diff --git a/src/core/namespace.c b/src/core/namespace.c
index 9a0375fddd..f9a33e16bc 100644
--- a/src/core/namespace.c
+++ b/src/core/namespace.c
@@ -1540,7 +1540,6 @@ static int apply_mounts(
 
         _cleanup_fclose_ FILE *proc_self_mountinfo = NULL;
         _cleanup_free_ char **deny_list = NULL;
-        size_t j;
         int r;
 
         if (n_mounts == 0) /* Shortcut: nothing to do */
@@ -1607,9 +1606,9 @@ static int apply_mounts(
         deny_list = new(char*, (*n_mounts)+1);
         if (!deny_list)
                 return -ENOMEM;
-        for (j = 0; j < *n_mounts; j++)
+        for (size_t j = 0; j < *n_mounts; j++)
                 deny_list[j] = (char*) mount_entry_path(mounts+j);
-        deny_list[j] = NULL;
+        deny_list[*n_mounts] = NULL;
 
         /* Second round, flip the ro bits if necessary. */
         for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) {
@@ -1622,10 +1621,10 @@ static int apply_mounts(
         }
 
         /* Third round, flip the noexec bits with a simplified deny list. */
-        for (j = 0; j < *n_mounts; j++)
+        for (size_t j = 0; j < *n_mounts; j++)
                 if (IN_SET((mounts+j)->mode, EXEC, NOEXEC))
                         deny_list[j] = (char*) mount_entry_path(mounts+j);
-        deny_list[j] = NULL;
+        deny_list[*n_mounts] = NULL;
 
         for (MountEntry *m = mounts; m < mounts + *n_mounts; ++m) {
                 r = make_noexec(m, deny_list, proc_self_mountinfo);
@@ -1664,8 +1663,6 @@ static bool home_read_only(
                 size_t n_temporary_filesystems,
                 ProtectHome protect_home) {
 
-        size_t i;
-
         /* Determine whether the /home directory is going to be read-only given the configured settings. Yes,
          * this is a bit sloppy, since we don't bother checking for cases where / is affected by multiple
          * settings. */
@@ -1678,12 +1675,12 @@ static bool home_read_only(
             prefixed_path_strv_contains(empty_directories, "/home"))
                 return true;
 
-        for (i = 0; i < n_temporary_filesystems; i++)
+        for (size_t i = 0; i < n_temporary_filesystems; i++)
                 if (path_equal(temporary_filesystems[i].path, "/home"))
                         return true;
 
         /* If /home is overmounted with some dir from the host it's not writable. */
-        for (i = 0; i < n_bind_mounts; i++)
+        for (size_t i = 0; i < n_bind_mounts; i++)
                 if (path_equal(bind_mounts[i].destination, "/home"))
                         return true;
 
diff --git a/src/libudev/libudev-device.c b/src/libudev/libudev-device.c
index 67f4b48da1..8091ff1d61 100644
--- a/src/libudev/libudev-device.c
+++ b/src/libudev/libudev-device.c
@@ -351,7 +351,7 @@ _public_ struct udev_device *udev_device_new_from_subsystem_sysname(struct udev
  * @udev: udev library context
  *
  * Create new udev device, and fill in information from the
- * current process environment. This only works reliable if
+ * current process environment. This only works reliably if
  * the process is called from a udev rule. It is usually used
  * for tools executed from IMPORT= rules.
  *
diff --git a/src/resolve/resolved-dns-stub.c b/src/resolve/resolved-dns-stub.c
index 78f7cb854f..2cfabb3629 100644
--- a/src/resolve/resolved-dns-stub.c
+++ b/src/resolve/resolved-dns-stub.c
@@ -89,15 +89,6 @@ DnsStubListenerExtra *dns_stub_listener_extra_free(DnsStubListenerExtra *p) {
         return mfree(p);
 }
 
-uint16_t dns_stub_listener_extra_port(DnsStubListenerExtra *p) {
-        assert(p);
-
-        if (p->port > 0)
-                return p->port;
-
-        return 53;
-}
-
 static void stub_packet_hash_func(const DnsPacket *p, struct siphash *state) {
         assert(p);
 
diff --git a/src/resolve/resolved-dns-stub.h b/src/resolve/resolved-dns-stub.h
index cf03d7f700..3b9bf65b21 100644
--- a/src/resolve/resolved-dns-stub.h
+++ b/src/resolve/resolved-dns-stub.h
@@ -35,7 +35,11 @@ extern const struct hash_ops dns_stub_listener_extra_hash_ops;
 
 int dns_stub_listener_extra_new(Manager *m, DnsStubListenerExtra **ret);
 DnsStubListenerExtra *dns_stub_listener_extra_free(DnsStubListenerExtra *p);
-uint16_t dns_stub_listener_extra_port(DnsStubListenerExtra *p);
+static inline uint16_t dns_stub_listener_extra_port(DnsStubListenerExtra *p) {
+        assert(p);
+
+        return p->port > 0 ? p->port : 53;
+}
 
 void manager_dns_stub_stop(Manager *m);
 int manager_dns_stub_start(Manager *m);
diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index f8c0857421..a47009c3c1 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -1551,13 +1551,12 @@ struct DecryptedImage {
 
 DecryptedImage* decrypted_image_unref(DecryptedImage* d) {
 #if HAVE_LIBCRYPTSETUP
-        size_t i;
         int r;
 
         if (!d)
                 return NULL;
 
-        for (i = 0; i < d->n_decrypted; i++) {
+        for (size_t i = 0; i < d->n_decrypted; i++) {
                 DecryptedPartition *p = d->decrypted + i;
 
                 if (p->device && p->name && !p->relinquished) {
@@ -2003,19 +2002,15 @@ int dissected_image_decrypt_interactively(
 }
 
 int decrypted_image_relinquish(DecryptedImage *d) {
-
-#if HAVE_LIBCRYPTSETUP
-        size_t i;
-        int r;
-#endif
-
         assert(d);
 
-        /* Turns on automatic removal after the last use ended for all DM devices of this image, and sets a boolean so
-         * that we don't clean it up ourselves either anymore */
+        /* Turns on automatic removal after the last use ended for all DM devices of this image, and sets a
+         * boolean so that we don't clean it up ourselves either anymore */
 
 #if HAVE_LIBCRYPTSETUP
-        for (i = 0; i < d->n_decrypted; i++) {
+        int r;
+
+        for (size_t i = 0; i < d->n_decrypted; i++) {
                 DecryptedPartition *p = d->decrypted + i;
 
                 if (p->relinquished)
@@ -2265,7 +2260,7 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
         _cleanup_(sigkill_waitp) pid_t child = 0;
         sd_id128_t machine_id = SD_ID128_NULL;
         _cleanup_free_ char *hostname = NULL;
-        unsigned n_meta_initialized = 0, k;
+        unsigned n_meta_initialized = 0;
         int fds[2 * _META_MAX], r, v;
         ssize_t n;
 
@@ -2316,7 +2311,7 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
                         _exit(EXIT_FAILURE);
                 }
 
-                for (k = 0; k < _META_MAX; k++) {
+                for (unsigned k = 0; k < _META_MAX; k++) {
                         _cleanup_close_ int fd = -ENOENT;
                         const char *p;
 
@@ -2350,7 +2345,7 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
 
         error_pipe[1] = safe_close(error_pipe[1]);
 
-        for (k = 0; k < _META_MAX; k++) {
+        for (unsigned k = 0; k < _META_MAX; k++) {
                 _cleanup_fclose_ FILE *f = NULL;
 
                 if (!paths[k])
@@ -2439,7 +2434,7 @@ int dissected_image_acquire_metadata(DissectedImage *m) {
         strv_free_and_replace(m->extension_release, extension_release);
 
 finish:
-        for (k = 0; k < n_meta_initialized; k++)
+        for (unsigned k = 0; k < n_meta_initialized; k++)
                 safe_close_pair(fds + 2*k);
 
         return r;