diff --git a/lib/printf.c b/lib/printf.c
index cafeeb93..c2065d9a 100644
--- a/lib/printf.c
+++ b/lib/printf.c
@@ -424,6 +424,7 @@ int bvsnprintf(char *buf, int size, const char *fmt, va_list args)
 
 		case 'X':
 			flags |= LARGE;
+			/* fallthrough */
 		case 'x':
 			base = 16;
 			break;
diff --git a/nest/a-path.c b/nest/a-path.c
index 6bad9747..6f1c40bf 100644
--- a/nest/a-path.c
+++ b/nest/a-path.c
@@ -805,7 +805,7 @@ as_path_match(const struct adata *path, struct f_path_mask *mask)
 	  val2 = val = mask->val;
 	  goto step;
 	case PM_ASN_EXPR:
-	  ASSERT(0);
+	  bug("Expressions should be evaluated on AS path mask construction.");
 	case PM_ASN_RANGE:
 	  val = mask->val;
 	  val2 = mask->val2;
diff --git a/proto/bfd/packets.c b/proto/bfd/packets.c
index b76efda6..6d5151ea 100644
--- a/proto/bfd/packets.c
+++ b/proto/bfd/packets.c
@@ -141,6 +141,7 @@ bfd_fill_authentication(struct bfd_proto *p, struct bfd_session *s, struct bfd_c
   case BFD_AUTH_METICULOUS_KEYED_MD5:
   case BFD_AUTH_METICULOUS_KEYED_SHA1:
     meticulous = 1;
+    /* fallthrough */
 
   case BFD_AUTH_KEYED_MD5:
   case BFD_AUTH_KEYED_SHA1:
@@ -230,6 +231,7 @@ bfd_check_authentication(struct bfd_proto *p, struct bfd_session *s, struct bfd_
   case BFD_AUTH_METICULOUS_KEYED_MD5:
   case BFD_AUTH_METICULOUS_KEYED_SHA1:
     meticulous = 1;
+    /* fallthrough */
 
   case BFD_AUTH_KEYED_MD5:
   case BFD_AUTH_KEYED_SHA1:
diff --git a/proto/ospf/dbdes.c b/proto/ospf/dbdes.c
index 2626a24c..019aff04 100644
--- a/proto/ospf/dbdes.c
+++ b/proto/ospf/dbdes.c
@@ -353,6 +353,7 @@ ospf_receive_dbdes(struct ospf_packet *pkt, struct ospf_iface *ifa,
     ospf_neigh_sm(n, INM_2WAYREC);
     if (n->state != NEIGHBOR_EXSTART)
       return;
+    /* fallthrough */
 
   case NEIGHBOR_EXSTART:
     if ((ifa->type != OSPF_IT_VLINK) &&
diff --git a/proto/ospf/ospf.c b/proto/ospf/ospf.c
index 150f519f..327ad0a4 100644
--- a/proto/ospf/ospf.c
+++ b/proto/ospf/ospf.c
@@ -1200,6 +1200,7 @@ ospf_sh_state(struct proto *P, int verbose, int reachable)
 	he->domain = 1; /* Abuse domain field to mark the LSA */
 	hex[jx++] = he;
       }
+      /* fallthrough */
     default:
       accept = 0;
     }
diff --git a/proto/ospf/packet.c b/proto/ospf/packet.c
index db387661..599f3094 100644
--- a/proto/ospf/packet.c
+++ b/proto/ospf/packet.c
@@ -57,6 +57,7 @@ ospf_pkt_finalize2(struct ospf_iface *ifa, struct ospf_packet *pkt, uint *plen)
       return;
     }
     strncpy(auth->password, pass->password, sizeof(auth->password));
+    /* fallthrough */
 
   case OSPF_AUTH_NONE:
     {
diff --git a/proto/radv/radv.c b/proto/radv/radv.c
index 389f598c..a381f737 100644
--- a/proto/radv/radv.c
+++ b/proto/radv/radv.c
@@ -230,6 +230,7 @@ radv_iface_notify(struct radv_iface *ifa, int event)
   {
   case RA_EV_CHANGE:
     radv_invalidate(ifa);
+    /* fallthrough */
   case RA_EV_INIT:
     ifa->initial = MAX_INITIAL_RTR_ADVERTISEMENTS;
     radv_prepare_prefixes(ifa);
diff --git a/proto/rip/packets.c b/proto/rip/packets.c
index 1b65362f..59ffd7c2 100644
--- a/proto/rip/packets.c
+++ b/proto/rip/packets.c
@@ -58,13 +58,17 @@ struct rip_block_auth
 {
   u16 must_be_ffff;
   u16 auth_type;
-  char password[0];
-  u16 packet_len;
-  u8 key_id;
-  u8 auth_len;
-  u32 seq_num;
-  u32 unused1;
-  u32 unused2;
+  union {
+    char password[16];
+    struct {
+      u16 packet_len;
+      u8 key_id;
+      u8 auth_len;
+      u32 seq_num;
+      u32 unused1;
+      u32 unused2;
+    };
+  };
 };
 
 /* Authentication tail, RFC 4822 */
diff --git a/sysdep/unix/io.c b/sysdep/unix/io.c
index a960b7f8..4455fc19 100644
--- a/sysdep/unix/io.c
+++ b/sysdep/unix/io.c
@@ -1128,7 +1128,7 @@ sk_ssh_connect(sock *s)
     default:
       return SSH_ERROR;
     }
-  }
+  } /* fallthrough */
 
   case SK_SSH_SERVER_KNOWN:
   {
@@ -1175,7 +1175,7 @@ sk_ssh_connect(sock *s)
       if (!server_identity_is_ok)
 	return SSH_ERROR;
     }
-  }
+  } /* fallthrough */
 
   case SK_SSH_USERAUTH:
   {
@@ -1191,7 +1191,7 @@ sk_ssh_connect(sock *s)
     default:
       return SSH_ERROR;
     }
-  }
+  } /* fallthrough */
 
   case SK_SSH_CHANNEL:
   {
@@ -1199,7 +1199,7 @@ sk_ssh_connect(sock *s)
     s->ssh->channel = ssh_channel_new(s->ssh->session);
     if (s->ssh->channel == NULL)
       return SSH_ERROR;
-  }
+  } /* fallthrough */
 
   case SK_SSH_SESSION:
   {
@@ -1215,7 +1215,7 @@ sk_ssh_connect(sock *s)
     default:
       return SSH_ERROR;
     }
-  }
+  } /* fallthrough */
 
   case SK_SSH_SUBSYSTEM:
   {
@@ -1234,7 +1234,7 @@ sk_ssh_connect(sock *s)
 	return SSH_ERROR;
       }
     }
-  }
+  } /* fallthrough */
 
   case SK_SSH_ESTABLISHED:
     s->ssh->state = SK_SSH_ESTABLISHED;
diff --git a/sysdep/unix/krt.c b/sysdep/unix/krt.c
index a79df54e..794ebcd0 100644
--- a/sysdep/unix/krt.c
+++ b/sysdep/unix/krt.c
@@ -784,7 +784,8 @@ krt_got_route_async(struct krt_proto *p, rte *e, int new)
   switch (e->u.krt.src)
     {
     case KRT_SRC_BIRD:
-      ASSERT(0);			/* Should be filtered by the back end */
+      /* Should be filtered by the back end */
+      bug("BIRD originated routes should not get here.");
 
     case KRT_SRC_REDIRECT:
       if (new)