one(link,
                                                        &(struct in_addr_full) { .family = AF_INET, .address.in = dns[i], },
@@ -605,7 +583,7 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
                                                        &s,
                                                        elements + n);
                                 if (r < 0)
-                                        goto finalize;
+                                        return r;
                                 if (r > 0)
                                         n++;
                         }
@@ -618,14 +596,12 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
 
                         r = sd_dhcp6_lease_get_server_address(link->dhcp6_lease, &s.in6);
                         if (r < 0)
-                                goto finalize;
+                                return r;
 
                         n_dns = sd_dhcp6_lease_get_dns(link->dhcp6_lease, &dns);
                         for (int i = 0; i < n_dns; i++) {
-                                if (!GREEDY_REALLOC(elements, n + 1)) {
-                                        r = -ENOMEM;
-                                        goto finalize;
-                                }
+                                if (!GREEDY_REALLOC(elements, n + 1))
+                                        return -ENOMEM;
 
                                 r = dns_build_json_one(link,
                                                        &(struct in_addr_full) { .family = AF_INET6, .address.in6 = dns[i], },
@@ -633,7 +609,7 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
                                                        &s,
                                                        elements + n);
                                 if (r < 0)
-                                        goto finalize;
+                                        return r;
                                 if (r > 0)
                                         n++;
                         }
@@ -643,10 +619,8 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
                         NDiscRDNSS *a;
 
                         SET_FOREACH(a, link->ndisc_rdnss) {
-                                if (!GREEDY_REALLOC(elements, n + 1)) {
-                                        r = -ENOMEM;
-                                        goto finalize;
-                                }
+                                if (!GREEDY_REALLOC(elements, n + 1))
+                                        return -ENOMEM;
 
                                 r = dns_build_json_one(link,
                                                        &(struct in_addr_full) { .family = AF_INET6, .address.in6 = a->address, },
@@ -654,7 +628,7 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
                                                        &(union in_addr_union) { .in6 = a->router },
                                                        elements + n);
                                 if (r < 0)
-                                        goto finalize;
+                                        return r;
                                 if (r > 0)
                                         n++;
                         }
@@ -663,16 +637,10 @@ static int dns_build_json(Link *link, JsonVariant **ret) {
 
         if (n == 0) {
                 *ret = NULL;
-                r = 0;
-                goto finalize;
+                return 0;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("DNS", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("DNS", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int server_build_json_one_addr(int family, const union in_addr_union *a, NetworkConfigSource s, const union in_addr_union *p, JsonVariant **ret) {
@@ -719,20 +687,20 @@ static int ntp_build_json(Link *link, JsonVariant **ret) {
         assert(link);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (!link->network) {
                 *ret = NULL;
                 return 0;
         }
 
         STRV_FOREACH(p, link->ntp ?: link->network->ntp) {
-                if (!GREEDY_REALLOC(elements, n + 1)) {
-                        r = -ENOMEM;
-                        goto finalize;
-                }
+                if (!GREEDY_REALLOC(elements, n + 1))
+                        return -ENOMEM;
 
                 r = server_build_json_one_string(*p, NETWORK_CONFIG_SOURCE_RUNTIME, elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
 
                 n++;
         }
@@ -745,14 +713,12 @@ static int ntp_build_json(Link *link, JsonVariant **ret) {
 
                         r = sd_dhcp_lease_get_server_identifier(link->dhcp_lease, &s.in);
                         if (r < 0)
-                                goto finalize;
+                                return r;
 
                         n_ntp = sd_dhcp_lease_get_ntp(link->dhcp_lease, &ntp);
                         for (int i = 0; i < n_ntp; i++) {
-                                if (!GREEDY_REALLOC(elements, n + 1)) {
-                                        r = -ENOMEM;
-                                        goto finalize;
-                                }
+                                if (!GREEDY_REALLOC(elements, n + 1))
+                                        return -ENOMEM;
 
                                 r = server_build_json_one_addr(AF_INET,
                                                                &(union in_addr_union) { .in = ntp[i], },
@@ -760,7 +726,7 @@ static int ntp_build_json(Link *link, JsonVariant **ret) {
                                                                &s,
                                                                elements + n);
                                 if (r < 0)
-                                        goto finalize;
+                                        return r;
 
                                 n++;
                         }
@@ -774,14 +740,12 @@ static int ntp_build_json(Link *link, JsonVariant **ret) {
 
                         r = sd_dhcp6_lease_get_server_address(link->dhcp6_lease, &s.in6);
                         if (r < 0)
-                                goto finalize;
+                                return r;
 
                         n_ntp = sd_dhcp6_lease_get_ntp_addrs(link->dhcp6_lease, &ntp_addr);
                         for (int i = 0; i < n_ntp; i++) {
-                                if (!GREEDY_REALLOC(elements, n + 1)) {
-                                        r = -ENOMEM;
-                                        goto finalize;
-                                }
+                                if (!GREEDY_REALLOC(elements, n + 1))
+                                        return -ENOMEM;
 
                                 r = server_build_json_one_addr(AF_INET6,
                                                                &(union in_addr_union) { .in6 = ntp_addr[i], },
@@ -789,17 +753,15 @@ static int ntp_build_json(Link *link, JsonVariant **ret) {
                                                                &s,
                                                                elements + n);
                                 if (r < 0)
-                                        goto finalize;
+                                        return r;
 
                                 n++;
                         }
 
                         n_ntp = sd_dhcp6_lease_get_ntp_fqdn(link->dhcp6_lease, &ntp_fqdn);
                         for (int i = 0; i < n_ntp; i++) {
-                                if (!GREEDY_REALLOC(elements, n + 1)) {
-                                        r = -ENOMEM;
-                                        goto finalize;
-                                }
+                                if (!GREEDY_REALLOC(elements, n + 1))
+                                        return -ENOMEM;
 
                                 r = server_build_json_one_fqdn(AF_INET6,
                                                                ntp_fqdn[i],
@@ -807,7 +769,7 @@ static int ntp_build_json(Link *link, JsonVariant **ret) {
                                                                &s,
                                                                elements + n);
                                 if (r < 0)
-                                        goto finalize;
+                                        return r;
 
                                 n++;
                         }
@@ -819,17 +781,12 @@ static int ntp_build_json(Link *link, JsonVariant **ret) {
                 return 0;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("NTP", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("NTP", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int sip_build_json(Link *link, JsonVariant **ret) {
         const struct in_addr *sip;
-        JsonVariant **elements;
+        JsonVariant **elements = NULL;
         union in_addr_union s;
         size_t n = 0;
         int n_sip, r;
@@ -837,6 +794,8 @@ static int sip_build_json(Link *link, JsonVariant **ret) {
         assert(link);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (!link->network || !link->network->dhcp_use_sip || !link->dhcp_lease) {
                 *ret = NULL;
                 return 0;
@@ -863,17 +822,12 @@ static int sip_build_json(Link *link, JsonVariant **ret) {
                                                &s,
                                                elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
                 if (r > 0)
                         n++;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("SIP", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("SIP", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int captive_portal_build_json(Link *link, JsonVariant **ret) {
@@ -919,6 +873,8 @@ static int domains_build_json(Link *link, bool is_route, JsonVariant **ret) {
         assert(link);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (!link->network) {
                 *ret = NULL;
                 return 0;
@@ -929,16 +885,14 @@ static int domains_build_json(Link *link, bool is_route, JsonVariant **ret) {
         use_domains = is_route ? DHCP_USE_DOMAINS_ROUTE : DHCP_USE_DOMAINS_YES;
 
         ORDERED_SET_FOREACH(domain, link_domains ?: network_domains) {
-                if (!GREEDY_REALLOC(elements, n + 1)) {
-                        r = -ENOMEM;
-                        goto finalize;
-                }
+                if (!GREEDY_REALLOC(elements, n + 1))
+                        return -ENOMEM;
 
                 r = domain_build_json(AF_UNSPEC, domain,
                                       link_domains ? NETWORK_CONFIG_SOURCE_RUNTIME : NETWORK_CONFIG_SOURCE_STATIC,
                                       NULL, elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
 
                 n++;
         }
@@ -948,31 +902,27 @@ static int domains_build_json(Link *link, bool is_route, JsonVariant **ret) {
                     link->network->dhcp_use_domains == use_domains) {
                         r = sd_dhcp_lease_get_server_identifier(link->dhcp_lease, &s.in);
                         if (r < 0)
-                                goto finalize;
+                                return r;
 
                         if (sd_dhcp_lease_get_domainname(link->dhcp_lease, &domain) >= 0) {
-                                if (!GREEDY_REALLOC(elements, n + 1)) {
-                                        r = -ENOMEM;
-                                        goto finalize;
-                                }
+                                if (!GREEDY_REALLOC(elements, n + 1))
+                                        return -ENOMEM;
 
                                 r = domain_build_json(AF_INET, domain, NETWORK_CONFIG_SOURCE_DHCP4, &s, elements + n);
                                 if (r < 0)
-                                        goto finalize;
+                                        return r;
 
                                 n++;
                         }
 
                         if (sd_dhcp_lease_get_search_domains(link->dhcp_lease, &domains) >= 0) {
                                 STRV_FOREACH(p, domains) {
-                                        if (!GREEDY_REALLOC(elements, n + 1)) {
-                                                r = -ENOMEM;
-                                                goto finalize;
-                                        }
+                                        if (!GREEDY_REALLOC(elements, n + 1))
+                                                return -ENOMEM;
 
                                         r = domain_build_json(AF_INET, *p, NETWORK_CONFIG_SOURCE_DHCP4, &s, elements + n);
                                         if (r < 0)
-                                                goto finalize;
+                                                return r;
 
                                         n++;
                                 }
@@ -983,18 +933,16 @@ static int domains_build_json(Link *link, bool is_route, JsonVariant **ret) {
                     link->network->dhcp6_use_domains == use_domains) {
                         r = sd_dhcp6_lease_get_server_address(link->dhcp6_lease, &s.in6);
                         if (r < 0)
-                                goto finalize;
+                                return r;
 
                         if (sd_dhcp6_lease_get_domains(link->dhcp6_lease, &domains) >= 0) {
                                 STRV_FOREACH(p, domains) {
-                                        if (!GREEDY_REALLOC(elements, n + 1)) {
-                                                r = -ENOMEM;
-                                                goto finalize;
-                                        }
+                                        if (!GREEDY_REALLOC(elements, n + 1))
+                                                return -ENOMEM;
 
                                         r = domain_build_json(AF_INET6, *p, NETWORK_CONFIG_SOURCE_DHCP6, &s, elements + n);
                                         if (r < 0)
-                                                goto finalize;
+                                                return r;
 
                                         n++;
                                 }
@@ -1005,16 +953,14 @@ static int domains_build_json(Link *link, bool is_route, JsonVariant **ret) {
                         NDiscDNSSL *a;
 
                         SET_FOREACH(a, link->ndisc_dnssl) {
-                                if (!GREEDY_REALLOC(elements, n + 1)) {
-                                        r = -ENOMEM;
-                                        goto finalize;
-                                }
+                                if (!GREEDY_REALLOC(elements, n + 1))
+                                        return -ENOMEM;
 
                                 r = domain_build_json(AF_INET6, NDISC_DNSSL_DOMAIN(a), NETWORK_CONFIG_SOURCE_NDISC,
                                                       &(union in_addr_union) { .in6 = a->router },
                                                       elements + n);
                                 if (r < 0)
-                                        goto finalize;
+                                        return r;
 
                                 n++;
                         }
@@ -1026,13 +972,8 @@ static int domains_build_json(Link *link, bool is_route, JsonVariant **ret) {
                 return 0;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR(is_route ? "RouteDomains" : "SearchDomains",
-                                                              JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR(is_route ? "RouteDomains" : "SearchDomains",
+                                                                 JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int nta_build_json(const char *nta, NetworkConfigSource s, JsonVariant **ret) {
@@ -1053,22 +994,22 @@ static int ntas_build_json(Link *link, JsonVariant **ret) {
         assert(link);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (!link->network) {
                 *ret = NULL;
                 return 0;
         }
 
         SET_FOREACH(nta, link->dnssec_negative_trust_anchors ?: link->network->dnssec_negative_trust_anchors) {
-                if (!GREEDY_REALLOC(elements, n + 1)) {
-                        r = -ENOMEM;
-                        goto finalize;
-                }
+                if (!GREEDY_REALLOC(elements, n + 1))
+                        return -ENOMEM;
 
                 r = nta_build_json(nta,
                                    link->dnssec_negative_trust_anchors ? NETWORK_CONFIG_SOURCE_RUNTIME : NETWORK_CONFIG_SOURCE_STATIC,
                                    elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
 
                 n++;
         }
@@ -1078,13 +1019,8 @@ static int ntas_build_json(Link *link, JsonVariant **ret) {
                 return 0;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("DNSSECNegativeTrustAnchors",
-                                                              JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("DNSSECNegativeTrustAnchors",
+                                                                 JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int dns_misc_build_json(Link *link, JsonVariant **ret) {
@@ -1098,6 +1034,8 @@ static int dns_misc_build_json(Link *link, JsonVariant **ret) {
         assert(link);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         if (!link->network) {
                 *ret = NULL;
                 return 0;
@@ -1107,16 +1045,14 @@ static int dns_misc_build_json(Link *link, JsonVariant **ret) {
         if (resolve_support >= 0) {
                 source = link->llmnr >= 0 ? NETWORK_CONFIG_SOURCE_RUNTIME : NETWORK_CONFIG_SOURCE_STATIC;
 
-                if (!GREEDY_REALLOC(elements, n + 1)) {
-                        r = -ENOMEM;
-                        goto finalize;
-                }
+                if (!GREEDY_REALLOC(elements, n + 1))
+                        return -ENOMEM;
 
                 r = json_build(elements + n, JSON_BUILD_OBJECT(
                                         JSON_BUILD_PAIR_STRING("LLMNR", resolve_support_to_string(resolve_support)),
                                         JSON_BUILD_PAIR_STRING("ConfigSource", network_config_source_to_string(source))));
                 if (r < 0)
-                        goto finalize;
+                        return r;
 
                 n++;
         }
@@ -1125,16 +1061,14 @@ static int dns_misc_build_json(Link *link, JsonVariant **ret) {
         if (resolve_support >= 0) {
                 source = link->mdns >= 0 ? NETWORK_CONFIG_SOURCE_RUNTIME : NETWORK_CONFIG_SOURCE_STATIC;
 
-                if (!GREEDY_REALLOC(elements, n + 1)) {
-                        r = -ENOMEM;
-                        goto finalize;
-                }
+                if (!GREEDY_REALLOC(elements, n + 1))
+                        return -ENOMEM;
 
                 r = json_build(elements + n, JSON_BUILD_OBJECT(
                                         JSON_BUILD_PAIR_STRING("MDNS", resolve_support_to_string(resolve_support)),
                                         JSON_BUILD_PAIR_STRING("ConfigSource", network_config_source_to_string(source))));
                 if (r < 0)
-                        goto finalize;
+                        return r;
 
                 n++;
         }
@@ -1143,16 +1077,14 @@ static int dns_misc_build_json(Link *link, JsonVariant **ret) {
         if (t >= 0) {
                 source = link->dns_default_route >= 0 ? NETWORK_CONFIG_SOURCE_RUNTIME : NETWORK_CONFIG_SOURCE_STATIC;
 
-                if (!GREEDY_REALLOC(elements, n + 1)) {
-                        r = -ENOMEM;
-                        goto finalize;
-                }
+                if (!GREEDY_REALLOC(elements, n + 1))
+                        return -ENOMEM;
 
                 r = json_build(elements + n, JSON_BUILD_OBJECT(
                                         JSON_BUILD_PAIR_BOOLEAN("DNSDefaultRoute", t),
                                         JSON_BUILD_PAIR_STRING("ConfigSource", network_config_source_to_string(source))));
                 if (r < 0)
-                        goto finalize;
+                        return r;
 
                 n++;
         }
@@ -1161,27 +1093,20 @@ static int dns_misc_build_json(Link *link, JsonVariant **ret) {
         if (mode >= 0) {
                 source = link->dns_over_tls_mode >= 0 ? NETWORK_CONFIG_SOURCE_RUNTIME : NETWORK_CONFIG_SOURCE_STATIC;
 
-                if (!GREEDY_REALLOC(elements, n + 1)) {
-                        r = -ENOMEM;
-                        goto finalize;
-                }
+                if (!GREEDY_REALLOC(elements, n + 1))
+                        return -ENOMEM;
 
                 r = json_build(elements + n, JSON_BUILD_OBJECT(
                                         JSON_BUILD_PAIR_STRING("DNSOverTLS", dns_over_tls_mode_to_string(mode)),
                                         JSON_BUILD_PAIR_STRING("ConfigSource", network_config_source_to_string(source))));
                 if (r < 0)
-                        goto finalize;
+                        return r;
 
                 n++;
         }
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("DNSSettings",
-                                                              JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("DNSSettings",
+                                                                 JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 static int dhcp_server_offered_leases_build_json(Link *link, JsonVariant **ret) {
@@ -1527,7 +1452,7 @@ static int link_json_compare(JsonVariant * const *a, JsonVariant * const *b) {
 }
 
 static int links_build_json(Manager *manager, JsonVariant **ret) {
-        JsonVariant **elements;
+        JsonVariant **elements = NULL;
         Link *link;
         size_t n = 0;
         int r;
@@ -1535,6 +1460,8 @@ static int links_build_json(Manager *manager, JsonVariant **ret) {
         assert(manager);
         assert(ret);
 
+        CLEANUP_ARRAY(elements, n, json_variant_unref_many);
+
         elements = new(JsonVariant*, hashmap_size(manager->links_by_index));
         if (!elements)
                 return -ENOMEM;
@@ -1542,18 +1469,13 @@ static int links_build_json(Manager *manager, JsonVariant **ret) {
         HASHMAP_FOREACH(link, manager->links_by_index) {
                 r = link_build_json(link, elements + n);
                 if (r < 0)
-                        goto finalize;
+                        return r;
                 n++;
         }
 
         typesafe_qsort(elements, n, link_json_compare);
 
-        r = json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("Interfaces", JSON_BUILD_VARIANT_ARRAY(elements, n))));
-
-finalize:
-        json_variant_unref_many(elements, n);
-        free(elements);
-        return r;
+        return json_build(ret, JSON_BUILD_OBJECT(JSON_BUILD_PAIR("Interfaces", JSON_BUILD_VARIANT_ARRAY(elements, n))));
 }
 
 int manager_build_json(Manager *manager, JsonVariant **ret) {
diff --git a/src/network/networkd-sriov.c b/src/network/networkd-sriov.c
index 77ada23602..1f205b7468 100644
--- a/src/network/networkd-sriov.c
+++ b/src/network/networkd-sriov.c
@@ -230,7 +230,7 @@ static int link_set_sr_iov_phys_port(Link *link) {
 
 static int link_set_sr_iov_virt_ports(Link *link) {
         const char *dev_port, *name;
-        sd_device *pci_dev, *child;
+        sd_device *pci_dev;
         int r;
 
         assert(link);
diff --git a/src/shared/battery-util.c b/src/shared/battery-util.c
index 43d72f9db7..71ee89a549 100644
--- a/src/shared/battery-util.c
+++ b/src/shared/battery-util.c
@@ -12,7 +12,7 @@
 static int device_is_power_sink(sd_device *device) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         bool found_source = false, found_sink = false;
-        sd_device *parent, *d;
+        sd_device *parent;
         int r;
 
         assert(device);
@@ -109,7 +109,6 @@ static bool battery_is_discharging(sd_device *d) {
 int on_ac_power(void) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         bool found_ac_online = false, found_discharging_battery = false;
-        sd_device *d;
         int r;
 
         r = sd_device_enumerator_new(&e);
@@ -234,7 +233,6 @@ int battery_read_capacity_percentage(sd_device *dev) {
 int battery_is_discharging_and_low(void) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         bool unsure = false, found_low = false;
-        sd_device *dev;
         int r;
 
          /* We have not used battery capacity_level since value is set to full
diff --git a/src/shared/blockdev-util.c b/src/shared/blockdev-util.c
index 3d03eedcf0..c6ccab081e 100644
--- a/src/shared/blockdev-util.c
+++ b/src/shared/blockdev-util.c
@@ -107,7 +107,6 @@ int block_device_get_whole_disk(sd_device *dev, sd_device **ret) {
 static int block_device_get_originating(sd_device *dev, sd_device **ret) {
         _cleanup_(sd_device_unrefp) sd_device *first_found = NULL;
         const char *suffix;
-        sd_device *child;
         dev_t devnum = 0;  /* avoid false maybe-uninitialized warning */
 
         /* For the specified block device tries to chase it through the layers, in case LUKS-style DM
@@ -665,7 +664,6 @@ int block_device_remove_all_partitions(sd_device *dev, int fd) {
         _cleanup_(sd_device_unrefp) sd_device *dev_unref = NULL;
         _cleanup_close_ int fd_close = -EBADF;
         bool has_partitions = false;
-        sd_device *part;
         int r, k = 0;
 
         assert(dev || fd >= 0);
diff --git a/src/shared/devnode-acl.c b/src/shared/devnode-acl.c
index 5911c2f84d..92a2aff3dc 100644
--- a/src/shared/devnode-acl.c
+++ b/src/shared/devnode-acl.c
@@ -143,7 +143,6 @@ int devnode_acl_all(const char *seat,
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         _cleanup_set_free_ Set *nodes = NULL;
         _cleanup_closedir_ DIR *dir = NULL;
-        sd_device *d;
         char *n;
         int r;
 
diff --git a/src/shared/format-table.c b/src/shared/format-table.c
index df79a42450..679e835db5 100644
--- a/src/shared/format-table.c
+++ b/src/shared/format-table.c
@@ -2828,10 +2828,8 @@ static int table_to_json_regular(Table *t, JsonVariant **ret) {
                 /* If sorting is requested, let's calculate an index table we use to lookup the actual index to display with. */
 
                 sorted = new(size_t, n_rows);
-                if (!sorted) {
-                        r = -ENOMEM;
-                        goto finish;
-                }
+                if (!sorted)
+                        return -ENOMEM;
 
                 for (size_t i = 0; i < n_rows; i++)
                         sorted[i] = i * t->n_columns;
@@ -2846,10 +2844,10 @@ static int table_to_json_regular(Table *t, JsonVariant **ret) {
         assert(display_columns > 0);
 
         elements = new0(JsonVariant*, display_columns * 2);
-        if (!elements) {
-                r = -ENOMEM;
-                goto finish;
-        }
+        if (!elements)
+                return -ENOMEM;
+
+        CLEANUP_ARRAY(elements, (size_t) { display_columns * 2 }, json_variant_unref_many);
 
         for (size_t j = 0; j < display_columns; j++) {
                 _cleanup_free_ char *mangled = NULL;
@@ -2863,21 +2861,21 @@ static int table_to_json_regular(Table *t, JsonVariant **ret) {
                 if (!n) {
                         r = table_make_json_field_name(t, ASSERT_PTR(t->data[c]), &mangled);
                         if (r < 0)
-                                goto finish;
+                                return r;
 
                         n = mangled;
                 }
 
                 r = json_variant_new_string(elements + j*2, n);
                 if (r < 0)
-                        goto finish;
+                        return r;
         }
 
         rows = new0(JsonVariant*, n_rows-1);
-        if (!rows) {
-                r = -ENOMEM;
-                goto finish;
-        }
+        if (!rows)
+                return -ENOMEM;
+
+        CLEANUP_ARRAY(rows, (size_t) { n_rows - 1 }, json_variant_unref_many);
 
         for (size_t i = 1; i < n_rows; i++) {
                 TableData **row;
@@ -2898,28 +2896,15 @@ static int table_to_json_regular(Table *t, JsonVariant **ret) {
 
                         r = table_data_to_json(d, elements + k);
                         if (r < 0)
-                                goto finish;
+                                return r;
                 }
 
                 r = json_variant_new_object(rows + i - 1, elements, display_columns * 2);
                 if (r < 0)
-                        goto finish;
+                        return r;
         }
 
-        r = json_variant_new_array(ret, rows, n_rows - 1);
-
-finish:
-        if (rows) {
-                json_variant_unref_many(rows, n_rows-1);
-                free(rows);
-        }
-
-        if (elements) {
-                json_variant_unref_many(elements, display_columns*2);
-                free(elements);
-        }
-
-        return r;
+        return json_variant_new_array(ret, rows, n_rows - 1);
 }
 
 static int table_to_json_vertical(Table *t, JsonVariant **ret) {
@@ -2937,10 +2922,10 @@ static int table_to_json_vertical(Table *t, JsonVariant **ret) {
         assert(t->n_cells % t->n_columns == 0);
 
         elements = new0(JsonVariant *, t->n_cells);
-        if (!elements) {
-                r = -ENOMEM;
-                goto finish;
-        }
+        if (!elements)
+                return -ENOMEM;
+
+        CLEANUP_ARRAY(elements, n_elements, json_variant_unref_many);
 
         for (size_t i = t->n_columns; i < t->n_cells; i++) {
 
@@ -2952,7 +2937,7 @@ static int table_to_json_vertical(Table *t, JsonVariant **ret) {
                         if (!n) {
                                 r = table_make_json_field_name(t, ASSERT_PTR(t->data[i]), &mangled);
                                 if (r < 0)
-                                        goto finish;
+                                        return r;
 
                                 n = mangled;
                         }
@@ -2961,20 +2946,12 @@ static int table_to_json_vertical(Table *t, JsonVariant **ret) {
                 } else
                         r = table_data_to_json(t->data[i], elements + n_elements);
                 if (r < 0)
-                        goto finish;
+                        return r;
 
                 n_elements++;
         }
 
-        r = json_variant_new_object(ret, elements, n_elements);
-
-finish:
-        if (elements) {
-                json_variant_unref_many(elements, n_elements);
-                free(elements);
-        }
-
-        return r;
+        return json_variant_new_object(ret, elements, n_elements);
 }
 
 int table_to_json(Table *t, JsonVariant **ret) {
diff --git a/src/shared/json.c b/src/shared/json.c
index 417d17df34..a6e23d82cd 100644
--- a/src/shared/json.c
+++ b/src/shared/json.c
@@ -881,6 +881,8 @@ void json_variant_unref_many(JsonVariant **array, size_t n) {
 
         for (size_t i = 0; i < n; i++)
                 json_variant_unref(array[i]);
+
+        free(array);
 }
 
 const char *json_variant_string(JsonVariant *v) {
@@ -2879,8 +2881,7 @@ typedef struct JsonStack {
 static void json_stack_release(JsonStack *s) {
         assert(s);
 
-        json_variant_unref_many(s->elements, s->n_elements);
-        s->elements = mfree(s->elements);
+        CLEANUP_ARRAY(s->elements, s->n_elements, json_variant_unref_many);
 }
 
 static int json_parse_internal(
diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c
index f467d844aa..7582dc9ace 100644
--- a/src/shared/logs-show.c
+++ b/src/shared/logs-show.c
@@ -936,11 +936,27 @@ void json_escape(
         }
 }
 
-struct json_data {
+typedef struct JsonData {
         JsonVariant* name;
         size_t n_values;
         JsonVariant* values[];
-};
+} JsonData;
+
+static JsonData* json_data_free(struct JsonData *d) {
+        if (!d)
+                return NULL;
+
+        json_variant_unref(d->name);
+
+        FOREACH_ARRAY(v, d->values, d->n_values)
+                json_variant_unref(*v);
+
+        return mfree(d);
+}
+
+DEFINE_HASH_OPS_WITH_VALUE_DESTRUCTOR(json_data_hash_ops_free,
+                                      char, string_hash_func, string_compare_func,
+                                      JsonData, json_data_free);
 
 static int update_json_data(
                 Hashmap *h,
@@ -950,7 +966,7 @@ static int update_json_data(
                 size_t size) {
 
         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
-        struct json_data *d;
+        JsonData *d = NULL;
         int r;
 
         assert(name);
@@ -970,9 +986,9 @@ static int update_json_data(
 
         d = hashmap_get(h, name);
         if (d) {
-                struct json_data *w;
+                JsonData *w;
 
-                w = realloc(d, offsetof(struct json_data, values) + sizeof(JsonVariant*) * (d->n_values + 1));
+                w = realloc(d, offsetof(JsonData, values) + sizeof(JsonVariant*) * (d->n_values + 1));
                 if (!w)
                         return log_oom();
 
@@ -985,7 +1001,7 @@ static int update_json_data(
                 if (r < 0)
                         return log_error_errno(r, "Failed to allocate JSON name variant: %m");
 
-                d = malloc0(offsetof(struct json_data, values) + sizeof(JsonVariant*));
+                d = malloc0(offsetof(JsonData, values) + sizeof(JsonVariant*));
                 if (!d)
                         return log_oom();
 
@@ -1049,12 +1065,12 @@ static int output_json(
 
         char usecbuf[CONST_MAX(DECIMAL_STR_MAX(usec_t), DECIMAL_STR_MAX(uint64_t))];
         _cleanup_(json_variant_unrefp) JsonVariant *object = NULL;
+        _cleanup_hashmap_free_ Hashmap *h = NULL;
         sd_id128_t journal_boot_id, seqnum_id;
         _cleanup_free_ char *cursor = NULL;
         usec_t realtime, monotonic;
         JsonVariant **array = NULL;
-        struct json_data *d;
-        Hashmap *h = NULL;
+        JsonData *d;
         uint64_t seqnum;
         size_t n = 0;
         int r;
@@ -1083,36 +1099,36 @@ static int output_json(
         if (r < 0)
                 return log_error_errno(r, "Failed to get seqnum: %m");
 
-        h = hashmap_new(&string_hash_ops);
+        h = hashmap_new(&json_data_hash_ops_free);
         if (!h)
                 return log_oom();
 
         r = update_json_data(h, flags, "__CURSOR", cursor, SIZE_MAX);
         if (r < 0)
-                goto finish;
+                return r;
 
         xsprintf(usecbuf, USEC_FMT, realtime);
         r = update_json_data(h, flags, "__REALTIME_TIMESTAMP", usecbuf, SIZE_MAX);
         if (r < 0)
-                goto finish;
+                return r;
 
         xsprintf(usecbuf, USEC_FMT, monotonic);
         r = update_json_data(h, flags, "__MONOTONIC_TIMESTAMP", usecbuf, SIZE_MAX);
         if (r < 0)
-                goto finish;
+                return r;
 
         r = update_json_data(h, flags, "_BOOT_ID", SD_ID128_TO_STRING(journal_boot_id), SIZE_MAX);
         if (r < 0)
-                goto finish;
+                return r;
 
         xsprintf(usecbuf, USEC_FMT, seqnum);
         r = update_json_data(h, flags, "__SEQNUM", usecbuf, SIZE_MAX);
         if (r < 0)
-                goto finish;
+                return r;
 
         r = update_json_data(h, flags, "__SEQNUM_ID", SD_ID128_TO_STRING(seqnum_id), SIZE_MAX);
         if (r < 0)
-                goto finish;
+                return r;
 
         for (;;) {
                 const void *data;
@@ -1121,26 +1137,23 @@ static int output_json(
                 r = sd_journal_enumerate_data(j, &data, &size);
                 if (IN_SET(r, -EBADMSG, -EADDRNOTAVAIL)) {
                         log_debug_errno(r, "Skipping message we can't read: %m");
-                        r = 0;
-                        goto finish;
-                }
-                if (r < 0) {
-                        log_error_errno(r, "Failed to read journal: %m");
-                        goto finish;
+                        return 0;
                 }
+                if (r < 0)
+                        return log_error_errno(r, "Failed to read journal: %m");
                 if (r == 0)
                         break;
 
                 r = update_json_data_split(h, flags, output_fields, data, size);
                 if (r < 0)
-                        goto finish;
+                        return r;
         }
 
         array = new(JsonVariant*, hashmap_size(h)*2);
-        if (!array) {
-                r = log_oom();
-                goto finish;
-        }
+        if (!array)
+                return log_oom();
+
+        CLEANUP_ARRAY(array, n, json_variant_unref_many);
 
         HASHMAP_FOREACH(d, h) {
                 assert(d->n_values > 0);
@@ -1153,41 +1166,22 @@ static int output_json(
                         _cleanup_(json_variant_unrefp) JsonVariant *q = NULL;
 
                         r = json_variant_new_array(&q, d->values, d->n_values);
-                        if (r < 0) {
-                                log_error_errno(r, "Failed to create JSON array: %m");
-                                goto finish;
-                        }
+                        if (r < 0)
+                                return log_error_errno(r, "Failed to create JSON array: %m");
 
                         array[n++] = TAKE_PTR(q);
                 }
         }
 
         r = json_variant_new_object(&object, array, n);
-        if (r < 0) {
-                log_error_errno(r, "Failed to allocate JSON object: %m");
-                goto finish;
-        }
+        if (r < 0)
+                return log_error_errno(r, "Failed to allocate JSON object: %m");
 
-        json_variant_dump(object,
-                          output_mode_to_json_format_flags(mode) |
-                          (FLAGS_SET(flags, OUTPUT_COLOR) ? JSON_FORMAT_COLOR : 0),
-                          f, NULL);
 
-        r = 0;
-
-finish:
-        while ((d = hashmap_steal_first(h))) {
-                json_variant_unref(d->name);
-                json_variant_unref_many(d->values, d->n_values);
-                free(d);
-        }
-
-        hashmap_free(h);
-
-        json_variant_unref_many(array, n);
-        free(array);
-
-        return r;
+        return json_variant_dump(object,
+                                 output_mode_to_json_format_flags(mode) |
+                                 (FLAGS_SET(flags, OUTPUT_COLOR) ? JSON_FORMAT_COLOR : 0),
+                                 f, NULL);
 }
 
 static int output_cat_field(
diff --git a/src/shared/sleep-util.c b/src/shared/sleep-util.c
index 1027ecce05..d7277399fb 100644
--- a/src/shared/sleep-util.c
+++ b/src/shared/sleep-util.c
@@ -143,7 +143,6 @@ int get_capacity_by_name(Hashmap *capacities_by_name, const char *name) {
 int fetch_batteries_capacity_by_name(Hashmap **ret) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         _cleanup_hashmap_free_ Hashmap *batteries_capacity_by_name = NULL;
-        sd_device *dev;
         int r;
 
         assert(ret);
@@ -334,7 +333,6 @@ int estimate_battery_discharge_rate_per_hour(
                 usec_t after_timestamp) {
 
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *dev;
         bool trunc = true;
         int r;
 
@@ -394,7 +392,6 @@ int estimate_battery_discharge_rate_per_hour(
 int get_total_suspend_interval(Hashmap *last_capacity, usec_t *ret) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         usec_t total_suspend_interval = 0;
-        sd_device *dev;
         int r;
 
         assert(last_capacity);
@@ -450,7 +447,6 @@ int get_total_suspend_interval(Hashmap *last_capacity, usec_t *ret) {
 /* Return true if all batteries have acpi_btp support */
 int battery_trip_point_alarm_exists(void) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *dev;
         int r;
 
         r = battery_enumerator_new(&e);
diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
index 59d01ee37c..cf2a97dde0 100644
--- a/src/shared/tpm2-util.c
+++ b/src/shared/tpm2-util.c
@@ -3862,7 +3862,9 @@ int tpm2_make_pcr_json_array(uint32_t pcr_mask, JsonVariant **ret) {
         r = 0;
 
 finish:
-        json_variant_unref_many(pcr_array, n_pcrs);
+        FOREACH_ARRAY(v, pcr_array, n_pcrs)
+                json_variant_unref(*v);
+
         return r;
 }
 
diff --git a/src/shared/udev-util.c b/src/shared/udev-util.c
index 088eb0fe9a..3e81234dc1 100644
--- a/src/shared/udev-util.c
+++ b/src/shared/udev-util.c
@@ -165,8 +165,8 @@ static int device_monitor_handler(sd_device_monitor *monitor, sd_device *device,
         if (data->devlink) {
                 const char *devlink;
 
-                FOREACH_DEVICE_DEVLINK(device, devlink)
-                        if (path_equal(devlink, data->devlink))
+                FOREACH_DEVICE_DEVLINK(device, link)
+                        if (path_equal(link, data->devlink))
                                 goto found;
 
                 if (sd_device_get_devname(device, &devlink) >= 0 && path_equal(devlink, data->devlink))
diff --git a/src/shutdown/detach-dm.c b/src/shutdown/detach-dm.c
index 71be74377d..8b8f72d678 100644
--- a/src/shutdown/detach-dm.c
+++ b/src/shutdown/detach-dm.c
@@ -42,7 +42,6 @@ static void device_mapper_list_free(DeviceMapper **head) {
 
 static int dm_list_get(DeviceMapper **head) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
         int r;
 
         assert(head);
diff --git a/src/shutdown/detach-loopback.c b/src/shutdown/detach-loopback.c
index f45960856b..267509f7d0 100644
--- a/src/shutdown/detach-loopback.c
+++ b/src/shutdown/detach-loopback.c
@@ -44,7 +44,6 @@ static void loopback_device_list_free(LoopbackDevice **head) {
 
 static int loopback_list_get(LoopbackDevice **head) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
         int r;
 
         assert(head);
diff --git a/src/shutdown/detach-md.c b/src/shutdown/detach-md.c
index ae592f6f31..2dbb866902 100644
--- a/src/shutdown/detach-md.c
+++ b/src/shutdown/detach-md.c
@@ -44,7 +44,6 @@ static void raid_device_list_free(RaidDevice **head) {
 
 static int md_list_get(RaidDevice **head) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
-        sd_device *d;
         int r;
 
         assert(head);
diff --git a/src/udev/udev-builtin-keyboard.c b/src/udev/udev-builtin-keyboard.c
index da67c2be1c..3903bc463f 100644
--- a/src/udev/udev-builtin-keyboard.c
+++ b/src/udev/udev-builtin-keyboard.c
@@ -164,7 +164,7 @@ static int builtin_keyboard(UdevEvent *event, int argc, char *argv[], bool test)
         unsigned release[1024];
         unsigned release_count = 0;
         _cleanup_close_ int fd = -EBADF;
-        const char *node, *key, *value;
+        const char *node;
         int has_abs = -1, r;
 
         r = sd_device_get_devname(dev, &node);
diff --git a/src/udev/udev-builtin-net_id.c b/src/udev/udev-builtin-net_id.c
index 000839cac9..0028fb39f4 100644
--- a/src/udev/udev-builtin-net_id.c
+++ b/src/udev/udev-builtin-net_id.c
@@ -110,7 +110,6 @@ static sd_device *skip_virtio(sd_device *dev) {
 static int get_virtfn_info(sd_device *pcidev, sd_device **ret_physfn_pcidev, char **ret_suffix) {
         _cleanup_(sd_device_unrefp) sd_device *physfn_pcidev = NULL;
         const char *syspath, *name;
-        sd_device *child;
         int r;
 
         assert(pcidev);
@@ -619,7 +618,7 @@ static int names_platform(sd_device *dev, NetNames *names, bool test) {
 
 static int dev_devicetree_onboard(sd_device *dev, NetNames *names) {
         _cleanup_(sd_device_unrefp) sd_device *aliases_dev = NULL, *ofnode_dev = NULL, *devicetree_dev = NULL;
-        const char *alias, *ofnode_path, *ofnode_syspath, *devicetree_syspath;
+        const char *ofnode_path, *ofnode_syspath, *devicetree_syspath;
         sd_device *parent;
         int r;
 
diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
index 296c0e344c..31547b7679 100644
--- a/src/udev/udev-event.c
+++ b/src/udev/udev-event.c
@@ -411,11 +411,11 @@ static ssize_t udev_event_subst_format(
                 }
                 break;
         case FORMAT_SUBST_LINKS:
-                FOREACH_DEVICE_DEVLINK(dev, val) {
+                FOREACH_DEVICE_DEVLINK(dev, link) {
                         if (s == dest)
-                                strpcpy_full(&s, l, val + STRLEN("/dev/"), &truncated);
+                                strpcpy_full(&s, l, link + STRLEN("/dev/"), &truncated);
                         else
-                                strpcpyl_full(&s, l, &truncated, " ", val + STRLEN("/dev/"), NULL);
+                                strpcpyl_full(&s, l, &truncated, " ", link + STRLEN("/dev/"), NULL);
                         if (truncated)
                                 break;
                 }
@@ -1107,7 +1107,6 @@ static int event_execute_rules_on_remove(
 }
 
 static int copy_all_tags(sd_device *d, sd_device *s) {
-        const char *tag;
         int r;
 
         assert(d);
diff --git a/src/udev/udev-node.c b/src/udev/udev-node.c
index 1bc2eda764..75845413cf 100644
--- a/src/udev/udev-node.c
+++ b/src/udev/udev-node.c
@@ -531,7 +531,6 @@ static int device_get_devpath_by_devnum(sd_device *dev, char **ret) {
 
 int udev_node_update(sd_device *dev, sd_device *dev_old) {
         _cleanup_free_ char *filename = NULL;
-        const char *devlink;
         int r;
 
         assert(dev);
@@ -577,7 +576,6 @@ int udev_node_update(sd_device *dev, sd_device *dev_old) {
 
 int udev_node_remove(sd_device *dev) {
         _cleanup_free_ char *filename = NULL;
-        const char *devlink;
         int r;
 
         assert(dev);
diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
index 265d328cd3..88846ae275 100644
--- a/src/udev/udev-rules.c
+++ b/src/udev/udev-rules.c
@@ -1780,7 +1780,6 @@ static int get_property_from_string(char *line, char **ret_key, char **ret_value
 }
 
 static int import_parent_into_properties(sd_device *dev, const char *filter) {
-        const char *key, *val;
         sd_device *parent;
         int r;
 
@@ -1896,14 +1895,11 @@ static int udev_rule_apply_token_to_event(
 
                 return token_match_string(token, val);
         }
-        case TK_M_DEVLINK: {
-                const char *val;
-
+        case TK_M_DEVLINK:
                 FOREACH_DEVICE_DEVLINK(dev, val)
                         if (token_match_string(token, strempty(startswith(val, "/dev/"))) == (token->op == OP_MATCH))
                                 return token->op == OP_MATCH;
                 return token->op == OP_NOMATCH;
-        }
         case TK_M_NAME:
                 return token_match_string(token, event->name);
         case TK_M_ENV: {
@@ -1928,14 +1924,11 @@ static int udev_rule_apply_token_to_event(
                 return token_match_string(token, val);
         }
         case TK_M_TAG:
-        case TK_M_PARENTS_TAG: {
-                const char *val;
-
+        case TK_M_PARENTS_TAG:
                 FOREACH_DEVICE_CURRENT_TAG(dev, val)
                         if (token_match_string(token, val) == (token->op == OP_MATCH))
                                 return token->op == OP_MATCH;
                 return token->op == OP_NOMATCH;
-        }
         case TK_M_SUBSYSTEM:
         case TK_M_PARENTS_SUBSYSTEM: {
                 const char *val;
diff --git a/src/udev/udevadm-info.c b/src/udev/udevadm-info.c
index fccc967a47..ae7251cbcc 100644
--- a/src/udev/udevadm-info.c
+++ b/src/udev/udevadm-info.c
@@ -86,7 +86,7 @@ static int sysattr_compare(const SysAttr *a, const SysAttr *b) {
 
 static int print_all_attributes(sd_device *device, bool is_parent) {
         _cleanup_free_ SysAttr *sysattrs = NULL;
-        const char *name, *value;
+        const char *value;
         size_t n_items = 0;
         int r;
 
@@ -180,7 +180,7 @@ static int print_device_chain(sd_device *device) {
 }
 
 static int print_record(sd_device *device, const char *prefix) {
-        const char *str, *val, *subsys;
+        const char *str, *subsys;
         dev_t devnum;
         uint64_t q;
         int i, ifi;
@@ -232,14 +232,16 @@ static int print_record(sd_device *device, const char *prefix) {
                 printf("%sI: %s%i%s\n", prefix, ansi_highlight_cyan(), ifi, ansi_normal());
 
         if (sd_device_get_devname(device, &str) >= 0) {
+                const char *val;
+
                 assert_se(val = path_startswith(str, "/dev/"));
                 printf("%sN: %s%s%s\n", prefix, ansi_highlight_cyan(), val, ansi_normal());
 
                 if (device_get_devlink_priority(device, &i) >= 0)
                         printf("%sL: %s%i%s\n", prefix, ansi_highlight_cyan(), i, ansi_normal());
 
-                FOREACH_DEVICE_DEVLINK(device, str) {
-                        assert_se(val = path_startswith(str, "/dev/"));
+                FOREACH_DEVICE_DEVLINK(device, link) {
+                        assert_se(val = path_startswith(link, "/dev/"));
                         printf("%sS: %s%s%s\n", prefix, ansi_highlight_cyan(), val, ansi_normal());
                 }
         }
@@ -250,8 +252,8 @@ static int print_record(sd_device *device, const char *prefix) {
         if (sd_device_get_driver(device, &str) >= 0)
                 printf("%sV: %s%s%s\n", prefix, ansi_highlight_yellow4(), str, ansi_normal());
 
-        FOREACH_DEVICE_PROPERTY(device, str, val)
-                printf("%sE: %s=%s\n", prefix, str, val);
+        FOREACH_DEVICE_PROPERTY(device, key, val)
+                printf("%sE: %s=%s\n", prefix, key, val);
 
         if (isempty(prefix))
                 puts("");
@@ -425,7 +427,7 @@ static int query_device(QueryType query, sd_device* device) {
         }
 
         case QUERY_SYMLINK: {
-                const char *devlink, *prefix = "";
+                const char *prefix = "";
 
                 FOREACH_DEVICE_DEVLINK(device, devlink) {
                         if (!arg_root)
@@ -448,9 +450,7 @@ static int query_device(QueryType query, sd_device* device) {
                 return 0;
         }
 
-        case QUERY_PROPERTY: {
-                const char *key, *value;
-
+        case QUERY_PROPERTY:
                 FOREACH_DEVICE_PROPERTY(device, key, value) {
                         if (arg_properties && !strv_contains(arg_properties, key))
                                 continue;
@@ -464,7 +464,6 @@ static int query_device(QueryType query, sd_device* device) {
                 }
 
                 return 0;
-        }
 
         case QUERY_ALL:
                 return print_record(device, NULL);
diff --git a/src/udev/udevadm-monitor.c b/src/udev/udevadm-monitor.c
index 99ad22a759..dbe13a8d3b 100644
--- a/src/udev/udevadm-monitor.c
+++ b/src/udev/udevadm-monitor.c
@@ -48,8 +48,6 @@ static int device_monitor_handler(sd_device_monitor *monitor, sd_device *device,
                devpath, subsystem);
 
         if (arg_show_property) {
-                const char *key, *value;
-
                 FOREACH_DEVICE_PROPERTY(device, key, value)
                         printf("%s=%s\n", key, value);
 
diff --git a/src/udev/udevadm-test.c b/src/udev/udevadm-test.c
index 8adebbc83e..682ff56720 100644
--- a/src/udev/udevadm-test.c
+++ b/src/udev/udevadm-test.c
@@ -88,7 +88,7 @@ int test_main(int argc, char *argv[], void *userdata) {
         _cleanup_(udev_rules_freep) UdevRules *rules = NULL;
         _cleanup_(udev_event_freep) UdevEvent *event = NULL;
         _cleanup_(sd_device_unrefp) sd_device *dev = NULL;
-        const char *cmd, *key, *value;
+        const char *cmd;
         sigset_t mask, sigmask_orig;
         void *val;
         int r;
diff --git a/src/udev/udevadm-wait.c b/src/udev/udevadm-wait.c
index 0ec7099eb0..7fa9b86263 100644
--- a/src/udev/udevadm-wait.c
+++ b/src/udev/udevadm-wait.c
@@ -166,8 +166,8 @@ static int device_monitor_handler(sd_device_monitor *monitor, sd_device *device,
         if (path_strv_contains(arg_devices, name))
                 return check_and_exit(sd_device_monitor_get_event(monitor));
 
-        FOREACH_DEVICE_DEVLINK(device, name)
-                if (path_strv_contains(arg_devices, name))
+        FOREACH_DEVICE_DEVLINK(device, link)
+                if (path_strv_contains(arg_devices, link))
                         return check_and_exit(sd_device_monitor_get_event(monitor));
 
         return 0;
diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index 8cf3597338..bd22dedf33 100644
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -1381,7 +1381,6 @@ static int synthesize_change(sd_device *dev) {
         _cleanup_(sd_device_enumerator_unrefp) sd_device_enumerator *e = NULL;
         bool part_table_read;
         const char *sysname;
-        sd_device *d;
         int r, k;
 
         r = sd_device_get_sysname(dev, &sysname);