- fix typos in linux.{req,prov}.

CVS patchset: 4834
CVS date: 2001/06/05 19:26:22

70 files changed, 2037 insertions, 1359 deletions

diff --git a/.lclintrc b/.lclintrc
index 60c22854c..36e9fe1fa 100644
--- a/.lclintrc
+++ b/.lclintrc
@@ -1,6 +1,7 @@
 -I. -I./build -I./lib -I./rpmdb -I./rpmio -I./popt -DHAVE_CONFIG_H -D_GNU_SOURCE
 
 #+partial
+#+forcehints
 
 -warnunixlib
 -warnposix
@@ -9,9 +10,9 @@
 
 -unrecogcomments	# XXX ignore doxygen markings
 
-#+proto-param-match
+#-deepbreak		# shortcut 485 occurences
 
-#-deepbreak		# shortcut 485 cases
++checks			# lclint level
 
 # --- not-yet at strict level
 #+ptrarith
@@ -20,41 +21,41 @@
 #+sizeoftype
 
 #+mod-uncon		# shortcut alloca is painful
-#+mod-nomods
-#+modglobsnomods
-#+modstrictglobsnomods
+#+mod-nomods		# 927 occurences
++modglobsnomods
++modstrictglobsnomods
 
-#+mod-uncon-nomods
+#+mod-uncon-nomods	# ~118 occurences
 #+mod-internal-strict
-#+mod-file-sys
-#+globnoglobs
-#+internalglobs
-#+internalglobnoglobs
-#+modglobsunchecked
-#+warnmissingglobs
-#+warnmissingglobsnomods
-#+impcheckedstrictglobs
-#+impcheckedstrictstatics
+#+mod-file-sys		# 102 occurences
+#+globnoglobs		# 1 occurence
+#+internalglobs		# 38 occurences
+#+internalglobnoglobs		# ???
+#+modglobsunchecked	# 73 occurences
++warnmissingglobs
+#+warnmissingglobsnomods	# ???
+#+impcheckedstrictglobs	# 358 occurences
+#+impcheckedstrictstatics # 1057 occurences
 #+strictusereleas
 #+strictbranchstate
 #+strictdestroy
-#+modobserveruncon
+#+modobserveruncon	# 192 occurences
 #+macroempty
 #+ansi-reserved-internal
-#+evalorderuncon
+#+evalorderuncon	# 32 occurences
 #+elseifcomplete
-#+loopswitchbreak
-#+switchswitchbreak
-#+looploopcontinue
+#+loopswitchbreak	# 286 occurences
+#+switchswitchbreak	# 32 occurences
+#+looploopcontinue	# 86 occurences
 #+whileblock
-#+forempty
++forempty
 #+forblock
 #+ifblock
-#+noeffectuncon
+#+noeffectuncon		# 228 occurences
 +topuse
 #+unusedspecial
 #+export-local
-#+oldstyle
++oldstyle
 #+sys-dir-errors
 #controlnestdepth 15
 #stringliterallen 509
@@ -62,36 +63,13 @@
 #numenummembers 127
 
 # --- not-yet at checks level
-#+predboolptr
--ptrnegate
-#-enumint
--relaxquals
-#+mustmod		# segfault in psm.c:597
-#+allglobs
-#+impcheckmodinternals
-#+uncheckedglobalias
-#+deparrays
-#+onlyunqglobaltrans 
-#+staticinittrans
-#+unqualifiedinittrans
-#+retalias
-#+assignexpose
-#+castexpose
-#+retexpose
-#+readonlytrans
-#+sefuncon
-#+ansi-reserved
-+cpp-names		# check for c++ names
-#+infloopsuncon
-#+looploopbreak
-#+switchloopbreak
-#+whileempty
-+declundef
-+export-header
-+export-header-var
-+redecl
-+noparams
-#includenest 8
+-predboolptr		# 773 occurences
++enumint		# 93 occurences
+-allglobs		# 131 occurrences
+-ansi-reserved		# goofy
+-infloopsuncon		# goofy
+
+-proto-param-match	# 59 occurences
 
 # don't-bother-me-yet parameters
 -branchstate		# painful
diff --git a/autodeps/linux.prov b/autodeps/linux.prov
index aa23cc197..110158f7d 100644
--- a/autodeps/linux.prov
+++ b/autodeps/linux.prov
@@ -51,3 +51,5 @@ done | sort -u
 # --- Tcl modules.
 [ -x /usr/lib/rpm/tcl.prov -a -n "$tcllist" ] &&
     echo $tcllist | tr [:blank:] \\n | /usr/lib/rpm/tcl.prov | sort -u
+
+exit 0
diff --git a/autodeps/linux.req b/autodeps/linux.req
index 9a92d5dac..03a9f64a3 100644
--- a/autodeps/linux.req
+++ b/autodeps/linux.req
@@ -56,7 +56,7 @@ for f in $scriptlist; do
     interplist="$interplist $interp"
     case $interp in
     */perl)	perllist="$perllist $f" ;;
-    *)		[ "${f%.pm} != "${f}" ] && perllist="$perllist $f" ;;
+    *)		[ "${f%.pm}" != "${f}" ] && perllist="$perllist $f" ;;
     esac
 done
 [ -n "$interplist" ] && { echo "$interplist" | sort -u ; }
diff --git a/build.c b/build.c
index d7ecc095d..eba1aee13 100644
--- a/build.c
+++ b/build.c
@@ -17,6 +17,7 @@
 /**
  */
 static int checkSpec(Header h)
+	/*@modifies h, fileSystem @*/
 {
     const char * rootdir = NULL;
     rpmdb db = NULL;
@@ -64,6 +65,7 @@ static int checkSpec(Header h)
 /**
  */
 static int isSpecFile(const char * specfile)
+	/*@modifies fileSystem @*/
 {
     char buf[256];
     const char * s;
@@ -101,10 +103,11 @@ static int isSpecFile(const char * specfile)
 /**
  */
 static int buildForTarget(const char * arg, BTA_t ba,
-	const char * passPhrase, char * cookie)
+		const char * passPhrase, char * cookie)
+	/*@modifies fileSystem @*/
 {
     int buildAmount = ba->buildAmount;
-    const char *buildRootURL = NULL;
+    const char * buildRootURL = NULL;
     const char * specFile;
     const char * specURL;
     int specut;
@@ -121,11 +124,12 @@ static int buildForTarget(const char * arg, BTA_t ba,
 
     if (ba->buildMode == 't') {
 	FILE *fp;
-	const char *specDir;
+	const char * specDir;
 	const char * tmpSpecFile;
-	char * cmd, *s;
+	char * cmd, * s;
 	rpmCompressedMagic res = COMPRESSED_OTHER;
-	static const char *zcmds[] = { "cat", "gunzip", "bunzip2", "cat" };
+	/*@observer@*/ static const char *zcmds[] =
+		{ "cat", "gunzip", "bunzip2", "cat" };
 
 	specDir = rpmGetPath("%{_specdir}", NULL);
 
diff --git a/build.h b/build.h
index b65b45743..964602b44 100644
--- a/build.h
+++ b/build.h
@@ -6,7 +6,8 @@ extern "C" {
 #endif
 
 int build(const char * arg, BTA_t ba, const char * passPhrase,
-	  char * cookie, /*@null@*/ const char * rcfile);
+		char * cookie, /*@null@*/ const char * rcfile)
+	/*@modifies ba->buildAmount, fileSystem @*/;
 
 #ifdef __cplusplus
 }
diff --git a/build/files.c b/build/files.c
index af7f6d262..930989e43 100644
--- a/build/files.c
+++ b/build/files.c
@@ -268,23 +268,23 @@ static void timeCheck(int tc, Header h)	/*@modifies internalState @*/
 /**
  */
 typedef struct VFA {
-	char *	attribute;
-	int	flag;
+/*@observer@*/ /*@null@*/ const char * attribute;
+    int	flag;
 } VFA_t;
 
 /**
  */
 /*@-exportlocal -exportheadervar@*/
 VFA_t verifyAttrs[] = {
-	{ "md5",	RPMVERIFY_MD5 },
-	{ "size",	RPMVERIFY_FILESIZE },
-	{ "link",	RPMVERIFY_LINKTO },
-	{ "user",	RPMVERIFY_USER },
-	{ "group",	RPMVERIFY_GROUP },
-	{ "mtime",	RPMVERIFY_MTIME },
-	{ "mode",	RPMVERIFY_MODE },
-	{ "rdev",	RPMVERIFY_RDEV },
-	{ NULL, 0 }
+    { "md5",	RPMVERIFY_MD5 },
+    { "size",	RPMVERIFY_FILESIZE },
+    { "link",	RPMVERIFY_LINKTO },
+    { "user",	RPMVERIFY_USER },
+    { "group",	RPMVERIFY_GROUP },
+    { "mtime",	RPMVERIFY_MTIME },
+    { "mode",	RPMVERIFY_MODE },
+    { "rdev",	RPMVERIFY_RDEV },
+    { NULL, 0 }
 };
 /*@=exportlocal =exportheadervar@*/
 
@@ -326,7 +326,7 @@ static int parseForVerify(char * buf, FileList fl)
     /* Bracket %*verify args */
     *pe++ = ' ';
     for (p = pe; *pe && *pe != ')'; pe++)
-	;
+	{};
 
     if (*pe == '\0') {
 	rpmError(RPMERR_BADSPEC, _("Missing ')' in %s(%s\n"), name, p);
@@ -358,7 +358,7 @@ static int parseForVerify(char * buf, FileList fl)
 		if (strcmp(p, vfa->attribute))
 		    continue;
 		verifyFlags |= vfa->flag;
-		break;
+		/*@innerbreak@*/ break;
 	    }
 	    if (vfa->attribute)
 		continue;
@@ -419,7 +419,7 @@ static int parseForAttr(char * buf, FileList fl)
     /* Bracket %*attr args */
     *pe++ = ' ';
     for (p = pe; *pe && *pe != ')'; pe++)
-	;
+	{};
 
     if (ret_ar == &(fl->def_ar)) {	/* %defattr */
 	q = pe;
@@ -533,7 +533,7 @@ static int parseForConfig(char * buf, FileList fl)
     /* Bracket %config args */
     *pe++ = ' ';
     for (p = pe; *pe && *pe != ')'; pe++)
-	;
+	{};
 
     if (*pe == '\0') {
 	rpmError(RPMERR_BADSPEC, _("Missing ')' in %s(%s\n"), name, p);
@@ -602,7 +602,7 @@ static int parseForLang(char * buf, FileList fl)
     /* Bracket %lang args */
     *pe++ = ' ';
     for (pe = p; *pe && *pe != ')'; pe++)
-	;
+	{};
 
     if (*pe == '\0') {
 	rpmError(RPMERR_BADSPEC, _("Missing ')' in %s(%s\n"), name, p);
@@ -814,7 +814,7 @@ static int parseForSimple(/*@unused@*/Spec spec, Package pkg, char * buf,
 		    fl->currentFlags |= multiLib;
 	    } else
 		fl->currentFlags |= vfa->flag;
-	    break;
+	    /*@innerbreak@*/ break;
 	}
 	/* if we got an attribute, continue with next token */
 	if (vfa->attribute != NULL)
@@ -2117,8 +2117,8 @@ top:
 /**
  */
 typedef struct {
-    const char *msg;
-    const char *argv[4];
+/*@observer@*/ /*@null@*/ const char *msg;
+/*@observer@*/ /*@null@*/ const char *argv[4];
     int ntag;
     int vtag;
     int ftag;
@@ -2231,7 +2231,9 @@ static int generateDepends(Spec spec, Package pkg, TFI_t cpioList, int multiLib)
 	}
 
 	/* Get the script name to run */
+	/*@-nullderef@*/	/* FIX: double indirection. @*/
 	myargv[0] = (dm->argv[0] ? rpmExpand(dm->argv[0], NULL) : NULL);
+	/*@=nullderef@*/
 
 	if (!(myargv[0] && *myargv[0] != '%')) {
 	    myargv[0] = _free(myargv[0]);
@@ -2250,7 +2252,9 @@ static int generateDepends(Spec spec, Package pkg, TFI_t cpioList, int multiLib)
 
 	/* Expand rest of script arguments (if any) */
 	for (i = 1; i < 4; i++) {
+	    /*@-nullderef@*/	/* FIX: double indirection. @*/
 	    myargv[i] = dm->argv[i] ? rpmExpand(dm->argv[i], NULL) : NULL;
+	    /*@=nullderef@*/
 	}
 
 	readBuf = getOutputFrom(NULL, myargv,
diff --git a/build/myftw.c b/build/myftw.c
index 499e26ba1..b30ce6f24 100644
--- a/build/myftw.c
+++ b/build/myftw.c
@@ -127,7 +127,9 @@ myftw_dir (DIR **dirs, int level, int descriptors,
       else
 	flag = MYFTW_F;
 
+      /*@-modunconnomods@*/
       retval = (*func) (fl, dir, &s);
+      /*@=modunconnomods@*/
 
       if (flag == MYFTW_D)
 	{
@@ -223,7 +225,9 @@ int myftw (const char *dir,
   len = strlen (dir);
   memcpy ((void *) buf, (void *) dir, len + 1);
 
+  /*@-modunconnomods@*/
   retval = (*func) (fl, buf, &s);
+  /*@=modunconnomods@*/
 
   if (flag == MYFTW_D)
     {
diff --git a/build/parseChangelog.c b/build/parseChangelog.c
index 44515383e..b5fe4dd75 100644
--- a/build/parseChangelog.c
+++ b/build/parseChangelog.c
@@ -38,13 +38,15 @@ static int dateToTimet(const char * datestr, /*@out@*/ time_t * secs)
 	/*@modifies *secs @*/
 {
     struct tm time;
-    char *p, *pe, *q, ** idx;
+    char * p, * pe, * q, ** idx;
     char * date = strcpy(alloca(strlen(datestr) + 1), datestr);
-    static char * days[] = { "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", 
-				NULL };
-    static char * months[] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun",
-			     "Jul", "Aug", "Sep", "Oct", "Nov", "Dec", NULL };
-    static char lengths[] = { 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
+/*@observer@*/ static char * days[] =
+	{ "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", NULL };
+/*@observer@*/ static char * months[] =
+	{ "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+ 	  "Jul", "Aug", "Sep", "Oct", "Nov", "Dec", NULL };
+/*@observer@*/ static char lengths[] =
+	{ 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
     
     memset(&time, 0, sizeof(time));
 
@@ -55,7 +57,7 @@ static int dateToTimet(const char * datestr, /*@out@*/ time_t * secs)
     if (*p == '\0') return -1;
     pe = p; SKIPNONSPACE(pe); if (*pe != '\0') *pe++ = '\0';
     for (idx = days; *idx && strcmp(*idx, p); idx++)
-	;
+	{};
     if (*idx == NULL) return -1;
 
     /* month */
@@ -63,7 +65,7 @@ static int dateToTimet(const char * datestr, /*@out@*/ time_t * secs)
     if (*p == '\0') return -1;
     pe = p; SKIPNONSPACE(pe); if (*pe != '\0') *pe++ = '\0';
     for (idx = months; *idx && strcmp(*idx, p); idx++)
-	;
+	{};
     if (*idx == NULL) return -1;
     time.tm_mon = idx - months;
 
diff --git a/build/parsePreamble.c b/build/parsePreamble.c
index fd3fe30fb..f28bedcaf 100644
--- a/build/parsePreamble.c
+++ b/build/parsePreamble.c
@@ -13,7 +13,7 @@
 
 /**
  */
-static int_32 copyTagsDuringParse[] = {
+/*@observer@*/ static int_32 copyTagsDuringParse[] = {
     RPMTAG_EPOCH,
     RPMTAG_VERSION,
     RPMTAG_RELEASE,
@@ -33,7 +33,7 @@ static int_32 copyTagsDuringParse[] = {
 
 /**
  */
-static int requiredTags[] = {
+/*@observer@*/ static int requiredTags[] = {
     RPMTAG_NAME,
     RPMTAG_VERSION,
     RPMTAG_RELEASE,
@@ -45,7 +45,8 @@ static int requiredTags[] = {
 
 /**
  */
-static void addOrAppendListEntry(Header h, int_32 tag, char *line)
+static void addOrAppendListEntry(Header h, int_32 tag, char * line)
+	/*@modifies h @*/
 {
     int argc;
     const char **argv;
@@ -62,6 +63,7 @@ static void addOrAppendListEntry(Header h, int_32 tag, char *line)
 /**
  */
 static int parseSimplePart(char *line, /*@out@*/char **name, /*@out@*/int *flag)
+	/*@modifies *name, *flag @*/
 {
     char *tok;
     char linebuf[BUFSIZ];
@@ -92,7 +94,8 @@ static int parseSimplePart(char *line, /*@out@*/char **name, /*@out@*/int *flag)
 
 /**
  */
-static inline int parseYesNo(const char *s)
+static inline int parseYesNo(const char * s)
+	/*@*/
 {
     return ((!s || (s[0] == 'n' || s[0] == 'N' || s[0] == '0') ||
 	!xstrcasecmp(s, "false") || !xstrcasecmp(s, "off"))
@@ -100,7 +103,7 @@ static inline int parseYesNo(const char *s)
 }
 
 typedef struct tokenBits_s {
-    const char * name;
+/*@observer@*/ /*@null@*/ const char * name;
     rpmsenseFlags bits;
 } * tokenBits;
 
@@ -132,6 +135,7 @@ static struct tokenBits_s buildScriptBits[] = {
  */
 static int parseBits(const char * s, const tokenBits tokbits,
 		/*@out@*/ rpmsenseFlags * bp)
+	/*@modifies *bp @*/
 {
     tokenBits tb;
     const char * se;
@@ -146,8 +150,9 @@ static int parseBits(const char * s, const tokenBits tokbits,
 	    if (s == se)
 		break;
 	    for (tb = tokbits; tb->name; tb++) {
-		if (strlen(tb->name) == (se-s) && !strncmp(tb->name, s, (se-s)))
-		    break;
+		if (tb->name != NULL &&
+		    strlen(tb->name) == (se-s) && !strncmp(tb->name, s, (se-s)))
+		    /*@innerbreak@*/ break;
 	    }
 	    if (tb->name == NULL)
 		break;
@@ -165,6 +170,7 @@ static int parseBits(const char * s, const tokenBits tokbits,
 /**
  */
 static inline char * findLastChar(char * s)
+	/*@*/
 {
     char *res = s;
 
@@ -174,21 +180,22 @@ static inline char * findLastChar(char * s)
 	s++;
     }
 
-    /*@-temptrans@*/
+    /*@-temptrans -retalias@*/
     return res;
-    /*@=temptrans@*/
+    /*@=temptrans =retalias@*/
 }
 
 /**
  */
-static int isMemberInEntry(Header header, const char *name, int tag)
+static int isMemberInEntry(Header h, const char *name, int tag)
+	/*@*/
 {
     HGE_t hge = (HGE_t)headerGetEntryMinMemory;
     HFD_t hfd = headerFreeData;
     const char ** names;
     int type, count;
 
-    if (!hge(header, tag, &type, (void **)&names, &count))
+    if (!hge(h, tag, &type, &names, &count))
 	return -1;
     while (count--) {
 	if (!xstrcasecmp(names[count], name))
@@ -201,6 +208,7 @@ static int isMemberInEntry(Header header, const char *name, int tag)
 /**
  */
 static int checkForValidArchitectures(Spec spec)
+	/*@*/
 {
 #ifndef	DYING
     const char *arch = NULL;
@@ -240,6 +248,7 @@ static int checkForValidArchitectures(Spec spec)
 /**
  */
 static int checkForRequired(Header h, const char *name)
+	/*@*/
 {
     int res = 0;
     int *p;
@@ -259,15 +268,12 @@ static int checkForRequired(Header h, const char *name)
 /**
  */
 static int checkForDuplicates(Header h, const char *name)
+	/*@modifies h @*/
 {
     int res = 0;
     int lastTag, tag;
     HeaderIterator hi;
     
-#if 0	/* XXX harmless, but headerInitIterator() does this anyways */
-    headerSort(h);
-#endif
-
     for (hi = headerInitIterator(h), lastTag = 0;
 	headerNextIterator(hi, &tag, NULL, NULL, NULL);
 	lastTag = tag)
@@ -287,7 +293,7 @@ static int checkForDuplicates(Header h, const char *name)
  */
 static struct optionalTag {
     int		ot_tag;
-    const char *ot_mac;
+/*@observer@*/ /*@null@*/ const char * ot_mac;
 } optionalTags[] = {
     { RPMTAG_VENDOR,		"%{vendor}" },
     { RPMTAG_PACKAGER,		"%{packager}" },
@@ -299,6 +305,7 @@ static struct optionalTag {
 /**
  */
 static void fillOutMainPackage(Header h)
+	/*@modifies h @*/
 {
     struct optionalTag *ot;
 
@@ -314,7 +321,8 @@ static void fillOutMainPackage(Header h)
 
 /**
  */
-static int readIcon(Header h, const char *file)
+static int readIcon(Header h, const char * file)
+	/*@modifies h, fileSystem @*/
 {
     const char *fn = NULL;
     char *icon;
@@ -416,6 +424,11 @@ extern int noLang;
  */
 static int handlePreambleTag(Spec spec, Package pkg, int tag, const char *macro,
 			     const char *lang)
+	/*@modifies spec->macros, spec->st, spec->buildRootURL,
+		spec->sources, spec->numSources, spec->noSource,
+		spec->buildRestrictions, spec->BANames, spec->BACount,
+		spec->line, spec->gotBuildRootURL,
+		pkg->header, pkg->autoProv, pkg->autoReq, pkg->icon @*/
 {
     HGE_t hge = (HGE_t)headerGetEntryMinMemory;
     HFD_t hfd = headerFreeData;
@@ -670,7 +683,7 @@ typedef struct PreambleRec_s {
     int tag;
     int len;
     int multiLang;
-    const char * token;
+/*@observer@*/ /*@null@*/ const char * token;
 } * PreambleRec;
 static struct PreambleRec_s preambleList[] = {
     {RPMTAG_NAME,		0, 0, "name"},
@@ -721,25 +734,27 @@ static struct PreambleRec_s preambleList[] = {
 /**
  */
 static inline void initPreambleList(void)
+	/*@modifies preambleList @*/
 {
     PreambleRec p;
-    for (p = preambleList; p->token; p++)
-	p->len = strlen(p->token);
+    for (p = preambleList; p->token != NULL; p++)
+	if (p->token) p->len = strlen(p->token);
 }
 
 /**
  */
 static int findPreambleTag(Spec spec, /*@out@*/int * tag,
-	/*@null@*/ /*@out@*/ const char ** macro, char *lang)
+		/*@null@*/ /*@out@*/ const char ** macro, char * lang)
+	/*@modifies *tag, *macro, *lang @*/
 {
-    char *s;
     PreambleRec p;
+    char *s;
 
     if (preambleList[0].len == 0)
 	initPreambleList();
 
-    for (p = preambleList; p->token; p++) {
-	if (!xstrncasecmp(spec->line, p->token, p->len))
+    for (p = preambleList; p->token != NULL; p++) {
+	if (p->token && !xstrncasecmp(spec->line, p->token, p->len))
 	    break;
     }
     if (p->token == NULL)
@@ -778,9 +793,9 @@ static int findPreambleTag(Spec spec, /*@out@*/int * tag,
 
     *tag = p->tag;
     if (macro)
-	/*@-onlytrans@*/	/* FIX: observer, but double indirection. */
+	/*@-onlytrans -observertrans -dependenttrans@*/	/* FIX: double indirection. */
 	*macro = p->token;
-	/*@=onlytrans@*/
+	/*@=onlytrans =observertrans =dependenttrans@*/
     return 0;
 }
 
diff --git a/build/parsePrep.c b/build/parsePrep.c
index b7730d757..d12c47c3f 100644
--- a/build/parsePrep.c
+++ b/build/parsePrep.c
@@ -31,7 +31,8 @@
  * @param urlfn		file url
  * @return		0 on success
  */
-static int checkOwners(const char *urlfn)
+static int checkOwners(const char * urlfn)
+	/*@*/
 {
     struct stat sb;
 
@@ -60,6 +61,7 @@ static int checkOwners(const char *urlfn)
  */
 /*@observer@*/ static char *doPatch(Spec spec, int c, int strip, const char *db,
 		     int reverse, int removeEmpties)
+	/*@modifies fileSystem @*/
 {
     const char *fn, *urlfn;
     static char buf[BUFSIZ];
@@ -150,6 +152,7 @@ static int checkOwners(const char *urlfn)
  * @return		expanded %setup macro (NULL on error)
  */
 /*@observer@*/ static const char *doUntar(Spec spec, int c, int quietly)
+	/*@modifies fileSystem @*/
 {
     const char *fn, *urlfn;
     static char buf[BUFSIZ];
@@ -263,6 +266,8 @@ static int checkOwners(const char *urlfn)
  * @return		0 on success
  */
 static int doSetupMacro(Spec spec, char *line)
+	/*@modifies spec->buildSubdir, spec->macros, spec->prep,
+		fileSystem @*/
 {
     char buf[BUFSIZ];
     StringBuf before;
@@ -388,13 +393,15 @@ static int doSetupMacro(Spec spec, char *line)
 
     /* XXX FIXME: owner & group fixes were conditioned on !geteuid() */
     /* Fix the owner, group, and permissions of the setup build tree */
-    {	static const char *fixmacs[] = {
-	    "%{_fixowner}", "%{_fixgroup}", "%{_fixperms}", NULL
-	};
-	const char **fm;
+    {	/*@observer@*/ static const char *fixmacs[] =
+		{ "%{_fixowner}", "%{_fixgroup}", "%{_fixperms}", NULL };
+	const char ** fm;
 
 	for (fm = fixmacs; *fm; fm++) {
-	    const char *fix = rpmExpand(*fm, " .", NULL);
+	    const char *fix;
+	    /*@-nullpass@*/
+	    fix = rpmExpand(*fm, " .", NULL);
+	    /*@=nullpass@*/
 	    if (fix && *fix != '%')
 		appendLineStringBuf(spec->prep, fix);
 	    fix = _free(fix);
@@ -411,6 +418,7 @@ static int doSetupMacro(Spec spec, char *line)
  * @return		0 on success
  */
 static int doPatchMacro(Spec spec, char *line)
+	/*@modifies spec->prep, fileSystem @*/
 {
     char *opt_b;
     int opt_P, opt_p, opt_R, opt_E;
diff --git a/build/parseReqs.c b/build/parseReqs.c
index d58b95892..c60c5dcc1 100644
--- a/build/parseReqs.c
+++ b/build/parseReqs.c
@@ -11,7 +11,7 @@
 /**
  */
 static struct ReqComp {
-    const char * token;
+/*@observer@*/ /*@null@*/ const char * token;
     rpmsenseFlags sense;
 } ReqComparisons[] = {
     { "<=", RPMSENSE_LESS | RPMSENSE_EQUAL},
@@ -164,7 +164,7 @@ int parseRCPOT(Spec spec, Package pkg, const char *field, int tag,
 	    SKIPWHITE(v);
 	    ve = v;
 	    SKIPNONWHITE(ve);
-	    break;
+	    /*@innerbreak@*/ break;
 	  }
 	}
 
diff --git a/build/parseSpec.c b/build/parseSpec.c
index b2bcf4979..a1ac61b40 100644
--- a/build/parseSpec.c
+++ b/build/parseSpec.c
@@ -415,45 +415,46 @@ fprintf(stderr, "*** PS buildRootURL(%s) %p macro set to %s\n", spec->buildRootU
     /* in the spec's line buffer.  Except for parsePreamble(),   */
     /* which handles the initial entry into a spec file.         */
     
+    /*@-infloops@*/	/* LCL: parsePart is modified @*/
     while (parsePart < PART_LAST && parsePart != PART_NONE) {
 	switch (parsePart) {
-	  case PART_PREAMBLE:
+	case PART_PREAMBLE:
 	    parsePart = parsePreamble(spec, initialPackage);
 	    initialPackage = 0;
 	    break;
-	  case PART_PREP:
+	case PART_PREP:
 	    parsePart = parsePrep(spec);
 	    break;
-	  case PART_BUILD:
-	  case PART_INSTALL:
-	  case PART_CLEAN:
+	case PART_BUILD:
+	case PART_INSTALL:
+	case PART_CLEAN:
 	    parsePart = parseBuildInstallClean(spec, parsePart);
 	    break;
-	  case PART_CHANGELOG:
+	case PART_CHANGELOG:
 	    parsePart = parseChangelog(spec);
 	    break;
-	  case PART_DESCRIPTION:
+	case PART_DESCRIPTION:
 	    parsePart = parseDescription(spec);
 	    break;
 
-	  case PART_PRE:
-	  case PART_POST:
-	  case PART_PREUN:
-	  case PART_POSTUN:
-	  case PART_VERIFYSCRIPT:
-	  case PART_TRIGGERIN:
-	  case PART_TRIGGERUN:
-	  case PART_TRIGGERPOSTUN:
+	case PART_PRE:
+	case PART_POST:
+	case PART_PREUN:
+	case PART_POSTUN:
+	case PART_VERIFYSCRIPT:
+	case PART_TRIGGERIN:
+	case PART_TRIGGERUN:
+	case PART_TRIGGERPOSTUN:
 	    parsePart = parseScript(spec, parsePart);
 	    break;
 
-	  case PART_FILES:
+	case PART_FILES:
 	    parsePart = parseFiles(spec);
 	    break;
 
-	  case PART_NONE:		/* XXX avoid gcc whining */
-	  case PART_LAST:
-	  case PART_BUILDARCHITECTURES:
+	case PART_NONE:		/* XXX avoid gcc whining */
+	case PART_LAST:
+	case PART_BUILDARCHITECTURES:
 	    break;
 	}
 
@@ -528,6 +529,7 @@ fprintf(stderr, "*** PS buildRootURL(%s) %p macro set to %s\n", spec->buildRootU
 	    return 0;
 	}
     }
+    /*@=infloops@*/	/* LCL: parsePart is modified @*/
 
     /* Check for description in each package and add arch and os */
   {
diff --git a/build/rpmbuild.h b/build/rpmbuild.h
index d0f09705d..640180fa8 100644
--- a/build/rpmbuild.h
+++ b/build/rpmbuild.h
@@ -136,7 +136,7 @@ void freeNames(void)
  */
 int readLine(Spec spec, int strip)
 	/*@modifies spec->fileStack, spec->readStack, spec->line, spec->lineNum,
-		spec->sl @*/;
+		spec->sl, fileSystem @*/;
 
 /** \ingroup rpmbuild
  * Stop reading from spec file, freeing resources.
@@ -186,7 +186,7 @@ void addChangelogEntry(Header h, time_t time, const char * name,
  * @return		>= 0 next rpmParseState, < 0 on error
  */
 int parseBuildInstallClean(Spec spec, rpmParseState parsePart)
-	/*@modifies spec->build, spec->install, spec->clean,
+	/*@modifies spec->build, spec->install, spec->clean, spec->macros,
 		spec->fileStack, spec->readStack, spec->line, spec->lineNum,
 		spec->sl @*/;
 
@@ -229,7 +229,11 @@ int parseFiles(Spec spec)
 int parsePreamble(Spec spec, int initialPackage)
 	/*@modifies spec->packages,
 		spec->fileStack, spec->readStack, spec->line, spec->lineNum,
-		spec->sl @*/;
+		spec->buildSubdir, spec->sl,
+		spec->macros, spec->st, spec->buildRootURL,
+		spec->sources, spec->numSources, spec->noSource,
+		spec->buildRestrictions, spec->BANames, spec->BACount,
+		spec->gotBuildRootURL @*/;
 
 /** \ingroup rpmbuild
  * Parse %%prep section of a spec file.
@@ -237,7 +241,7 @@ int parsePreamble(Spec spec, int initialPackage)
  * @return		>= 0 next rpmParseState, < 0 on error
  */
 int parsePrep(Spec spec)
-	/*@modifies spec->prep,
+	/*@modifies spec->prep, spec->buildSubdir, spec->macros,
 		spec->fileStack, spec->readStack, spec->line, spec->lineNum,
 		spec->sl @*/;
 
@@ -368,7 +372,8 @@ int rpmlibNeedsFeature(Header h, const char * feature, const char * featureEVR)
 int processBinaryFiles(Spec spec, int installSpecialDoc, int test)
 	/*@modifies spec->macros,
 		spec->packages->cpioList, spec->packages->fileList,
-		spec->packages->specialDoc, spec->packages->header @*/;
+		spec->packages->specialDoc, spec->packages->header,
+		fileSystem @*/;
 
 /** \ingroup rpmbuild
  * Create and initialize header for source package.
@@ -411,7 +416,8 @@ int parseSpec(/*@out@*/ Spec * specp, const char * specFile,
 		/*@null@*/ const char * passPhrase,
 		/*@null@*/ char * cookie,
 		int anyarch, int force)
-	/*@modifies *specp @*/;
+	/*@modifies *specp,
+		fileSystem @*/;
 
 /** \ingroup rpmbuild
  * @retval specp	spec file control structure
@@ -433,7 +439,8 @@ extern int (*parseSpecVec) (Spec * specp, const char * specFile,
 		/*@null@*/ const char * passPhrase,
 		/*@null@*/ char * cookie,
 		int anyarch, int force)
-	/*@modifies *specp @*/;
+	/*@modifies *specp,
+		fileSystem @*/;
 /*@=declundef@*/
 
 /** \ingroup rpmbuild
@@ -449,7 +456,8 @@ int buildSpec(Spec spec, int what, int test)
 		spec->BASpecs,
 		spec->buildRestrictions, spec->BANames,
 		spec->packages->cpioList, spec->packages->fileList,
-		spec->packages->specialDoc, spec->packages->header @*/;
+		spec->packages->specialDoc, spec->packages->header,
+		fileSystem @*/;
 
 /** \ingroup rpmbuild
  * Generate binary package(s).
@@ -458,7 +466,8 @@ int buildSpec(Spec spec, int what, int test)
  */
 int packageBinaries(Spec spec)
 	/*@modifies spec->packages->header,
-		spec->sourceRpmName @*/;
+		spec->sourceRpmName,
+		fileSystem @*/;
 
 /** \ingroup rpmbuild
  * Generate source package.
@@ -467,7 +476,8 @@ int packageBinaries(Spec spec)
  */
 int packageSources(Spec spec)
 	/*@modifies spec->sourceHeader, spec->cookie,
-		spec->sourceRpmName @*/;
+		spec->sourceRpmName,
+		fileSystem @*/;
 
 #ifdef __cplusplus
 }
diff --git a/build/spec.c b/build/spec.c
index 541d80c8d..c7bfcf44b 100644
--- a/build/spec.c
+++ b/build/spec.c
@@ -139,7 +139,7 @@ Package newPackage(Spec spec)
     } else {
 	/* Always add package to end of list */
 	for (pp = spec->packages; pp->next != NULL; pp = pp->next)
-	    ;
+	    {};
 	pp->next = p;
     }
     p->next = NULL;
diff --git a/configure.in b/configure.in
index 24a7d5669..80dd35b2b 100644
--- a/configure.in
+++ b/configure.in
@@ -1066,6 +1066,11 @@ FINDPROVIDES="${RPMCONFIGDIR}/find-provides"
 AC_DEFINE_UNQUOTED(FINDPROVIDES, "$FINDPROVIDES")
 AC_SUBST(FINDPROVIDES)
 
+dnl for Doxyfiles.in
+TOP_SOURCEDIR="`pwd`"
+AC_DEFINE_UNQUOTED(TOP_SOURCEDIR, "$TOP_SOURCEDIR")
+AC_SUBST(TOP_SOURCEDIR)
+
 testdir="`pwd`/tests"
 dnl AC_DEFINE_UNQUOTED(testdir, "$testdir")
 AC_SUBST(testdir)
diff --git a/lib/Makefile.am b/lib/Makefile.am
index 77b7a2872..a597fa82a 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -60,12 +60,14 @@ getdate.c: getdate.y
 	-@if test -f y.tab.c; then \
 	 { echo "/*@-globstate -statictrans -unqualifiedtrans -noparams @*/";\
 	   echo "/*@-retvalint -usedef -varuse -nullderef -nullassign @*/";\
+	   echo "/*@-readonlytrans -modunconnomods @*/";\
 	   sed	-e 's,y.tab.c,getdate.c,' y.tab.c \
 		-e 's,^YYSTYPE ,static &,' \
 		-e 's,^short ,static &,' \
 		-e 's,^const short ,static &,' \
 		-e 's,^int yydebug,/*@unused@*/ static &,' \
 		-e 's,^int ,static &,' ;\
+	   echo "/*@=readonlytrans =modunconnomods @*/";\
 	   echo "/*@=retvalint =usedef =varuse =nullderef =nullassign @*/";\
 	   echo "/*@=globstate =statictrans =unqualifiedtrans =noparams @*/";\
 	 } > getdate.c ;\
diff --git a/lib/depends.c b/lib/depends.c
index bde10929e..79002de90 100644
--- a/lib/depends.c
+++ b/lib/depends.c
@@ -364,7 +364,8 @@ alAddPackage(availableList al,
 	while (first < p->filesCount) {
 	    last = first;
 	    while ((last + 1) < p->filesCount) {
-		if (dirIndexes[first] != dirIndexes[last + 1]) break;
+		if (dirIndexes[first] != dirIndexes[last + 1])
+		    /*@innerbreak@*/ break;
 		last++;
 	    }
 
@@ -394,7 +395,7 @@ alAddPackage(availableList al,
 
     if (relocs) {
 	for (i = 0, r = relocs; r->oldPath || r->newPath; i++, r++)
-	    ;
+	    {};
 	p->relocs = xmalloc((i + 1) * sizeof(*p->relocs));
 
 	for (i = 0, r = relocs; r->oldPath || r->newPath; i++, r++) {
@@ -514,8 +515,8 @@ static void parseEVR(char * evr,
     if (rp) *rp = release;
 }
 
-const char *rpmNAME = PACKAGE;
-const char *rpmEVR = VERSION;
+/*@observer@*/ const char *rpmNAME = PACKAGE;
+/*@observer@*/ const char *rpmEVR = VERSION;
 int rpmFLAGS = RPMSENSE_EQUAL;
 
 int rpmRangesOverlap(const char * AName, const char * AEVR, int AFlags,
@@ -692,7 +693,9 @@ rpmTransactionSet rpmtransCreateSet(rpmdb rpmdb, const char * rootDir)
     ts->filesystemCount = 0;
     ts->filesystems = NULL;
     ts->di = NULL;
+    /*@-assignexpose@*/
     ts->rpmdb = rpmdb;
+    /*@=assignexpose@*/
     ts->scriptFd = NULL;
     ts->id = 0;
     ts->delta = 5;
@@ -979,7 +982,9 @@ alAllFileSatisfiesDepend(const availableList al,
     while (dirMatch > al->dirs && dirInfoCompare(dirMatch-1, &dirNeedle) == 0)
 	dirMatch--;
 
+    /*@-nullptrarith@*/		/* FIX: fileName NULL ??? */
     baseName = strrchr(fileName, '/') + 1;
+    /*@=nullptrarith@*/
 
     for (found = 0, ret = NULL;
 	 dirMatch <= al->dirs + al->numDirs &&
@@ -1007,7 +1012,7 @@ alAllFileSatisfiesDepend(const availableList al,
 	    ret = xrealloc(ret, (found+2) * sizeof(*ret));
 	    if (ret)	/* can't happen */
 		ret[found++] = al->list + dirMatch->files[i].pkgNum;
-	    break;
+	    /*@innerbreak@*/ break;
 	}
     }
 
@@ -1103,7 +1108,8 @@ alAllSatisfiesDepend(const availableList al,
 		proFlags = (p->provideFlags ? p->provideFlags[i] : 0);
 		rc = rpmRangesOverlap(p->provides[i], proEVR, proFlags,
 				keyName, keyEVR, keyFlags);
-		if (rc) break;
+		if (rc)
+		    /*@innerbreak@*/ break;
 	    }
 	    if (keyType && keyDepend && rc)
 		rpmMessage(RPMMESS_DEBUG, _("%s: %-45s YES (added provide)\n"),
@@ -1423,7 +1429,7 @@ static int checkPackageDeps(rpmTransactionSet ts, problemsSet psp,
 	    if (suggestion) {
 		int j;
 		for (j = 0; suggestion[j]; j++)
-		    ;
+		    {};
 		psp->problems[psp->num].suggestedPackages =
 			xmalloc( (j + 1) * sizeof(void *) );
 		for (j = 0; suggestion[j]; j++)
@@ -1603,8 +1609,8 @@ static int checkDependentConflicts(rpmTransactionSet ts,
 
 #if defined(DEPENDENCY_WHITEOUT)
 static struct badDeps_s {
-    const char * pname;
-    const char * qname;
+/*@observer@*/ /*@null@*/ const char * pname;
+/*@observer@*/ /*@null@*/ const char * qname;
 } badDeps[] = {
     { "libtermcap", "bash" },
     { "modutils", "vixie-cron" },
@@ -1632,11 +1638,12 @@ static int ignoreDep(const struct availablePackage * p,
 		const struct availablePackage * q)
 	/*@*/
 {
-    struct badDeps_s *bdp;
+    struct badDeps_s * bdp = badDeps;
 
-    for (bdp = badDeps; bdp->pname != NULL; bdp++) {
+    while (bdp->pname != NULL && bdp->qname != NULL) {
 	if (!strcmp(p->name, bdp->pname) && !strcmp(q->name, bdp->qname))
 	    return 1;
+	bdp++;
     }
     return 0;
 }
@@ -1647,8 +1654,10 @@ static int ignoreDep(const struct availablePackage * p,
  * @param tsi		successor chain
  * @param q		predecessor
  */
-static void markLoop(struct tsortInfo * tsi, struct availablePackage * q)
-	/*@modifies *tsi @*/
+static void markLoop(/*@special@*/ struct tsortInfo * tsi,
+		struct availablePackage * q)
+	/*@uses tsi @*/
+	/*@modifies internalState @*/
 {
     struct availablePackage * p;
 
@@ -2022,7 +2031,7 @@ rescan:
 	    /* T12. Mark predecessor chain, looking for start of loop. */
 	    for (q = r->tsi.tsi_pkg; q != NULL; q = q->tsi.tsi_pkg) {
 		if (q->tsi.tsi_reqx)
-		    break;
+		    /*@innerbreak@*/ break;
 		q->tsi.tsi_reqx = 1;
 	    }
 
@@ -2102,9 +2111,8 @@ rescan:
 	    if (ts->order[j].type == TR_REMOVED &&
 		ts->order[j].u.removed.dependsOnIndex == needle->alIndex) {
 		newOrder[newOrderCount++] = ts->order[j];
-	    } else {
-		break;
-	    }
+	    } else
+		/*@innerbreak@*/ break;
 	}
     }
 
@@ -2175,7 +2183,7 @@ int rpmdepCheck(rpmTransactionSet ts,
 	    if (!checkDependentConflicts(ts, ps, p->provides[j]))
 		continue;
 	    rc = 1;
-	    break;
+	    /*@innerbreak@*/ break;
 	}
 	if (rc)
 	    goto exit;
@@ -2214,7 +2222,7 @@ int rpmdepCheck(rpmTransactionSet ts,
 		    if (!checkDependentPackages(ts, ps, provides[j]))
 			continue;
 		    rc = 1;
-		    break;
+		    /*@innerbreak@*/ break;
 		}
 		provides = hfd(provides, pnt);
 		if (rc)
@@ -2248,7 +2256,7 @@ int rpmdepCheck(rpmTransactionSet ts,
 		    if (!checkDependentPackages(ts, ps, fileName))
 			continue;
 		    rc = 1;
-		    break;
+		    /*@innerbreak@*/ break;
 		}
 
 		fileName = _free(fileName);
diff --git a/lib/formats.c b/lib/formats.c
index 9de2fbdd4..d48be379c 100644
--- a/lib/formats.c
+++ b/lib/formats.c
@@ -179,7 +179,7 @@ static int instprefixTag(Header h, /*@null@*/ /*@out@*/ int_32 * type,
 	/*@null@*/ /*@out@*/ const void ** data,
 	/*@null@*/ /*@out@*/ int_32 * count,
 	/*@null@*/ /*@out@*/ int * freeData)
-		/*@modifies *type, *data, *count, *freeData @*/
+		/*@modifies *type, *data, *freeData @*/
 {
     HGE_t hge = (HGE_t)headerGetEntryMinMemory;
     HFD_t hfd = headerFreeData;
@@ -211,7 +211,7 @@ static int instprefixTag(Header h, /*@null@*/ /*@out@*/ int_32 * type,
 static int fssizesTag(Header h, /*@out@*/ int_32 * type,
 	/*@out@*/ const void ** data, /*@out@*/ int_32 * count,
 	/*@out@*/ int * freeData)
-		/*@modifies h, *type, *data, *count, *freeData @*/
+		/*@modifies *type, *data, *count, *freeData @*/
 {
     HGE_t hge = (HGE_t)headerGetEntryMinMemory;
     const char ** filenames;
@@ -262,7 +262,7 @@ static int fssizesTag(Header h, /*@out@*/ int_32 * type,
 static int triggercondsTag(Header h, /*@out@*/ int_32 * type,
 	/*@out@*/ const void ** data, /*@out@*/ int_32 * count,
 	/*@out@*/ int * freeData)
-		/*@modifies h, *type, *data, *count, *freeData @*/
+		/*@modifies *type, *data, *count, *freeData @*/
 {
     HGE_t hge = (HGE_t)headerGetEntryMinMemory;
     HFD_t hfd = headerFreeData;
@@ -333,7 +333,7 @@ static int triggercondsTag(Header h, /*@out@*/ int_32 * type,
 static int triggertypeTag(Header h, /*@out@*/ int_32 * type,
 	/*@out@*/ const void ** data, /*@out@*/ int_32 * count,
 	/*@out@*/ int * freeData)
-		/*@modifies h, *type, *data, *count, *freeData @*/
+		/*@modifies *type, *data, *count, *freeData @*/
 {
     HGE_t hge = (HGE_t)headerGetEntryMinMemory;
     HFD_t hfd = headerFreeData;
@@ -367,7 +367,7 @@ static int triggertypeTag(Header h, /*@out@*/ int_32 * type,
 		conds[i] = xstrdup("un");
 	    else
 		conds[i] = xstrdup("postun");
-	    break;
+	    /*@innerbreak@*/ break;
 	}
     }
 
@@ -402,9 +402,10 @@ static int filenamesTag(Header h, /*@out@*/ int_32 * type,
 /*@-exportlocal -exportheadervar@*/
 int _nl_msg_cat_cntr;	/* XXX GNU gettext voodoo */
 /*@=exportlocal =exportheadervar@*/
-static const char * language = "LANGUAGE";
+/*@observer@*/ static const char * language = "LANGUAGE";
 
-static char * _macro_i18ndomains = "%{?_i18ndomains:%{_i18ndomains}}";
+/*@observer@*/ static const char * _macro_i18ndomains =
+		"%{?_i18ndomains:%{_i18ndomains}}";
 
 /**
  * @param h		header
@@ -534,7 +535,7 @@ static int descriptionTag(Header h, /*@out@*/ int_32 * type,
 static int groupTag(Header h, /*@out@*/ int_32 * type,
 	/*@out@*/ const void ** data, /*@out@*/ int_32 * count,
 	/*@out@*/ int * freeData)
-		/*@modifies h, *type, *data, *count, *freeData @*/
+		/*@modifies *type, *data, *count, *freeData @*/
 {
     return i18nTag(h, RPMTAG_GROUP, type, data, count, freeData);
 }
diff --git a/lib/fs.c b/lib/fs.c
index 2734e220c..aaf0647d1 100644
--- a/lib/fs.c
+++ b/lib/fs.c
@@ -164,6 +164,7 @@ static int getFilesystemList(void)
     while (1) {
 #	if GETMNTENT_ONE
 	    /* this is Linux */
+	    /*@-modunconnomods@*/
 	    our_mntent * itemptr = getmntent(mtab);
 	    if (!itemptr) break;
 	    item = *itemptr;	/* structure assignment */
@@ -174,6 +175,7 @@ static int getFilesystemList(void)
 		rdonly = 1;
 	    /*@=compdef@*/
 #endif
+	    /*@=modunconnomods@*/
 #	elif GETMNTENT_TWO
 	    /* Solaris, maybe others */
 	    if (getmntent(mtab, &item)) break;
@@ -305,7 +307,8 @@ int rpmGetFilesystemUsage(const char ** fileList, int_32 * fssizes, int numFiles
 
 	    if (lastDev != sb.st_dev) {
 		for (j = 0; j < numFilesystems; j++)
-		    if (filesystems && filesystems[j].dev == sb.st_dev) break;
+		    if (filesystems && filesystems[j].dev == sb.st_dev)
+			/*@innerbreak@*/ break;
 
 		if (j == numFilesystems) {
 		    rpmError(RPMERR_BADDEV, 
diff --git a/lib/fsm.c b/lib/fsm.c
index 11ac48d73..b677ff449 100644
--- a/lib/fsm.c
+++ b/lib/fsm.c
@@ -26,13 +26,17 @@ int strict_erasures = 0;
 
 rpmTransactionSet fsmGetTs(const FSM_t fsm) {
     const FSMI_t iter = fsm->iter;
+    /*@-retexpose@*/
     return (iter ? iter->ts : NULL);
+    /*@=retexpose@*/
 }
 
 TFI_t fsmGetFi(const FSM_t fsm)
 {
     const FSMI_t iter = fsm->iter;
+    /*@-retexpose@*/
     return (iter ? iter->fi : NULL);
+    /*@=retexpose@*/
 }
 
 #define	SUFFIX_RPMORIG	".rpmorig"
@@ -100,8 +104,10 @@ mapInitIterator(/*@kept@*/ const void * a, /*@kept@*/ const void * b)
     FSMI_t iter = NULL;
 
     iter = xcalloc(1, sizeof(*iter));
+    /*@-assignexpose@*/
     iter->ts = ts;
     iter->fi = fi;
+    /*@=assignexpose@*/
     iter->reverse = (fi->type == TR_REMOVED && fi->action != FA_COPYOUT);
     iter->i = (iter->reverse ? (fi->fc - 1) : 0);
     iter->isave = iter->i;
@@ -192,6 +198,7 @@ typedef struct dnli_s {
  * @retval		NULL always
  */
 static /*@null@*/ void * dnlFreeIterator(/*@only@*//*@null@*/ const void * a)
+	/*@modifies a @*/
 {
     if (a) {
 	DNLI_t dnli = (void *)a;
@@ -202,13 +209,17 @@ static /*@null@*/ void * dnlFreeIterator(/*@only@*//*@null@*/ const void * a)
 
 /** \ingroup payload
  */
-static inline int dnlCount(const DNLI_t dnli) {
+static inline int dnlCount(const DNLI_t dnli)
+	/*@*/
+{
     return (dnli ? dnli->fi->dc : 0);
 }
 
 /** \ingroup payload
  */
-static inline int dnlIndex(const DNLI_t dnli) {
+static inline int dnlIndex(const DNLI_t dnli)
+	/*@*/
+{
     return (dnli ? dnli->isave : -1);
 }
 
@@ -221,6 +232,7 @@ static inline int dnlIndex(const DNLI_t dnli) {
 static /*@only@*/ void * dnlInitIterator(/*@special@*/ const FSM_t fsm,
 		int reverse)
 	/*@uses fsm->iter @*/ 
+	/*@*/
 {
     TFI_t fi = fsmGetFi(fsm);
     DNLI_t dnli;
@@ -265,7 +277,7 @@ static /*@only@*/ void * dnlInitIterator(/*@special@*/ const FSM_t fsm,
 		    continue;
 		/* This directory is included in the package. */
 		dnli->active[j] = 0;
-		break;
+		/*@innerbreak@*/ break;
 	    }
 	}
 
@@ -294,6 +306,7 @@ static /*@only@*/ void * dnlInitIterator(/*@special@*/ const FSM_t fsm,
  * @return		next directory name
  */
 static /*@observer@*/ const char * dnlNextIterator(/*@null@*/ DNLI_t dnli)
+	/*@modifies dnli @*/
 {
     const char * dn = NULL;
 
@@ -325,6 +338,7 @@ static int saveHardLink(/*@special@*/ /*@partial@*/ FSM_t fsm)
 	/*@uses fsm->links, fsm->ix, fsm->sb, fsm->goal, fsm->nsuffix @*/
 	/*@defines fsm->li @*/
 	/*@releases fsm->path @*/
+	/*@modifies fsm @*/
 {
     struct stat * st = &fsm->sb;
     int rc = 0;
@@ -413,6 +427,7 @@ fprintf(stderr, "*** %p link[%d:%d] %d filex %d %s\n", fsm->li, fsm->li->linksLe
  * @param li		set of hard links
  */
 static /*@null@*/ void * freeHardLink(/*@only@*/ /*@null@*/ struct hardLink * li)
+	/*@modifies li @*/
 {
     if (li) {
 	li->nsuffix = _free(li->nsuffix);	/* XXX elements are shared */
@@ -465,12 +480,14 @@ int fsmSetup(FSM_t fsm, fileStage goal,
 	}
     }
 
+    /*@-assignexpose@*/
     fsm->archiveSize = archiveSize;
     if (fsm->archiveSize)
 	*fsm->archiveSize = 0;
     fsm->failedFile = failedFile;
     if (fsm->failedFile)
 	*fsm->failedFile = NULL;
+    /*@=assignexpose@*/
 
     memset(fsm->sufbuf, 0, sizeof(fsm->sufbuf));
     if (fsm->goal == FSM_PKGINSTALL) {
@@ -634,6 +651,7 @@ int fsmMapAttrs(FSM_t fsm)
  */
 static int expandRegular(/*@special@*/ FSM_t fsm)
 	/*@uses fsm->sb @*/
+	/*@modifies fsm, fileSystem @*/
 {
     const char * fmd5sum;
     const struct stat * st = &fsm->sb;
@@ -697,6 +715,7 @@ exit:
  */
 static int writeFile(/*@special@*/ FSM_t fsm, int writeData)
 	/*@uses fsm->path, fsm->opath, fsm->sb, fsm->osb, fsm->cfd @*/
+	/*@modifies fsm, fileSystem @*/
 {
     const char * path = fsm->path;
     const char * opath = fsm->opath;
@@ -804,8 +823,10 @@ static int writeFile(/*@special@*/ FSM_t fsm, int writeData)
 	TFI_t fi = fsmGetFi(fsm);
 	if (ts && fi && ts->notify) {
 	    size_t size = (fdGetCpioPos(fsm->cfd) - pos);
+	    /*@-modunconnomods@*/
 	    (void)ts->notify(fi->h, RPMCALLBACK_INST_PROGRESS, size, size,
 			(fi->ap ? fi->ap->key : NULL), ts->notifyData);
+	    /*@=modunconnomods@*/
 	}
     }
 
@@ -828,6 +849,7 @@ exit:
  */
 static int writeLinkedFile(/*@special@*/ FSM_t fsm)
 	/*@uses fsm->path, fsm->nsuffix, fsm->ix, fsm->li, fsm->failedFile @*/
+	/*@modifies fsm, fileSystem @*/
 {
     const char * path = fsm->path;
     const char * nsuffix = fsm->nsuffix;
@@ -870,6 +892,7 @@ static int writeLinkedFile(/*@special@*/ FSM_t fsm)
  */
 static int fsmMakeLinks(/*@special@*/ FSM_t fsm)
 	/*@uses fsm->path, fsm->opath, fsm->nsuffix, fsm->ix, fsm->li @*/
+	/*@modifies fsm, fileSystem @*/
 {
     const char * path = fsm->path;
     const char * opath = fsm->opath;
@@ -924,6 +947,7 @@ static int fsmMakeLinks(/*@special@*/ FSM_t fsm)
 static int fsmCommitLinks(/*@special@*/ FSM_t fsm)
 	/*@uses fsm->path, fsm->nsuffix, fsm->ix, fsm->sb,
 		fsm->li, fsm->links @*/
+	/*@modifies fsm, fileSystem @*/
 {
     const char * path = fsm->path;
     const char * nsuffix = fsm->nsuffix;
@@ -964,6 +988,7 @@ static int fsmCommitLinks(/*@special@*/ FSM_t fsm)
 /*@-compdef@*/
 static int fsmRmdirs(/*@special@*/ FSM_t fsm)
 	/*@uses fsm->path, fsm->dnlx, fsm->ldn, fsm->rdbuf, fsm->iter @*/
+	/*@modifies fsm, fileSystem @*/
 {
     const char * path = fsm->path;
     void * dnli = dnlInitIterator(fsm, 1);
@@ -994,7 +1019,8 @@ static int fsmRmdirs(/*@special@*/ FSM_t fsm)
 		rc = fsmStage(fsm, FSM_RMDIR);
 		*te = '/';
 	    }
-	    if (rc) break;
+	    if (rc)
+		/*@innerbreak@*/ break;
 	    te--;
 	} while ((te - dn) > fsm->dnlx[dc]);
     }
@@ -1015,6 +1041,7 @@ static int fsmMkdirs(/*@special@*/ FSM_t fsm)
 	/*@uses fsm->path, fsm->sb, fsm->osb, fsm->rdbuf, fsm->iter,
 		fsm->ldn, fsm->ldnlen, fsm->ldnalloc @*/
 	/*@defines fsm->dnlx, fsm->ldn @*/
+	/*@modifies fsm, fileSystem @*/
 {
     struct stat * st = &fsm->sb;
     struct stat * ost = &fsm->osb;
@@ -1089,7 +1116,8 @@ static int fsmMkdirs(/*@special@*/ FSM_t fsm)
 			fsm->path, (unsigned)(st->st_mode & 07777));
 		*te = '/';
 	    }
-	    if (rc) break;
+	    if (rc)
+		/*@innerbreak@*/ break;
 	}
 	if (rc) break;
 
@@ -1165,28 +1193,28 @@ int fsmStage(FSM_t fsm, fileStage stage)
 	    /* Exit on end-of-payload. */
 	    if (rc == CPIOERR_HDR_TRAILER) {
 		rc = 0;
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
 	    /* Exit on error. */
 	    if (rc) {
 		fsm->postpone = 1;
 		(void) fsmStage(fsm, FSM_UNDO);
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
 	    /* Extract file from archive. */
 	    rc = fsmStage(fsm, FSM_PROCESS);
 	    if (rc) {
 		(void) fsmStage(fsm, FSM_UNDO);
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
 	    /* Notify on success. */
 	    (void) fsmStage(fsm, FSM_NOTIFY);
 
 	    if (fsmStage(fsm, FSM_FINI))
-		break;
+		/*@loopbreak@*/ break;
 	}
 	break;
     case FSM_PKGERASE:
@@ -1198,12 +1226,12 @@ int fsmStage(FSM_t fsm, fileStage stage)
 	    /* Exit on end-of-payload. */
 	    if (rc == CPIOERR_HDR_TRAILER) {
 		rc = 0;
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
 	    /* Rename/erase next item. */
 	    if (fsmStage(fsm, FSM_FINI))
-		break;
+		/*@loopbreak@*/ break;
 	}
 	break;
     case FSM_PKGBUILD:
@@ -1214,25 +1242,25 @@ int fsmStage(FSM_t fsm, fileStage stage)
 	    /* Exit on end-of-payload. */
 	    if (rc == CPIOERR_HDR_TRAILER) {
 		rc = 0;
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
 	    /* Exit on error. */
 	    if (rc) {
 		fsm->postpone = 1;
 		(void) fsmStage(fsm, FSM_UNDO);
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
 	    /* Copy file into archive. */
 	    rc = fsmStage(fsm, FSM_PROCESS);
 	    if (rc) {
 		(void) fsmStage(fsm, FSM_UNDO);
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
 	    if (fsmStage(fsm, FSM_FINI))
-		break;
+		/*@loopbreak@*/ break;
 	}
 
 	if (!rc)
@@ -1339,8 +1367,10 @@ int fsmStage(FSM_t fsm, fileStage stage)
 
 	fsm->postpone = XFA_SKIPPING(fsm->action);
 	if (fsm->goal == FSM_PKGINSTALL || fsm->goal == FSM_PKGBUILD) {
+	    /*@-evalorder@*/
 	    if (!S_ISDIR(st->st_mode) && st->st_nlink > 1)
 		fsm->postpone = saveHardLink(fsm);
+	    /*@=evalorder@*/
 	}
 	break;
     case FSM_PRE:
@@ -1369,7 +1399,8 @@ int fsmStage(FSM_t fsm, fileStage stage)
 		if (rc) break;	/* W2DO? */
 
 		for (li = fsm->links, prev = NULL; li; prev = li, li = li->next)
-		     if (li == fsm->li) break;
+		     if (li == fsm->li)
+			/*@loopbreak@*/ break;
 
 		if (prev == NULL)
 		    fsm->links = fsm->li->next;
@@ -1632,7 +1663,7 @@ int fsmStage(FSM_t fsm, fileStage stage)
 			    fsm->path = NULL;
 			}
 		    }
-		    break;
+		    /*@loopbreak@*/ break;
 		}
 	    }
 	    if (fsm->goal == FSM_PKGBUILD) {
@@ -1844,7 +1875,8 @@ int fsmStage(FSM_t fsm, fileStage stage)
 	for (left = st->st_size; left > 0; left -= fsm->rdnb) {
 	    fsm->wrlen = (left > fsm->wrsize ? fsm->wrsize : left);
 	    rc = fsmStage(fsm, FSM_DREAD);
-	    if (rc) break;
+	    if (rc)
+		/*@loopbreak@*/ break;
 	}
 	break;
     case FSM_POS:
diff --git a/lib/fsm.h b/lib/fsm.h
index b24843716..1fac3463f 100644
--- a/lib/fsm.h
+++ b/lib/fsm.h
@@ -173,28 +173,30 @@ extern "C" {
  * @param a		file stage
  * @return		formatted string
  */
-/*@observer@*/ const char *const fileStageString(fileStage a);
+/*@observer@*/ const char *const fileStageString(fileStage a)	/*@*/;
 
 /**
  * Return formatted string representation of file disposition.
  * @param a		file dispostion
  * @return		formatted string
  */
-/*@observer@*/ const char *const fileActionString(fileAction a);
+/*@observer@*/ const char *const fileActionString(fileAction a)	/*@*/;
 /*@=exportlocal@*/
 
 /**
  * Create file state machine instance.
  * @return		file state machine data
  */
-/*@only@*/ FSM_t newFSM(void);
+/*@only@*/ FSM_t newFSM(void)
+	/*@*/;
 
 /**
  * Destroy file state machine instance.
  * @param fsm		file state machine data
  * @return		always NULL
  */
-/*@null@*/ FSM_t freeFSM(/*@only@*/ /*@null@*/ FSM_t fsm);
+/*@null@*/ FSM_t freeFSM(/*@only@*/ /*@null@*/ FSM_t fsm)
+	/*@modifies fsm @*/;
 
 /**
  * Load external data into file state machine.
@@ -212,7 +214,7 @@ int fsmSetup(FSM_t fsm, fileStage goal,
 		FD_t cfd,
 		/*@out@*/ unsigned int * archiveSize,
 		/*@out@*/ const char ** failedFile)
-	/*@modifies fsm, *archiveSize, *failedFile  @*/;
+	/*@modifies fsm, *archiveSize, *failedFile, fileSystem  @*/;
 
 /**
  * Clean file state machine.
@@ -261,7 +263,7 @@ int fsmMapAttrs(FSM_t fsm)
  * @return		0 on success
  */
 int fsmStage(/*@partial@*/ FSM_t fsm, fileStage stage)
-	/*@modifies fsm @*/;
+	/*@modifies fsm, fileSystem @*/;
 
 #ifdef __cplusplus
 }
diff --git a/lib/header.c b/lib/header.c
index 01ab075d3..656cbc938 100644
--- a/lib/header.c
+++ b/lib/header.c
@@ -172,7 +172,7 @@ _free(/*@only@*/ /*@null@*/ const void * p) /*@modifies *p @*/
  */
 /*@mayexit@*/
 static int dataLength(int_32 type, const void * p, int_32 count, int onDisk)
-	/*@*/
+	/*@modifies fileSystem @*/
 {
     int length = 0;
 
@@ -1145,7 +1145,7 @@ void headerDump(Header h, FILE *f, int flags,
 			ct++;
 			dp += sizeof(int_8);
 			if (! (ct % 8)) {
-			    break;
+			    /*@loopbreak@*/ break;
 			}
 		    }
 		    fprintf(f, "\n");
@@ -1320,19 +1320,19 @@ static int headerMatchLocale(const char *td, const char *l, const char *le)
 
     /* Next, try stripping optional dialect and matching.  */
     for (fe = l; fe < le && *fe != '@'; fe++)
-	;
+	{};
     if (fe < le && !strncmp(td, l, (fe - l)))
 	return 1;
 
     /* Next, try stripping optional codeset and matching.  */
     for (fe = l; fe < le && *fe != '.'; fe++)
-	;
+	{};
     if (fe < le && !strncmp(td, l, (fe - l)))
 	return 1;
 
     /* Finally, try stripping optional country code and matching. */
     for (fe = l; fe < le && *fe != '_'; fe++)
-	;
+	{};
     if (fe < le && !strncmp(td, l, (fe - l)))
 	return 1;
 
@@ -1356,10 +1356,10 @@ headerFindI18NString(Header h, struct indexEntry *entry)
 	(lang = getenv("LC_ALL")) == NULL &&
         (lang = getenv("LC_MESSAGES")) == NULL &&
 	(lang = getenv("LANG")) == NULL)
-	    return entry->data;
+	    /*@-retalias@*/ return entry->data; /*@=retalias@*/
     
     if ((table = findEntry(h, HEADER_I18NTABLE, RPM_STRING_ARRAY_TYPE)) == NULL)
-	return entry->data;
+	/*@-retalias@*/ return entry->data; /*@=retalias@*/
 
     for (l = lang; *l != '\0'; l = le) {
 	const char *td;
@@ -1371,7 +1371,7 @@ headerFindI18NString(Header h, struct indexEntry *entry)
 	if (*l == '\0')
 	    break;
 	for (le = l; *le && *le != ':'; le++)	/* find end of this locale */
-	    ;
+	    {};
 
 	/* For each entry in the header ... */
 	for (langNum = 0, td = table->data, ed = entry->data;
@@ -1384,7 +1384,7 @@ headerFindI18NString(Header h, struct indexEntry *entry)
 	}
     }
 
-    return entry->data;
+    /*@-retalias@*/ return entry->data; /*@=retalias@*/
 }
 
 /**
@@ -1619,8 +1619,12 @@ int headerAddEntry(Header h, int_32 tag, int_32 type, const void *p, int_32 c)
     struct indexEntry *entry;
 
     if (c <= 0) {
+#ifdef	DYING
 	fprintf(stderr, _("Bad count for headerAddEntry(): %d\n"), (int) c);
 	exit(EXIT_FAILURE);
+#else
+	return 0;
+#endif
 	/*@notreached@*/
     }
 
@@ -1685,13 +1689,13 @@ int headerAddI18NString(Header h, int_32 tag, const char * string, const char *
 	const char * charArray[2];
 	int count = 0;
 	if (!lang || (lang[0] == 'C' && lang[1] == '\0')) {
-	    /*@-observertrans@*/
+	    /*@-observertrans -readonlytrans@*/
 	    charArray[count++] = "C";
-	    /*@=observertrans@*/
+	    /*@=observertrans =readonlytrans@*/
 	} else {
-	    /*@-observertrans@*/
+	    /*@-observertrans -readonlytrans@*/
 	    charArray[count++] = "C";
-	    /*@=observertrans@*/
+	    /*@=observertrans =readonlytrans@*/
 	    charArray[count++] = lang;
 	}
 	if (!headerAddEntry(h, HEADER_I18NTABLE, RPM_STRING_ARRAY_TYPE, 
@@ -1985,6 +1989,8 @@ static void findTag(char * name, const struct headerTagTableEntry * tags,
     /* Search extensions first to permit overriding header tags. */
     ext = extensions;
     while (ext->type != HEADER_EXT_LAST) {
+	if (ext->name == NULL)		/* XXX programmer error. */
+	    continue;
 	if (ext->type == HEADER_EXT_TAG && !xstrcasecmp(ext->name, tagname))
 	    break;
 
@@ -2001,7 +2007,8 @@ static void findTag(char * name, const struct headerTagTableEntry * tags,
 
     /* Search header tags. */
     for (entry = tags; entry->name; entry++)
-	if (!xstrcasecmp(entry->name, tagname)) break;
+	if (entry->name && !xstrcasecmp(entry->name, tagname))
+	    break;
 
     if (entry->name) {
 	*tagMatch = entry;
@@ -2091,9 +2098,9 @@ static int parseFormat(char * str, const struct headerTagTableEntry * tags,
 	    chptr = start;
 	    while (*chptr && *chptr != '{' && *chptr != '%') chptr++;
 	    if (!*chptr || *chptr == '%') {
-		/*@-observertrans@*/
+		/*@-observertrans -readonlytrans@*/
 		if (errmsg) *errmsg = _("missing { after %");
-		/*@=observertrans@*/
+		/*@=observertrans =readonlytrans@*/
 		format = freeFormat(format, numTokens);
 		return 1;
 	    }
@@ -2121,9 +2128,9 @@ static int parseFormat(char * str, const struct headerTagTableEntry * tags,
 	    next = start;
 	    while (*next && *next != '}') next++;
 	    if (!*next) {
-		/*@-observertrans@*/
+		/*@-observertrans -readonlytrans@*/
 		if (errmsg) *errmsg = _("missing } after %{");
-		/*@=observertrans@*/
+		/*@=observertrans =readonlytrans@*/
 		format = freeFormat(format, numTokens);
 		return 1;
 	    }
@@ -2135,9 +2142,9 @@ static int parseFormat(char * str, const struct headerTagTableEntry * tags,
 	    if (*chptr != '\0') {
 		*chptr++ = '\0';
 		if (!*chptr) {
-		    /*@-observertrans@*/
+		    /*@-observertrans -readonlytrans@*/
 		    if (errmsg) *errmsg = _("empty tag format");
-		    /*@=observertrans@*/
+		    /*@=observertrans =readonlytrans@*/
 		    format = freeFormat(format, numTokens);
 		    return 1;
 		}
@@ -2147,9 +2154,9 @@ static int parseFormat(char * str, const struct headerTagTableEntry * tags,
 	    }
 	    
 	    if (!*start) {
-		/*@-observertrans@*/
+		/*@-observertrans -readonlytrans@*/
 		if (errmsg) *errmsg = _("empty tag name");
-		/*@=observertrans@*/
+		/*@=observertrans =readonlytrans@*/
 		format = freeFormat(format, numTokens);
 		return 1;
 	    }
@@ -2164,9 +2171,9 @@ static int parseFormat(char * str, const struct headerTagTableEntry * tags,
 		format[currToken].u.tag.ext = ext->u.tagFunction;
 		format[currToken].u.tag.extNum = ext - extensions;
 	    } else {
-		/*@-observertrans@*/
+		/*@-observertrans -readonlytrans@*/
 		if (errmsg) *errmsg = _("unknown tag");
-		/*@=observertrans@*/
+		/*@=observertrans =readonlytrans@*/
 		format = freeFormat(format, numTokens);
 		return 1;
 	    }
@@ -2191,9 +2198,9 @@ static int parseFormat(char * str, const struct headerTagTableEntry * tags,
 	    }
 
 	    if (!start) {
-		/*@-observertrans@*/
+		/*@-observertrans -readonlytrans@*/
 		if (errmsg) *errmsg = _("] expected at end of array");
-		/*@=observertrans@*/
+		/*@=observertrans =readonlytrans@*/
 		format = freeFormat(format, numTokens);
 		return 1;
 	    }
@@ -2209,13 +2216,13 @@ static int parseFormat(char * str, const struct headerTagTableEntry * tags,
 	    if ((*start == ']' && state != PARSER_IN_ARRAY) ||
 	        (*start == '}' && state != PARSER_IN_EXPR)) {
 		if (*start == ']') {
-		    /*@-observertrans@*/
+		    /*@-observertrans -readonlytrans@*/
 		    if (errmsg) *errmsg = _("unexpected ]");
-		    /*@=observertrans@*/
+		    /*@=observertrans =readonlytrans@*/
 		} else {
-		    /*@-observertrans@*/
+		    /*@-observertrans -readonlytrans@*/
 		    if (errmsg) *errmsg = _("unexpected }");
-		    /*@=observertrans@*/
+		    /*@=observertrans =readonlytrans@*/
 		}
 		format = freeFormat(format, numTokens);
 		return 1;
@@ -2278,18 +2285,18 @@ static int parseExpression(struct sprintfToken * token, char * str,
     while (*chptr && *chptr != '?') chptr++;
 
     if (*chptr != '?') {
-	/*@-observertrans@*/
+	/*@-observertrans -readonlytrans@*/
 	if (errmsg) *errmsg = _("? expected in expression");
-	/*@=observertrans@*/
+	/*@=observertrans =readonlytrans@*/
 	return 1;
     }
 
     *chptr++ = '\0';;
 
     if (*chptr != '{') {
-	/*@-observertrans@*/
+	/*@-observertrans -readonlytrans@*/
 	if (errmsg) *errmsg = _("{ expected after ? in expression");
-	/*@=observertrans@*/
+	/*@=observertrans =readonlytrans@*/
 	return 1;
     }
 
@@ -2300,9 +2307,9 @@ static int parseExpression(struct sprintfToken * token, char * str,
 	return 1;
 
     if (!*end) {
-	/*@-observertrans@*/
+	/*@-observertrans -readonlytrans@*/
 	if (errmsg) *errmsg = _("} expected in expression");
-	/*@=observertrans@*/
+	/*@=observertrans =readonlytrans@*/
 	token->u.cond.ifFormat =
 		freeFormat(token->u.cond.ifFormat, token->u.cond.numIfTokens);
 	return 1;
@@ -2310,9 +2317,9 @@ static int parseExpression(struct sprintfToken * token, char * str,
 
     chptr = end;
     if (*chptr != ':' && *chptr != '|') {
-	/*@-observertrans@*/
+	/*@-observertrans -readonlytrans@*/
 	if (errmsg) *errmsg = _(": expected following ? subexpression");
-	/*@=observertrans@*/
+	/*@=observertrans =readonlytrans@*/
 	token->u.cond.ifFormat =
 		freeFormat(token->u.cond.ifFormat, token->u.cond.numIfTokens);
 	return 1;
@@ -2327,9 +2334,9 @@ static int parseExpression(struct sprintfToken * token, char * str,
 	chptr++;
 
 	if (*chptr != '{') {
-	    /*@-observertrans@*/
+	    /*@-observertrans -readonlytrans@*/
 	    if (errmsg) *errmsg = _("{ expected after : in expression");
-	    /*@=observertrans@*/
+	    /*@=observertrans =readonlytrans@*/
 	    token->u.cond.ifFormat =
 		freeFormat(token->u.cond.ifFormat, token->u.cond.numIfTokens);
 	    return 1;
@@ -2342,9 +2349,9 @@ static int parseExpression(struct sprintfToken * token, char * str,
 			errmsg)) 
 	    return 1;
 	if (!*end) {
-	    /*@-observertrans@*/
+	    /*@-observertrans -readonlytrans@*/
 	    if (errmsg) *errmsg = _("} expected in expression");
-	    /*@=observertrans@*/
+	    /*@=observertrans =readonlytrans@*/
 	    token->u.cond.ifFormat =
 		freeFormat(token->u.cond.ifFormat, token->u.cond.numIfTokens);
 	    return 1;
@@ -2352,9 +2359,9 @@ static int parseExpression(struct sprintfToken * token, char * str,
 
 	chptr = end;
 	if (*chptr != '|') {
-	    /*@-observertrans@*/
+	    /*@-observertrans -readonlytrans@*/
 	    if (errmsg) *errmsg = _("| expected at end of expression");
-	    /*@=observertrans@*/
+	    /*@=observertrans =readonlytrans@*/
 	    token->u.cond.ifFormat =
 		freeFormat(token->u.cond.ifFormat, token->u.cond.numIfTokens);
 	    token->u.cond.elseFormat =
@@ -2457,8 +2464,10 @@ static char * formatValue(struct sprintfTag * tag, Header h,
     if (tag->type) {
 	ext = extensions;
 	while (ext->type != HEADER_EXT_LAST) {
-	    if (ext->type == HEADER_EXT_FORMAT && 
-		!strcmp(ext->name, tag->type)) {
+	    if (ext->name == NULL)		/* XXX programmer error. */
+		continue;
+	    if (ext->type == HEADER_EXT_FORMAT && !strcmp(ext->name, tag->type))
+	    {
 		tagtype = ext->u.formatFunction;
 		break;
 	    }
@@ -2583,6 +2592,7 @@ static const char * singleSprintf(Header h, struct sprintfToken * token,
 	*val = '\0';
 	len = 0;
 
+	if (condFormat)
 	for (i = 0; i < condNumFormats; i++) {
 	    thisItem = singleSprintf(h, condFormat + i, 
 				     extensions, extCache, element);
@@ -2618,7 +2628,7 @@ static const char * singleSprintf(Header h, struct sprintfToken * token,
 		    continue;
 		val = headerFreeData(val, type);
 	    } 
-	    break;
+	    /*@loopbreak@*/ break;
 	}
 
 	if (numElements == -1) {
diff --git a/lib/header.h b/lib/header.h
index 4df0f825d..deb15e3e2 100644
--- a/lib/header.h
+++ b/lib/header.h
@@ -106,17 +106,17 @@ typedef /*@abstract@*/ struct headerIteratorS *HeaderIterator;
  * Associate tag names with numeric values.
  */
 struct headerTagTableEntry {
-    const char * name;		/*!< Tag name. */
-    int val;			/*!< Tag numeric value. */
+/*@observer@*/ /*@null@*/ const char * name;	/*!< Tag name. */
+    int val;					/*!< Tag numeric value. */
 };
 
 /** \ingroup header
  */
 enum headerSprintfExtenstionType {
-	HEADER_EXT_LAST = 0,	/*!< End of extension chain. */
-	HEADER_EXT_FORMAT,	/*!< headerTagFormatFunction() extension */
-	HEADER_EXT_MORE,	/*!< Chain to next table. */
-	HEADER_EXT_TAG		/*!< headerTagTagFunction() extension */
+    HEADER_EXT_LAST = 0,	/*!< End of extension chain. */
+    HEADER_EXT_FORMAT,		/*!< headerTagFormatFunction() extension */
+    HEADER_EXT_MORE,		/*!< Chain to next table. */
+    HEADER_EXT_TAG		/*!< headerTagTagFunction() extension */
 };
 
 /** \ingroup header
@@ -145,15 +145,18 @@ typedef /*only@*/ char * (*headerTagFormatFunction)(int_32 type,
  * @retval freedata	address of data-was-malloc'ed indicator
  * @return		0 on success
  */
-typedef int (*headerTagTagFunction)(Header h, int_32 * type, const void ** data,
-				       int_32 * count, int * freeData);
+typedef int (*headerTagTagFunction) (Header h,
+		/*@null@*/ /*@out@*/ int_32 * type,
+		/*@null@*/ /*@out@*/ const void ** data,
+		/*@null@*/ /*@out@*/ int_32 * count,
+		/*@null@*/ /*@out@*/ int * freeData);
 
 /** \ingroup header
  * Define header tag output formats.
  */
 struct headerSprintfExtension {
     enum headerSprintfExtenstionType type;	/*!< Type of extension. */
-    char * name;				/*!< Name of extension. */
+/*@observer@*/ /*@null@*/ const char * name;	/*!< Name of extension. */
     union {
 /*@unused@*/ void * generic;			/*!< Private extension. */
 	headerTagFormatFunction formatFunction; /*!< HEADER_EXT_TAG extension. */
@@ -184,7 +187,7 @@ enum hMagic {
  * @return		header (or NULL on error)
  */
 /*@null@*/ Header headerRead(FD_t fd, enum hMagic magicp)
-	/*@modifies fd @*/;
+	/*@modifies fd, fileSystem @*/;
 
 /** \ingroup header
  * Write (with unload) header to file handle.
@@ -194,7 +197,7 @@ enum hMagic {
  * @return		0 on success, 1 on error
  */
 int headerWrite(FD_t fd, /*@null@*/ Header h, enum hMagic magicp)
-	/*@modifies fd, h @*/;
+	/*@modifies fd, h, fileSystem @*/;
 
 /** \ingroup header
  * Return size of on-disk header representation in bytes.
diff --git a/lib/manifest.h b/lib/manifest.h
index 5c5c51599..6ca4429c9 100644
--- a/lib/manifest.h
+++ b/lib/manifest.h
@@ -25,7 +25,7 @@ char * rpmPermsString(int mode)
  * @retval argvPtr		args themselves
  */
 int rpmReadPackageManifest(FD_t fd, int * argcPtr, const char *** argvPtr)
-	/*@modifies fd, *argcPtr, *argvPtr @*/;
+	/*@modifies fd, *argcPtr, *argvPtr, fileSystem @*/;
 
 #ifdef __cplusplus
 }
diff --git a/lib/md5.h b/lib/md5.h
index 98fb4d0e7..afaef6993 100644
--- a/lib/md5.h
+++ b/lib/md5.h
@@ -37,7 +37,8 @@ extern "C" {
  * @param ctx	MD5 private data
  * @param brokenEndian	calculate broken MD5 sum?
  */
-void rpmMD5Init( /*@out@*/ struct MD5Context * ctx, int brokenEndian);
+void rpmMD5Init( /*@out@*/ struct MD5Context * ctx, int brokenEndian)
+	/*@modifies *ctx @*/;
 
 /**
  * Update context to reflect the concatenation of another buffer full.
@@ -47,14 +48,16 @@ void rpmMD5Init( /*@out@*/ struct MD5Context * ctx, int brokenEndian);
  * @param len		no. bytes of data
  */
 void rpmMD5Update(struct MD5Context * ctx, unsigned char const *buf,
-	       unsigned len);
+	       unsigned len)
+	/*@modifies ctx @*/;
 /**
  * Return MD5 digest, and reset context.
  * @retval		MD5 digest
  * @param ctx		MD5 private data
  */
 /*@-fixedformalarray@*/
-void rpmMD5Final(unsigned char digest[16], struct MD5Context * ctx);
+void rpmMD5Final(unsigned char digest[16], struct MD5Context * ctx)
+	/*@modifies digest, ctx @*/;
 /*@=fixedformalarray@*/
 
 /**
@@ -65,7 +68,8 @@ void rpmMD5Final(unsigned char digest[16], struct MD5Context * ctx);
  * @param in		next block of data to add
  */
 /*@-fixedformalarray -exportlocal@*/
-void rpmMD5Transform(uint32 buf[4], uint32 const in[16]);
+void rpmMD5Transform(uint32 buf[4], uint32 const in[16])
+	/*@modifies *buf @*/;
 /*@=fixedformalarray =exportlocal@*/
 
 /**
@@ -74,7 +78,8 @@ void rpmMD5Transform(uint32 buf[4], uint32 const in[16]);
  * @retval digest	MD5 digest
  * @return		0 on success, 1 on error
  */
-int mdfile(const char *fn, unsigned char *digest);
+int mdfile(const char * fn, unsigned char * digest)
+	/*@modifies digest @*/;
 
 /**
  * Return MD5 sum of file as binary data.
@@ -82,7 +87,8 @@ int mdfile(const char *fn, unsigned char *digest);
  * @retval bindigest	MD5 digest
  * @return		0 on success, 1 on error
  */
-int mdbinfile(const char *fn, unsigned char *bindigest);
+int mdbinfile(const char * fn, unsigned char * bindigest)
+	/*@modifies *bindigest @*/;
 
 /* These assume a little endian machine and return incorrect results!
    They are here for compatibility with old (broken) versions of RPM */
@@ -94,7 +100,8 @@ int mdbinfile(const char *fn, unsigned char *bindigest);
  * @retval digest	MD5 digest
  * @return		0 on success, 1 on error
  */
-int mdfileBroken(const char *fn, unsigned char *digest);
+int mdfileBroken(const char * fn, unsigned char * digest)
+	/*@modifies *digest @*/;
 
 /**
  * Return (broken!) MD5 sum of file as binary data.
@@ -103,7 +110,8 @@ int mdfileBroken(const char *fn, unsigned char *digest);
  * @retval bindigest	MD5 digest
  * @return		0 on success, 1 on error
  */
-int mdbinfileBroken(const char *fn, unsigned char *bindigest);
+int mdbinfileBroken(const char * fn, unsigned char * bindigest)
+	/*@modifies *bindigest @*/;
 
 #ifdef __cplusplus
 }
diff --git a/lib/misc.c b/lib/misc.c
index a0d2fee81..e9693e69d 100644
--- a/lib/misc.c
+++ b/lib/misc.c
@@ -17,7 +17,8 @@ static int _debug = 0;
 /*@access FD_t@*/		/* XXX compared with NULL */
 
 /*@-exportheadervar@*/
-/*@unused@*/ char * RPMVERSION = VERSION; /* just to put a marker in librpm.a */
+/* just to put a marker in librpm.a */
+/*@unused@*/ /*@observer@*/ char * RPMVERSION = VERSION;
 /*@=exportheadervar@*/
 
 char ** splitString(const char * str, int length, char sep)
@@ -414,6 +415,8 @@ void compressFilelist(Header h)
 
     if (!hge(h, RPMTAG_OLDFILENAMES, &fnt, (void **) &fileNames, &count))
 	return;		/* no file list */
+    if (fileNames == NULL || count <= 0)
+	return;
 
     dirNames = alloca(sizeof(*dirNames) * count);	/* worst case */
     baseNames = alloca(sizeof(*dirNames) * count);
@@ -432,10 +435,14 @@ void compressFilelist(Header h)
 
     for (i = 0; i < count; i++) {
 	const char ** needle;
-	char *baseName = strrchr(fileNames[i], '/') + 1;
 	char savechar;
-	int len = baseName - fileNames[i];
+	char * baseName;
+	int len;
 
+	if (fileNames[i] == NULL)	/* XXX can't happen */
+	    continue;
+	baseName = strrchr(fileNames[i], '/') + 1;
+	len = baseName - fileNames[i];
 	needle = dirNames;
 	savechar = *baseName;
 	*baseName = '\0';
@@ -454,12 +461,14 @@ void compressFilelist(Header h)
     }
 
 exit:
-    (void) headerAddEntry(h, RPMTAG_DIRINDEXES, RPM_INT32_TYPE,
+    if (count > 0) {
+	(void) headerAddEntry(h, RPMTAG_DIRINDEXES, RPM_INT32_TYPE,
 			dirIndexes, count);
-    (void) headerAddEntry(h, RPMTAG_BASENAMES, RPM_STRING_ARRAY_TYPE,
+	(void) headerAddEntry(h, RPMTAG_BASENAMES, RPM_STRING_ARRAY_TYPE,
 			baseNames, count);
-    (void) headerAddEntry(h, RPMTAG_DIRNAMES, RPM_STRING_ARRAY_TYPE,
+	(void) headerAddEntry(h, RPMTAG_DIRNAMES, RPM_STRING_ARRAY_TYPE,
 			dirNames, dirIndex + 1);
+    }
 
     fileNames = headerFreeData(fileNames, fnt);
 
diff --git a/lib/misc.h b/lib/misc.h
index b3d7fad0f..2e909ddcd 100644
--- a/lib/misc.h
+++ b/lib/misc.h
@@ -104,7 +104,7 @@ int myGlobPatternP (const char *patternURL)	/*@*/;
  */
 int rpmGlob(const char * patterns, /*@out@*/ int * argcPtr,
 	/*@out@*/ const char *** argvPtr)
-		/*@modifies *argcPtr, *argvPtr @*/;
+		/*@modifies *argcPtr, *argvPtr, fileSystem @*/;
 
 /**
  */
diff --git a/lib/problems.c b/lib/problems.c
index b7e578dee..95e4946dc 100644
--- a/lib/problems.c
+++ b/lib/problems.c
@@ -69,7 +69,7 @@ void printDepProblems(FILE * fp,
 	/* Filter already displayed problems. */
 	for (j = 0; j < i; j++) {
 	    if (!sameProblem(conflicts + i, conflicts + j))
-		break;
+		/*@innerbreak@*/ break;
 	}
 	if (j < i)
 	    continue;
@@ -101,7 +101,9 @@ static inline int snprintf(char * buf, int nb, const char * fmt, ...)
     va_list ap;
     int rc;
     va_start(ap, fmt);
+    /*@-modunconnomods@*/
     rc = vsnprintf(buf, nb, fmt, ap);
+    /*@=modunconnomods@*/
     va_end(ap);
     return rc;
 }
diff --git a/lib/psm.c b/lib/psm.c
index 420da51d3..d3c83282c 100644
--- a/lib/psm.c
+++ b/lib/psm.c
@@ -220,7 +220,8 @@ void freeFi(TFI_t fi)
     /*@=nullstate@*/
 }
 
-/*@observer@*/ const char *const fiTypeString(TFI_t fi) {
+/*@observer@*/ const char *const fiTypeString(TFI_t fi)
+{
     switch(fi->type) {
     case TR_ADDED:	return " install";
     case TR_REMOVED:	return "   erase";
@@ -234,16 +235,16 @@ void freeFi(TFI_t fi)
  * @todo Should other macros be added from header when installing a package?
  */
 static struct tagMacro {
-	const char *	macroname;	/*!< Macro name to define. */
-	int		tag;		/*!< Header tag to use for value. */
+/*@observer@*/ /*@null@*/ const char *	macroname; /*!< Macro name to define. */
+    int		tag;		/*!< Header tag to use for value. */
 } tagMacros[] = {
-	{ "name",	RPMTAG_NAME },
-	{ "version",	RPMTAG_VERSION },
-	{ "release",	RPMTAG_RELEASE },
+    { "name",		RPMTAG_NAME },
+    { "version",	RPMTAG_VERSION },
+    { "release",	RPMTAG_RELEASE },
 #if 0
-	{ "epoch",	RPMTAG_EPOCH },
+    { "epoch",		RPMTAG_EPOCH },
 #endif
-	{ NULL, 0 }
+    { NULL, 0 }
 };
 
 /**
@@ -252,6 +253,7 @@ static struct tagMacro {
  * @return		0 always
  */
 static int rpmInstallLoadMacros(TFI_t fi, Header h)
+	/*@modifies internalState @*/
 {
     HGE_t hge = (HGE_t)fi->hge;
     struct tagMacro *tagm;
@@ -286,6 +288,7 @@ static int rpmInstallLoadMacros(TFI_t fi, Header h)
  * @return		0 on success, 1 on failure
  */
 static int mergeFiles(TFI_t fi, Header h, Header newH)
+	/*@modifies h @*/
 {
     HGE_t hge = (HGE_t)fi->hge;
     HFD_t hfd = (fi->hfd ? fi->hfd : headerFreeData);
@@ -393,7 +396,7 @@ static int mergeFiles(TFI_t fi, Header h, Header newH)
 	    continue;
 	for (j = 0; j < dirCount; j++)
 	    if (!strcmp(dirNames[j], newDirNames[newDirIndexes[i]]))
-		break;
+		/*@innerbreak@*/ break;
 	if (j == dirCount)
 	    dirNames[dirCount++] = newDirNames[newDirIndexes[i]];
 	((int_32 *) newdata)[k++] = j;
@@ -431,7 +434,7 @@ static int mergeFiles(TFI_t fi, Header h, Header newH)
 			   (Flags[k] & RPMSENSE_SENSEMASK))
 		    {
 			newNames[j] = NULL;
-			break;
+			/*@innerbreak@*/ break;
 		    }
 	}
 	for (j = 0, k = 0; j < newCount; j++) {
@@ -465,6 +468,7 @@ static int mergeFiles(TFI_t fi, Header h, Header newH)
  * @return		0 always
  */
 static int markReplacedFiles(PSM_t psm)
+	/*@modifies psm, fileSystem @*/
 {
     const rpmTransactionSet ts = psm->ts;
     TFI_t fi = psm->fi;
@@ -538,6 +542,7 @@ static int markReplacedFiles(PSM_t psm)
 /**
  */
 static rpmRC chkdir (const char * dpath, const char * dname)
+	/*@modifies fileSystem @*/
 {
     struct stat st;
     int rc;
@@ -592,11 +597,13 @@ rpmRC rpmInstallSourcePackage(const char * rootDir, FD_t fd,
     int i;
 
     ts->notify = notify;
-    /*@-temptrans@*/
+    /*@-temptrans -assignexpose@*/
     ts->notifyData = notifyData;
-    /*@=temptrans@*/
+    /*@=temptrans =assignexpose@*/
 
+    /*@-mustmod@*/	/* LCL: segfault */
     rc = rpmReadPackageHeader(fd, &h, &isSource, NULL, NULL);
+    /*@=mustmod@*/
     if (rc)
 	goto exit;
 
@@ -744,7 +751,8 @@ exit:
     return rc;
 }
 
-static char * SCRIPT_PATH = "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin";
+/*@observer@*/ static char * SCRIPT_PATH =
+	"PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin";
 
 /**
  * Return scriptlet name from tag.
@@ -752,6 +760,7 @@ static char * SCRIPT_PATH = "PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/X11R6/bin";
  * @return		name of scriptlet
  */
 static /*@observer@*/ const char * const tag2sln(int tag)
+	/*@*/
 {
     switch (tag) {
     case RPMTAG_PREIN:		return "%pre";
@@ -785,6 +794,7 @@ static int runScript(PSM_t psm, Header h,
 		const char * sln,
 		int progArgc, const char ** progArgv, 
 		const char * script, int arg1, int arg2)
+	/*@modifies psm, fileSystem @*/
 {
     const rpmTransactionSet ts = psm->ts;
     TFI_t fi = psm->fi;
@@ -921,7 +931,9 @@ static int runScript(PSM_t psm, Header h,
 	    if (ipath && ipath[5] != '%')
 		path = ipath;
 	    (void) doputenv(path);
+	    /*@-modobserver@*/
 	    ipath = _free(ipath);
+	    /*@=modobserver@*/
 	}
 
 	for (i = 0; i < numPrefixes; i++) {
@@ -990,6 +1002,7 @@ static int runScript(PSM_t psm, Header h,
  * @return		rpmRC return code
  */
 static rpmRC runInstScript(PSM_t psm)
+	/*@modifies psm, fileSystem @*/
 {
     TFI_t fi = psm->fi;
     HGE_t hge = fi->hge;
@@ -1033,6 +1046,7 @@ static rpmRC runInstScript(PSM_t psm)
  */
 static int handleOneTrigger(PSM_t psm, Header sourceH, Header triggeredH,
 			int arg2, unsigned char * triggersAlreadyRun)
+	/*@modifies psm, *triggersAlreadyRun, fileSystem @*/
 {
     const rpmTransactionSet ts = psm->ts;
     TFI_t fi = psm->fi;
@@ -1143,6 +1157,7 @@ static int handleOneTrigger(PSM_t psm, Header sourceH, Header triggeredH,
  * @return		0 on success, 1 on error
  */
 static int runTriggers(PSM_t psm)
+	/*@modifies psm, fileSystem @*/
 {
     const rpmTransactionSet ts = psm->ts;
     TFI_t fi = psm->fi;
@@ -1176,6 +1191,7 @@ static int runTriggers(PSM_t psm)
  * @return		0 on success, 1 on error
  */
 static int runImmedTriggers(PSM_t psm)
+	/*@modifies psm, fileSystem @*/
 {
     const rpmTransactionSet ts = psm->ts;
     TFI_t fi = psm->fi;
@@ -1306,7 +1322,7 @@ assert(psm->mi == NULL);
 		    psm->oh = headerCopy(psm->oh);
 		else
 		    psm->oh = NULL;
-		break;
+		/*@loopbreak@*/ break;
 	    }
 	    psm->mi = rpmdbFreeIterator(psm->mi);
 	    rc = RPMRC_OK;
diff --git a/lib/psm.h b/lib/psm.h
index c85c04c1d..629f038fe 100644
--- a/lib/psm.h
+++ b/lib/psm.h
@@ -190,7 +190,7 @@ void freeFi(TFI_t fi)
  * @return		0 on success
  */
 int psmStage(PSM_t psm, pkgStage stage)
-	/*@modifies psm @*/;
+	/*@modifies psm, fileSystem @*/;
 
 #ifdef __cplusplus
 }
diff --git a/lib/query.c b/lib/query.c
index 712be0eda..34e676da3 100644
--- a/lib/query.c
+++ b/lib/query.c
@@ -431,28 +431,29 @@ printNewSpecfile(Spec spec)
     }
 }
 
-void rpmDisplayQueryTags(FILE * f)
+void rpmDisplayQueryTags(FILE * fp)
 {
     const struct headerTagTableEntry * t;
     int i;
     const struct headerSprintfExtension * ext = rpmHeaderFormats;
 
-    for (i = 0, t = rpmTagTable; i < rpmTagTableSize; i++, t++) {
-	fprintf(f, "%s\n", t->name + 7);
-    }
+    for (i = 0, t = rpmTagTable; i < rpmTagTableSize; i++, t++)
+	if (t->name) fprintf(fp, "%s\n", t->name + 7);
 
-    while (ext->name) {
+    while (ext->name != NULL) {
 	if (ext->type == HEADER_EXT_MORE) {
 	    ext = ext->u.more;
 	    continue;
 	}
 	/* XXX don't print query tags twice. */
 	for (i = 0, t = rpmTagTable; i < rpmTagTableSize; i++, t++) {
+	    if (t->name == NULL)	/* XXX programmer error. */
+		continue;
 	    if (!strcmp(t->name, ext->name))
-	    	break;
+	    	/*@innerbreak@*/ break;
 	}
 	if (i >= rpmTagTableSize && ext->type == HEADER_EXT_TAG)
-	    fprintf(f, "%s\n", ext->name + 7);
+	    fprintf(fp, "%s\n", ext->name + 7);
 	ext++;
     }
 }
@@ -522,22 +523,24 @@ restart:
 			Fstrerror(fd));
 		if (fd) (void) Fclose(fd);
 		retcode = 1;
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
+	    /*@-mustmod@*/	/* LCL: segfault. */
 	    rpmrc = rpmReadPackageHeader(fd, &h, &isSource, NULL, NULL);
+	    /*@=mustmod@*/
 	    (void) Fclose(fd);
 
 	    if (!(rpmrc == RPMRC_OK || rpmrc == RPMRC_BADMAGIC)) {
 		rpmError(RPMERR_QUERY, _("query of %s failed\n"), fileURL);
 		retcode = 1;
-		break;
+		/*@loopbreak@*/ break;
 	    }
 	    if (rpmrc == RPMRC_OK && h == NULL) {
 		rpmError(RPMERR_QUERY,
 			_("old format source packages cannot be queried\n"));
 		retcode = 1;
-		break;
+		/*@loopbreak@*/ break;
 	    }
 
 	    /* Query a package file. */
@@ -554,7 +557,7 @@ restart:
 			Fstrerror(fd));
 		if (fd) (void) Fclose(fd);
 		retcode = 1;
-		break;
+		/*@loopbreak@*/ break;
 	    }
 	    
 	    /* Read list of packages from manifest. */
@@ -570,7 +573,7 @@ restart:
 	    if (retcode == 0)
 		goto restart;
 
-	    break;
+	    /*@loopbreak@*/ break;
 	}
 
 	fileURL = _free(fileURL);
@@ -680,7 +683,8 @@ restart:
 	char * fn;
 
 	for (s = arg; *s != '\0'; s++)
-	    if (!(*s == '.' || *s == '/')) break;
+	    if (!(*s == '.' || *s == '/'))
+		/*@loopbreak@*/ break;
 
 	if (*s == '\0') {
 	    char fnbuf[PATH_MAX];
diff --git a/lib/rpmchecksig.c b/lib/rpmchecksig.c
index 73b57c941..164c71d82 100644
--- a/lib/rpmchecksig.c
+++ b/lib/rpmchecksig.c
@@ -17,6 +17,7 @@
 
 static int manageFile(FD_t *fdp, const char **fnp, int flags,
 		/*@unused@*/ int rc)
+	/*@modifies *fdp, *fnp, fileSystem @*/
 {
     const char *fn;
     FD_t fd;
@@ -69,6 +70,7 @@ static int manageFile(FD_t *fdp, const char **fnp, int flags,
 
 static int copyFile(FD_t *sfdp, const char **sfnp,
 	FD_t *tfdp, const char **tfnp)
+	/*@modifies *sfdp, *sfnp, *tfdp, *tfnp, fileSystem @*/
 {
     unsigned char buffer[BUFSIZ];
     ssize_t count;
diff --git a/lib/rpminstall.c b/lib/rpminstall.c
index bc504229f..ddee82c4e 100644
--- a/lib/rpminstall.c
+++ b/lib/rpminstall.c
@@ -33,6 +33,7 @@ static int progressCurrent = 0;
 /**
  */
 static void printHash(const unsigned long amount, const unsigned long total)
+	/*@modifies fileSystem @*/
 {
     int hashesNeeded;
     int hashesTotal = 50;
@@ -85,8 +86,11 @@ void * showProgress(/*@null@*/ const void * arg, const rpmCallbackType what,
 			const unsigned long total,
 			/*@null@*/ const void * pkgKey,
 			/*@null@*/ void * data)
+	/*@modifies fileSystem @*/
 {
+    /*@-castexpose@*/
     Header h = (Header) arg;
+    /*@=castexpose@*/
     char * s;
     int flags = (int) ((long)data);
     void * rc = NULL;
@@ -325,7 +329,9 @@ restart:
 	    continue;
 	}
 
+	/*@-mustmod@*/	/* LCL: segfault */
 	rpmrc = rpmReadPackageHeader(fd, &h, &isSource, NULL, NULL);
+	/*@-mustmod@*/
 	(void) Fclose(fd);
 
 	if (rpmrc == RPMRC_FAIL || rpmrc == RPMRC_SHORTREAD) {
@@ -399,7 +405,7 @@ restart:
 			continue;
 		    /* same or newer package already installed */
 		    count = 0;
-		    break;
+		    /*@innerbreak@*/ break;
 		}
 		mi = rpmdbFreeIterator(mi);
 		if (count == 0) {
diff --git a/lib/rpmlib.h b/lib/rpmlib.h
index 744909b5c..df5062393 100644
--- a/lib/rpmlib.h
+++ b/lib/rpmlib.h
@@ -37,7 +37,8 @@ extern "C" {
  * @return		NULL always
  */
 /*@unused@*/ static inline /*@null@*/ void *
-_free(/*@only@*/ /*@null@*/ const void * p) /*@modifies p@*/
+_free(/*@only@*/ /*@null@*/ const void * p)
+	/*@modifies p @*/
 {
     if (p != NULL)	free((void *)p);
     return NULL;
@@ -53,8 +54,8 @@ _free(/*@only@*/ /*@null@*/ const void * p) /*@modifies p@*/
  * @return		rpmRC return code
  */
 rpmRC rpmReadPackageInfo(FD_t fd, /*@null@*/ /*@out@*/ Header * sigp,
-	/*@null@*/ /*@out@*/ Header * hdrp)
-		/*@modifies fd, *sigp, *hdrp @*/;
+		/*@null@*/ /*@out@*/ Header * hdrp)
+	/*@modifies fd, *sigp, *hdrp, fileSystem @*/;
 
 /**
  * Return package header and lead info from file handle.
@@ -66,9 +67,10 @@ rpmRC rpmReadPackageInfo(FD_t fd, /*@null@*/ /*@out@*/ Header * sigp,
  * @return		rpmRC return code
  */
 rpmRC rpmReadPackageHeader(FD_t fd, /*@null@*/ /*@out@*/ Header * hdrp,
-	/*@null@*/ /*@out@*/ int * isSource, /*@null@*/ /*@out@*/ int * major,
-	/*@null@*/ /*@out@*/ int * minor)
-		/*@modifies fd, *hdrp, *isSource, *major, *minor @*/;
+		/*@null@*/ /*@out@*/ int * isSource,
+		/*@null@*/ /*@out@*/ int * major,
+		/*@null@*/ /*@out@*/ int * minor)
+	/*@modifies fd, *hdrp, *isSource, *major, *minor, fileSystem @*/;
 
 /** \ingroup header
  * Return name, version, release strings from header.
@@ -79,10 +81,10 @@ rpmRC rpmReadPackageHeader(FD_t fd, /*@null@*/ /*@out@*/ Header * hdrp,
  * @return		0 always
  */
 int headerNVR(Header h,
-	/*@null@*/ /*@out@*/ const char ** np,
-	/*@null@*/ /*@out@*/ const char ** vp,
-	/*@null@*/ /*@out@*/ const char ** rp)
-		/*@modifies *np, *vp, *rp @*/;
+		/*@null@*/ /*@out@*/ const char ** np,
+		/*@null@*/ /*@out@*/ const char ** vp,
+		/*@null@*/ /*@out@*/ const char ** rp)
+	/*@modifies *np, *vp, *rp @*/;
 
 /** \ingroup header
  * Translate and merge legacy signature tags into header.
@@ -97,7 +99,8 @@ void headerMergeLegacySigs(Header h, const Header sig)
  * @param h		header
  * @return		regenerated signature header
  */
-Header headerRegenSigHeader(const Header h)	/*@*/;
+Header headerRegenSigHeader(const Header h)
+	/*@*/;
 
 /**
  * Retrieve file names from header.
@@ -113,8 +116,8 @@ Header headerRegenSigHeader(const Header h)	/*@*/;
  * @retval fileCountPtr	address of number of files
  */
 void rpmBuildFileList(Header h, /*@out@*/ const char *** fileListPtr, 
-	/*@out@*/ int * fileCountPtr)
-		/*@modifies *fileListPtr, *fileCountPtr @*/;
+		/*@out@*/ int * fileCountPtr)
+	/*@modifies *fileListPtr, *fileCountPtr @*/;
 
 /**
  * Retrieve tag info from header.
@@ -130,8 +133,8 @@ void rpmBuildFileList(Header h, /*@out@*/ const char *** fileListPtr,
  * @return		0 on success, 1 on bad magic, 2 on error
  */
 int rpmHeaderGetEntry(Header h, int_32 tag, /*@out@*/ int_32 *type,
-        /*@out@*/ void **p, /*@out@*/ int_32 *c)
-		/*@modifies *type, *p, *c @*/;
+		/*@out@*/ void **p, /*@out@*/ int_32 *c)
+	/*@modifies *type, *p, *c @*/;
 
 /**
  * Retrieve tag info from header.
@@ -150,8 +153,8 @@ int rpmHeaderGetEntry(Header h, int_32 tag, /*@out@*/ int_32 *type,
  */
 /*@unused@*/
 int rpmPackageGetEntry(void *leadp, Header sigs, Header h,
-        int_32 tag, int_32 *type, void **p, int_32 *c)
-		/*@modifies *type, *p, *c @*/;
+		int_32 tag, int_32 *type, void **p, int_32 *c)
+	/*@modifies *type, *p, *c @*/;
 
 /*@-redecl@*/
 /**
@@ -465,7 +468,8 @@ typedef	enum rpmsenseFlags_e {
  * @todo Eliminate from API.
  */
 /*@-redecl@*/
-/*@observer@*/ /*@null@*/ extern const char * rpmGetVar(int var)	/*@*/;
+/*@observer@*/ /*@null@*/ extern const char * rpmGetVar(int var)
+	/*@*/;
 /*@=redecl@*/
 
 /** \ingroup rpmrc
@@ -473,7 +477,8 @@ typedef	enum rpmsenseFlags_e {
  * @deprecated Use rpmDefineMacro() to change appropriate macro instead.
  * @todo Eliminate from API.
  */
-void rpmSetVar(int var, const char *val);
+void rpmSetVar(int var, const char * val)
+	/*@modifies internalState @*/;
 
 /** \ingroup rpmrc
  * List of macro files to read when configuring rpm.
@@ -481,7 +486,7 @@ void rpmSetVar(int var, const char *val);
  * identified by the token '://', so file paths must not begin with '//'.
  */
 /*@-redecl@*/
-extern const char * macrofiles;
+/*@observer@*/ extern const char * macrofiles;
 /*@=redecl@*/
 
 /** \ingroup rpmrc
@@ -503,14 +508,16 @@ enum rpm_machtable_e {
  * @return		0 on success, -1 on error
  */
 int rpmReadConfigFiles(/*@null@*/ const char * file,
-		/*@null@*/ const char * target);
+		/*@null@*/ const char * target)
+	/*@modifies fileSystem @*/;
 
 /** \ingroup rpmrc
  * Read rpmrc (and macro) configuration file(s).
  * @param rcfiles	colon separated files to read (NULL uses default)
  * @return		0 on succes
  */
-int rpmReadRC(/*@null@*/ const char * rcfiles);
+int rpmReadRC(/*@null@*/ const char * rcfiles)
+	/*@modifies fileSystem @*/;
 
 /** \ingroup rpmrc
  * Return current arch name and/or number.
@@ -519,8 +526,8 @@ int rpmReadRC(/*@null@*/ const char * rcfiles);
  * @retval num		address of arch number (or NULL)
  */
 void rpmGetArchInfo( /*@null@*/ /*@out@*/ const char ** name,
-	/*@null@*/ /*@out@*/ int * num)
-		/*@modifies *name, *num @*/;
+		/*@null@*/ /*@out@*/ int * num)
+	/*@modifies *name, *num @*/;
 
 /** \ingroup rpmrc
  * Return current os name and/or number.
@@ -529,8 +536,8 @@ void rpmGetArchInfo( /*@null@*/ /*@out@*/ const char ** name,
  * @retval num		address of os number (or NULL)
  */
 void rpmGetOsInfo( /*@null@*/ /*@out@*/ const char ** name,
-	/*@null@*/ /*@out@*/ int * num)
-		/*@modifies *name, *num @*/;
+		/*@null@*/ /*@out@*/ int * num)
+	/*@modifies *name, *num @*/;
 
 /** \ingroup rpmrc
  * Return arch/os score of a name.
@@ -545,22 +552,26 @@ void rpmGetOsInfo( /*@null@*/ /*@out@*/ const char ** name,
  * @param name		name
  * @return		arch score (0 is no match, lower is preferred)
  */
-int rpmMachineScore(int type, const char * name);
+int rpmMachineScore(int type, const char * name)
+	/*@*/;
 
 /** \ingroup rpmrc
  * Display current rpmrc (and macro) configuration.
  * @param fp		output file handle
  * @return		0 always
  */
-int rpmShowRC(FILE * fp);
+int rpmShowRC(FILE * fp)
+	/*@modifies *fp, fileSystem @*/;
 
 /** \ingroup rpmrc
  * @deprecated Use addMacro to set _target_* macros.
  * @todo Eliminate from API.
+ # @note Only used by build code.
  * @param archTable
  * @param osTable
  */
-void rpmSetTables(int archTable, int osTable);  /* only used by build code */
+void rpmSetTables(int archTable, int osTable)
+	/*@modifies internalState @*/;
 
 /** \ingroup rpmrc
  * Set current arch/os names.
@@ -572,7 +583,8 @@ void rpmSetTables(int archTable, int osTable);  /* only used by build code */
  * @param arch		arch name (or NULL)
  * @param os		os name (or NULL)
  */
-void rpmSetMachine(/*@null@*/ const char * arch, /*@null@*/ const char * os);
+void rpmSetMachine(/*@null@*/ const char * arch, /*@null@*/ const char * os)
+	/*@modifies internalState @*/;
 
 /** \ingroup rpmrc
  * Return current arch/os names.
@@ -584,14 +596,15 @@ void rpmSetMachine(/*@null@*/ const char * arch, /*@null@*/ const char * os);
  */
 /*@unused@*/
 void rpmGetMachine( /*@null@*/ /*@out@*/ const char **arch,
-	/*@null@*/ /*@out@*/ const char **os)
-		/*@modifies *arch, *os @*/;
+		/*@null@*/ /*@out@*/ const char **os)
+	/*@modifies *arch, *os @*/;
 
 /** \ingroup rpmrc
  * Destroy rpmrc arch/os compatibility tables.
  * @todo Eliminate from API.
  */
-void rpmFreeRpmrc(void);
+void rpmFreeRpmrc(void)
+	/*@modifies internalState @*/;
 
 /*@}*/
 /* ==================================================================== */
@@ -614,8 +627,8 @@ typedef /*@abstract@*/ struct _dbiIndexSet * dbiIndexSet;
  * @return		0 on success
  */
 int rpmdbOpen (/*@null@*/ const char * root, /*@null@*/ /*@out@*/ rpmdb * dbp,
-	int mode, int perms)
-		/*@modifies *dbp, fileSystem @*/;
+		int mode, int perms)
+	/*@modifies *dbp, fileSystem @*/;
 
 /** \ingroup rpmdb
  * Initialize database.
@@ -624,7 +637,7 @@ int rpmdbOpen (/*@null@*/ const char * root, /*@null@*/ /*@out@*/ rpmdb * dbp,
  * @return		0 on success
  */
 int rpmdbInit(/*@null@*/ const char * root, int perms)
-		/*@modifies fileSystem @*/;
+	/*@modifies fileSystem @*/;
 
 /** \ingroup rpmdb
  * Verify database components.
@@ -632,7 +645,7 @@ int rpmdbInit(/*@null@*/ const char * root, int perms)
  * @return		0 on success
  */
 int rpmdbVerify(/*@null@*/ const char * root)
-		/*@modifies fileSystem @*/;
+	/*@modifies fileSystem @*/;
 
 /** \ingroup rpmdb
  * Close all database indices and free rpmdb.
@@ -640,7 +653,7 @@ int rpmdbVerify(/*@null@*/ const char * root)
  * @return		0 on success
  */
 int rpmdbClose (/*@only@*/ /*@null@*/ rpmdb rpmdb)
-		/*@modifies fileSystem @*/;
+	/*@modifies fileSystem @*/;
 
 /** \ingroup rpmdb
  * Sync all database indices.
@@ -648,7 +661,7 @@ int rpmdbClose (/*@only@*/ /*@null@*/ rpmdb rpmdb)
  * @return		0 on success
  */
 int rpmdbSync (/*@null@*/ rpmdb rpmdb)
-		/*@modifies fileSystem @*/;
+	/*@modifies fileSystem @*/;
 
 /** \ingroup rpmdb
  * Open all database indices.
@@ -656,7 +669,7 @@ int rpmdbSync (/*@null@*/ rpmdb rpmdb)
  * @return		0 on success
  */
 int rpmdbOpenAll (/*@null@*/ rpmdb db)
-		/*@modifies db, fileSystem @*/;
+	/*@modifies db, fileSystem @*/;
 
 /** \ingroup rpmdb
  * Return number of instances of package in rpm database.
@@ -665,7 +678,7 @@ int rpmdbOpenAll (/*@null@*/ rpmdb db)
  * @return		number of instances
  */
 int rpmdbCountPackages(rpmdb db, const char * name)
-		/*@modifies db @*/;
+	/*@modifies db @*/;
 
 /** \ingroup rpmdb
  */
@@ -694,14 +707,16 @@ typedef /*@abstract@*/ struct _rpmdbMatchIterator * rpmdbMatchIterator;
  * @param mi		rpm database iterator
  * @return		current join key
  */
-unsigned int rpmdbGetIteratorOffset(/*@null@*/ rpmdbMatchIterator mi)	/*@*/;
+unsigned int rpmdbGetIteratorOffset(/*@null@*/ rpmdbMatchIterator mi)
+	/*@*/;
 
 /** \ingroup rpmdb
  * Return number of elements in rpm database iterator.
  * @param mi		rpm database iterator
  * @return		number of elements
  */
-int rpmdbGetIteratorCount(/*@null@*/ rpmdbMatchIterator mi)	/*@*/;
+int rpmdbGetIteratorCount(/*@null@*/ rpmdbMatchIterator mi)
+	/*@*/;
 
 /** \ingroup rpmdb
  * Append items to set of package instances to iterate.
@@ -711,8 +726,8 @@ int rpmdbGetIteratorCount(/*@null@*/ rpmdbMatchIterator mi)	/*@*/;
  * @return		0 on success, 1 on failure (bad args)
  */
 int rpmdbAppendIterator(/*@null@*/ rpmdbMatchIterator mi,
-	/*@null@*/ const int * hdrNums, int nHdrNums)
-		/*@modifies mi @*/;
+		/*@null@*/ const int * hdrNums, int nHdrNums)
+	/*@modifies mi @*/;
 
 /** \ingroup rpmdb
  * Remove items from set of package instances to iterate.
@@ -723,8 +738,8 @@ int rpmdbAppendIterator(/*@null@*/ rpmdbMatchIterator mi,
  * @return		0 on success, 1 on failure (bad args)
  */
 int rpmdbPruneIterator(/*@null@*/ rpmdbMatchIterator mi,
-	/*@null@*/ int * hdrNums, int nHdrNums, int sorted)
-		/*@modifies mi @*/;
+		/*@null@*/ int * hdrNums, int nHdrNums, int sorted)
+	/*@modifies mi, *hdrNums @*/;
 
 /** \ingroup rpmdb
  * Modify iterator to filter out headers that do not match version.
@@ -733,8 +748,8 @@ int rpmdbPruneIterator(/*@null@*/ rpmdbMatchIterator mi,
  * @param version	version to check for
  */
 void rpmdbSetIteratorVersion(/*@null@*/ rpmdbMatchIterator mi,
-	/*@null@*/ const char * version)
-		/*@modifies mi @*/;
+		/*@null@*/ const char * version)
+	/*@modifies mi @*/;
 
 /** \ingroup rpmdb
  * Modify iterator to filter out headers that do not match release.
@@ -743,8 +758,8 @@ void rpmdbSetIteratorVersion(/*@null@*/ rpmdbMatchIterator mi,
  * @param release	release to check for
  */
 void rpmdbSetIteratorRelease(/*@null@*/ rpmdbMatchIterator mi,
-	/*@null@*/ const char * release)
-		/*@modifies mi @*/;
+		/*@null@*/ const char * release)
+	/*@modifies mi @*/;
 
 /** \ingroup rpmdb
  * Prepare iterator for lazy writes.
@@ -754,7 +769,7 @@ void rpmdbSetIteratorRelease(/*@null@*/ rpmdbMatchIterator mi,
  * @return		previous value
  */
 int rpmdbSetIteratorRewrite(/*@null@*/ rpmdbMatchIterator mi, int rewrite)
-		/*@modifies mi @*/;
+	/*@modifies mi @*/;
 
 /** \ingroup rpmdb
  * Modify iterator to mark header for lazy write.
@@ -763,7 +778,7 @@ int rpmdbSetIteratorRewrite(/*@null@*/ rpmdbMatchIterator mi, int rewrite)
  * @return		previous value
  */
 int rpmdbSetIteratorModified(/*@null@*/ rpmdbMatchIterator mi, int modified)
-		/*@modifies mi @*/;
+	/*@modifies mi @*/;
 
 /** \ingroup rpmdb
  * Return next package header from iteration.
@@ -771,12 +786,12 @@ int rpmdbSetIteratorModified(/*@null@*/ rpmdbMatchIterator mi, int modified)
  * @return		NULL on end of iteration.
  */
 /*@null@*/ Header rpmdbNextIterator(/*@null@*/ rpmdbMatchIterator mi)
-		/*@modifies mi @*/;
+	/*@modifies mi @*/;
 #define	rpmdbNextIterator(_a) \
 	XrpmdbNextIterator(_a, __FILE__, __LINE__)
 /*@null@*/ Header XrpmdbNextIterator(/*@null@*/ rpmdbMatchIterator mi,
 				const char * f, unsigned int l)
-		/*@modifies mi @*/;
+	/*@modifies mi @*/;
 
 /** \ingroup rpmdb
  * Return database iterator.
@@ -789,7 +804,7 @@ int rpmdbSetIteratorModified(/*@null@*/ rpmdbMatchIterator mi, int modified)
 /*@only@*/ /*@null@*/ rpmdbMatchIterator rpmdbInitIterator(
 			/*@kept@*/ /*@null@*/ rpmdb db, int rpmtag,
 			/*@null@*/ const void * key, size_t keylen)
-		/*@modifies db, fileSystem @*/;
+	/*@modifies db, fileSystem @*/;
 
 /** \ingroup rpmdb
  * Add package header to rpm database and indices.
@@ -799,7 +814,7 @@ int rpmdbSetIteratorModified(/*@null@*/ rpmdbMatchIterator mi, int modified)
  * @return		0 on success
  */
 int rpmdbAdd(rpmdb db, int iid, Header h)
-		/*@modifies db, h, fileSystem @*/;
+	/*@modifies db, h, fileSystem @*/;
 
 /** \ingroup rpmdb
  * Remove package header from rpm database and indices.
@@ -809,14 +824,14 @@ int rpmdbAdd(rpmdb db, int iid, Header h)
  * @return		0 on success
  */
 int rpmdbRemove(rpmdb db, int rid, unsigned int offset)
-		/*@modifies db, fileSystem @*/;
+	/*@modifies db, fileSystem @*/;
 
 /** \ingroup rpmdb
  * Rebuild database indices from package headers.
  * @param root		path to top of install tree
  */
 int rpmdbRebuild(/*@null@*/ const char * root)
-		/*@modifies fileSystem @*/;
+	/*@modifies fileSystem @*/;
 
 /*@}*/
 /* ==================================================================== */
@@ -865,7 +880,7 @@ typedef /*@abstract@*/ struct rpmProblemSet_s {
 /**
  */
 void printDepFlags(FILE *fp, const char *version, int flags)
-	/*@modifies *fp @*/;
+	/*@modifies *fp, fileSystem @*/;
 
 /**
  */
@@ -895,8 +910,8 @@ typedef /*@abstract@*/ struct rpmDependencyConflict_s {
  * @param numConflicts	no. of dependency problems
  */
 void printDepProblems(FILE * fp, const rpmDependencyConflict conflicts,
-	int numConflicts)
-		/*@modifies *fp @*/;
+			int numConflicts)
+	/*@modifies *fp, fileSystem @*/;
 
 /**
  * Return formatted string representation of problem.
@@ -914,7 +929,8 @@ void printDepProblems(FILE * fp, const rpmDependencyConflict conflicts,
  * @param fp		file handle
  * @param prob		rpm problem
  */
-void rpmProblemPrint(FILE *fp, rpmProblem prob)	/*@modifies *fp, prob @*/;
+void rpmProblemPrint(FILE *fp, rpmProblem prob)
+	/*@modifies prob, *fp, fileSystem @*/;
 
 /**
  * Print problems to file handle.
@@ -922,13 +938,14 @@ void rpmProblemPrint(FILE *fp, rpmProblem prob)	/*@modifies *fp, prob @*/;
  * @param probs		problem set
  */
 void rpmProblemSetPrint(FILE *fp, rpmProblemSet probs)
-		/*@modifies *fp, probs @*/;
+	/*@modifies probs, *fp, fileSystem @*/;
 
 /**
  * Destroy problem set.
  * @param probs		problem set
  */
-void rpmProblemSetFree( /*@only@*/ rpmProblemSet probs);
+void rpmProblemSetFree( /*@only@*/ rpmProblemSet probs)
+	/*@modifies probs @*/;
 
 /*@}*/
 /* ==================================================================== */
@@ -948,7 +965,7 @@ typedef int (*HGE_t) (Header h, int_32 tag,
 			/*@null@*/ /*@out@*/ int_32 * type,
 			/*@null@*/ /*@out@*/ void ** p,
 			/*@null@*/ /*@out@*/ int_32 * c)
-				/*@modifies *type, *p, *c @*/;
+	/*@modifies *type, *p, *c @*/;
 
 /**
  * We pass these around as an array with a sentinel.
@@ -983,7 +1000,8 @@ rpmRC rpmInstallSourcePackage(/*@null@*/ const char * rootDir, FD_t fd,
  * @param second	2nd header
  * @return		result of comparison
  */
-int rpmVersionCompare(Header first, Header second);
+int rpmVersionCompare(Header first, Header second)
+	/*@*/;
 
 /**
  * File disposition(s) during package install/erase transaction.
@@ -1127,8 +1145,9 @@ void rpmtransSetScriptFd(rpmTransactionSet ts, FD_t fd)
  */
 /*@unused@*/
 int rpmtransGetKeys(const rpmTransactionSet ts,
-	/*@null@*/ /*@out@*/ const void *** ep, /*@null@*/ /*@out@*/ int * nep)
-		/*@modifies ep, nep @*/;
+		/*@null@*/ /*@out@*/ const void *** ep,
+		/*@null@*/ /*@out@*/ int * nep)
+	/*@modifies ep, nep @*/;
 
 /** \ingroup rpmtrans
  * Check that all dependencies can be resolved.
@@ -1138,9 +1157,9 @@ int rpmtransGetKeys(const rpmTransactionSet ts,
  * @return		0 on success
  */
 int rpmdepCheck(rpmTransactionSet ts,
-	/*@exposed@*/ /*@out@*/ rpmDependencyConflict * conflicts,
-	/*@exposed@*/ /*@out@*/ int * numConflicts)
-		/*@modifies ts, *conflicts, *numConflicts @*/;
+		/*@exposed@*/ /*@out@*/ rpmDependencyConflict * conflicts,
+		/*@exposed@*/ /*@out@*/ int * numConflicts)
+	/*@modifies ts, *conflicts, *numConflicts, fileSystem @*/;
 
 /** \ingroup rpmtrans
  * Determine package order in a transaction set according to dependencies.
@@ -1162,7 +1181,7 @@ int rpmdepCheck(rpmTransactionSet ts,
  * @return		0 if packages are successfully ordered, 1 otherwise
  */
 int rpmdepOrder(rpmTransactionSet ts)
-	/*@modifies ts @*/;
+	/*@modifies ts, fileSystem @*/;
 
 /** \ingroup rpmtrans
  * Destroy dependency conflicts storage.
@@ -1171,8 +1190,9 @@ int rpmdepOrder(rpmTransactionSet ts)
  * @retrun		NULL always
  */
 /*@null@*/ rpmDependencyConflict rpmdepFreeConflicts(
-	/*@only@*/ /*@null@*/ rpmDependencyConflict conflicts, int numConflicts)
-		/*@modifies conflicts @*/;
+		/*@only@*/ /*@null@*/ rpmDependencyConflict conflicts,
+		int numConflicts)
+	/*@modifies conflicts @*/;
 
 /** \ingroup rpmtrans
  * Bit(s) to control rpmRunTransaction() operation.
@@ -1241,9 +1261,10 @@ typedef enum rpmtransFlags_e {
  * @return		no. of entries
  */
 /*@unused@*/
-int rpmGetRpmlibProvides(/*@out@*/ const char *** provNames,
-	/*@out@*/ int ** provFlags, /*@out@*/ const char *** provVersions)
-		/*@ modifies *provNames, *provFlags, *provVersions @*/;
+int rpmGetRpmlibProvides(/*@null@*/ /*@out@*/ const char *** provNames,
+			/*@null@*/ /*@out@*/ int ** provFlags,
+			/*@null@*/ /*@out@*/ const char *** provVersions)
+	/*@ modifies *provNames, *provFlags, *provVersions @*/;
 
 /** \ingroup rpmtrans
  * Compare two versioned dependency ranges, looking for overlap.
@@ -1256,8 +1277,8 @@ int rpmGetRpmlibProvides(/*@out@*/ const char *** provNames,
  * @return		1 if dependencies overlap, 0 otherwise
  */
 int rpmRangesOverlap(const char * AName, const char * AEVR, int AFlags,
-        const char * BName, const char * BEVR, int BFlags)
-		/*@*/;
+			const char * BName, const char * BEVR, int BFlags)
+	/*@*/;
 
 /** \ingroup rpmtrans
  * Check dependency against internal rpmlib feature provides.
@@ -1273,7 +1294,8 @@ int rpmCheckRpmlibProvides(const char * keyName, const char * keyEVR,
  * Display current rpmlib feature provides.
  * @param fp		output file handle
  */
-void rpmShowRpmlibProvides(FILE * fp) /*@modifies *fp @*/;
+void rpmShowRpmlibProvides(FILE * fp)
+	/*@modifies *fp, fileSystem @*/;
 
 /**
  * @todo Generalize filter mechanism.
@@ -1309,7 +1331,7 @@ int rpmRunTransactions(rpmTransactionSet ts,
 			/*@out@*/ rpmProblemSet * newProbs,
 			rpmtransFlags transFlags,
 			rpmprobFilterFlags ignoreSet)
-	/*@modifies ts, *newProbs @*/;
+	/*@modifies ts, *newProbs, fileSystem @*/;
 
 /*@}*/
 
@@ -1319,7 +1341,8 @@ int rpmRunTransactions(rpmTransactionSet ts,
  * @return		name of tag
  */
 /*@-redecl@*/
-/*@observer@*/ extern const char *const tagName(int tag)	/*@*/;
+/*@observer@*/ extern const char *const tagName(int tag)
+	/*@*/;
 /*@=redecl@*/
 
 /**
@@ -1327,7 +1350,8 @@ int rpmRunTransactions(rpmTransactionSet ts,
  * @param targstr	name of tag
  * @return		tag value
  */
-int tagValue(const char *tagstr)			/*@*/;
+int tagValue(const char *tagstr)
+	/*@*/;
 
 #define	RPMLEAD_BINARY 0
 #define	RPMLEAD_SOURCE 1
@@ -1359,7 +1383,8 @@ struct rpmlead {
 /**
  * Release storage used by file system usage cache.
  */
-void freeFilesystems(void)	/*@modifies internalState@*/;
+void freeFilesystems(void)
+	/*@modifies internalState@*/;
 
 /**
  * Return (cached) file system mount points.
@@ -1368,8 +1393,8 @@ void freeFilesystems(void)	/*@modifies internalState@*/;
  * @return			0 on success, 1 on error
  */
 int rpmGetFilesystemList( /*@null@*/ /*@out@*/ const char *** listptr,
-	/*@null@*/ /*@out@*/ int * num)
-		/*@modifies *listptr, *num @*/;
+		/*@null@*/ /*@out@*/ int * num)
+	/*@modifies *listptr, *num @*/;
 
 /**
  * Determine per-file system usage for a list of files.
@@ -1381,8 +1406,9 @@ int rpmGetFilesystemList( /*@null@*/ /*@out@*/ const char *** listptr,
  * @return			0 on success, 1 on error
  */
 int rpmGetFilesystemUsage(const char ** fileList, int_32 * fssizes,
-	int numFiles, /*@null@*/ /*@out@*/ uint_32 ** usagesPtr, int flags)
-		/*@modifies *usagesPtr @*/;
+		int numFiles, /*@null@*/ /*@out@*/ uint_32 ** usagesPtr,
+		int flags)
+	/*@modifies *usagesPtr @*/;
 
 /* ==================================================================== */
 /** \name RPMBT */
@@ -1404,7 +1430,7 @@ struct rpmBuildArguments_s {
     int useCatalog;		/*!< from --usecatalog */
     char buildMode;		/*!< Build mode (one of "btBC") */
     char buildChar;		/*!< Build stage (one of "abcilps ") */
-/*@dependent@*/ /*@null@*/ const char * rootdir;
+/*@observer@*/ /*@null@*/ const char * rootdir;
 };
 /** \ingroup rpmcli
  */
@@ -1454,7 +1480,7 @@ typedef enum rpmVerifyAttrs_e {
  * @return		0 on success (or not installed), 1 on error
  */
 int rpmVerifyFile(const char * root, Header h, int filenum,
-	/*@out@*/ int * result, int omitMask);
+		/*@out@*/ int * result, int omitMask);
 
 /**
  * Return exit code from running verify script in header.
@@ -1516,7 +1542,7 @@ typedef struct rpmQVArguments_s {
     int		qva_flags;	/*!< Bit(s) to control operation. */
 /*@unused@*/ int qva_verbose;	/*!< (unused) */
 /*@only@*/ /*@null@*/ const char * qva_queryFormat; /*!< Format for headerSprintf(). */
-/*@dependent@*/ /*@null@*/ const char * qva_prefix; /*!< Path to top of install tree. */
+/*@observer@*/ /*@null@*/ const char * qva_prefix; /*!< Path to top of install tree. */
     char	qva_mode;	/*!< 'q' is query, 'v' is verify mode. */
     char	qva_char;	/*!< (unused) always ' ' */
 } * QVA_t;
@@ -1535,7 +1561,7 @@ extern struct poptOption rpmQVSourcePoptTable[];
  * @param h		header to use for query/verify
  */
 typedef	int (*QVF_t) (QVA_t qva, rpmdb db, Header h)
-	/*@modifies db @*/;
+	/*@modifies db, fileSystem @*/;
 
 /** \ingroup rpmcli
  * Display query/verify information for each header in iterator.
@@ -1545,8 +1571,8 @@ typedef	int (*QVF_t) (QVA_t qva, rpmdb db, Header h)
  * @return		result of last non-zero showPackage() return
  */
 int showMatches(QVA_t qva, /*@only@*/ /*@null@*/ rpmdbMatchIterator mi,
-	QVF_t showPackage)
-		/*@modifies mi @*/;
+		QVF_t showPackage)
+	/*@modifies mi @*/;
 
 /** \ingroup rpmcli
  */
@@ -1558,9 +1584,10 @@ extern struct poptOption rpmQueryPoptTable[];
 
 /** \ingroup rpmcli
  * Display list of tags that can be used in --queryformat.
- * @param f	file handle to use for display
+ * @param fp	file handle to use for display
  */
-void rpmDisplayQueryTags(FILE * f)	/*@modifies f @*/;
+void rpmDisplayQueryTags(FILE * fp)
+	/*@modifies *fp, fileSystem @*/;
 
 /** \ingroup rpmcli
  * Common query/verify source interface, called once for each CLI arg.
@@ -1572,8 +1599,8 @@ void rpmDisplayQueryTags(FILE * f)	/*@modifies f @*/;
  * @return		showPackage() result, 1 if rpmdbInitIterator() is NULL
  */
 int rpmQueryVerify(QVA_t qva, rpmQVSources source, const char * arg,
-	rpmdb db, QVF_t showPackage)
-		/*@modifies db, fileSystem@*/;
+		rpmdb db, QVF_t showPackage)
+	/*@modifies db, fileSystem @*/;
 
 /** \ingroup rpmcli
  * Display results of package query.
@@ -1594,7 +1621,7 @@ int showQueryPackage(QVA_t qva, rpmdb db, Header h)
  * @return		rpmQueryVerify() result, or 1 on rpmdbOpen() failure
  */
 int rpmQuery(QVA_t qva, rpmQVSources source, const char * arg)
-		/*@modifies fileSystem@*/;
+	/*@modifies fileSystem @*/;
 
 /** \ingroup rpmcli
  */
@@ -1608,7 +1635,7 @@ extern struct poptOption rpmVerifyPoptTable[];
  * @return		result of last non-zero verify return
  */
 int showVerifyPackage(QVA_t qva, /*@only@*/ rpmdb db, Header h)
-		/*@modifies db, fileSystem@*/;
+	/*@modifies db, h, fileSystem @*/;
 
 /** \ingroup rpmcli
  * Verify package install.
@@ -1618,7 +1645,7 @@ int showVerifyPackage(QVA_t qva, /*@only@*/ rpmdb db, Header h)
  * @return		rpmQueryVerify() result, or 1 on rpmdbOpen() failure
  */
 int rpmVerify(QVA_t qva, rpmQVSources source, const char *arg)
-		/*@modifies fileSystem@*/;
+	/*@modifies fileSystem @*/;
 
 /*@}*/
 /* ==================================================================== */
@@ -1656,7 +1683,7 @@ int rpmInstall(/*@null@*/ const char * rootdir,
 		rpmInstallInterfaceFlags interfaceFlags,
 		rpmprobFilterFlags probFilter,
 		/*@null@*/ rpmRelocation * relocations)
-	/*@modifies fileSystem, *relocations @*/;
+	/*@modifies *relocations, fileSystem @*/;
 
 /** \ingroup rpmcli
  * Install source rpm package.
@@ -1669,7 +1696,7 @@ int rpmInstall(/*@null@*/ const char * rootdir,
 int rpmInstallSource(const char * rootdir, const char * arg,
 		/*@null@*/ /*@out@*/ const char ** specFile,
 		/*@null@*/ /*@out@*/ char ** cookie)
-	/*@modifies fileSystem, *specFile, *cookie @*/;
+	/*@modifies *specFile, *cookie, fileSystem @*/;
 
 /** \ingroup rpmcli
  * Bit(s) to control rpmErase() operation.
@@ -1690,7 +1717,8 @@ typedef enum rpmEraseInterfaceFlags_e {
  */
 int rpmErase(/*@null@*/ const char * rootdir, /*@null@*/ const char ** argv,
 		rpmtransFlags transFlags, 
-		rpmEraseInterfaceFlags interfaceFlags);
+		rpmEraseInterfaceFlags interfaceFlags)
+	/*@modifies fileSystem @*/;
 
 /*@}*/
 /* ==================================================================== */
@@ -1755,14 +1783,16 @@ typedef enum rpmVerifySignatureReturn_e {
  * @return		result of signature verification
  */
 rpmVerifySignatureReturn rpmVerifySignature(const char *file,
-		int_32 sigTag, const void * sig, int count, char *result);
+		int_32 sigTag, const void * sig, int count, char * result)
+	/*@modifies *result, fileSystem @*/;
 
 /** \ingroup signature
  * Destroy signature header from package.
  * @param h		signature header
  * @return		NULL always
  */
-/*@null@*/ Header rpmFreeSignature(/*@null@*/ /*@killref@*/ Header h);
+/*@null@*/ Header rpmFreeSignature(/*@null@*/ /*@killref@*/ Header h)
+	/*@modifies h @*/;
 
 /* --- checksig/resign */
 
diff --git a/lib/rpmlibprov.c b/lib/rpmlibprov.c
index 1613b138e..8ee443e87 100644
--- a/lib/rpmlibprov.c
+++ b/lib/rpmlibprov.c
@@ -8,10 +8,10 @@
 #include "debug.h"
 
 static struct rpmlibProvides {
-    const char * featureName;
-    const char * featureEVR;
+/*@observer@*/ /*@null@*/ const char * featureName;
+/*@observer@*/ /*@null@*/ const char * featureEVR;
     int featureFlags;
-    const char * featureDescription;
+/*@observer@*/ /*@null@*/ const char * featureDescription;
 } rpmlibProvides[] = {
     { "rpmlib(VersionedDependencies)",	"3.0.3-1",
 	(RPMSENSE_RPMLIB|RPMSENSE_EQUAL),
@@ -40,10 +40,11 @@ void rpmShowRpmlibProvides(FILE * fp)
 
     for (rlp = rpmlibProvides; rlp->featureName != NULL; rlp++) {
 	fprintf(fp, "    %s", rlp->featureName);
-	if (rlp->featureFlags)
+	if (rlp->featureEVR && rlp->featureFlags)
 	    printDepFlags(fp, rlp->featureEVR, rlp->featureFlags);
 	fprintf(fp, "\n");
-	fprintf(fp, "\t%s\n", rlp->featureDescription);
+	if (rlp->featureDescription)
+	    fprintf(fp, "\t%s\n", rlp->featureDescription);
     }
 }
 
@@ -54,7 +55,8 @@ int rpmCheckRpmlibProvides(const char * keyName, const char * keyEVR,
     int rc = 0;
 
     for (rlp = rpmlibProvides; rlp->featureName != NULL; rlp++) {
-	rc = rpmRangesOverlap(keyName, keyEVR, keyFlags,
+	if (rlp->featureEVR && rlp->featureFlags)
+	    rc = rpmRangesOverlap(keyName, keyEVR, keyFlags,
 		rlp->featureName, rlp->featureEVR, rlp->featureFlags);
 	if (rc)
 	    break;
@@ -72,9 +74,9 @@ int rpmGetRpmlibProvides(const char *** provNames, int ** provFlags,
     while (rpmlibProvides[n].featureName != NULL)
         n++;
 
-    names = xmalloc(sizeof(*names) * (n+1));
-    versions = xmalloc(sizeof(*versions) * (n+1));
-    flags = xmalloc(sizeof(*flags) * (n+1));
+    names = xcalloc((n+1), sizeof(*names));
+    versions = xcalloc((n+1), sizeof(*versions));
+    flags = xcalloc((n+1), sizeof(*flags));
     
     for (n = 0; rpmlibProvides[n].featureName != NULL; n++) {
         names[n] = rpmlibProvides[n].featureName;
@@ -82,12 +84,20 @@ int rpmGetRpmlibProvides(const char *** provNames, int ** provFlags,
         versions[n] = rpmlibProvides[n].featureEVR;
     }
     
-    names[n] = NULL;
-    versions[n] = NULL;
-    flags[n] = -1;
-    
-    *provNames = names;
-    *provFlags = flags;
-    *provVersions = versions;
+    if (provNames)
+	*provNames = names;
+    else
+	names = _free(names);
+
+    if (provFlags)
+	*provFlags = flags;
+    else
+	flags = _free(flags);
+
+    if (provVersions)
+	*provVersions = versions;
+    else
+	versions = _free(versions);
+
     return n;
 }
diff --git a/lib/rpmrc.c b/lib/rpmrc.c
index 469b4c7e6..4c7fa239a 100644
--- a/lib/rpmrc.c
+++ b/lib/rpmrc.c
@@ -16,9 +16,10 @@
 
 /*@access FD_t@*/		/* compared with NULL */
 
-static const char *defrcfiles = LIBRPMRC_FILENAME ":/etc/rpmrc:~/.rpmrc";
+/*@observer@*/ static const char *defrcfiles =
+	LIBRPMRC_FILENAME ":/etc/rpmrc:~/.rpmrc";
 
-const char * macrofiles = MACROFILES;
+/*@observer@*/ const char * macrofiles = MACROFILES;
 
 typedef /*@owned@*/ const char * cptr_t;
 
@@ -48,7 +49,7 @@ struct rpmvarValue {
     const char * value;
     /* eventually, this arch will be replaced with a generic condition */
     const char * arch;
-    struct rpmvarValue * next;
+/*@only@*/ /*@null@*/ struct rpmvarValue * next;
 };
 
 struct rpmOption {
@@ -77,7 +78,7 @@ typedef struct canonEntry_s {
  * for giggles, 'key'_canon, 'key'_compat, and 'key'_canon will also work
  */
 typedef struct tableType_s {
-    const char * const key;
+/*@observer@*/ const char * const key;
     const int hasCanon;
     const int hasTranslate;
     struct machEquivTable_s equiv;
@@ -117,13 +118,16 @@ static struct rpmvarValue values[RPMVAR_NUM];
 static int defaultsInitialized = 0;
 
 /* prototypes */
-static int doReadRC( /*@killref@*/ FD_t fd, const char * urlfn);
+static int doReadRC( /*@killref@*/ FD_t fd, const char * urlfn)
+	/*@modifies fd, fileSystem @*/;
 static void rpmSetVarArch(int var, const char * val,
-	/*@null@*/ const char * arch);
-static void rebuildCompatTables(int type, const char * name);
+		/*@null@*/ const char * arch)
+	/*@modifies internalState @*/;
+static void rebuildCompatTables(int type, const char * name)
+	/*@modifies internalState @*/;
 
 static int optionCompare(const void * a, const void * b)
-		/*@*/
+	/*@*/
 {
     return xstrcasecmp(((struct rpmOption *) a)->name,
 		      ((struct rpmOption *) b)->name);
@@ -133,7 +137,7 @@ static void rpmRebuildTargetVars(/*@null@*/ const char **target, /*@null@*/ cons
 
 static /*@observer@*/ /*@null@*/ machCacheEntry
 machCacheFindEntry(const machCache cache, const char * key)
-		/*@*/
+	/*@*/
 {
     int i;
 
@@ -145,11 +149,13 @@ machCacheFindEntry(const machCache cache, const char * key)
 
 static int machCompatCacheAdd(char * name, const char * fn, int linenum,
 				machCache cache)
+	/*@modifies *name, cache->cache, cache->size @*/
 {
-    char * chptr, * equivs;
+    machCacheEntry entry = NULL;
+    char * chptr;
+    char * equivs;
     int delEntry = 0;
     int i;
-    machCacheEntry entry = NULL;
 
     while (*name && xisspace(*name)) name++;
 
@@ -212,6 +218,7 @@ static int machCompatCacheAdd(char * name, const char * fn, int linenum,
 
 static /*@observer@*/ /*@null@*/ machEquivInfo
 machEquivSearch(const machEquivTable table, const char * name)
+	/*@*/
 {
     int i;
 
@@ -224,7 +231,7 @@ machEquivSearch(const machEquivTable table, const char * name)
 
 static void machAddEquiv(machEquivTable table, const char * name,
 			   int distance)
-		/*@modifies table->list, table->count @*/
+	/*@modifies table->list, table->count @*/
 {
     machEquivInfo equiv;
 
@@ -242,9 +249,8 @@ static void machAddEquiv(machEquivTable table, const char * name,
 }
 
 static void machCacheEntryVisit(machCache cache,
-				  machEquivTable table,
-				  const char * name,
-	  			  int distance)
+		machEquivTable table, const char * name, int distance)
+	/*@modifies table->list, table->count @*/
 {
     machCacheEntry entry;
     int i;
@@ -264,7 +270,8 @@ static void machCacheEntryVisit(machCache cache,
 }
 
 static void machFindEquivs(machCache cache, machEquivTable table,
-	const char * key)
+		const char * key)
+	/*@modifies cache->cache, table->list, table->count @*/
 {
     int i;
 
@@ -292,6 +299,7 @@ static void machFindEquivs(machCache cache, machEquivTable table,
 
 static int addCanon(canonEntry * table, int * tableLen, char * line,
 		    const char * fn, int lineNum)
+	/*@modifies *table, *tableLen, *line @*/
 {
     canonEntry t;
     char *s, *s1;
@@ -346,8 +354,9 @@ static int addCanon(canonEntry * table, int * tableLen, char * line,
     return 0;
 }
 
-static int addDefault(defaultEntry *table, int *tableLen, char *line,
-			const char *fn, int lineNum)
+static int addDefault(defaultEntry * table, int * tableLen, char * line,
+			const char * fn, int lineNum)
+	/*@modifies *table, *tableLen, *line @*/
 {
     defaultEntry t;
 
@@ -383,25 +392,26 @@ static int addDefault(defaultEntry *table, int *tableLen, char *line,
     return 0;
 }
 
-static /*@null@*/ const canonEntry lookupInCanonTable(const char *name,
-	const canonEntry table, int tableLen)
-		/*@*/
+static /*@null@*/ const canonEntry lookupInCanonTable(const char * name,
+		const canonEntry table, int tableLen)
+	/*@*/
 {
     while (tableLen) {
 	tableLen--;
 	if (strcmp(name, table[tableLen].name))
 	    continue;
-	/*@-immediatetrans@*/
+	/*@-immediatetrans -retalias@*/
 	return &(table[tableLen]);
-	/*@=immediatetrans@*/
+	/*@=immediatetrans =retalias@*/
     }
 
     return NULL;
 }
 
 static /*@observer@*/ /*@null@*/
-const char * lookupInDefaultTable(const char *name,
+const char * lookupInDefaultTable(const char * name,
 		const defaultEntry table, int tableLen)
+	/*@*/
 {
     while (tableLen) {
 	tableLen--;
@@ -437,8 +447,9 @@ int rpmReadConfigFiles(const char * file, const char * target)
     return 0;
 }
 
-static void setVarDefault(int var, const char *macroname, const char *val,
-	/*@null@*/ const char *body)
+static void setVarDefault(int var, const char * macroname, const char * val,
+		/*@null@*/ const char * body)
+	/*@modifies internalState @*/
 {
     if (var >= 0) {	/* XXX Dying ... */
 	if (rpmGetVar(var)) return;
@@ -449,7 +460,8 @@ static void setVarDefault(int var, const char *macroname, const char *val,
     addMacro(NULL, macroname, NULL, body, RMIL_DEFAULT);
 }
 
-static void setPathDefault(int var, const char *macroname, const char *subdir)
+static void setPathDefault(int var, const char * macroname, const char * subdir)
+	/*@modifies internalState @*/
 {
 
     if (var >= 0) {	/* XXX Dying ... */
@@ -480,7 +492,7 @@ static void setPathDefault(int var, const char *macroname, const char *subdir)
     }
 }
 
-static const char *prescriptenviron = "\n\
+/*@observer@*/ static const char * prescriptenviron = "\n\
 RPM_SOURCE_DIR=\"%{_sourcedir}\"\n\
 RPM_BUILD_DIR=\"%{_builddir}\"\n\
 RPM_OPT_FLAGS=\"%{optflags}\"\n\
@@ -497,7 +509,9 @@ export RPM_PACKAGE_NAME RPM_PACKAGE_VERSION RPM_PACKAGE_RELEASE\n\
 export RPM_BUILD_ROOT\n}\
 ";
 
-static void setDefaults(void) {
+static void setDefaults(void)
+	/*@modifies internalState @*/
+{
 
     addMacro(NULL, "_usr", NULL, "/usr", RMIL_DEFAULT);
     addMacro(NULL, "_var", NULL, "/var", RMIL_DEFAULT);
@@ -553,7 +567,7 @@ int rpmReadRC(const char * rcfiles)
 	/* Get pointer to rest of files */
 	for (re = r; (re = strchr(re, ':')) != NULL; re++) {
 	    if (!(re[1] == '/' && re[2] == '/'))
-		break;
+		/*@innerbreak@*/ break;
 	}
 	if (re && *re == ':')
 	    *re++ = '\0';
@@ -618,6 +632,7 @@ int rpmReadRC(const char * rcfiles)
 
 /*@-usedef@*/	/*@ FIX: se usage inconsistent, W2DO? */
 static int doReadRC( /*@killref@*/ FD_t fd, const char * urlfn)
+	/*@modifies fd, fileSystem @*/
 {
     const char *s;
     char *se, *next;
@@ -794,7 +809,7 @@ static int doReadRC( /*@killref@*/ FD_t fd, const char * urlfn)
 
 	    for (i = 0; i < RPM_MACHTABLE_COUNT; i++) {
 		if (!strncmp(tables[i].key, s, strlen(tables[i].key)))
-		    break;
+		    /*@innerbreak@*/ break;
 	    }
 
 	    if (i < RPM_MACHTABLE_COUNT) {
@@ -841,7 +856,11 @@ static int doReadRC( /*@killref@*/ FD_t fd, const char * urlfn)
  * Generic CPUID function
  */
 static inline void cpuid(int op, int *eax, int *ebx, int *ecx, int *edx)
+	/*@modifies *eax, *ebx, *ecx, *edx @*/
 {
+#ifdef	__LCLINT__
+    *eax = *ebx = *ecx = *edx = 0;
+#endif
 #ifdef PIC
 	__asm__("pushl %%ebx; cpuid; movl %%ebx,%1; popl %%ebx"
 		: "=a"(*eax), "=g"(*ebx), "=&c"(*ecx), "=&d"(*edx)
@@ -858,6 +877,7 @@ static inline void cpuid(int op, int *eax, int *ebx, int *ecx, int *edx)
  * CPUID functions returning a single datum
  */
 static inline unsigned int cpuid_eax(unsigned int op)
+	/*@*/
 {
 	unsigned int val;
 
@@ -872,6 +892,7 @@ static inline unsigned int cpuid_eax(unsigned int op)
 }
 
 static inline unsigned int cpuid_ebx(unsigned int op)
+	/*@*/
 {
 	unsigned int tmp, val;
 
@@ -886,6 +907,7 @@ static inline unsigned int cpuid_ebx(unsigned int op)
 }
 
 static inline unsigned int cpuid_ecx(unsigned int op)
+	/*@*/
 {
 	unsigned int tmp, val;
 #ifdef PIC
@@ -900,6 +922,7 @@ static inline unsigned int cpuid_ecx(unsigned int op)
 }
 
 static inline unsigned int cpuid_edx(unsigned int op)
+	/*@*/
 {
 	unsigned int tmp, val;
 #ifdef PIC
@@ -916,11 +939,13 @@ static inline unsigned int cpuid_edx(unsigned int op)
 static sigjmp_buf jenv;
 
 static inline void model3(int _unused)
+	/*@modifies internalState @*/
 {
 	siglongjmp(jenv, 1);
 }
 
 static inline int RPMClass(void)
+	/*@modifies internalState @*/
 {
 	int cpu;
 	unsigned int tfms, junk, cap;
@@ -946,7 +971,9 @@ static inline int RPMClass(void)
 }
 
 /* should only be called for model 6 CPU's */
-static int is_athlon(void) {
+static int is_athlon(void)
+	/*@*/
+{
 	unsigned int eax, ebx, ecx, edx;
 	char vendor[16];
 	int i;
@@ -972,7 +999,9 @@ static int is_athlon(void) {
 
 #endif
 
-static void defaultMachine(/*@out@*/ const char ** arch, /*@out@*/ const char ** os)
+static void defaultMachine(/*@out@*/ const char ** arch,
+		/*@out@*/ const char ** os)
+	/*@modifies *arch, *os @*/
 {
     static struct utsname un;
     static int gotDefaults = 0;
@@ -1193,6 +1222,7 @@ static void defaultMachine(/*@out@*/ const char ** arch, /*@out@*/ const char **
 
 static /*@observer@*/ /*@null@*/
 const char * rpmGetVarArch(int var, /*@null@*/ const char * arch)
+	/*@*/
 {
     const struct rpmvarValue * next;
 
@@ -1218,7 +1248,9 @@ const char *rpmGetVar(int var)
 }
 
 /* this doesn't free the passed pointer! */
-static void freeRpmVar(/*@only@*/ struct rpmvarValue * orig) {
+static void freeRpmVar(/*@only@*/ struct rpmvarValue * orig)
+	/*@modifies *orig @*/
+{
     struct rpmvarValue * next, * var = orig;
 
     while (var) {
@@ -1231,14 +1263,17 @@ static void freeRpmVar(/*@only@*/ struct rpmvarValue * orig) {
     }
 }
 
-void rpmSetVar(int var, const char *val) {
+void rpmSetVar(int var, const char * val)
+{
     /*@-immediatetrans@*/
     freeRpmVar(&values[var]);
     /*@=immediatetrans@*/
     values[var].value = (val ? xstrdup(val) : NULL);
 }
 
-static void rpmSetVarArch(int var, const char * val, const char * arch) {
+static void rpmSetVarArch(int var, const char * val, const char * arch)
+	/*@*/
+{
     struct rpmvarValue * next = values + var;
 
     if (next->value) {
@@ -1272,7 +1307,8 @@ static void rpmSetVarArch(int var, const char * val, const char * arch) {
     next->arch = (arch ? xstrdup(arch) : NULL);
 }
 
-void rpmSetTables(int archTable, int osTable) {
+void rpmSetTables(int archTable, int osTable)
+{
     const char * arch, * os;
 
     defaultMachine(&arch, &os);
@@ -1288,12 +1324,13 @@ void rpmSetTables(int archTable, int osTable) {
     }
 }
 
-int rpmMachineScore(int type, const char * name) {
+int rpmMachineScore(int type, const char * name)
+{
     machEquivInfo info = machEquivSearch(&tables[type].equiv, name);
     return (info != NULL ? info->score : 0);
 }
 
-void rpmGetMachine(const char **arch, const char **os)
+void rpmGetMachine(const char ** arch, const char ** os)
 {
     if (arch)
 	*arch = current[ARCH];
@@ -1302,7 +1339,8 @@ void rpmGetMachine(const char **arch, const char **os)
 	*os = current[OS];
 }
 
-void rpmSetMachine(const char * arch, const char * os) {
+void rpmSetMachine(const char * arch, const char * os)
+{
     const char * host_cpu, * host_os;
 
     defaultMachine(&host_cpu, &host_os);
@@ -1350,7 +1388,9 @@ void rpmSetMachine(const char * arch, const char * os) {
     }
 }
 
-static void rebuildCompatTables(int type, const char * name) {
+static void rebuildCompatTables(int type, const char * name)
+	/*@*/
+{
     machFindEquivs(&tables[currTables[type]].cache,
 		   &tables[currTables[type]].equiv,
 		   name);
@@ -1358,7 +1398,7 @@ static void rebuildCompatTables(int type, const char * name) {
 
 static void getMachineInfo(int type, /*@null@*/ /*@out@*/ const char ** name,
 			/*@null@*/ /*@out@*/int * num)
-		/*@modifies *name, *num @*/
+	/*@modifies *name, *num @*/
 {
     canonEntry canon;
     int which = currTables[type];
@@ -1384,11 +1424,13 @@ static void getMachineInfo(int type, /*@null@*/ /*@out@*/ const char ** name,
     }
 }
 
-void rpmGetArchInfo(const char ** name, int * num) {
+void rpmGetArchInfo(const char ** name, int * num)
+{
     getMachineInfo(ARCH, name, num);
 }
 
-void rpmGetOsInfo(const char ** name, int * num) {
+void rpmGetOsInfo(const char ** name, int * num)
+{
     getMachineInfo(OS, name, num);
 }
 
@@ -1533,7 +1575,7 @@ void rpmFreeRpmrc(void)
     }
 
     for (i = 0; i < RPMVAR_NUM; i++) {
-	struct rpmvarValue * vp;
+	/*@only@*/ /*@null@*/ struct rpmvarValue * vp;
 	while ((vp = values[i].next) != NULL) {
 	    values[i].next = vp->next;
 	    vp->value = _free(vp->value);
@@ -1549,7 +1591,7 @@ void rpmFreeRpmrc(void)
     return;
 }
 
-int rpmShowRC(FILE *fp)
+int rpmShowRC(FILE * fp)
 {
     struct rpmOption *opt;
     int i;
diff --git a/lib/signature.c b/lib/signature.c
index a760ecfc5..a60ffa837 100644
--- a/lib/signature.c
+++ b/lib/signature.c
@@ -114,6 +114,7 @@ const char * rpmDetectPGPVersion(pgpVersion * pgpVer)
  * @return 			rpmRC return code
  */
 static inline rpmRC checkSize(FD_t fd, int siglen, int pad, int datalen)
+	/*@modifies fileSystem @*/
 {
     struct stat st;
     rpmRC rc;
@@ -242,6 +243,7 @@ Header rpmFreeSignature(Header h)
 
 static int makePGPSignature(const char * file, /*@out@*/ void ** sig,
 		/*@out@*/ int_32 * size, /*@null@*/ const char * passPhrase)
+	/*@modifies *sig, *size, fileSystem @*/
 {
     char * sigfile = alloca(1024);
     int pid, status;
@@ -339,6 +341,7 @@ static int makePGPSignature(const char * file, /*@out@*/ void ** sig,
  */
 static int makeGPGSignature(const char * file, /*@out@*/ void ** sig,
 		/*@out@*/ int_32 * size, /*@null@*/ const char * passPhrase)
+	/*@modifies *sig, *size, fileSystem @*/
 {
     char * sigfile = alloca(1024);
     int pid, status;
@@ -454,6 +457,7 @@ int rpmAddSignature(Header h, const char * file, int_32 sigTag,
 
 static rpmVerifySignatureReturn
 verifySizeSignature(const char * datafile, int_32 size, char * result)
+	/*@modifies *result, fileSystem @*/
 {
     struct stat st;
 
@@ -474,6 +478,7 @@ verifySizeSignature(const char * datafile, int_32 size, char * result)
 static rpmVerifySignatureReturn
 verifyMD5Signature(const char * datafile, const byte * sig, 
 			      char * result, md5func fn)
+	/*@modifies *result, fileSystem @*/
 {
     byte md5sum[16];
 
@@ -508,6 +513,7 @@ verifyMD5Signature(const char * datafile, const byte * sig,
 static rpmVerifySignatureReturn
 verifyPGPSignature(const char * datafile, const void * sig, int count,
 		char * result)
+	/*@modifies *result, fileSystem @*/
 {
     int pid, status, outpipe[2];
     FD_t sfd;
@@ -624,6 +630,7 @@ verifyPGPSignature(const char * datafile, const void * sig, int count,
 static rpmVerifySignatureReturn
 verifyGPGSignature(const char * datafile, const void * sig, int count,
 		char * result)
+	/*@modifies *result, fileSystem @*/
 {
     int pid, status, outpipe[2];
     FD_t sfd;
@@ -689,6 +696,7 @@ verifyGPGSignature(const char * datafile, const void * sig, int count,
 }
 
 static int checkPassPhrase(const char * passPhrase, const int sigTag)
+	/*@modifies fileSystem @*/
 {
     int passPhrasePipe[2];
     int pid, status;
diff --git a/lib/signature.h b/lib/signature.h
index 2dcc91a4b..832c66fcd 100644
--- a/lib/signature.h
+++ b/lib/signature.h
@@ -63,7 +63,7 @@ rpmRC rpmReadSignature(FD_t fd, /*@null@*/ /*@out@*/ Header *headerp,
  * @return		0 on success, 1 on error
  */
 int rpmWriteSignature(FD_t fd, Header h)
-	/*@modifies fd, h @*/;
+	/*@modifies fd, h, fileSystem @*/;
 
 /** \ingroup signature
  *  Generate a signature of data in file, insert in header.
diff --git a/lib/tagName.c b/lib/tagName.c
index c846acfc6..6c6780ac2 100644
--- a/lib/tagName.c
+++ b/lib/tagName.c
@@ -40,7 +40,9 @@ const char *const tagName(int tag)
     for (i = 0; i < rpmTagTableSize; i++) {
 	if (tag != rpmTagTable[i].val)
 	    continue;
-	strcpy(nameBuf, rpmTagTable[i].name + 7);
+	nameBuf[0] = nameBuf[1] = '\0';
+	if (rpmTagTable[i].name != NULL)	/* XXX programmer error. */
+	    strcpy(nameBuf, rpmTagTable[i].name + 7);
 	for (s = nameBuf+1; *s != '\0'; s++)
 	    *s = xtolower(*s);
 	break;
diff --git a/lib/transaction.c b/lib/transaction.c
index 6e37902de..45912e105 100644
--- a/lib/transaction.c
+++ b/lib/transaction.c
@@ -62,7 +62,9 @@ struct diskspaceInfo {
 
 #define XSTRCMP(a, b) ((!(a) && !(b)) || ((a) && (b) && !strcmp((a), (b))))
 
-static /*@null@*/ void * freeFl(rpmTransactionSet ts, /*@only@*/ /*@null@*/ TFI_t flList)
+static /*@null@*/ void * freeFl(rpmTransactionSet ts,
+		/*@only@*/ /*@null@*/ TFI_t flList)
+	/*@*/
 {
     if (flList) {
 	TFI_t fi;
@@ -93,14 +95,20 @@ int rpmtransGetKeys(const rpmTransactionSet ts, const void *** ep, int * nep)
 
 	*ep = e = xmalloc(ts->orderCount * sizeof(*e));
 	for (oc = 0; oc < ts->orderCount; oc++, e++) {
-	    struct availablePackage * alp;
 	    switch (ts->order[oc].type) {
 	    case TR_ADDED:
-		alp = ts->addedPackages.list + ts->order[oc].u.addedIndex;
-		*e = alp->key;
-		break;
+		if (ts->addedPackages.list) {
+		    struct availablePackage * alp;
+		    alp = ts->addedPackages.list + ts->order[oc].u.addedIndex;
+		    *e = alp->key;
+		    break;
+		}
+		/*@fallthrough@*/
+	    default:
 	    case TR_REMOVED:
+		/*@-mods@*/	/* FIX: double indirection. */
 		*e = NULL;
+		/*@=mods@*/
 		break;
 	    }
 	}
@@ -109,6 +117,7 @@ int rpmtransGetKeys(const rpmTransactionSet ts, const void *** ep, int * nep)
 }
 
 static rpmProblemSet psCreate(void)
+	/*@*/
 {
     rpmProblemSet probs;
 
@@ -123,6 +132,7 @@ static void psAppend(rpmProblemSet probs, rpmProblemType type,
 		const struct availablePackage * alp,
 		const char * dn, const char *bn,
 		Header altH, unsigned long ulong1)
+	/*@modifies probs, alp @*/
 {
     rpmProblem p;
     char *t;
@@ -138,7 +148,9 @@ static void psAppend(rpmProblemSet probs, rpmProblemType type,
 
     p = probs->probs + probs->numProblems++;
     p->type = type;
+    /*@-assignexpose@*/
     p->key = alp->key;
+    /*@=assignexpose@*/
     p->ulong1 = ulong1;
     p->ignoreProblem = 0;
 
@@ -181,6 +193,7 @@ static void psAppend(rpmProblemSet probs, rpmProblemType type,
 }
 
 static int archOkay(Header h)
+	/*@*/
 {
     void * pkgArch;
     int type, count;
@@ -211,6 +224,7 @@ static int archOkay(Header h)
 }
 
 static int osOkay(Header h)
+	/*@*/
 {
     void * pkgOs;
     int type, count;
@@ -249,6 +263,7 @@ void rpmProblemSetFree(rpmProblemSet probs)
 }
 
 static /*@observer@*/ const char *const ftstring (fileTypes ft)
+	/*@*/
 {
     switch (ft) {
     case XDIR:	return "directory";
@@ -264,6 +279,7 @@ static /*@observer@*/ const char *const ftstring (fileTypes ft)
 }
 
 static fileTypes whatis(uint_16 mode)
+	/*@*/
 {
     if (S_ISDIR(mode))	return XDIR;
     if (S_ISCHR(mode))	return CDEV;
@@ -289,6 +305,7 @@ static fileTypes whatis(uint_16 mode)
 static Header relocateFileList(const rpmTransactionSet ts, TFI_t fi,
 		struct availablePackage * alp,
 		Header origH, fileAction * actions)
+	/*@modifies ts, fi, alp, origH, actions @*/
 {
     HGE_t hge = fi->hge;
     HFD_t hfd = (fi->hfd ? fi->hfd : headerFreeData);
@@ -382,7 +399,8 @@ static Header relocateFileList(const rpmTransactionSet ts, TFI_t fi,
 
 	    /* Verify that the relocation's old path is in the header. */
 	    for (j = 0; j < numValid; j++)
-		if (!strcmp(validRelocations[j], relocations[i].oldPath)) break;
+		if (!strcmp(validRelocations[j], relocations[i].oldPath))
+		    /*@innerbreak@*/ break;
 	    /* XXX actions check prevents problem from being appended twice. */
 	    if (j == numValid && !allowBadRelocate && actions)
 		psAppend(probs, RPMPROB_BADRELOCATE, alp,
@@ -445,7 +463,7 @@ static Header relocateFileList(const rpmTransactionSet ts, TFI_t fi,
 		    actualRelocations[numActual] = relocations[j].newPath;
 		    numActual++;
 		}
-		break;
+		/*@innerbreak@*/ break;
 	    }
 	    if (j == numRelocations) {
 		actualRelocations[numActual] = validRelocations[i];
@@ -532,7 +550,7 @@ static Header relocateFileList(const rpmTransactionSet ts, TFI_t fi,
 
 	    if (strncmp(relocations[j].oldPath, fn, len))
 		continue;
-	    break;
+	    /*@innerbreak@*/ break;
 	}
 	if (j < 0) continue;
 
@@ -549,7 +567,7 @@ static Header relocateFileList(const rpmTransactionSet ts, TFI_t fi,
 			continue;
 		    if (strncmp(fn, dirNames[j], fnlen))
 			continue;
-		    break;
+		    /*@innerbreak@*/ break;
 		}
 		if (j < dirCount)
 		    skipDirList[j] = 1;
@@ -590,7 +608,7 @@ static Header relocateFileList(const rpmTransactionSet ts, TFI_t fi,
 		continue;
 	    if (strncmp(fn, dirNames[j], fnlen))
 		continue;
-	    break;
+	    /*@innerbreak@*/ break;
 	}
 	
 	if (j < dirCount) {
@@ -704,6 +722,7 @@ static Header relocateFileList(const rpmTransactionSet ts, TFI_t fi,
  * then logarithmic or quadratic.
  */
 static int psTrim(rpmProblemSet filter, rpmProblemSet target)
+	/*@modifies target @*/
 {
     rpmProblem f = filter->probs;
     rpmProblem t = target->probs;
@@ -718,7 +737,7 @@ static int psTrim(rpmProblemSet filter, rpmProblemSet target)
 	    /*@-nullpass@*/	/* LCL: looks good to me */
 	    if (f->h == t->h && f->type == t->type && t->key == f->key &&
 		     XSTRCMP(f->str1, t->str1))
-		break;
+		/*@innerbreak@*/ break;
 	    /*@=nullpass@*/
 	    t++;
 	    gotProblems = 1;
@@ -740,6 +759,7 @@ static int psTrim(rpmProblemSet filter, rpmProblemSet target)
 }
 
 static int sharedCmp(const void * one, const void * two)
+	/*@*/
 {
     const struct sharedFileInfo * a = one;
     const struct sharedFileInfo * b = two;
@@ -757,6 +777,7 @@ static fileAction decideFileFate(const char * dirName,
 			const char * dbMd5, const char * dbLink, short newMode,
 			const char * newMd5, const char * newLink, int newFlags,
 			int brokenMd5, rpmtransFlags transFlags)
+	/*@*/
 {
     char buffer[1024];
     const char * dbAttr, * newAttr;
@@ -850,6 +871,7 @@ static fileAction decideFileFate(const char * dirName,
 
 static int filecmp(short mode1, const char * md51, const char * link1,
 	           short mode2, const char * md52, const char * link2)
+	/*@*/
 {
     fileTypes what1 = whatis(mode1);
     fileTypes what2 = whatis(mode2);
@@ -869,6 +891,7 @@ static int handleInstInstalledFiles(TFI_t fi, /*@null@*/ rpmdb db,
 			            int sharedCount, int reportConflicts,
 				    rpmProblemSet probs,
 				    rpmtransFlags transFlags)
+	/*@modifies fi, db, probs @*/
 {
     HGE_t hge = fi->hge;
     HFD_t hfd = (fi->hfd ? fi->hfd : headerFreeData);
@@ -924,8 +947,10 @@ static int handleInstInstalledFiles(TFI_t fi, /*@null@*/ rpmdb db,
 			fi->dnl[fi->dil[fileNum]], fi->bnl[fileNum], h, 0);
 	    if (!(otherFlags[otherFileNum] | fi->fflags[fileNum])
 			& RPMFILE_CONFIG) {
+		/*@-assignexpose@*/
 		if (!shared->isRemoved)
 		    fi->replaced[numReplaced++] = *shared;
+		/*@=assignexpose@*/
 	    }
 	}
 
@@ -961,6 +986,7 @@ static int handleInstInstalledFiles(TFI_t fi, /*@null@*/ rpmdb db,
 static int handleRmvdInstalledFiles(TFI_t fi, /*@null@*/ rpmdb db,
 			            struct sharedFileInfo * shared,
 			            int sharedCount)
+	/*@modifies fi, db @*/
 {
     HGE_t hge = fi->hge;
     Header h;
@@ -1000,6 +1026,7 @@ static int handleRmvdInstalledFiles(TFI_t fi, /*@null@*/ rpmdb db,
  */
 static void handleOverlappedFiles(TFI_t fi, hashTable ht,
 			   rpmProblemSet probs, struct diskspaceInfo * dsl)
+	/*@modifies fi, probs, dsl @*/
 {
     int i, j;
     struct diskspaceInfo * ds = NULL;
@@ -1060,7 +1087,7 @@ static void handleOverlappedFiles(TFI_t fi, hashTable ht,
 
 	/* Locate this overlapped file in the set of added/removed packages. */
 	for (j = 0; j < numRecs && recs[j] != fi; j++)
-	    ;
+	    {};
 
 	/* Find what the previous disposition of this file was. */
 	otherFileNum = -1;			/* keep gcc quiet */
@@ -1075,18 +1102,18 @@ static void handleOverlappedFiles(TFI_t fi, hashTable ht,
 
 		/* If the addresses are the same, so are the values. */
 		if ((fi->fps + i) == (recs[otherPkgNum]->fps + otherFileNum))
-		    break;
+		    /*@innerbreak@*/ break;
 
 		/* Otherwise, compare fingerprints by value. */
 		/*@-nullpass@*/	/* LCL: looks good to me */
 		if (FP_EQUAL(fi->fps[i], recs[otherPkgNum]->fps[otherFileNum]))
-		    break;
+		    /*@innerbreak@*/ break;
 		/*@=nullpass@*/
 
 	    }
 	    /* XXX is this test still necessary? */
 	    if (recs[otherPkgNum]->actions[otherFileNum] != FA_UNKNOWN)
-		break;
+		/*@innerbreak@*/ break;
 	}
 
 	switch (fi->type) {
@@ -1198,6 +1225,7 @@ static void handleOverlappedFiles(TFI_t fi, hashTable ht,
 
 static int ensureOlder(struct availablePackage * alp, Header old,
 		rpmProblemSet probs)
+	/*@modifies alp, probs @*/
 {
     int result, rc = 0;
 
@@ -1215,6 +1243,7 @@ static int ensureOlder(struct availablePackage * alp, Header old,
 }
 
 static void skipFiles(const rpmTransactionSet ts, TFI_t fi)
+	/*@modifies fi @*/
 {
     int noDocs = (ts->transFlags & RPMTRANS_FLAG_NODOCS);
     char ** netsharedPaths = NULL;
@@ -1289,7 +1318,7 @@ static void skipFiles(const rpmTransactionSet ts, TFI_t fi)
 		if (!((*nsp)[len] == '/' || (*nsp)[len] == '\0')) continue;
 	    }
 
-	    break;
+	    /*@innerbreak@*/ break;
 	}
 
 	if (nsp && *nsp) {
@@ -1305,15 +1334,16 @@ static void skipFiles(const rpmTransactionSet ts, TFI_t fi)
 	    const char **lang, *l, *le;
 	    for (lang = languages; *lang != '\0'; lang++) {
 		if (!strcmp(*lang, "all"))
-		    break;
+		    /*@innerbreak@*/ break;
 		for (l = fi->flangs[i]; *l != '\0'; l = le) {
 		    for (le = l; *le != '\0' && *le != '|'; le++)
-			;
+			{};
 		    if ((le-l) > 0 && !strncmp(*lang, l, (le-l)))
-			break;
+			/*@innerbreak@*/ break;
 		    if (*le == '|') le++;	/* skip over | */
 		}
-		if (*l != '\0')	break;
+		if (*l != '\0')
+		    /*@innerbreak@*/ break;
 	    }
 	    if (*lang == NULL) {
 		drc[ix]--;	dff[ix] = 1;
@@ -1366,7 +1396,7 @@ static void skipFiles(const rpmTransactionSet ts, TFI_t fi)
 		continue;
 	    rpmMessage(RPMMESS_DEBUG, _("excluding directory %s\n"), dn);
 	    fi->actions[i] = FA_SKIPNSTATE;
-	    break;
+	    /*@innerbreak@*/ break;
 	}
     }
 
@@ -1392,7 +1422,9 @@ struct tsIterator_s {
  * @param a		transaction element iterator
  * @return		element order count
  */
-static int tsGetOc(void * a) {
+static int tsGetOc(void * a)
+	/*@*/
+{
     struct tsIterator_s * iter = a;
     int oc = iter->ocsave;
     return oc;
@@ -1403,7 +1435,9 @@ static int tsGetOc(void * a) {
  * @param a		transaction element iterator
  * @return		available package pointer
  */
-static /*@dependent@*/ struct availablePackage * tsGetAlp(void * a) {
+static /*@dependent@*/ struct availablePackage * tsGetAlp(void * a)
+	/*@*/
+{
     struct tsIterator_s * iter = a;
     struct availablePackage * alp = NULL;
     int oc = iter->ocsave;
@@ -1411,7 +1445,7 @@ static /*@dependent@*/ struct availablePackage * tsGetAlp(void * a) {
     if (oc != -1) {
 	rpmTransactionSet ts = iter->ts;
 	TFI_t fi = ts->flList + oc;
-	if (fi->type == TR_ADDED)
+	if (ts->addedPackages.list && fi->type == TR_ADDED)
 	    alp = ts->addedPackages.list + ts->order[oc].u.addedIndex;
     }
     return alp;
@@ -1423,6 +1457,7 @@ static /*@dependent@*/ struct availablePackage * tsGetAlp(void * a) {
  * @return		NULL always
  */
 static /*@null@*/ void * tsFreeIterator(/*@only@*//*@null@*/ const void * a)
+	/*@modifies a @*/
 {
     return _free(a);
 }
@@ -1433,6 +1468,7 @@ static /*@null@*/ void * tsFreeIterator(/*@only@*//*@null@*/ const void * a)
  * @return		transaction element iterator
  */
 static void * tsInitIterator(/*@kept@*/ const void * a)
+	/*@*/
 {
     rpmTransactionSet ts = (void *)a;
     struct tsIterator_s * iter = NULL;
@@ -1450,7 +1486,9 @@ static void * tsInitIterator(/*@kept@*/ const void * a)
  * @param a		file info iterator
  * @return		next index, -1 on termination
  */
-static /*@dependent@*/ TFI_t tsNextIterator(void * a) {
+static /*@dependent@*/ TFI_t tsNextIterator(void * a)
+	/*@*/
+{
     struct tsIterator_s * iter = a;
     rpmTransactionSet ts = iter->ts;
     TFI_t fi = NULL;
@@ -1506,7 +1544,9 @@ int rpmRunTransactions(	rpmTransactionSet ts,
 
     ts->notify = notify;
     ts->notifyData = notifyData;
+    /*@-assignexpose@*/
     ts->probs = *newProbs = psCreate();
+    /*@=assignexpose@*/
     ts->ignoreSet = ignoreSet;
     ts->currDir = _free(ts->currDir);
     ts->currDir = currentDirectory();
@@ -1514,7 +1554,9 @@ int rpmRunTransactions(	rpmTransactionSet ts,
     ts->id = time(NULL);
 
     memset(psm, 0, sizeof(*psm));
+    /*@-assignexpose@*/
     psm->ts = ts;
+    /*@=assignexpose@*/
 
     /* Get available space on mounted file systems. */
     if (!(ts->ignoreSet & RPMPROB_FILTER_DISKSPACE) &&
@@ -1611,7 +1653,7 @@ int rpmRunTransactions(	rpmTransactionSet ts,
 	    while (rpmdbNextIterator(mi) != NULL) {
 		psAppend(ts->probs, RPMPROB_PKG_INSTALLED, alp,
 			NULL, NULL, NULL, 0);
-		break;
+		/*@innerbreak@*/ break;
 	    }
 	    mi = rpmdbFreeIterator(mi);
 	}
@@ -1726,8 +1768,10 @@ int rpmRunTransactions(	rpmTransactionSet ts,
     }
     tsi = tsFreeIterator(tsi);
 
+    /*@-moduncon@*/
     NOTIFY(ts, (NULL, RPMCALLBACK_TRANS_START, 6, ts->flEntries,
 	NULL, ts->notifyData));
+    /*@=moduncon@*/
 
     /* ===============================================
      * Compute file disposition for each package in transaction set.
@@ -1737,8 +1781,10 @@ int rpmRunTransactions(	rpmTransactionSet ts,
 	dbiIndexSet * matches;
 	int knownBad;
 
+	/*@-moduncon@*/
 	NOTIFY(ts, (NULL, RPMCALLBACK_TRANS_PROGRESS, (fi - ts->flList),
 			ts->flEntries, NULL, ts->notifyData));
+	/*@=moduncon@*/
 
 	if (fi->fc == 0) continue;
 
@@ -1800,7 +1846,7 @@ int rpmRunTransactions(	rpmTransactionSet ts,
 	    /* Find the end of the files in the other package. */
 	    for (nexti = i + 1; nexti < numShared; nexti++) {
 		if (sharedList[nexti].otherPkg != shared->otherPkg)
-		    break;
+		    /*@innerbreak@*/ break;
 	    }
 
 	    /* Is this file from a package being removed? */
@@ -1809,7 +1855,7 @@ int rpmRunTransactions(	rpmTransactionSet ts,
 		if (ts->removedPackages[j] != shared->otherPkg)
 		    continue;
 		beingRemoved = 1;
-		break;
+		/*@innerbreak@*/ break;
 	    }
 
 	    /* Determine the fate of each file. */
@@ -1869,8 +1915,10 @@ int rpmRunTransactions(	rpmTransactionSet ts,
 	(void) chdir(ts->currDir);
     }
 
+    /*@-moduncon@*/
     NOTIFY(ts, (NULL, RPMCALLBACK_TRANS_STOP, 6, ts->flEntries,
 	NULL, ts->notifyData));
+    /*@=moduncon@*/
 
     /* ===============================================
      * Free unused memory as soon as possible.
@@ -1956,7 +2004,9 @@ assert(alp == fi->ap);
 		    rpmRC rpmrc;
 
 		    hdrs[i] = headerFree(hdrs[i]);
+		    /*@-mustmod@*/	/* LCL: segfault */
 		    rpmrc = rpmReadPackageHeader(alp->fd, &h, NULL, NULL, NULL);
+		    /*@=mustmod@*/
 		    if (!(rpmrc == RPMRC_OK || rpmrc == RPMRC_BADSIZE)) {
 			(void)ts->notify(fi->h, RPMCALLBACK_INST_CLOSE_FILE,
 					0, 0, alp->key, ts->notifyData);
diff --git a/lib/verify.c b/lib/verify.c
index e50762581..b6622fc33 100644
--- a/lib/verify.c
+++ b/lib/verify.c
@@ -35,9 +35,10 @@ static union _vendian {
 
 /* ========== Verify specific popt args */
 static void verifyArgCallback(/*@unused@*/poptContext con,
-	/*@unused@*/enum poptCallbackReason reason,
-	const struct poptOption * opt, /*@unused@*/const char * arg,
-	/*@unused@*/ const void * data)
+		/*@unused@*/enum poptCallbackReason reason,
+		const struct poptOption * opt, /*@unused@*/const char * arg,
+		/*@unused@*/ const void * data)
+	/*@*/
 {
     QVA_t qva = &rpmQVArgs;
     switch (opt->val) {
@@ -335,6 +336,7 @@ int rpmVerifyScript(const char * rootDir, Header h, /*@null@*/ FD_t scriptFd)
  * @return		0 no problems, 1 problems found
  */
 static int verifyHeader(QVA_t qva, Header h)
+	/*@*/
 {
     HGE_t hge = (HGE_t)headerGetEntryMinMemory;
     char buf[BUFSIZ];
@@ -426,6 +428,7 @@ exit:
  * @return		0 no problems, 1 problems found
  */
 static int verifyDependencies(rpmdb rpmdb, Header h)
+	/*@modifies h @*/
 {
     rpmTransactionSet rpmdep;
     rpmDependencyConflict conflicts;
diff --git a/popt/findme.h b/popt/findme.h
index 1626ee5c6..bb54ec780 100644
--- a/popt/findme.h
+++ b/popt/findme.h
@@ -14,6 +14,7 @@
  * @param argv0		name of executable
  * @return		(malloc'd) absolute path to executable (or NULL)
  */
-/*@null@*/ const char * findProgramPath(/*@null@*/ const char * argv0);
+/*@null@*/ const char * findProgramPath(/*@null@*/ const char * argv0)
+	/*@modifies fileSystem @*/;
 
 #endif
diff --git a/popt/popt.c b/popt/popt.c
index 8c42f90c3..851f6ab9c 100644
--- a/popt/popt.c
+++ b/popt/popt.c
@@ -66,7 +66,9 @@ static void invokeCallbacksPRE(poptContext con, const struct poptOption * opt)
 	    poptCallbackType cb = (poptCallbackType)opt->arg;
 	    /*@=castfcnptr@*/
 	    /* Perform callback. */
+	    /*@-moduncon@*/
 	    cb(con, POPT_CALLBACK_REASON_PRE, NULL, NULL, opt->descrip);
+	    /*@=moduncon@*/
 	}
     }
 }
@@ -86,7 +88,9 @@ static void invokeCallbacksPOST(poptContext con, const struct poptOption * opt)
 	    poptCallbackType cb = (poptCallbackType)opt->arg;
 	    /*@=castfcnptr@*/
 	    /* Perform callback. */
+	    /*@-moduncon@*/
 	    cb(con, POPT_CALLBACK_REASON_POST, NULL, NULL, opt->descrip);
+	    /*@=moduncon@*/
 	}
     }
 }
@@ -123,8 +127,10 @@ static void invokeCallbacksOPTION(poptContext con,
 	    const void * cbData = (cbopt->descrip ? cbopt->descrip : myData);
 	    /* Perform callback. */
 	    if (cb != NULL) {	/* XXX program error */
+		/*@-moduncon@*/
 		cb(con, POPT_CALLBACK_REASON_OPTION, myOpt,
 			con->os->nextArg, cbData);
+		/*@=moduncon@*/
 	    }
 	    /* Terminate (unless explcitly continuing). */
 	    if (!(cbopt->argInfo & POPT_CBFLAG_CONTINUE))
@@ -143,18 +149,18 @@ poptContext poptGetContext(const char * name, int argc, const char ** argv,
 
     con->os = con->optionStack;
     con->os->argc = argc;
-    /*@-dependenttrans@*/	/* FIX: W2DO? */
+    /*@-dependenttrans -assignexpose@*/	/* FIX: W2DO? */
     con->os->argv = argv;
-    /*@=dependenttrans@*/
+    /*@=dependenttrans =assignexpose@*/
     con->os->argb = NULL;
 
     if (!(flags & POPT_CONTEXT_KEEP_FIRST))
 	con->os->next = 1;			/* skip argv[0] */
 
     con->leftovers = calloc( (argc + 1), sizeof(char *) );
-    /*@-dependenttrans@*/	/* FIX: W2DO? */
+    /*@-dependenttrans -assignexpose@*/	/* FIX: W2DO? */
     con->options = options;
-    /*@=dependenttrans@*/
+    /*@=dependenttrans =assignexpose@*/
     con->aliases = NULL;
     con->numAliases = 0;
     con->flags = flags;
@@ -181,6 +187,7 @@ poptContext poptGetContext(const char * name, int argc, const char ** argv,
 static void cleanOSE(/*@special@*/ struct optionStackEntry *os)
 	/*@uses os @*/
 	/*@releases os->nextArg, os->argv, os->argb @*/
+	/*@modifies os @*/
 {
     os->nextArg = _free(os->nextArg);
     os->argv = _free(os->argv);
@@ -224,6 +231,7 @@ static int handleExec(/*@special@*/ poptContext con,
 		/*@null@*/ const char * longName, char shortName)
 	/*@uses con->execs, con->numExecs, con->flags, con->doExec,
 		con->finalArgv, con->finalArgvAlloced, con->finalArgvCount @*/
+	/*@modifies con @*/
 {
     int i;
 
@@ -280,6 +288,7 @@ static int handleAlias(/*@special@*/ poptContext con,
 		/*@keep@*/ /*@null@*/ const char * nextCharArg)
 	/*@uses con->aliases, con->numAliases, con->optionStack,
 		con->os, con->os->currAlias, con->os->currAlias->longName @*/
+	/*@modifies con @*/
 {
     int rc;
     int i;
@@ -480,6 +489,7 @@ static const char * findNextArg(/*@special@*/ poptContext con,
 		unsigned argx, int delete_arg)
 	/*@uses con->optionStack, con->os,
 		con->os->next, con->os->argb, con->os->argc, con->os->argv @*/
+	/*@modifies con @*/
 {
     struct optionStackEntry * os = con->os;
     const char * arg;
@@ -500,7 +510,7 @@ static const char * findNextArg(/*@special@*/ poptContext con,
 		if (os->argb != NULL)	/* XXX can't happen */
 		PBM_SET(i, os->argb);
 	    }
-	    break;
+	    /*@innerbreak@*/ break;
 	}
 	if (os > con->optionStack) os--;
     } while (arg == NULL);
@@ -555,7 +565,9 @@ expandNextArg(/*@special@*/ poptContext con, const char * s)
     return t;
 }
 
-static void poptStripArg(poptContext con, int which)
+static void poptStripArg(/*@special@*/ poptContext con, int which)
+	/*@uses con->arg_strip, con->optionStack @*/
+	/*@defines con->arg_strip @*/
 	/*@modifies con @*/
 {
     if (con->arg_strip == NULL)
@@ -699,7 +711,7 @@ int poptGetNextOpt(poptContext con)
 
 		/* Check for "--long=arg" option. */
 		for (oe = optString; *oe && *oe != '='; oe++)
-		    ;
+		    {};
 		if (*oe == '=') {
 		    *oe++ = '\0';
 		    /* XXX longArg is mapped back to persistent storage. */
@@ -993,24 +1005,26 @@ int poptAddAlias(poptContext con, struct poptAlias newAlias,
 		/*@unused@*/ int flags)
 {
     int aliasNum = con->numAliases++;
-    struct poptAlias * alias;
 
     /* SunOS won't realloc(NULL, ...) */
-    if (!con->aliases)
-	con->aliases = malloc(sizeof(newAlias) * con->numAliases);
+    if (con->aliases == NULL)
+	con->aliases = malloc(con->numAliases * sizeof(newAlias));
     else
 	con->aliases = realloc(con->aliases,
-			       sizeof(newAlias) * con->numAliases);
-    alias = con->aliases + aliasNum;
-
-    alias->longName = (newAlias.longName)
-	/*@-nullpass@*/		/* FIX: malloc can return NULL. */
-	? strcpy(malloc(strlen(newAlias.longName) + 1), newAlias.longName)
-	/*@=nullpass@*/
-	: NULL;
-    alias->shortName = newAlias.shortName;
-    alias->argc = newAlias.argc;
-    alias->argv = newAlias.argv;
+			       con->numAliases * sizeof(newAlias));
+
+    if (con->aliases) {
+	struct poptAlias * alias = con->aliases + aliasNum;
+
+	alias->longName = (newAlias.longName)
+	    /*@-nullpass@*/		/* FIX: malloc can return NULL. */
+	    ? strcpy(malloc(strlen(newAlias.longName) + 1), newAlias.longName)
+	    /*@=nullpass@*/
+	    : NULL;
+	alias->shortName = newAlias.shortName;
+	alias->argc = newAlias.argc;
+	alias->argv = newAlias.argv;
+    }
 
     return 0;
 }
@@ -1064,7 +1078,7 @@ int poptStuffArgs(poptContext con, const char ** argv)
 	return POPT_ERROR_OPTSTOODEEP;
 
     for (argc = 0; argv[argc]; argc++)
-	;
+	{};
 
     con->os++;
     con->os->next = 0;
diff --git a/popt/popt.h b/popt/popt.h
index 52819f5f0..a195947f0 100644
--- a/popt/popt.h
+++ b/popt/popt.h
@@ -195,7 +195,7 @@ void poptResetContext(/*@null@*/poptContext con)
  * @return		next option val, -1 on last item, POPT_ERROR_* on error
  */
 int poptGetNextOpt(/*@null@*/poptContext con)
-	/*@modifies con @*/;
+	/*@modifies con, fileSystem @*/;
 
 /*@-redecl@*/
 /** \ingroup popt
@@ -340,20 +340,20 @@ void poptSetExecPath(poptContext con, const char * path, int allowAbsolute)
 /** \ingroup popt
  * Print detailed description of options.
  * @param con		context
- * @param f		ouput file handle
+ * @param fp		ouput file handle
  * @param flags		(unused)
  */
-void poptPrintHelp(poptContext con, FILE * f, /*@unused@*/ int flags)
-	/*@modifies *f @*/;
+void poptPrintHelp(poptContext con, FILE * fp, /*@unused@*/ int flags)
+	/*@modifies *fp, fileSystem @*/;
 
 /** \ingroup popt
  * Print terse description of options.
  * @param con		context
- * @param f		ouput file handle
+ * @param fp		ouput file handle
  * @param flags		(unused)
  */
-void poptPrintUsage(poptContext con, FILE * f, /*@unused@*/ int flags)
-	/*@modifies *f @*/;
+void poptPrintUsage(poptContext con, FILE * fp, /*@unused@*/ int flags)
+	/*@modifies *fp, fileSystem @*/;
 
 /** \ingroup popt
  * Provide text to replace default "[OPTION...]" in help/usage output.
diff --git a/popt/poptconfig.c b/popt/poptconfig.c
index f53dd5d37..8fddbcdf7 100644
--- a/popt/poptconfig.c
+++ b/popt/poptconfig.c
@@ -9,9 +9,9 @@
 #include "system.h"
 #include "poptint.h"
 
+/*@-mustmod@*/	/* LCL: *line is modified @*/
 static void configLine(poptContext con, char * line)
-	/*@modifies *line,
-		con->execs, con->numExecs @*/
+	/*@modifies *line, con->execs, con->numExecs @*/
 {
     int nameLength = strlen(con->appName);
     const char * opt;
@@ -63,6 +63,7 @@ static void configLine(poptContext con, char * line)
 	/*@=noeffect@*/
     }
 }
+/*@=mustmod@*/
 
 int poptReadConfigFile(poptContext con, const char * fn)
 {
diff --git a/popt/popthelp.c b/popt/popthelp.c
index 62822fa64..a5e19800b 100644
--- a/popt/popthelp.c
+++ b/popt/popthelp.c
@@ -34,6 +34,7 @@ struct poptOption poptHelpOptions[] = {
 
 /*@observer@*/ /*@null@*/ static const char *const
 getTableTranslationDomain(/*@null@*/ const struct poptOption *table)
+	/*@*/
 {
     const struct poptOption *opt;
 
@@ -50,6 +51,7 @@ getArgDescrip(const struct poptOption * opt,
 		/*@-paramuse@*/		/* FIX: wazzup? */
 		/*@null@*/ const char * translation_domain)
 		/*@=paramuse@*/
+	/*@*/
 {
     if (!(opt->argInfo & POPT_ARG_MASK)) return NULL;
 
@@ -70,9 +72,10 @@ getArgDescrip(const struct poptOption * opt,
     }
 }
 
-static void singleOptionHelp(FILE * f, int maxLeftCol, 
+static void singleOptionHelp(FILE * fp, int maxLeftCol, 
 		const struct poptOption * opt,
 		/*@null@*/ const char *translation_domain)
+	/*@modifies *fp, fileSystem @*/
 {
     int indentLength = maxLeftCol + 5;
     int lineLength = 79 - indentLength;
@@ -146,9 +149,9 @@ static void singleOptionHelp(FILE * f, int maxLeftCol,
     }
 
     if (help)
-	fprintf(f,"  %-*s   ", maxLeftCol, left);
+	fprintf(fp,"  %-*s   ", maxLeftCol, left);
     else {
-	fprintf(f,"  %s\n", left); 
+	fprintf(fp,"  %s\n", left); 
 	goto out;
     }
 
@@ -164,20 +167,21 @@ static void singleOptionHelp(FILE * f, int maxLeftCol,
 	ch++;
 
 	sprintf(format, "%%.%ds\n%%%ds", (int) (ch - help), indentLength);
-	fprintf(f, format, help, " ");
+	fprintf(fp, format, help, " ");
 	help = ch;
 	while (isspace(*help) && *help) help++;
 	helpLength = strlen(help);
     }
 
-    if (helpLength) fprintf(f, "%s\n", help);
+    if (helpLength) fprintf(fp, "%s\n", help);
 
 out:
-    free(left);
+    left = _free(left);
 }
 
 static int maxArgWidth(const struct poptOption * opt,
 		       /*@null@*/ const char * translation_domain)
+	/*@*/
 {
     int max = 0;
     int len = 0;
@@ -212,9 +216,10 @@ static int maxArgWidth(const struct poptOption * opt,
     return max;
 }
 
-static void singleTableHelp(FILE * f,
+static void singleTableHelp(FILE * fp,
 		/*@null@*/ const struct poptOption * table, int left,
 		/*@null@*/ const char * translation_domain)
+	/*@modifies *fp, fileSystem @*/
 {
     const struct poptOption * opt;
     const char *sub_transdom;
@@ -223,7 +228,7 @@ static void singleTableHelp(FILE * f,
     for (opt = table; (opt->longName || opt->shortName || opt->arg); opt++) {
 	if ((opt->longName || opt->shortName) && 
 	    !(opt->argInfo & POPT_ARGFLAG_DOC_HIDDEN))
-	    singleOptionHelp(f, left, opt, translation_domain);
+	    singleOptionHelp(fp, left, opt, translation_domain);
     }
 
     if (table != NULL)
@@ -234,49 +239,51 @@ static void singleTableHelp(FILE * f,
 		sub_transdom = translation_domain;
 	    
 	    if (opt->descrip)
-		fprintf(f, "\n%s\n", D_(sub_transdom, opt->descrip));
+		fprintf(fp, "\n%s\n", D_(sub_transdom, opt->descrip));
 
-	    singleTableHelp(f, opt->arg, left, sub_transdom);
+	    singleTableHelp(fp, opt->arg, left, sub_transdom);
 	}
     }
 }
 
-static int showHelpIntro(poptContext con, FILE * f)
+static int showHelpIntro(poptContext con, FILE * fp)
+	/*@modifies *fp, fileSystem @*/
 {
     int len = 6;
     const char * fn;
 
-    fprintf(f, POPT_("Usage:"));
+    fprintf(fp, POPT_("Usage:"));
     if (!(con->flags & POPT_CONTEXT_KEEP_FIRST)) {
 	/*@-nullderef@*/	/* LCL: wazzup? */
 	fn = con->optionStack->argv[0];
 	/*@=nullderef@*/
 	if (fn == NULL) return len;
 	if (strchr(fn, '/')) fn = strrchr(fn, '/') + 1;
-	fprintf(f, " %s", fn);
+	fprintf(fp, " %s", fn);
 	len += strlen(fn) + 1;
     }
 
     return len;
 }
 
-void poptPrintHelp(poptContext con, FILE * f, /*@unused@*/ int flags)
+void poptPrintHelp(poptContext con, FILE * fp, /*@unused@*/ int flags)
 {
     int leftColWidth;
 
-    (void) showHelpIntro(con, f);
+    (void) showHelpIntro(con, fp);
     if (con->otherHelp)
-	fprintf(f, " %s\n", con->otherHelp);
+	fprintf(fp, " %s\n", con->otherHelp);
     else
-	fprintf(f, " %s\n", POPT_("[OPTION...]"));
+	fprintf(fp, " %s\n", POPT_("[OPTION...]"));
 
     leftColWidth = maxArgWidth(con->options, NULL);
-    singleTableHelp(f, con->options, leftColWidth, NULL);
+    singleTableHelp(fp, con->options, leftColWidth, NULL);
 }
 
-static int singleOptionUsage(FILE * f, int cursor, 
+static int singleOptionUsage(FILE * fp, int cursor, 
 		const struct poptOption * opt,
 		/*@null@*/ const char *translation_domain)
+	/*@modifies *fp, fileSystem @*/
 {
     int len = 3;
     char shortStr[2] = { '\0', '\0' };
@@ -300,11 +307,11 @@ static int singleOptionUsage(FILE * f, int cursor,
 	len += strlen(argDescrip) + 1;
 
     if ((cursor + len) > 79) {
-	fprintf(f, "\n       ");
+	fprintf(fp, "\n       ");
 	cursor = 7;
     } 
 
-    fprintf(f, " [-%s%s%s%s]",
+    fprintf(fp, " [-%s%s%s%s]",
 	((opt->shortName || (opt->argInfo & POPT_ARGFLAG_ONEDASH)) ? "" : "-"),
 	item,
 	(argDescrip ? (opt->shortName != '\0' ? " " : "=") : ""),
@@ -313,9 +320,10 @@ static int singleOptionUsage(FILE * f, int cursor,
     return cursor + len + 1;
 }
 
-static int singleTableUsage(FILE * f,
+static int singleTableUsage(FILE * fp,
 		int cursor, const struct poptOption * opt,
 		/*@null@*/ const char * translation_domain)
+	/*@modifies *fp, fileSystem @*/
 {
     /*@-branchstate@*/		/* FIX: W2DO? */
     if (opt != NULL)
@@ -324,10 +332,10 @@ static int singleTableUsage(FILE * f,
 	    translation_domain = (const char *)opt->arg;
 	} else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE) {
 	    if (opt->arg)	/* XXX program error */
-	    cursor = singleTableUsage(f, cursor, opt->arg, translation_domain);
+	    cursor = singleTableUsage(fp, cursor, opt->arg, translation_domain);
 	} else if ((opt->longName || opt->shortName) &&
 		 !(opt->argInfo & POPT_ARGFLAG_DOC_HIDDEN)) {
-	    cursor = singleOptionUsage(f, cursor, opt, translation_domain);
+	    cursor = singleOptionUsage(fp, cursor, opt, translation_domain);
 	}
     }
     /*@=branchstate@*/
@@ -335,8 +343,9 @@ static int singleTableUsage(FILE * f,
     return cursor;
 }
 
-static int showShortOptions(const struct poptOption * opt, FILE * f,
+static int showShortOptions(const struct poptOption * opt, FILE * fp,
 		/*@null@*/ char * str)
+	/*@modifies *str, *fp, fileSystem @*/
 {
     char * s = alloca(300);	/* larger then the ascii set */
 
@@ -354,34 +363,35 @@ static int showShortOptions(const struct poptOption * opt, FILE * f,
 	    str[strlen(str)] = opt->shortName;
 	else if ((opt->argInfo & POPT_ARG_MASK) == POPT_ARG_INCLUDE_TABLE)
 	    if (opt->arg)	/* XXX program error */
-		(void) showShortOptions(opt->arg, f, str);
+		(void) showShortOptions(opt->arg, fp, str);
     } 
 
     if (s != str || *s != '\0')
 	return 0;
 
-    fprintf(f, " [-%s]", s);
+    fprintf(fp, " [-%s]", s);
     return strlen(s) + 4;
 }
 
-void poptPrintUsage(poptContext con, FILE * f, /*@unused@*/ int flags)
+void poptPrintUsage(poptContext con, FILE * fp, /*@unused@*/ int flags)
 {
     int cursor;
 
-    cursor = showHelpIntro(con, f);
-    cursor += showShortOptions(con->options, f, NULL);
-    (void) singleTableUsage(f, cursor, con->options, NULL);
+    cursor = showHelpIntro(con, fp);
+    cursor += showShortOptions(con->options, fp, NULL);
+    (void) singleTableUsage(fp, cursor, con->options, NULL);
 
     if (con->otherHelp) {
 	cursor += strlen(con->otherHelp) + 1;
-	if (cursor > 79) fprintf(f, "\n       ");
-	fprintf(f, " %s", con->otherHelp);
+	if (cursor > 79) fprintf(fp, "\n       ");
+	fprintf(fp, " %s", con->otherHelp);
     }
 
-    fprintf(f, "\n");
+    fprintf(fp, "\n");
 }
 
-void poptSetOtherOptionHelp(poptContext con, const char * text) {
-    if (con->otherHelp) free((void *)con->otherHelp);
+void poptSetOtherOptionHelp(poptContext con, const char * text)
+{
+    con->otherHelp = _free(con->otherHelp);
     con->otherHelp = xstrdup(text);
 }
diff --git a/popt/poptint.h b/popt/poptint.h
index 59841e0db..fe8430b76 100644
--- a/popt/poptint.h
+++ b/popt/poptint.h
@@ -14,7 +14,10 @@
  * @param p		memory to free
  * @retval		NULL always
  */
-/*@unused@*/ static inline /*@null@*/ void * _free(/*@only@*/ /*@null@*/ const void * p) {
+/*@unused@*/ static inline /*@null@*/ void *
+_free(/*@only@*/ /*@null@*/ const void * p)
+	/*@modifies p @*/
+{
     if (p != NULL)	free((void *)p);
     return NULL;
 }
diff --git a/python/Makefile.in b/python/Makefile.in
index 185b33b4e..4b5f440e4 100644
--- a/python/Makefile.in
+++ b/python/Makefile.in
@@ -128,6 +128,7 @@ RPMGROUP = @RPMGROUP@
 RPMUID = @RPMUID@
 RPMUSER = @RPMUSER@
 SYSCONFIGDIR = @SYSCONFIGDIR@
+TOP_SOURCEDIR = @TOP_SOURCEDIR@
 U = @U@
 UNZIPBIN = @UNZIPBIN@
 USE_INCLUDED_LIBINTL = @USE_INCLUDED_LIBINTL@
diff --git a/rpmdb/db1.c b/rpmdb/db1.c
index 0fe7e8818..eb451e63c 100644
--- a/rpmdb/db1.c
+++ b/rpmdb/db1.c
@@ -83,7 +83,9 @@ static /*@observer@*/ char * db_strerror(int error)
     /*@notreached@*/
 }
 
-static int cvtdberr(dbiIndex dbi, const char * msg, int error, int printit) {
+static int cvtdberr(dbiIndex dbi, const char * msg, int error, int printit)
+	/*@modifies dbi, fileSystem @*/
+{
     int rc = 0;
 
     if (error == 0)
@@ -106,7 +108,9 @@ static int cvtdberr(dbiIndex dbi, const char * msg, int error, int printit) {
 }
 #endif	/* DYING */
 
-static int db1sync(dbiIndex dbi, /*@unused@*/ unsigned int flags) {
+static int db1sync(dbiIndex dbi, /*@unused@*/ unsigned int flags)
+	/*@modifies fileSystem @*/
+{
     int rc = 0;
 
     if (dbi->dbi_db) {
@@ -129,6 +133,7 @@ static int db1sync(dbiIndex dbi, /*@unused@*/ unsigned int flags) {
 }
 
 /*@null@*/ static void * doGetRecord(dbiIndex dbi, unsigned int offset)
+	/*@modifies dbi, fileSystem @*/
 {
     FD_t pkgs = dbi->dbi_db;
     void * uh = NULL;
@@ -234,22 +239,32 @@ exit:
     return uh;
 }
 
-static int db1copen(/*@unused@*/ dbiIndex dbi, /*@unused@*/ DBC ** dbcp, unsigned int flags) {
+static int db1copen(/*@unused@*/ dbiIndex dbi,
+		/*@unused@*/ DBC ** dbcp, unsigned int flags)
+	/*@modifies *dbcp @*/
+{
     /* XXX per-iterator cursors need to be set to non-NULL. */
     if (flags)
 	*dbcp = (DBC *)-1;
     return 0;
 }
 
-static int db1cclose(dbiIndex dbi, /*@unused@*/ DBC * dbcursor, /*@unused@*/ unsigned int flags) {
+static int db1cclose(dbiIndex dbi,
+		/*@unused@*/ DBC * dbcursor, /*@unused@*/ unsigned int flags)
+	/*@modifies dbi @*/
+{
     dbi->dbi_lastoffset = 0;
     return 0;
 }
 
 /*@-compmempass@*/
-static int db1cget(dbiIndex dbi, /*@unused@*/ DBC * dbcursor, void ** keyp,
-		size_t * keylen, void ** datap, size_t * datalen,
+static int db1cget(dbiIndex dbi, /*@unused@*/ DBC * dbcursor,
+		/*@null@*/ void ** keyp,
+		/*@null@*/ size_t * keylen, 
+		/*@null@*/ void ** datap, 
+		/*@null@*/ size_t * datalen,
 		/*@unused@*/ unsigned int flags)
+	/*@modifies dbi, *keyp, *keylen, *datap, *datalen, fileSystem @*/
 {
     DBT key, data;
     int rc = 0;
@@ -339,6 +354,7 @@ static int db1cget(dbiIndex dbi, /*@unused@*/ DBC * dbcursor, void ** keyp,
 
 static int db1cdel(dbiIndex dbi, /*@unused@*/ DBC * dbcursor, const void * keyp,
 		size_t keylen, /*@unused@*/ unsigned int flags)
+	/*@modifies dbi, fileSystem @*/
 {
     DBT key;
     int rc = 0;
@@ -373,6 +389,7 @@ static int db1cput(dbiIndex dbi, /*@unused@*/ DBC * dbcursor,
 		const void * keyp, size_t keylen,
 		const void * datap, size_t datalen,
 		/*@unused@*/ unsigned int flags)
+	/*@modifies dbi, datap, fileSystem @*/
 {
     DBT key, data;
     int rc = 0;
@@ -426,21 +443,25 @@ static int db1cput(dbiIndex dbi, /*@unused@*/ DBC * dbcursor,
 static int db1ccount(/*@unused@*/ dbiIndex dbi, /*@unused@*/ DBC * dbcursor,
 		/*@unused@*/ /*@out@*/ unsigned int * countp,
 		/*@unused@*/ unsigned int flags)
+	/*@*/
 {
     return EINVAL;
 }
 
 static int db1byteswapped(/*@unused@*/dbiIndex dbi)
+	/*@*/
 {
     return 0;
 }
 
 static int db1stat(/*@unused@*/ dbiIndex dbi, /*@unused@*/ unsigned int flags)
+	/*@*/
 {
     return EINVAL;
 }
 
 static int db1close(/*@only@*/ dbiIndex dbi, /*@unused@*/ unsigned int flags)
+	/*@modifies dbi, fileSystem @*/
 {
     rpmdb rpmdb = dbi->dbi_rpmdb;
     const char * base = db1basename(dbi->dbi_rpmtag);
@@ -483,6 +504,7 @@ static int db1close(/*@only@*/ dbiIndex dbi, /*@unused@*/ unsigned int flags)
 
 static int db1open(/*@keep@*/ rpmdb rpmdb, int rpmtag,
 	/*@out@*/ dbiIndex * dbip)
+	/*@modifies *dbip, fileSystem @*/
 {
     /*@-nestedextern@*/
     extern struct _dbiVec db1vec;
diff --git a/rpmdb/db3.c b/rpmdb/db3.c
index 61291c4d9..b9b7d6989 100644
--- a/rpmdb/db3.c
+++ b/rpmdb/db3.c
@@ -138,7 +138,9 @@ static int db_env_create(DB_ENV **dbenvp, int foo)
 }
 #endif	/* __USE_DB2 */
 
-static int cvtdberr(dbiIndex dbi, const char * msg, int error, int printit) {
+static int cvtdberr(dbiIndex dbi, const char * msg, int error, int printit)
+	/*@modifies fileSystem @*/
+{
     int rc = 0;
 
     rc = error;
@@ -158,6 +160,7 @@ static int cvtdberr(dbiIndex dbi, const char * msg, int error, int printit) {
 static int db_fini(dbiIndex dbi, const char * dbhome,
 		/*@null@*/ const char * dbfile,
 		/*@unused@*/ /*@null@*/ const char * dbsubfile)
+	/*@modifies dbi, fileSystem @*/
 {
     rpmdb rpmdb = dbi->dbi_rpmdb;
     DB_ENV * dbenv = dbi->dbi_dbenv;
@@ -204,14 +207,17 @@ static int db_fini(dbiIndex dbi, const char * dbhome,
     return rc;
 }
 
-static int db3_fsync_disable(/*@unused@*/ int fd) {
+static int db3_fsync_disable(/*@unused@*/ int fd)
+	/*@*/
+{
     return 0;
 }
 
-static int db_init(dbiIndex dbi, const char *dbhome,
-		/*@null@*/ const char *dbfile,
+static int db_init(dbiIndex dbi, const char * dbhome,
+		/*@null@*/ const char * dbfile,
 		/*@unused@*/ /*@null@*/ const char * dbsubfile,
-		/*@out@*/ DB_ENV **dbenvp)
+		/*@out@*/ DB_ENV ** dbenvp)
+	/*@modifies dbi, *dbenvp, fileSystem @*/
 {
     rpmdb rpmdb = dbi->dbi_rpmdb;
     DB_ENV *dbenv = NULL;
@@ -222,8 +228,10 @@ static int db_init(dbiIndex dbi, const char *dbhome,
 	return 1;
 
     /* XXX HACK */
+    /*@-assignexpose@*/
     if (rpmdb->db_errfile == NULL)
 	rpmdb->db_errfile = stderr;
+    /*@=assignexpose@*/
 
     eflags = (dbi->dbi_oeflags | dbi->dbi_eflags);
     if (eflags & DB_JOINENV) eflags &= DB_JOINENV;
@@ -351,6 +359,7 @@ errxit:
 #endif	/* __USE_DB2 || __USE_DB3 */
 
 static int db3sync(dbiIndex dbi, unsigned int flags)
+	/*@modifies fileSystem @*/
 {
     DB * db = dbi->dbi_db;
     int rc = 0;
@@ -371,6 +380,7 @@ static int db3sync(dbiIndex dbi, unsigned int flags)
 }
 
 static int db3c_del(dbiIndex dbi, DBC * dbcursor, u_int32_t flags)
+	/*@modifies fileSystem @*/
 {
     int rc;
 
@@ -381,16 +391,19 @@ static int db3c_del(dbiIndex dbi, DBC * dbcursor, u_int32_t flags)
 
 /*@unused@*/ static int db3c_dup(dbiIndex dbi, DBC * dbcursor, DBC ** dbcp,
 		u_int32_t flags)
+	/*@modifies *dbcp, fileSystem @*/
 {
     int rc;
 
+    if (dbcp) *dbcp = NULL;
     rc = dbcursor->c_dup(dbcursor, dbcp, flags);
     rc = cvtdberr(dbi, "dbcursor->c_dup", rc, _debug);
     return rc;
 }
 
 static int db3c_get(dbiIndex dbi, DBC * dbcursor,
-	DBT * key, DBT * data, u_int32_t flags)
+		DBT * key, DBT * data, u_int32_t flags)
+	/*@modifies fileSystem @*/
 {
     int _printit;
     int rc;
@@ -412,7 +425,8 @@ static int db3c_get(dbiIndex dbi, DBC * dbcursor,
 }
 
 static int db3c_put(dbiIndex dbi, DBC * dbcursor,
-	DBT * key, DBT * data, u_int32_t flags)
+		DBT * key, DBT * data, u_int32_t flags)
+	/*@modifies fileSystem @*/
 {
     int rc;
 
@@ -423,6 +437,7 @@ static int db3c_put(dbiIndex dbi, DBC * dbcursor,
 }
 
 static inline int db3c_close(dbiIndex dbi, /*@only@*/ /*@null@*/ DBC * dbcursor)
+	/*@modifies fileSystem @*/
 {
     int rc;
 
@@ -433,7 +448,9 @@ static inline int db3c_close(dbiIndex dbi, /*@only@*/ /*@null@*/ DBC * dbcursor)
     return rc;
 }
 
-static inline int db3c_open(dbiIndex dbi, /*@out@*/ DBC ** dbcp, int dbiflags)
+static inline int db3c_open(dbiIndex dbi, /*@null@*/ /*@out@*/ DBC ** dbcp,
+		int dbiflags)
+	/*@modifies *dbcp, fileSystem @*/
 {
     DB * db = dbi->dbi_db;
     DB_TXN * txnid = NULL;
@@ -448,6 +465,7 @@ static inline int db3c_open(dbiIndex dbi, /*@out@*/ DBC ** dbcp, int dbiflags)
 	flags = DB_WRITECURSOR;
     } else
 	flags = 0;
+    if (dbcp) *dbcp = NULL;
     rc = db->cursor(db, txnid, dbcp, flags);
 #else	/* __USE_DB3 */
     rc = db->cursor(db, txnid, dbcp);
@@ -459,6 +477,7 @@ static inline int db3c_open(dbiIndex dbi, /*@out@*/ DBC ** dbcp, int dbiflags)
 
 static int db3cclose(dbiIndex dbi, /*@only@*/ /*@null@*/ DBC * dbcursor,
 		unsigned int flags)
+	/*@modifies dbi, fileSystem @*/
 {
     int rc = 0;
 
@@ -479,7 +498,9 @@ static int db3cclose(dbiIndex dbi, /*@only@*/ /*@null@*/ DBC * dbcursor,
     /*@-usereleased -compdef@*/ return rc; /*@=usereleased =compdef@*/
 }
 
-static int db3copen(dbiIndex dbi, /*@out@*/ DBC ** dbcp, unsigned int flags)
+static int db3copen(dbiIndex dbi,
+		/*@null@*/ /*@out@*/ DBC ** dbcp, unsigned int flags)
+	/*@modifies dbi, *dbcp, fileSystem @*/
 {
     DBC * dbcursor;
     int rc = 0;
@@ -508,6 +529,7 @@ static int db3cput(dbiIndex dbi, DBC * dbcursor,
 		const void * keyp, size_t keylen,
 		const void * datap, size_t datalen,
 		/*@unused@*/ unsigned int flags)
+	/*@modifies fileSystem @*/
 {
     DB * db = dbi->dbi_db;
     DB_TXN * txnid = NULL;
@@ -537,6 +559,7 @@ static int db3cput(dbiIndex dbi, DBC * dbcursor,
 static int db3cdel(dbiIndex dbi, DBC * dbcursor,
 		const void * keyp, size_t keylen,
 		/*@unused@*/ unsigned int flags)
+	/*@modifies fileSystem @*/
 {
     DB * db = dbi->dbi_db;
     DB_TXN * txnid = NULL;
@@ -571,6 +594,7 @@ static int db3cget(dbiIndex dbi, DBC * dbcursor,
 		void ** keyp, size_t * keylen,
 		void ** datap, size_t * datalen,
 		/*@unused@*/ unsigned int flags)
+	/*@modifies *keyp, *keylen, *datap, *datalen, fileSystem @*/
 {
     DB * db = dbi->dbi_db;
     DB_TXN * txnid = NULL;
@@ -618,8 +642,9 @@ static int db3cget(dbiIndex dbi, DBC * dbcursor,
 }
 
 static int db3ccount(dbiIndex dbi, DBC * dbcursor,
-		/*@out@*/ unsigned int * countp,
+		/*@null@*/ /*@out@*/ unsigned int * countp,
 		/*@unused@*/ unsigned int flags)
+	/*@modifies *countp, fileSystem @*/
 {
     db_recno_t count = 0;
     int rc = 0;
@@ -633,7 +658,7 @@ static int db3ccount(dbiIndex dbi, DBC * dbcursor,
     return rc;
 }
 
-static int db3byteswapped(dbiIndex dbi)
+static int db3byteswapped(dbiIndex dbi)	/*@*/
 {
     DB * db = dbi->dbi_db;
     int rc = 0;
@@ -647,6 +672,7 @@ static int db3byteswapped(dbiIndex dbi)
 }
 
 static int db3stat(dbiIndex dbi, unsigned int flags)
+	/*@modifies dbi, fileSystem @*/
 {
     DB * db = dbi->dbi_db;
     int rc = 0;
@@ -671,6 +697,7 @@ static int db3stat(dbiIndex dbi, unsigned int flags)
 
 /** @todo Add/use per-rpmdb verify_on_close. */
 static int db3close(/*@only@*/ dbiIndex dbi, /*@unused@*/ unsigned int flags)
+	/*@modifies dbi, fileSystem @*/
 {
     rpmdb rpmdb = dbi->dbi_rpmdb;
     const char * urlfn = NULL;
@@ -772,6 +799,7 @@ exit:
 }
 
 static int db3open(/*@keep@*/ rpmdb rpmdb, int rpmtag, dbiIndex * dbip)
+	/*@modifies *dbip, fileSystem @*/
 {
     /*@-nestedextern@*/
     extern struct _dbiVec db3vec;
diff --git a/rpmdb/dbconfig.c b/rpmdb/dbconfig.c
index c4ed81e19..ab6470601 100644
--- a/rpmdb/dbconfig.c
+++ b/rpmdb/dbconfig.c
@@ -27,7 +27,7 @@ struct _dbiIndex db3dbi;
  *  Analogue to struct poptOption
  */
 struct dbOption {
-/*@null@*/const char * longName;/* may be NULL */
+/*@observer@*/ /*@null@*/const char * longName;	/* may be NULL */
     const char shortName;	/* may be '\0' */
     int argInfo;
 /*@null@*/ void * arg;		/* depends on argInfo */
@@ -315,7 +315,7 @@ dbiIndex db3Free(dbiIndex dbi) {
 }
 
 /** @todo Set a reasonable "last gasp" default db config. */
-static const char *db3_config_default =
+/*@observer@*/ static const char *db3_config_default =
     "db3:hash:mpool:cdb:usecursors:verbose:mp_mmapsize=8Mb:mp_size=512Kb:pagesize=512:perms=0644";
 
 dbiIndex db3New(rpmdb rpmdb, int rpmtag)
@@ -356,9 +356,9 @@ dbiIndex db3New(rpmdb rpmdb, int rpmtag)
 	    /* Find and terminate next key=value pair. Save next start point. */
 	    for (oe = o; oe && *oe; oe++) {
 		if (xisspace(*oe))
-		    break;
+		    /*@innerbreak@*/ break;
 		if (oe[0] == ':' && !(oe[1] == '/' && oe[2] == '/'))
-		    break;
+		    /*@innerbreak@*/ break;
 	    }
 	    if (oe && *oe)
 		*oe++ = '\0';
@@ -367,18 +367,18 @@ dbiIndex db3New(rpmdb rpmdb, int rpmtag)
 
 	    /* Separate key from value, save value start (if any). */
 	    for (pe = o; pe && *pe && *pe != '='; pe++)
-		;
+		{};
 	    p = (pe ? *pe++ = '\0', pe : NULL);
 
 	    /* Skip over negation at start of token. */
 	    for (tok = o; *tok == '!'; tok++)
-		;
+		{};
 
 	    /* Find key in option table. */
 	    for (opt = rdbOptions; opt->longName != NULL; opt++) {
 		if (strcmp(tok, opt->longName))
 		    continue;
-		break;
+		/*@innerbreak@*/ break;
 	    }
 	    if (opt->longName == NULL) {
 		rpmError(RPMERR_DBCONFIG,
@@ -452,8 +452,10 @@ dbiIndex db3New(rpmdb rpmdb, int rpmtag)
 
     dbOpts = _free(dbOpts);
 
-    *dbi = db3dbi;	/* structure assignment */
     memset(&db3dbi, 0, sizeof(db3dbi));
+    /*@-assignexpose@*/
+    *dbi = db3dbi;	/* structure assignment */
+    /*@=assignexpose@*/
 
     if (!(dbi->dbi_perms & 0600))
 	dbi->dbi_perms = 0644;
@@ -472,7 +474,9 @@ dbiIndex db3New(rpmdb rpmdb, int rpmtag)
 	dbi->dbi_jlen = 2 * sizeof(int_32);
 	break;
     }
+    /*@-globstate@*/
     return dbi;
+    /*@=globstate@*/
 }
 
 const char *const prDbiOpenFlags(int dbflags, int print_dbenv_flags)
diff --git a/rpmdb/falloc.h b/rpmdb/falloc.h
index 621f98cab..b8d21fda0 100644
--- a/rpmdb/falloc.h
+++ b/rpmdb/falloc.h
@@ -16,45 +16,56 @@
 extern "C" {
 #endif
 
-/*@unused@*/ static inline long int fadGetFileSize(FD_t fd) {
+/*@unused@*/ static inline long int fadGetFileSize(FD_t fd) /*@*/ {
     return fd->fileSize;
 }
 
-/*@unused@*/ static inline void fadSetFileSize(FD_t fd, long int fileSize) {
+/*@unused@*/ static inline void fadSetFileSize(FD_t fd, long int fileSize)
+	/*@modifies fd @*/
+{
     fd->fileSize = fileSize;
 }
 
-/*@unused@*/ static inline unsigned int fadGetFirstFree(FD_t fd) {
+/*@unused@*/ static inline unsigned int fadGetFirstFree(FD_t fd) /*@*/ {
     return fd->firstFree;
 }
 
-/*@unused@*/ static inline void fadSetFirstFree(FD_t fd, unsigned int firstFree) {
+/*@unused@*/ static inline void fadSetFirstFree(FD_t fd, unsigned int firstFree)
+	/*@modifies fd @*/
+{
     fd->firstFree = firstFree;
 }
 
 /** \ingroup db1
  */
-/*@null@*/ FD_t	fadOpen		(const char * path, int flags, mode_t perms);
+/*@null@*/ FD_t	fadOpen(const char * path, int flags, mode_t perms)
+	/*@modifies fileSystem @*/;
 
 /** \ingroup db1
- * @param fd			file handle
+ * @param fd		file handle
+ * @return		0 on failure
  */
-unsigned int	fadAlloc	(FD_t fd, unsigned int size); /* 0 on failure */
+unsigned int fadAlloc(FD_t fd, unsigned int size)
+	/*@modifies fd, fileSystem @*/;
 
 /** \ingroup db1
- * @param fd			file handle
+ * @param fd		file handle
  */
-void		fadFree		(FD_t fd, unsigned int offset);
+void fadFree(FD_t fd, unsigned int offset)
+	/*@modifies fd, fileSystem @*/;
 
 /** \ingroup db1
- * @param fd			file handle
+ * @param fd		file handle
  */
-int		fadFirstOffset	(FD_t fd);
+int fadFirstOffset(FD_t fd)
+	/*@modifies fd, fileSystem @*/;
 
 /** \ingroup db1
- * @param fd			file handle
+ * @param fd		file handle
+ * @return		next offset, 0 to terminate
  */
-int		fadNextOffset	(FD_t fd, unsigned int lastoff); /* 0 at end */
+int fadNextOffset(FD_t fd, unsigned int lastoff)
+	/*@modifies fd, fileSystem @*/;
 
 #ifdef __cplusplus
 }
diff --git a/rpmdb/fprint.c b/rpmdb/fprint.c
index 1205f9629..d85b8df40 100644
--- a/rpmdb/fprint.c
+++ b/rpmdb/fprint.c
@@ -34,6 +34,7 @@ void fpCacheFree(fingerPrintCache cache)
 static /*@null@*/ const struct fprintCacheEntry_s * cacheContainsDirectory(
 			    fingerPrintCache cache,
 			    const char * dirName)
+	/*@*/
 {
     const void ** data;
 
@@ -51,7 +52,8 @@ static /*@null@*/ const struct fprintCacheEntry_s * cacheContainsDirectory(
  * @return pointer to the finger print associated with a file path.
  */
 static fingerPrint doLookup(fingerPrintCache cache,
-	const char * dirName, const char * baseName, int scareMemory)
+		const char * dirName, const char * baseName, int scareMemory)
+	/*@modifies cache @*/
 {
     char dir[PATH_MAX];
     const char * cleanDirName;
diff --git a/rpmdb/fprint.h b/rpmdb/fprint.h
index 221130a9e..df7c1c61b 100644
--- a/rpmdb/fprint.h
+++ b/rpmdb/fprint.h
@@ -68,13 +68,15 @@ extern "C" {
  * @param sizeHint	number of elements expected
  * @return pointer to initialized fingerprint cache
  */
-/*@only@*/ fingerPrintCache fpCacheCreate(int sizeHint)	/*@*/;
+/*@only@*/ fingerPrintCache fpCacheCreate(int sizeHint)
+	/*@*/;
 
 /**
  * Destroy finger print cache.
  * @param cache		pointer to fingerprint cache
  */
-void		fpCacheFree(/*@only@*/ fingerPrintCache cache);
+void fpCacheFree(/*@only@*/ fingerPrintCache cache)
+	/*@modifies cache @*/;
 
 /**
  * Return finger print of a file path.
@@ -84,8 +86,9 @@ void		fpCacheFree(/*@only@*/ fingerPrintCache cache);
  * @param scareMemory
  * @return pointer to the finger print associated with a file path.
  */
-fingerPrint	fpLookup(fingerPrintCache cache, const char * dirName, 
-			const char * baseName, int scareMemory)	/*@*/;
+fingerPrint fpLookup(fingerPrintCache cache, const char * dirName, 
+			const char * baseName, int scareMemory)
+	/*@modifies cache @*/;
 
 /**
  * Return hash value for a finger print.
@@ -93,7 +96,8 @@ fingerPrint	fpLookup(fingerPrintCache cache, const char * dirName,
  * @param key		pointer to finger print entry
  * @return hash value
  */
-unsigned int fpHashFunction(const void * key)	/*@*/;
+unsigned int fpHashFunction(const void * key)
+	/*@*/;
 
 /**
  * Compare two finger print entries.
@@ -102,7 +106,8 @@ unsigned int fpHashFunction(const void * key)	/*@*/;
  * @param key2		finger print 2
  * @return result of comparing key1 and key2
  */
-int fpEqual(const void * key1, const void * key2)	/*@*/;
+int fpEqual(const void * key1, const void * key2)
+	/*@*/;
 
 /**
  * Return finger prints of an array of file paths.
@@ -117,7 +122,7 @@ int fpEqual(const void * key1, const void * key2)	/*@*/;
 void fpLookupList(fingerPrintCache cache, const char ** dirNames, 
 		  const char ** baseNames, const int * dirIndexes, 
 		  int fileCount, fingerPrint * fpList)
-			/*@modifies cache, *fpList @*/;
+	/*@modifies cache, *fpList @*/;
 
 /**
  * Return finger prints of all file names in header.
diff --git a/rpmdb/rpmdb.c b/rpmdb/rpmdb.c
index ac61c58ed..858b70ee1 100644
--- a/rpmdb/rpmdb.c
+++ b/rpmdb/rpmdb.c
@@ -46,11 +46,11 @@ static int dbiTagsMax = 0;
  * @param rpmtag	rpm header tag
  * @return dbi index, -1 on error
  */
-static int dbiTagToDbix(int rpmtag)
+static int dbiTagToDbix(int rpmtag)	/*@*/
 {
     int dbix;
 
-    if (!(dbiTags != NULL && dbiTagsMax > 0))
+    if (dbiTags == NULL || dbiTagsMax <= 0)
 	return -1;
     for (dbix = 0; dbix < dbiTagsMax; dbix++) {
 	if (rpmtag == dbiTags[dbix])
@@ -63,6 +63,7 @@ static int dbiTagToDbix(int rpmtag)
  * Initialize database (index, tag) tuple from configuration.
  */
 static void dbiTagsInit(void)
+	/*@modifies dbiTags, dbiTagsMax @*/
 {
 /*@observer@*/ static const char * const _dbiTagStr_default =
 	"Packages:Name:Basenames:Group:Requirename:Providename:Conflictname:Triggername:Dirnames:Requireversion:Provideversion:Installtid:Removetid";
@@ -94,9 +95,9 @@ static void dbiTagsInit(void)
 	    break;
 	for (oe = o; oe && *oe; oe++) {
 	    if (xisspace(*oe))
-		break;
+		/*@innerbreak@*/ break;
 	    if (oe[0] == ':' && !(oe[1] == '/' && oe[2] == '/'))
-		break;
+		/*@innerbreak@*/ break;
 	}
 	if (oe && *oe)
 	    *oe++ = '\0';
@@ -307,14 +308,14 @@ fprintf(stderr, "    Close %s\n", tagName(dbi->dbi_rpmtag));
     return (*dbi->dbi_vec->close) (dbi, flags);
 }
 
-dbiIndex dbiOpen(rpmdb rpmdb, int rpmtag, /*@unused@*/ unsigned int flags)
+dbiIndex dbiOpen(rpmdb db, int rpmtag, /*@unused@*/ unsigned int flags)
 {
     int dbix;
     dbiIndex dbi = NULL;
     int _dbapi, _dbapi_rebuild, _dbapi_wanted;
     int rc = 0;
 
-    if (rpmdb == NULL)
+    if (db == NULL)
 	return NULL;
 
     dbix = dbiTagToDbix(rpmtag);
@@ -322,13 +323,13 @@ dbiIndex dbiOpen(rpmdb rpmdb, int rpmtag, /*@unused@*/ unsigned int flags)
 	return NULL;
 
     /* Is this index already open ? */
-    if ((dbi = rpmdb->_dbi[dbix]) != NULL)
+    if ((dbi = db->_dbi[dbix]) != NULL)
 	return dbi;
 
     _dbapi_rebuild = rpmExpandNumeric("%{_dbapi_rebuild}");
     if (_dbapi_rebuild < 1 || _dbapi_rebuild > 3)
 	_dbapi_rebuild = 3;
-    _dbapi_wanted = (_rebuildinprogress ? -1 : rpmdb->db_api);
+    _dbapi_wanted = (_rebuildinprogress ? -1 : db->db_api);
 
     switch (_dbapi_wanted) {
     default:
@@ -338,7 +339,7 @@ dbiIndex dbiOpen(rpmdb rpmdb, int rpmtag, /*@unused@*/ unsigned int flags)
 	}
 	errno = 0;
 	dbi = NULL;
-	rc = (*mydbvecs[_dbapi]->open) (rpmdb, rpmtag, &dbi);
+	rc = (*mydbvecs[_dbapi]->open) (db, rpmtag, &dbi);
 	if (rc) {
 	    static int _printed[32];
 	    if (!_printed[dbix & 0x1f]++)
@@ -356,9 +357,9 @@ dbiIndex dbiOpen(rpmdb rpmdb, int rpmtag, /*@unused@*/ unsigned int flags)
 		continue;
 	    errno = 0;
 	    dbi = NULL;
-	    rc = (*mydbvecs[_dbapi]->open) (rpmdb, rpmtag, &dbi);
+	    rc = (*mydbvecs[_dbapi]->open) (db, rpmtag, &dbi);
 	    if (rc == 0 && dbi)
-		break;
+		/*@loopbreak@*/ break;
 	}
 	if (_dbapi <= 0) {
 	    static int _printed[32];
@@ -368,8 +369,8 @@ dbiIndex dbiOpen(rpmdb rpmdb, int rpmtag, /*@unused@*/ unsigned int flags)
 	    rc = 1;
 	    goto exit;
 	}
-	if (rpmdb->db_api == -1 && _dbapi > 0)
-	    rpmdb->db_api = _dbapi;
+	if (db->db_api == -1 && _dbapi > 0)
+	    db->db_api = _dbapi;
     	break;
     }
 
@@ -393,7 +394,7 @@ dbiIndex dbiOpen(rpmdb rpmdb, int rpmtag, /*@unused@*/ unsigned int flags)
 
 exit:
     if (rc == 0 && dbi)
-	rpmdb->_dbi[dbix] = dbi;
+	db->_dbi[dbix] = dbi;
     else
 	dbi = db3Free(dbi);
 
@@ -406,7 +407,8 @@ exit:
  * @param tagNum	tag index in header
  * @return		new item
  */
-static INLINE dbiIndexItem dbiIndexNewItem(unsigned int hdrNum, unsigned int tagNum) {
+static INLINE dbiIndexItem dbiIndexNewItem(unsigned int hdrNum, unsigned int tagNum)
+{
     dbiIndexItem rec = xcalloc(1, sizeof(*rec));
     rec->hdrNum = hdrNum;
     rec->tagNum = tagNum;
@@ -435,6 +437,7 @@ union _dbswap {
  */
 static int dbiSearch(dbiIndex dbi, DBC * dbcursor,
 	const char * keyp, size_t keylen, /*@out@*/ dbiIndexSet * setp)
+	/*@modifies *dbcursor, *setp @*/
 {
     void * datap = NULL;
     size_t datalen = 0;
@@ -443,7 +446,9 @@ static int dbiSearch(dbiIndex dbi, DBC * dbcursor,
     if (setp) *setp = NULL;
     if (keylen == 0) keylen = strlen(keyp);
 
+    /*@-mods@*/		/* FIX: indirection @*/
     rc = dbiGet(dbi, dbcursor, (void **)&keyp, &keylen, &datap, &datalen, 0);
+    /*@=mods@*/
 
     if (rc > 0) {
 	rpmError(RPMERR_DBGETINDEX,
@@ -514,9 +519,10 @@ static int dbiSearch(dbiIndex dbi, DBC * dbcursor,
  * @param set		items to update in index database
  * @return		0 success, 1 not found
  */
-/*@-compmempass@*/
+/*@-compmempass -mustmod@*/
 static int dbiUpdateIndex(dbiIndex dbi, DBC * dbcursor,
-	const void * keyp, size_t keylen, dbiIndexSet set)
+		const void * keyp, size_t keylen, dbiIndexSet set)
+	/*@modifies *dbcursor, set, fileSystem @*/
 {
     void * datap;
     size_t datalen;
@@ -590,7 +596,7 @@ static int dbiUpdateIndex(dbiIndex dbi, DBC * dbcursor,
 
     return rc;
 }
-/*@=compmempass@*/
+/*@=compmempass =mustmod@*/
 
 /* XXX assumes hdrNum is first int in dbiIndexItem */
 static int hdrNumCmp(const void * one, const void * two) {
@@ -609,6 +615,7 @@ static int hdrNumCmp(const void * one, const void * two) {
  */
 static INLINE int dbiAppendSet(dbiIndexSet set, const void * recs,
 	int nrecs, size_t recsize, int sortset)
+	/*@modifies set @*/
 {
     const char * rptr = recs;
     size_t rlen = (recsize < sizeof(*(set->recs)))
@@ -649,7 +656,8 @@ static INLINE int dbiAppendSet(dbiIndexSet set, const void * recs,
  * @return		0 success, 1 failure (no items found)
  */
 static INLINE int dbiPruneSet(dbiIndexSet set, void * recs, int nrecs,
-	size_t recsize, int sorted)
+		size_t recsize, int sorted)
+	/*@modifies set, recs @*/
 {
     int from;
     int to = 0;
@@ -699,12 +707,16 @@ void dbiFreeIndexSet(dbiIndexSet set) {
 /**
  * Disable all signals, returning previous signal mask.
  */
-static void blockSignals(rpmdb rpmdb, /*@out@*/ sigset_t * oldMask)
+static void blockSignals(/*@unused@*/ rpmdb db, /*@out@*/ sigset_t * oldMask)
+	/*@modifies *oldMask, internalState @*/
 {
     sigset_t newMask;
 
+#ifdef DYING
     /* XXX HACK (disabled) permit ^C aborts for now ... */
-    if (!(rpmdb && rpmdb->db_api == 4)) {
+    if (!(db && db->db_api == 4))
+#endif
+    {
 	(void) sigfillset(&newMask);		/* block all signals */
 	(void) sigprocmask(SIG_BLOCK, &newMask, oldMask);
     }
@@ -713,10 +725,14 @@ static void blockSignals(rpmdb rpmdb, /*@out@*/ sigset_t * oldMask)
 /**
  * Restore signal mask.
  */
-static void unblockSignals(rpmdb rpmdb, sigset_t * oldMask)
+static void unblockSignals(/*@unused@*/ rpmdb db, sigset_t * oldMask)
+	/*@modifies internalState @*/
 {
+#ifdef	DYING
     /* XXX HACK (disabled) permit ^C aborts for now ... */
-    if (!(rpmdb && rpmdb->db_api == 4)) {
+    if (!(db && db->db_api == 4))
+#endif
+    {
 	(void) sigprocmask(SIG_SETMASK, oldMask, NULL);
     }
 }
@@ -739,59 +755,59 @@ static void unblockSignals(rpmdb rpmdb, sigset_t * oldMask)
 };
 /*@=fullinitblock@*/
 
-int rpmdbOpenAll(rpmdb rpmdb)
+int rpmdbOpenAll(rpmdb db)
 {
     int dbix;
     int rc = 0;
 
-    if (rpmdb == NULL) return -2;
+    if (db == NULL) return -2;
 
     if (dbiTags != NULL)
     for (dbix = 0; dbix < dbiTagsMax; dbix++) {
-	if (rpmdb->_dbi[dbix] != NULL)
+	if (db->_dbi[dbix] != NULL)
 	    continue;
-	(void) dbiOpen(rpmdb, dbiTags[dbix], rpmdb->db_flags);
+	(void) dbiOpen(db, dbiTags[dbix], db->db_flags);
     }
     return rc;
 }
 
 /* XXX query.c, rpminstall.c, verify.c */
-int rpmdbClose(rpmdb rpmdb)
+int rpmdbClose(rpmdb db)
 {
     int dbix;
     int rc = 0;
 
-    if (rpmdb == NULL) return 0;
-    if (rpmdb->_dbi)
-    for (dbix = rpmdb->db_ndbi; --dbix >= 0; ) {
+    if (db == NULL) return 0;
+    if (db->_dbi)
+    for (dbix = db->db_ndbi; --dbix >= 0; ) {
 	int xx;
-	if (rpmdb->_dbi[dbix] == NULL)
+	if (db->_dbi[dbix] == NULL)
 	    continue;
 	/*@-unqualifiedtrans@*/		/* FIX: double indirection. */
-    	xx = dbiClose(rpmdb->_dbi[dbix], 0);
+    	xx = dbiClose(db->_dbi[dbix], 0);
 	if (xx && rc == 0) rc = xx;
-    	rpmdb->_dbi[dbix] = NULL;
+    	db->_dbi[dbix] = NULL;
 	/*@=unqualifiedtrans@*/
     }
-    rpmdb->db_errpfx = _free(rpmdb->db_errpfx);
-    rpmdb->db_root = _free(rpmdb->db_root);
-    rpmdb->db_home = _free(rpmdb->db_home);
-    rpmdb->_dbi = _free(rpmdb->_dbi);
-    rpmdb = _free(rpmdb);
+    db->db_errpfx = _free(db->db_errpfx);
+    db->db_root = _free(db->db_root);
+    db->db_home = _free(db->db_home);
+    db->_dbi = _free(db->_dbi);
+    db = _free(db);
     return rc;
 }
 
-int rpmdbSync(rpmdb rpmdb)
+int rpmdbSync(rpmdb db)
 {
     int dbix;
     int rc = 0;
 
-    if (rpmdb == NULL) return 0;
-    for (dbix = 0; dbix < rpmdb->db_ndbi; dbix++) {
+    if (db == NULL) return 0;
+    for (dbix = 0; dbix < db->db_ndbi; dbix++) {
 	int xx;
-	if (rpmdb->_dbi[dbix] == NULL)
+	if (db->_dbi[dbix] == NULL)
 	    continue;
-    	xx = dbiSync(rpmdb->_dbi[dbix], 0);
+    	xx = dbiSync(db->_dbi[dbix], 0);
 	if (xx && rc == 0) rc = xx;
     }
     return rc;
@@ -801,8 +817,9 @@ static /*@only@*/ /*@null@*/
 rpmdb newRpmdb(/*@kept@*/ /*@null@*/ const char * root,
 		/*@kept@*/ /*@null@*/ const char * home,
 		int mode, int perms, int flags)
+	/*@modifies _filterDbDups @*/
 {
-    rpmdb rpmdb = xcalloc(sizeof(*rpmdb), 1);
+    rpmdb db = xcalloc(sizeof(*db), 1);
     const char * epfx = _DB_ERRPFX;
     static int _initialized = 0;
 
@@ -811,39 +828,42 @@ rpmdb newRpmdb(/*@kept@*/ /*@null@*/ const char * root,
 	_initialized = 1;
     }
 
-    *rpmdb = dbTemplate;	/* structure assignment */
+    /*@-assignexpose@*/
+    *db = dbTemplate;	/* structure assignment */
+    /*@=assignexpose@*/
 
     if (!(perms & 0600)) perms = 0644;	/* XXX sanity */
 
-    if (mode >= 0)	rpmdb->db_mode = mode;
-    if (perms >= 0)	rpmdb->db_perms = perms;
-    if (flags >= 0)	rpmdb->db_flags = flags;
+    if (mode >= 0)	db->db_mode = mode;
+    if (perms >= 0)	db->db_perms = perms;
+    if (flags >= 0)	db->db_flags = flags;
 
     /*@-nullpass@*/
-    rpmdb->db_root = rpmGetPath( (root && *root ? root : _DB_ROOT), NULL);
-    rpmdb->db_home = rpmGetPath( (home && *home ? home : _DB_HOME), NULL);
+    db->db_root = rpmGetPath( (root && *root ? root : _DB_ROOT), NULL);
+    db->db_home = rpmGetPath( (home && *home ? home : _DB_HOME), NULL);
     /*@=nullpass@*/
-    if (!(rpmdb->db_home && rpmdb->db_home[0] != '%')) {
+    if (!(db->db_home && db->db_home[0] != '%')) {
 	rpmError(RPMERR_DBOPEN, _("no dbpath has been set\n"));
-	(void) rpmdbClose(rpmdb);
+	(void) rpmdbClose(db);
 	/*@-globstate@*/ return NULL; /*@=globstate@*/
     }
     /*@-nullpass@*/
-    rpmdb->db_errpfx = rpmExpand( (epfx && *epfx ? epfx : _DB_ERRPFX), NULL);
+    db->db_errpfx = rpmExpand( (epfx && *epfx ? epfx : _DB_ERRPFX), NULL);
     /*@=nullpass@*/
-    rpmdb->db_remove_env = 0;
-    rpmdb->db_filter_dups = _filterDbDups;
-    rpmdb->db_ndbi = dbiTagsMax;
-    rpmdb->_dbi = xcalloc(rpmdb->db_ndbi, sizeof(*rpmdb->_dbi));
-    /*@-globstate@*/ return rpmdb; /*@=globstate@*/
+    db->db_remove_env = 0;
+    db->db_filter_dups = _filterDbDups;
+    db->db_ndbi = dbiTagsMax;
+    db->_dbi = xcalloc(db->db_ndbi, sizeof(*db->_dbi));
+    /*@-globstate@*/ return db; /*@=globstate@*/
 }
 
 static int openDatabase(/*@null@*/ const char * prefix,
-	/*@null@*/ const char * dbpath,
-	int _dbapi, /*@null@*/ /*@out@*/ rpmdb *dbp,
-	int mode, int perms, int flags)
+		/*@null@*/ const char * dbpath,
+		int _dbapi, /*@null@*/ /*@out@*/ rpmdb *dbp,
+		int mode, int perms, int flags)
+	/*@modifies *dbp, fileSystem @*/
 {
-    rpmdb rpmdb;
+    rpmdb db;
     int rc;
     static int _initialized = 0;
     int justCheck = flags & RPMDB_FLAG_JUSTCHECK;
@@ -865,10 +885,10 @@ static int openDatabase(/*@null@*/ const char * prefix,
     if (mode & O_WRONLY) 
 	return 1;
 
-    rpmdb = newRpmdb(prefix, dbpath, mode, perms, flags);
-    if (rpmdb == NULL)
+    db = newRpmdb(prefix, dbpath, mode, perms, flags);
+    if (db == NULL)
 	return 1;
-    rpmdb->db_api = _dbapi;
+    db->db_api = _dbapi;
 
     {	int dbix;
 
@@ -890,7 +910,7 @@ static int openDatabase(/*@null@*/ const char * prefix,
 		break;
 	    }
 
-	    dbi = dbiOpen(rpmdb, rpmtag, 0);
+	    dbi = dbiOpen(db, rpmtag, 0);
 	    if (dbi == NULL) {
 		rc = -2;
 		break;
@@ -901,7 +921,7 @@ static int openDatabase(/*@null@*/ const char * prefix,
 		if (dbi == NULL) rc |= 1;
 		/* XXX open only Packages, indices created on the fly. */
 #if 0
-		if (rpmdb->db_api == 3)
+		if (db->db_api == 3)
 #endif
 		    goto exit;
 		/*@notreached@*/ break;
@@ -945,9 +965,9 @@ static int openDatabase(/*@null@*/ const char * prefix,
 
 exit:
     if (rc || justCheck || dbp == NULL)
-	(void) rpmdbClose(rpmdb);
+	(void) rpmdbClose(db);
     else
-	*dbp = rpmdb;
+	*dbp = db;
 
     return rc;
 }
@@ -961,58 +981,59 @@ int rpmdbOpen (const char * prefix, rpmdb *dbp, int mode, int perms)
 
 int rpmdbInit (const char * prefix, int perms)
 {
-    rpmdb rpmdb = NULL;
+    rpmdb db = NULL;
     int _dbapi = rpmExpandNumeric("%{_dbapi}");
     int rc;
 
-    rc = openDatabase(prefix, NULL, _dbapi, &rpmdb, (O_CREAT | O_RDWR),
+    rc = openDatabase(prefix, NULL, _dbapi, &db, (O_CREAT | O_RDWR),
 		perms, RPMDB_FLAG_JUSTCHECK);
-    if (rpmdb) {
+    if (db != NULL) {
 	int xx;
-	xx = rpmdbOpenAll(rpmdb);
+	xx = rpmdbOpenAll(db);
 	if (xx && rc == 0) rc = xx;
-	xx = rpmdbClose(rpmdb);
+	xx = rpmdbClose(db);
 	if (xx && rc == 0) rc = xx;
-	rpmdb = NULL;
+	db = NULL;
     }
     return rc;
 }
 
 int rpmdbVerify(const char * prefix)
 {
-    rpmdb rpmdb = NULL;
+    rpmdb db = NULL;
     int _dbapi = rpmExpandNumeric("%{_dbapi}");
     int rc = 0;
 
-    rc = openDatabase(prefix, NULL, _dbapi, &rpmdb, O_RDONLY, 0644, 0);
+    rc = openDatabase(prefix, NULL, _dbapi, &db, O_RDONLY, 0644, 0);
     if (rc) return rc;
 
-    if (rpmdb) {
+    if (db != NULL) {
 	int dbix;
 	int xx;
-	rc = rpmdbOpenAll(rpmdb);
+	rc = rpmdbOpenAll(db);
 
-	for (dbix = rpmdb->db_ndbi; --dbix >= 0; ) {
-	    if (rpmdb->_dbi[dbix] == NULL)
+	for (dbix = db->db_ndbi; --dbix >= 0; ) {
+	    if (db->_dbi[dbix] == NULL)
 		continue;
 	    /*@-unqualifiedtrans@*/		/* FIX: double indirection. */
-	    xx = dbiVerify(rpmdb->_dbi[dbix], 0);
+	    xx = dbiVerify(db->_dbi[dbix], 0);
 	    if (xx && rc == 0) rc = xx;
-	    rpmdb->_dbi[dbix] = NULL;
+	    db->_dbi[dbix] = NULL;
 	    /*@=unqualifiedtrans@*/
 	}
 
-	/*@-nullstate@*/	/* FIX: rpmdb->_dbi[] may be NULL. */
-	xx = rpmdbClose(rpmdb);
+	/*@-nullstate@*/	/* FIX: db->_dbi[] may be NULL. */
+	xx = rpmdbClose(db);
 	/*@=nullstate@*/
 	if (xx && rc == 0) rc = xx;
-	rpmdb = NULL;
+	db = NULL;
     }
     return rc;
 }
 
-static int rpmdbFindByFile(rpmdb rpmdb, /*@null@*/ const char * filespec,
+static int rpmdbFindByFile(rpmdb db, /*@null@*/ const char * filespec,
 			/*@out@*/ dbiIndexSet * matches)
+	/*@modifies db, *matches, fileSystem @*/
 {
     HGE_t hge = (HGE_t)headerGetEntryMinMemory;
     HFD_t hfd = headerFreeData;
@@ -1050,7 +1071,7 @@ static int rpmdbFindByFile(rpmdb rpmdb, /*@null@*/ const char * filespec,
     fpc = fpCacheCreate(20);
     fp1 = fpLookup(fpc, dirName, baseName, 1);
 
-    dbi = dbiOpen(rpmdb, RPMTAG_BASENAMES, 0);
+    dbi = dbiOpen(db, RPMTAG_BASENAMES, 0);
     if (dbi != NULL) {
 	dbcursor = NULL;
 	xx = dbiCopen(dbi, &dbcursor, 0);
@@ -1079,7 +1100,7 @@ static int rpmdbFindByFile(rpmdb rpmdb, /*@null@*/ const char * filespec,
 	Header h;
 
 	{   rpmdbMatchIterator mi;
-	    mi = rpmdbInitIterator(rpmdb, RPMDBI_PACKAGES, &offset, sizeof(offset));
+	    mi = rpmdbInitIterator(db, RPMDBI_PACKAGES, &offset, sizeof(offset));
 	    h = rpmdbNextIterator(mi);
 	    if (h)
 		h = headerLink(h);
@@ -1137,7 +1158,7 @@ static int rpmdbFindByFile(rpmdb rpmdb, /*@null@*/ const char * filespec,
 }
 
 /* XXX python/upgrade.c, install.c, uninstall.c */
-int rpmdbCountPackages(rpmdb rpmdb, const char * name)
+int rpmdbCountPackages(rpmdb db, const char * name)
 {
     dbiIndex dbi;
     dbiIndexSet matches = NULL;
@@ -1151,7 +1172,7 @@ int rpmdbCountPackages(rpmdb rpmdb, const char * name)
     if (name == NULL || *name == '\0')
 	return 0;
 
-    dbi = dbiOpen(rpmdb, RPMTAG_NAME, 0);
+    dbi = dbiOpen(db, RPMTAG_NAME, 0);
     if (dbi) {
 	DBC * dbcursor = NULL;
 	xx = dbiCopen(dbi, &dbcursor, 0);
@@ -1184,6 +1205,7 @@ static int dbiFindMatches(dbiIndex dbi, DBC * dbcursor,
 		/*@null@*/ const char * version,
 		/*@null@*/ const char * release,
 		/*@out@*/ dbiIndexSet * matches)
+	/*@modifies dbi, *dbcursor, *matches @*/
 {
     int gotMatches;
     int rc;
@@ -1269,7 +1291,8 @@ exit:
  * @return 		0 on success, 1 on no mtches, 2 on error
  */
 static int dbiFindByLabel(dbiIndex dbi, DBC * dbcursor,
-		/*@null@*/ const char * arg, dbiIndexSet * matches)
+		/*@null@*/ const char * arg, /*@out@*/ dbiIndexSet * matches)
+	/*@modifies dbi, *dbcursor, *matches @*/
 {
     char * localarg, * chptr;
     char * release;
@@ -1324,6 +1347,7 @@ static int dbiFindByLabel(dbiIndex dbi, DBC * dbcursor,
  * @return 		0 on success
  */
 static int dbiUpdateRecord(dbiIndex dbi, DBC * dbcursor, int offset, Header h)
+	/*@modifies *dbcursor, h, fileSystem @*/
 {
     sigset_t signalMask;
     void * uh;
@@ -1405,7 +1429,9 @@ rpmdbMatchIterator rpmdbFreeIterator(rpmdbMatchIterator mi)
 rpmdb rpmdbGetIteratorRpmDB(rpmdbMatchIterator mi) {
     if (mi == NULL)
 	return NULL;
+    /*@-retexpose -retalias@*/
     return mi->mi_rpmdb;
+    /*@=retexpose =retalias@*/
 }
 
 unsigned int rpmdbGetIteratorOffset(rpmdbMatchIterator mi) {
@@ -1587,7 +1613,9 @@ exit:
 		mi->mi_offset, mi->mi_h);
     }
 #endif
+    /*@-retexpose -retalias@*/
     /*@-compdef -usereleased@*/ return mi->mi_h; /*@=compdef =usereleased@*/
+    /*@=retexpose =retalias@*/
 }
 
 static void rpmdbSortIterator(/*@null@*/ rpmdbMatchIterator mi) {
@@ -1650,8 +1678,10 @@ int rpmdbPruneIterator(rpmdbMatchIterator mi, int * hdrNums,
     if (mi == NULL || hdrNums == NULL || nHdrNums <= 0)
 	return 1;
 
+    /*@-mods@*/		/* FIX: wazzup? */
     if (mi->mi_set)
 	(void) dbiPruneSet(mi->mi_set, hdrNums, nHdrNums, sizeof(*hdrNums), sorted);
+    /*@=mods@*/
     return 0;
 }
 
@@ -1742,7 +1772,9 @@ fprintf(stderr, "*** RMW %s %p\n", tagName(rpmtag), dbi->dbi_rmw);
     mi->mi_keyp = mi_keyp;
     mi->mi_keylen = keylen;
 
+    /*@-assignexpose@*/
     mi->mi_rpmdb = rpmdb;
+    /*@=assignexpose@*/
     mi->mi_rpmtag = rpmtag;
 
     mi->mi_dbc = NULL;
@@ -2193,7 +2225,7 @@ int rpmdbAdd(rpmdb rpmdb, int iid, Header h)
 		    if (i) {	/* don't add duplicates */
 			for (j = 0; j < i; j++) {
 			    if (!strcmp(rpmvals[i], rpmvals[j]))
-				break;
+				/*@innerbreak@*/ break;
 			}
 			if (j < i)
 			    continue;
@@ -2312,7 +2344,7 @@ int rpmdbFindFpList(rpmdb rpmdb, fingerPrint * fpList, dbiIndexSet * matchList,
 	/* Find the end of the set of matched files in this package. */
 	for (end = start + 1; end < mi->mi_set->count; end++) {
 	    if (im->hdrNum != mi->mi_set->recs[end].hdrNum)
-		break;
+		/*@innerbreak@*/ break;
 	}
 	num = end - start;
 
@@ -2359,7 +2391,8 @@ int rpmdbFindFpList(rpmdb rpmdb, fingerPrint * fpList, dbiIndexSet * matchList,
 
 }
 
-char * db1basename (int rpmtag) {
+char * db1basename (int rpmtag)
+{
     char * base = NULL;
     switch (rpmtag) {
     case RPMDBI_PACKAGES:	base = "packages.rpm";		break;
@@ -2380,7 +2413,8 @@ char * db1basename (int rpmtag) {
 }
 
 static int rpmdbRemoveDatabase(const char * rootdir,
-	const char * dbpath, int _dbapi)
+		const char * dbpath, int _dbapi)
+	/*@modifies fileSystem @*/
 { 
     int i;
     char * filename;
@@ -2434,8 +2468,9 @@ static int rpmdbRemoveDatabase(const char * rootdir,
 }
 
 static int rpmdbMoveDatabase(const char * rootdir,
-	const char * olddbpath, int _olddbapi,
-	const char * newdbpath, int _newdbapi)
+		const char * olddbpath, int _olddbapi,
+		const char * newdbpath, int _newdbapi)
+	/*@modifies fileSystem @*/
 {
     int i;
     char * ofilename, * nfilename;
@@ -2678,7 +2713,7 @@ int rpmdbRebuild(const char * rootdir)
 		    rpmdbSetIteratorRelease(mi, release);
 		    while (rpmdbNextIterator(mi)) {
 			skip = 1;
-			break;
+			/*@innerbreak@*/ break;
 		    }
 		    mi = rpmdbFreeIterator(mi);
 		}
diff --git a/rpmdb/rpmdb.h b/rpmdb/rpmdb.h
index a090119d0..ab465d535 100644
--- a/rpmdb/rpmdb.h
+++ b/rpmdb/rpmdb.h
@@ -433,7 +433,7 @@ int dbiGet(dbiIndex dbi, DBC * dbcursor, void ** keypp,
 		/*@null@*/ void ** datapp, 
 		/*@null@*/ size_t * datalenp,
 		unsigned int flags)
-	/*@modifies *dbcursor, *keypp, *keylenp, *datapp, *datalenp,
+	/*@modifies *dbcursor, **keypp, *keylenp, **datapp, *datalenp,
 		fileSystem @*/;
 
 /** \ingroup dbi
diff --git a/rpmdb/rpmhash.c b/rpmdb/rpmhash.c
index b55a26952..5807fa318 100644
--- a/rpmdb/rpmhash.c
+++ b/rpmdb/rpmhash.c
@@ -36,15 +36,18 @@ struct hashTable_s {
  */
 static /*@shared@*/ /*@null@*/
 struct hashBucket *findEntry(hashTable ht, const void * key)
+	/*@*/
 {
     unsigned int hash;
     struct hashBucket * b;
 
+    /*@-modunconnomods@*/
     hash = ht->fn(key) % ht->numBuckets;
     b = ht->buckets[hash];
 
     while (b && b->key && ht->eq(b->key, key))
 	b = b->next;
+    /*@=modunconnomods@*/
 
     return b;
 }
diff --git a/rpmdb/rpmhash.h b/rpmdb/rpmhash.h
index b279a2ef2..358a25e54 100644
--- a/rpmdb/rpmhash.h
+++ b/rpmdb/rpmhash.h
@@ -6,24 +6,31 @@
  * Hash table implemenation.
  */
 
+/**
+ */
 typedef struct hashTable_s * hashTable;
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
-/** */
-typedef unsigned int (*hashFunctionType) (const void * string) /*@*/;
+/**
+ */
+typedef unsigned int (*hashFunctionType) (const void * string)
+	/*@*/;
 
-/** */
-typedef int (*hashEqualityType) (const void * key1, const void * key2) /*@*/;
+/**
+ */
+typedef int (*hashEqualityType) (const void * key1, const void * key2)
+	/*@*/;
 
 /**
  * Return hash value of a string
  * @param string  string on which to calculate hash value
  * @return hash value
  */
-unsigned int hashFunctionString(const void * string) /*@*/;
+unsigned int hashFunctionString(const void * string)
+	/*@*/;
 
 /**
  * Compare two hash table entries for equality.
@@ -31,7 +38,8 @@ unsigned int hashFunctionString(const void * string) /*@*/;
  * @param key2          entry 2
  * @return 0 if entries are equal
  */
-int hashEqualityString(const void * key1, const void * key2) /*@*/;
+int hashEqualityString(const void * key1, const void * key2)
+	/*@*/;
 
 /**
  * Create hash table.
@@ -45,13 +53,15 @@ int hashEqualityString(const void * key1, const void * key2) /*@*/;
  * @return pointer to initialized hash table
  */
 hashTable htCreate(int numBuckets, int keySize, int freeData,
-		hashFunctionType fn, hashEqualityType eq) /*@*/; 
+		hashFunctionType fn, hashEqualityType eq)
+	/*@*/; 
 
 /**
  * Destroy hash table.
  * @param ht            pointer to hash table
  */
-void htFree( /*@only@*/ hashTable ht);
+void htFree( /*@only@*/ hashTable ht)
+	/*@modifies ht @*/;
 
 /**
  * Add item to hash table.
@@ -85,7 +95,8 @@ int htGetEntry(hashTable ht, const void * key,
  * @return 1 if the key is present, 0 otherwise
  */
 /*@unused@*/
-int htHasEntry(hashTable ht, const void * key) /*@*/;
+int htHasEntry(hashTable ht, const void * key)
+	/*@*/;
 
 #ifdef __cplusplus
 }
diff --git a/rpmio/digest.c b/rpmio/digest.c
index c463d1509..60bb9ae84 100644
--- a/rpmio/digest.c
+++ b/rpmio/digest.c
@@ -377,6 +377,7 @@ static union _mendian {
 /*@-shadow@*/
 static void
 byteReverse(byte *buf, unsigned nbytes)
+	/*@modifies *buf @*/
 {
     unsigned nlongs = nbytes / sizeof(uint32);
     uint32 t;
@@ -455,7 +456,9 @@ rpmDigestUpdate(DIGEST_CTX ctx, const void * data, size_t len)
 	memcpy(p, buf, t);
 	if (ctx->doByteReverse)
 	    byteReverse(ctx->in, ctx->datalen);
+	/*@-moduncon@*/
 	ctx->transform(ctx);
+	/*@=moduncon@*/
 	buf += t;
 	len -= t;
     }
@@ -467,7 +470,9 @@ rpmDigestUpdate(DIGEST_CTX ctx, const void * data, size_t len)
 	/*@=mayaliasunique@*/
 	if (ctx->doByteReverse)
 	    byteReverse(ctx->in, ctx->datalen);
+	/*@-moduncon@*/
 	ctx->transform(ctx);
+	/*@=moduncon@*/
     }
 
     /* Handle any remaining bytes of data. */
@@ -495,7 +500,9 @@ rpmDigestFinal(/*@only@*/ DIGEST_CTX ctx, /*@out@*/ void ** datap,
 	memset(p, 0, count);
 	if (ctx->doByteReverse)
 	    byteReverse(ctx->in, ctx->datalen);
+	/*@-moduncon@*/
 	ctx->transform(ctx);
+	/*@=moduncon@*/
 	p = ctx->in;
 	count = ctx->datalen;
     }
@@ -506,7 +513,9 @@ rpmDigestFinal(/*@only@*/ DIGEST_CTX ctx, /*@out@*/ void ** datap,
 	byteReverse(ctx->in, ctx->datalen - sizeof(ctx->bits));
     ((uint32 *) ctx->in)[14] = ctx->bits[0];
     ((uint32 *) ctx->in)[15] = ctx->bits[1];
+    /*@-moduncon@*/
     ctx->transform(ctx);
+    /*@=moduncon@*/
 
     /* Return final digest. */
     if (ctx->doByteReverse)
diff --git a/rpmio/macro.c b/rpmio/macro.c
index 1edbd66c1..8324bce50 100644
--- a/rpmio/macro.c
+++ b/rpmio/macro.c
@@ -2,7 +2,7 @@
  * \file rpmio/macro.c
  */
 
-static int _debug = 0;
+/*@unused@*/ static int _debug = 0;
 
 #include "system.h"
 #include <stdarg.h>
@@ -61,20 +61,21 @@ struct MacroContext_s rpmCLIMacroContext;
 /**
  * Macro expansion state.
  */
-typedef struct MacroBuf {
-/*@shared@*/ const char * s;		/*!< Text to expand. */
-/*@shared@*/ char * t;			/*!< Expansion buffer. */
-	size_t nb;		/*!< No. bytes remaining in expansion buffer. */
-	int depth;			/*!< Current expansion depth. */
-	int macro_trace;		/*!< Pre-print macro to expand? */
-	int expand_trace;		/*!< Post-print macro expansion? */
+typedef /*@abstract@*/ struct MacroBuf_s {
+/*@shared@*/ const char * s;	/*!< Text to expand. */
+/*@shared@*/ char * t;		/*!< Expansion buffer. */
+    size_t nb;			/*!< No. bytes remaining in expansion buffer. */
+    int depth;			/*!< Current expansion depth. */
+    int macro_trace;		/*!< Pre-print macro to expand? */
+    int expand_trace;		/*!< Post-print macro expansion? */
 /*@shared@*/ /*@null@*/ void * spec;	/*!< (future) %file expansion info?. */
 /*@dependent@*/ MacroContext mc;
-} MacroBuf;
+} * MacroBuf;
 
 #define SAVECHAR(_mb, _c) { *(_mb)->t = (_c), (_mb)->t++, (_mb)->nb--; }
 
-static int expandMacro(MacroBuf *mb);
+static int expandMacro(MacroBuf mb)
+	/*@modifies mb @*/;
 
 /*@-exportlocal -exportheadervar@*/
 #define	MAX_MACRO_DEPTH	16
@@ -97,7 +98,8 @@ int print_expand_trace = 0;
  * @retval		NULL always
  */
 /*@unused@*/ static inline /*@null@*/ void *
-_free(/*@only@*/ /*@null@*/ const void * p) /*@modifies p@*/
+_free(/*@only@*/ /*@null@*/ const void * p)
+	/*@modifies p@*/
 {
     if (p != NULL)	free((void *)p);
     return NULL;
@@ -112,18 +114,19 @@ _free(/*@only@*/ /*@null@*/ const void * p) /*@modifies p@*/
  * @return		result of comparison
  */
 static int
-compareMacroName(const void *ap, const void *bp)
+compareMacroName(const void * ap, const void * bp)
+	/*@*/
 {
-	MacroEntry ame = *((MacroEntry *)ap);
-	MacroEntry bme = *((MacroEntry *)bp);
-
-	if (ame == NULL && bme == NULL)
-		return 0;
-	if (ame == NULL)
-		return 1;
-	if (bme == NULL)
-		return -1;
-	return strcmp(ame->name, bme->name);
+    MacroEntry ame = *((MacroEntry *)ap);
+    MacroEntry bme = *((MacroEntry *)bp);
+
+    if (ame == NULL && bme == NULL)
+	return 0;
+    if (ame == NULL)
+	return 1;
+    if (bme == NULL)
+	return -1;
+    return strcmp(ame->name, bme->name);
 }
 
 /**
@@ -132,19 +135,20 @@ compareMacroName(const void *ap, const void *bp)
  */
 static void
 expandMacroTable(MacroContext mc)
+	/*@modifies mc @*/
 {
-	if (mc->macroTable == NULL) {
-		mc->macrosAllocated = MACRO_CHUNK_SIZE;
-		mc->macroTable = (MacroEntry *)
-		    xmalloc(sizeof(*(mc->macroTable)) * mc->macrosAllocated);
-		mc->firstFree = 0;
-	} else {
-		mc->macrosAllocated += MACRO_CHUNK_SIZE;
-		mc->macroTable = (MacroEntry *)
-		    xrealloc(mc->macroTable, sizeof(*(mc->macroTable)) *
-				mc->macrosAllocated);
-	}
-	memset(&mc->macroTable[mc->firstFree], 0, MACRO_CHUNK_SIZE * sizeof(*(mc->macroTable)));
+    if (mc->macroTable == NULL) {
+	mc->macrosAllocated = MACRO_CHUNK_SIZE;
+	mc->macroTable = (MacroEntry *)
+	    xmalloc(sizeof(*(mc->macroTable)) * mc->macrosAllocated);
+	mc->firstFree = 0;
+    } else {
+	mc->macrosAllocated += MACRO_CHUNK_SIZE;
+	mc->macroTable = (MacroEntry *)
+	    xrealloc(mc->macroTable, sizeof(*(mc->macroTable)) *
+			mc->macrosAllocated);
+    }
+    memset(&mc->macroTable[mc->firstFree], 0, MACRO_CHUNK_SIZE * sizeof(*(mc->macroTable)));
 }
 
 /**
@@ -153,6 +157,7 @@ expandMacroTable(MacroContext mc)
  */
 static void
 sortMacroTable(MacroContext mc)
+	/*@modifies mc @*/
 {
     int i;
 
@@ -212,7 +217,8 @@ rpmDumpMacroTable(MacroContext mc, FILE * fp)
  * @return		address of slot in macro table with name (or NULL)
  */
 /*@dependent@*/ /*@null@*/ static MacroEntry *
-findEntry(MacroContext mc, const char *name, size_t namelen)
+findEntry(MacroContext mc, const char * name, size_t namelen)
+	/*@*/
 {
     MacroEntry key, *ret;
     struct MacroEntry_s keybuf;
@@ -230,9 +236,9 @@ findEntry(MacroContext mc, const char *name, size_t namelen)
     
     key = &keybuf;
     memset(key, 0, sizeof(*key));
-    /*@-temptrans@*/
+    /*@-temptrans -assignexpose@*/
     key->name = (char *)name;
-    /*@=temptrans@*/
+    /*@=temptrans =assignexpose@*/
     ret = (MacroEntry *) bsearch(&key, mc->macroTable, mc->firstFree,
 			sizeof(*(mc->macroTable)), compareMacroName);
     /* XXX TODO: find 1st empty slot and return that */
@@ -245,7 +251,8 @@ findEntry(MacroContext mc, const char *name, size_t namelen)
  * fgets(3) analogue that reads \ continuations. Last newline always trimmed.
  */
 /*@dependent@*/ static char *
-rdcl(char *buf, size_t size, FD_t fd, int escapes)
+rdcl(char * buf, size_t size, FD_t fd, int escapes)
+	/*@modifies buf, fileSystem @*/
 {
     char *q = buf;
     size_t nb = 0;
@@ -275,7 +282,7 @@ rdcl(char *buf, size_t size, FD_t fd, int escapes)
 	    *q = '\n';
 	*(++q) = '\0';			/* next char in buf */
     } while (size > 0);
-    return (nread > 0 ? buf : NULL);
+    /*@-retalias@*/ return (nread > 0 ? buf : NULL); /*@=retalias@*/
 }
 
 /**
@@ -286,22 +293,23 @@ rdcl(char *buf, size_t size, FD_t fd, int escapes)
  * @return		address of last char before pr (or NULL)
  */
 static const char *
-matchchar(const char *p, char pl, char pr)
+matchchar(const char * p, char pl, char pr)
+	/*@*/
 {
-	int lvl = 0;
-	char c;
+    int lvl = 0;
+    char c;
 
-	while ((c = *p++) != '\0') {
-		if (c == '\\') {		/* Ignore escaped chars */
-			p++;
-			continue;
-		}
-		if (c == pr) {
-			if (--lvl <= 0)	return --p;
-		} else if (c == pl)
-			lvl++;
+    while ((c = *p++) != '\0') {
+	if (c == '\\') {		/* Ignore escaped chars */
+	    p++;
+	    continue;
 	}
-	return (const char *)NULL;
+	if (c == pr) {
+	    if (--lvl <= 0)	return --p;
+	} else if (c == pl)
+	    lvl++;
+    }
+    return (const char *)NULL;
 }
 
 /**
@@ -311,39 +319,40 @@ matchchar(const char *p, char pl, char pr)
  * @param se		end of string
  */
 static void
-printMacro(MacroBuf *mb, const char *s, const char *se)
+printMacro(MacroBuf mb, const char * s, const char * se)
+	/*@modifies fileSystem @*/
 {
-	const char *senl;
-	const char *ellipsis;
-	int choplen;
-
-	if (s >= se) {	/* XXX just in case */
-		fprintf(stderr, _("%3d>%*s(empty)"), mb->depth,
-			(2 * mb->depth + 1), "");
-		return;
-	}
+    const char *senl;
+    const char *ellipsis;
+    int choplen;
 
-	if (s[-1] == '{')
-		s--;
+    if (s >= se) {	/* XXX just in case */
+	fprintf(stderr, _("%3d>%*s(empty)"), mb->depth,
+		(2 * mb->depth + 1), "");
+	return;
+    }
 
-	/* Print only to first end-of-line (or end-of-string). */
-	for (senl = se; *senl && !iseol(*senl); senl++)
-		;
+    if (s[-1] == '{')
+	s--;
 
-	/* Limit trailing non-trace output */
-	choplen = 61 - (2 * mb->depth);
-	if ((senl - s) > choplen) {
-		senl = s + choplen;
-		ellipsis = "...";
-	} else
-		ellipsis = "";
-
-	/* Substitute caret at end-of-macro position */
-	fprintf(stderr, "%3d>%*s%%%.*s^", mb->depth,
-		(2 * mb->depth + 1), "", (int)(se - s), s);
-	if (se[1] != '\0' && (senl - (se+1)) > 0)
-		fprintf(stderr, "%-.*s%s", (int)(senl - (se+1)), se+1, ellipsis);
-	fprintf(stderr, "\n");
+    /* Print only to first end-of-line (or end-of-string). */
+    for (senl = se; *senl && !iseol(*senl); senl++)
+	{};
+
+    /* Limit trailing non-trace output */
+    choplen = 61 - (2 * mb->depth);
+    if ((senl - s) > choplen) {
+	senl = s + choplen;
+	ellipsis = "...";
+    } else
+	ellipsis = "";
+
+    /* Substitute caret at end-of-macro position */
+    fprintf(stderr, "%3d>%*s%%%.*s^", mb->depth,
+	(2 * mb->depth + 1), "", (int)(se - s), s);
+    if (se[1] != '\0' && (senl - (se+1)) > 0)
+	fprintf(stderr, "%-.*s%s", (int)(senl - (se+1)), se+1, ellipsis);
+    fprintf(stderr, "\n");
 }
 
 /**
@@ -353,39 +362,40 @@ printMacro(MacroBuf *mb, const char *s, const char *se)
  * @param te		end of string
  */
 static void
-printExpansion(MacroBuf *mb, const char *t, const char *te)
+printExpansion(MacroBuf mb, const char * t, const char * te)
+	/*@modifies fileSystem @*/
 {
-	const char *ellipsis;
-	int choplen;
+    const char *ellipsis;
+    int choplen;
 
-	if (!(te > t)) {
-		fprintf(stderr, _("%3d<%*s(empty)\n"), mb->depth, (2 * mb->depth + 1), "");
-		return;
-	}
+    if (!(te > t)) {
+	fprintf(stderr, _("%3d<%*s(empty)\n"), mb->depth, (2 * mb->depth + 1), "");
+	return;
+    }
 
-	/* Shorten output which contains newlines */
-	while (te > t && iseol(te[-1]))
-		te--;
-	ellipsis = "";
-	if (mb->depth > 0) {
-		const char *tenl;
-
-		/* Skip to last line of expansion */
-		while ((tenl = strchr(t, '\n')) && tenl < te)
-			t = ++tenl;
-
-		/* Limit expand output */
-		choplen = 61 - (2 * mb->depth);
-		if ((te - t) > choplen) {
-			te = t + choplen;
-			ellipsis = "...";
-		}
+    /* Shorten output which contains newlines */
+    while (te > t && iseol(te[-1]))
+	te--;
+    ellipsis = "";
+    if (mb->depth > 0) {
+	const char *tenl;
+
+	/* Skip to last line of expansion */
+	while ((tenl = strchr(t, '\n')) && tenl < te)
+	    t = ++tenl;
+
+	/* Limit expand output */
+	choplen = 61 - (2 * mb->depth);
+	if ((te - t) > choplen) {
+	    te = t + choplen;
+	    ellipsis = "...";
 	}
+    }
 
-	fprintf(stderr, "%3d<%*s", mb->depth, (2 * mb->depth + 1), "");
-	if (te > t)
-		fprintf(stderr, "%.*s%s", (int)(te - t), t, ellipsis);
-	fprintf(stderr, "\n");
+    fprintf(stderr, "%3d<%*s", mb->depth, (2 * mb->depth + 1), "");
+    if (te > t)
+	fprintf(stderr, "%.*s%s", (int)(te - t), t, ellipsis);
+    fprintf(stderr, "\n");
 }
 
 #define	SKIPBLANK(_s, _c)	\
@@ -426,21 +436,22 @@ printExpansion(MacroBuf *mb, const char *t, const char *te)
  * @return		result of expansion
  */
 static int
-expandT(MacroBuf *mb, const char *f, size_t flen)
+expandT(MacroBuf mb, const char * f, size_t flen)
+	/*@modifies mb @*/
 {
-	char *sbuf;
-	const char *s = mb->s;
-	int rc;
-
-	sbuf = alloca(flen + 1);
-	memset(sbuf, 0, (flen + 1));
-
-	strncpy(sbuf, f, flen);
-	sbuf[flen] = '\0';
-	mb->s = sbuf;
-	rc = expandMacro(mb);
-	mb->s = s;
-	return rc;
+    char *sbuf;
+    const char *s = mb->s;
+    int rc;
+
+    sbuf = alloca(flen + 1);
+    memset(sbuf, 0, (flen + 1));
+
+    strncpy(sbuf, f, flen);
+    sbuf[flen] = '\0';
+    mb->s = sbuf;
+    rc = expandMacro(mb);
+    mb->s = s;
+    return rc;
 }
 
 #if 0
@@ -452,18 +463,19 @@ expandT(MacroBuf *mb, const char *f, size_t flen)
  * @return		result of expansion
  */
 static int
-expandS(MacroBuf *mb, char *tbuf, size_t tbuflen)
+expandS(MacroBuf mb, char * tbuf, size_t tbuflen)
+	/*@modifies mb, *tbuf @*/
 {
-	const char *t = mb->t;
-	size_t nb = mb->nb;
-	int rc;
-
-	mb->t = tbuf;
-	mb->nb = tbuflen;
-	rc = expandMacro(mb);
-	mb->t = t;
-	mb->nb = nb;
-	return rc;
+    const char *t = mb->t;
+    size_t nb = mb->nb;
+    int rc;
+
+    mb->t = tbuf;
+    mb->nb = tbuflen;
+    rc = expandMacro(mb);
+    mb->t = t;
+    mb->nb = nb;
+    return rc;
 }
 #endif
 
@@ -475,33 +487,34 @@ expandS(MacroBuf *mb, char *tbuf, size_t tbuflen)
  * @return		result of expansion
  */
 static int
-expandU(MacroBuf *mb, char *u, size_t ulen)
+expandU(MacroBuf mb, char * u, size_t ulen)
+	/*@modifies mb, *u @*/
 {
-	const char *s = mb->s;
-	char *t = mb->t;
-	size_t nb = mb->nb;
-	char *tbuf;
-	int rc;
-
-	tbuf = alloca(ulen + 1);
-	memset(tbuf, 0, (ulen + 1));
-
-	/*@-temptrans@*/
-	mb->s = u;
-	/*@=temptrans@*/
-	mb->t = tbuf;
-	mb->nb = ulen;
-	rc = expandMacro(mb);
-
-	tbuf[ulen] = '\0';	/* XXX just in case */
-	if (ulen > mb->nb)
-		strncpy(u, tbuf, (ulen - mb->nb + 1));
-
-	mb->s = s;
-	mb->t = t;
-	mb->nb = nb;
+    const char *s = mb->s;
+    char *t = mb->t;
+    size_t nb = mb->nb;
+    char *tbuf;
+    int rc;
 
-	return rc;
+    tbuf = alloca(ulen + 1);
+    memset(tbuf, 0, (ulen + 1));
+
+    /*@-temptrans -assignexpose@*/
+    mb->s = u;
+    /*@=temptrans =assignexpose@*/
+    mb->t = tbuf;
+    mb->nb = ulen;
+    rc = expandMacro(mb);
+
+    tbuf[ulen] = '\0';	/* XXX just in case */
+    if (ulen > mb->nb)
+	strncpy(u, tbuf, (ulen - mb->nb + 1));
+
+    mb->s = s;
+    mb->t = t;
+    mb->nb = nb;
+
+    return rc;
 }
 
 /**
@@ -512,31 +525,32 @@ expandU(MacroBuf *mb, char *u, size_t ulen)
  * @return		result of expansion
  */
 static int
-doShellEscape(MacroBuf *mb, const char *cmd, size_t clen)
+doShellEscape(MacroBuf mb, const char * cmd, size_t clen)
+	/*@modifies mb, fileSystem @*/
 {
-	char pcmd[BUFSIZ];
-	FILE *shf;
-	int rc;
-	int c;
-
-	strncpy(pcmd, cmd, clen);
-	pcmd[clen] = '\0';
-	rc = expandU(mb, pcmd, sizeof(pcmd));
-	if (rc)
-		return rc;
-
-	if ((shf = popen(pcmd, "r")) == NULL)
-		return 1;
-	while(mb->nb > 0 && (c = fgetc(shf)) != EOF)
-		SAVECHAR(mb, c);
-	(void) pclose(shf);
+    char pcmd[BUFSIZ];
+    FILE *shf;
+    int rc;
+    int c;
 
-	/* XXX delete trailing \r \n */
-	while (iseol(mb->t[-1])) {
-		*(mb->t--) = '\0';
-		mb->nb++;
-	}
-	return 0;
+    strncpy(pcmd, cmd, clen);
+    pcmd[clen] = '\0';
+    rc = expandU(mb, pcmd, sizeof(pcmd));
+    if (rc)
+	return rc;
+
+    if ((shf = popen(pcmd, "r")) == NULL)
+	return 1;
+    while(mb->nb > 0 && (c = fgetc(shf)) != EOF)
+	SAVECHAR(mb, c);
+    (void) pclose(shf);
+
+    /* XXX delete trailing \r \n */
+    while (iseol(mb->t[-1])) {
+	*(mb->t--) = '\0';
+	mb->nb++;
+    }
+    return 0;
 }
 
 /**
@@ -548,84 +562,84 @@ doShellEscape(MacroBuf *mb, const char *cmd, size_t clen)
  * @return		address to continue parsing
  */
 /*@dependent@*/ static const char *
-doDefine(MacroBuf *mb, const char *se, int level, int expandbody)
+doDefine(MacroBuf mb, const char * se, int level, int expandbody)
+	/*@modifies mb @*/
 {
-	const char *s = se;
-	char buf[BUFSIZ], *n = buf, *ne = n;
-	char *o = NULL, *oe;
-	char *b, *be;
-	int c;
-	int oc = ')';
-
-	/* Copy name */
-	COPYNAME(ne, s, c);
-
-	/* Copy opts (if present) */
-	oe = ne + 1;
-	if (*s == '(') {
-		s++;	/* skip ( */
-		o = oe;
-		COPYOPTS(oe, s, oc);
-		s++;	/* skip ) */
-	}
+    const char *s = se;
+    char buf[BUFSIZ], *n = buf, *ne = n;
+    char *o = NULL, *oe;
+    char *b, *be;
+    int c;
+    int oc = ')';
+
+    /* Copy name */
+    COPYNAME(ne, s, c);
+
+    /* Copy opts (if present) */
+    oe = ne + 1;
+    if (*s == '(') {
+	s++;	/* skip ( */
+	o = oe;
+	COPYOPTS(oe, s, oc);
+	s++;	/* skip ) */
+    }
 
-	/* Copy body, skipping over escaped newlines */
-	b = be = oe + 1;
-	SKIPBLANK(s, c);
-	if (c == '{') {	/* XXX permit silent {...} grouping */
-		if ((se = matchchar(s, c, '}')) == NULL) {
-			rpmError(RPMERR_BADSPEC,
-				_("Macro %%%s has unterminated body\n"), n);
-			se = s;	/* XXX W2DO? */
-			return se;
-		}
-		s++;	/* XXX skip { */
-		strncpy(b, s, (se - s));
-		b[se - s] = '\0';
-		be += strlen(b);
-		se++;	/* XXX skip } */
-		s = se;	/* move scan forward */
-	} else {	/* otherwise free-field */
-		COPYBODY(be, s, c);
-
-		/* Trim trailing blanks/newlines */
-		while (--be >= b && (c = *be) && (isblank(c) || iseol(c)))
-			;
-		*(++be) = '\0';	/* one too far */
+    /* Copy body, skipping over escaped newlines */
+    b = be = oe + 1;
+    SKIPBLANK(s, c);
+    if (c == '{') {	/* XXX permit silent {...} grouping */
+	if ((se = matchchar(s, c, '}')) == NULL) {
+	    rpmError(RPMERR_BADSPEC,
+		_("Macro %%%s has unterminated body\n"), n);
+	    se = s;	/* XXX W2DO? */
+	    /*@-retalias@*/ return se; /*@=retalias@*/
 	}
+	s++;	/* XXX skip { */
+	strncpy(b, s, (se - s));
+	b[se - s] = '\0';
+	be += strlen(b);
+	se++;	/* XXX skip } */
+	s = se;	/* move scan forward */
+    } else {	/* otherwise free-field */
+	COPYBODY(be, s, c);
+
+	/* Trim trailing blanks/newlines */
+	while (--be >= b && (c = *be) && (isblank(c) || iseol(c)))
+	    {};
+	*(++be) = '\0';	/* one too far */
+    }
 
-	/* Move scan over body */
-	while (iseol(*s))
-		s++;
-	se = s;
+    /* Move scan over body */
+    while (iseol(*s))
+	s++;
+    se = s;
 
-	/* Names must start with alphabetic or _ and be at least 3 chars */
-	if (!((c = *n) && (xisalpha(c) || c == '_') && (ne - n) > 2)) {
-		rpmError(RPMERR_BADSPEC,
-			_("Macro %%%s has illegal name (%%define)\n"), n);
-		return se;
-	}
+    /* Names must start with alphabetic or _ and be at least 3 chars */
+    if (!((c = *n) && (xisalpha(c) || c == '_') && (ne - n) > 2)) {
+	rpmError(RPMERR_BADSPEC,
+		_("Macro %%%s has illegal name (%%define)\n"), n);
+	/*@-retalias@*/ return se; /*@=retalias@*/
+    }
 
-	/* Options must be terminated with ')' */
-	if (o && oc != ')') {
-		rpmError(RPMERR_BADSPEC,
-			_("Macro %%%s has unterminated opts\n"), n);
-		return se;
-	}
+    /* Options must be terminated with ')' */
+    if (o && oc != ')') {
+	rpmError(RPMERR_BADSPEC, _("Macro %%%s has unterminated opts\n"), n);
+	/*@-retalias@*/ return se; /*@=retalias@*/
+    }
 
-	if ((be - b) < 1) {
-		rpmError(RPMERR_BADSPEC, _("Macro %%%s has empty body\n"), n);
-		return se;
-	}
+    if ((be - b) < 1) {
+	rpmError(RPMERR_BADSPEC, _("Macro %%%s has empty body\n"), n);
+	/*@-retalias@*/ return se; /*@=retalias@*/
+    }
 
-	if (expandbody && expandU(mb, b, (&buf[sizeof(buf)] - b))) {
-		rpmError(RPMERR_BADSPEC, _("Macro %%%s failed to expand\n"), n);
-		return se;
-	}
+    if (expandbody && expandU(mb, b, (&buf[sizeof(buf)] - b))) {
+	rpmError(RPMERR_BADSPEC, _("Macro %%%s failed to expand\n"), n);
+	/*@-retalias@*/ return se; /*@=retalias@*/
+    }
 
-	addMacro(mb->mc, n, o, b, (level - 1));
+    addMacro(mb->mc, n, o, b, (level - 1));
 
-	return se;
+    /*@-retalias@*/ return se; /*@=retalias@*/
 }
 
 /**
@@ -635,42 +649,44 @@ doDefine(MacroBuf *mb, const char *se, int level, int expandbody)
  * @return		address to continue parsing
  */
 /*@dependent@*/ static const char *
-doUndefine(MacroContext mc, const char *se)
+doUndefine(MacroContext mc, const char * se)
+	/*@modifies mc @*/
 {
-	const char *s = se;
-	char buf[BUFSIZ], *n = buf, *ne = n;
-	int c;
+    const char *s = se;
+    char buf[BUFSIZ], *n = buf, *ne = n;
+    int c;
 
-	COPYNAME(ne, s, c);
+    COPYNAME(ne, s, c);
 
-	/* Move scan over body */
-	while (iseol(*s))
-		s++;
-	se = s;
+    /* Move scan over body */
+    while (iseol(*s))
+	s++;
+    se = s;
 
-	/* Names must start with alphabetic or _ and be at least 3 chars */
-	if (!((c = *n) && (xisalpha(c) || c == '_') && (ne - n) > 2)) {
-		rpmError(RPMERR_BADSPEC,
-			_("Macro %%%s has illegal name (%%undefine)\n"), n);
-		return se;
-	}
+    /* Names must start with alphabetic or _ and be at least 3 chars */
+    if (!((c = *n) && (xisalpha(c) || c == '_') && (ne - n) > 2)) {
+	rpmError(RPMERR_BADSPEC,
+		_("Macro %%%s has illegal name (%%undefine)\n"), n);
+	/*@-retalias@*/ return se; /*@=retalias@*/
+    }
 
-	delMacro(mc, n);
+    delMacro(mc, n);
 
-	return se;
+    /*@-retalias@*/ return se; /*@=retalias@*/
 }
 
 #ifdef	DYING
 static void
-dumpME(const char *msg, MacroEntry me)
+dumpME(const char * msg, MacroEntry me)
+	/*@modifies fileSystem @*/
 {
-	if (msg)
-		fprintf(stderr, "%s", msg);
-	fprintf(stderr, "\tme %p", me);
-	if (me)
-		fprintf(stderr,"\tname %p(%s) prev %p",
-			me->name, me->name, me->prev);
-	fprintf(stderr, "\n");
+    if (msg)
+	fprintf(stderr, "%s", msg);
+    fprintf(stderr, "\tme %p", me);
+    if (me)
+	fprintf(stderr,"\tname %p(%s) prev %p",
+		me->name, me->name, me->prev);
+    fprintf(stderr, "\n");
 }
 #endif
 
@@ -683,16 +699,19 @@ dumpME(const char *msg, MacroEntry me)
  * @param level		macro recursion level
  */
 static void
-pushMacro(/*@out@*/ MacroEntry *mep,
-		const char *n, /*@null@*/ const char *o,
-		/*@null@*/ const char *b, int level)
+pushMacro(/*@out@*/ MacroEntry * mep,
+		const char * n, /*@null@*/ const char * o,
+		/*@null@*/ const char * b, int level)
+	/*@modifies *mep @*/
 {
     /*@-usedef@*/
     MacroEntry prev = (mep && *mep ? *mep : NULL);
     /*@=usedef@*/
     MacroEntry me = (MacroEntry) xmalloc(sizeof(*me));
 
+    /*@-assignexpose@*/
     me->prev = prev;
+    /*@=assignexpose@*/
     me->name = (prev ? prev->name : xstrdup(n));
     me->opts = (o ? xstrdup(o) : NULL);
     me->body = xstrdup(b ? b : "");
@@ -709,7 +728,8 @@ pushMacro(/*@out@*/ MacroEntry *mep,
  * @param mep		address of macro entry slot
  */
 static void
-popMacro(MacroEntry *mep)
+popMacro(MacroEntry * mep)
+	/*@modifies *mep @*/
 {
 	MacroEntry me = (*mep ? *mep : NULL);
 
@@ -730,7 +750,8 @@ popMacro(MacroEntry *mep)
  * @param mb		macro expansion state
  */
 static void
-freeArgs(MacroBuf *mb)
+freeArgs(MacroBuf mb)
+	/*@modifies mb @*/
 {
     MacroContext mc = mb->mc;
     int ndeleted = 0;
@@ -779,7 +800,8 @@ freeArgs(MacroBuf *mb)
  * @return		address to continue parsing
  */
 /*@dependent@*/ static const char *
-grabArgs(MacroBuf *mb, const MacroEntry me, const char *se, char lastc)
+grabArgs(MacroBuf mb, const MacroEntry me, const char * se, char lastc)
+	/*@modifies mb @*/
 {
     char buf[BUFSIZ], *b, *be;
     char aname[16];
@@ -852,7 +874,7 @@ grabArgs(MacroBuf *mb, const MacroEntry me, const char *se, char lastc)
 	if (c == '?' || (o = strchr(opts, c)) == NULL) {
 	    rpmError(RPMERR_BADSPEC, _("Unknown option %c in %s(%s)\n"),
 			(char)c, me->name, opts);
-	    return se;
+	    /*@-retalias@*/ return se; /*@=retalias@*/
 	}
 	*be++ = '-';
 	*be++ = c;
@@ -890,7 +912,7 @@ grabArgs(MacroBuf *mb, const MacroEntry me, const char *se, char lastc)
     /* Add unexpanded args as macro. */
     addMacro(mb->mc, "*", NULL, b, mb->depth);
 
-    return se;
+    /*@-retalias@*/ return se; /*@=retalias@*/
 }
 
 /**
@@ -901,17 +923,18 @@ grabArgs(MacroBuf *mb, const MacroEntry me, const char *se, char lastc)
  * @param msglen	no. of bytes in message
  */
 static void
-doOutput(MacroBuf *mb, int waserror, const char *msg, size_t msglen)
+doOutput(MacroBuf mb, int waserror, const char * msg, size_t msglen)
+	/*@modifies mb, fileSystem @*/
 {
-	char buf[BUFSIZ];
+    char buf[BUFSIZ];
 
-	strncpy(buf, msg, msglen);
-	buf[msglen] = '\0';
-	(void) expandU(mb, buf, sizeof(buf));
-	if (waserror)
-		rpmError(RPMERR_BADSPEC, "%s\n", buf);
-	else
-		fprintf(stderr, "%s", buf);
+    strncpy(buf, msg, msglen);
+    buf[msglen] = '\0';
+    (void) expandU(mb, buf, sizeof(buf));
+    if (waserror)
+	rpmError(RPMERR_BADSPEC, "%s\n", buf);
+    else
+	fprintf(stderr, "%s", buf);
 }
 
 /**
@@ -924,90 +947,92 @@ doOutput(MacroBuf *mb, int waserror, const char *msg, size_t msglen)
  * @param gn		length of field g
  */
 static void
-doFoo(MacroBuf *mb, int negate, const char *f, size_t fn, const char *g, size_t glen)
+doFoo(MacroBuf mb, int negate, const char * f, size_t fn,
+		const char * g, size_t glen)
+	/*@modifies mb @*/
 {
-	char buf[BUFSIZ], *b = NULL, *be;
-	int c;
+    char buf[BUFSIZ], *b = NULL, *be;
+    int c;
 
-	buf[0] = '\0';
-	if (g) {
-		strncpy(buf, g, glen);
-		buf[glen] = '\0';
-		(void) expandU(mb, buf, sizeof(buf));
-	}
-	if (STREQ("basename", f, fn)) {
-		if ((b = strrchr(buf, '/')) == NULL)
-			b = buf;
+    buf[0] = '\0';
+    if (g) {
+	strncpy(buf, g, glen);
+	buf[glen] = '\0';
+	(void) expandU(mb, buf, sizeof(buf));
+    }
+    if (STREQ("basename", f, fn)) {
+	if ((b = strrchr(buf, '/')) == NULL)
+	    b = buf;
 #if NOTYET
-	/* XXX watchout for conflict with %dir */
-	} else if (STREQ("dirname", f, fn)) {
-		if ((b = strrchr(buf, '/')) != NULL)
-			*b = '\0';
-		b = buf;
+    /* XXX watchout for conflict with %dir */
+    } else if (STREQ("dirname", f, fn)) {
+	if ((b = strrchr(buf, '/')) != NULL)
+	    *b = '\0';
+	b = buf;
 #endif
-	} else if (STREQ("suffix", f, fn)) {
-		if ((b = strrchr(buf, '.')) != NULL)
-			b++;
-	} else if (STREQ("expand", f, fn)) {
-		b = buf;
-	} else if (STREQ("verbose", f, fn)) {
-		if (negate)
-		    b = (rpmIsVerbose() ? NULL : buf);
-		else
-		    b = (rpmIsVerbose() ? buf : NULL);
-	} else if (STREQ("url2path", f, fn) || STREQ("u2p", f, fn)) {
-		(void)urlPath(buf, (const char **)&b);
-		if (*b == '\0') b = "/";
-	} else if (STREQ("uncompress", f, fn)) {
-		rpmCompressedMagic compressed = COMPRESSED_OTHER;
-		for (b = buf; (c = *b) && isblank(c);)
-			b++;
-		for (be = b; (c = *be) && !isblank(c);)
-			be++;
-		*be++ = '\0';
+    } else if (STREQ("suffix", f, fn)) {
+	if ((b = strrchr(buf, '.')) != NULL)
+	    b++;
+    } else if (STREQ("expand", f, fn)) {
+	b = buf;
+    } else if (STREQ("verbose", f, fn)) {
+	if (negate)
+	    b = (rpmIsVerbose() ? NULL : buf);
+	else
+	    b = (rpmIsVerbose() ? buf : NULL);
+    } else if (STREQ("url2path", f, fn) || STREQ("u2p", f, fn)) {
+	(void)urlPath(buf, (const char **)&b);
+	if (*b == '\0') b = "/";
+    } else if (STREQ("uncompress", f, fn)) {
+	rpmCompressedMagic compressed = COMPRESSED_OTHER;
+	for (b = buf; (c = *b) && isblank(c);)
+	    b++;
+	for (be = b; (c = *be) && !isblank(c);)
+	    be++;
+	*be++ = '\0';
 #ifndef	DEBUG_MACROS
-		(void) isCompressed(b, &compressed);
+	(void) isCompressed(b, &compressed);
 #endif
-		switch(compressed) {
-		default:
-		case 0:	/* COMPRESSED_NOT */
-			sprintf(be, "%%_cat %s", b);
-			break;
-		case 1:	/* COMPRESSED_OTHER */
-			sprintf(be, "%%_gzip -dc %s", b);
-			break;
-		case 2:	/* COMPRESSED_BZIP2 */
-			sprintf(be, "%%_bzip2 %s", b);
-			break;
-		case 3:	/* COMPRESSED_ZIP */
-			sprintf(be, "%%_unzip %s", b);
-			break;
-		}
-		b = be;
-	} else if (STREQ("S", f, fn)) {
-		for (b = buf; (c = *b) && xisdigit(c);)
-			b++;
-		if (!c) {	/* digit index */
-			b++;
-			sprintf(b, "%%SOURCE%s", buf);
-		} else
-			b = buf;
-	} else if (STREQ("P", f, fn)) {
-		for (b = buf; (c = *b) && xisdigit(c);)
-			b++;
-		if (!c) {	/* digit index */
-			b++;
-			sprintf(b, "%%PATCH%s", buf);
-		} else
-			b = buf;
-	} else if (STREQ("F", f, fn)) {
-		b = buf + strlen(buf) + 1;
-		sprintf(b, "file%s.file", buf);
+	switch(compressed) {
+	default:
+	case 0:	/* COMPRESSED_NOT */
+	    sprintf(be, "%%_cat %s", b);
+	    break;
+	case 1:	/* COMPRESSED_OTHER */
+	    sprintf(be, "%%_gzip -dc %s", b);
+	    break;
+	case 2:	/* COMPRESSED_BZIP2 */
+	    sprintf(be, "%%_bzip2 %s", b);
+	    break;
+	case 3:	/* COMPRESSED_ZIP */
+	    sprintf(be, "%%_unzip %s", b);
+	    break;
 	}
+	b = be;
+    } else if (STREQ("S", f, fn)) {
+	for (b = buf; (c = *b) && xisdigit(c);)
+	    b++;
+	if (!c) {	/* digit index */
+	    b++;
+	    sprintf(b, "%%SOURCE%s", buf);
+	} else
+	    b = buf;
+    } else if (STREQ("P", f, fn)) {
+	for (b = buf; (c = *b) && xisdigit(c);)
+	    b++;
+	if (!c) {	/* digit index */
+	    b++;
+	    sprintf(b, "%%PATCH%s", buf);
+	} else
+			b = buf;
+    } else if (STREQ("F", f, fn)) {
+	b = buf + strlen(buf) + 1;
+	sprintf(b, "file%s.file", buf);
+    }
 
-	if (b) {
-		(void) expandT(mb, b, strlen(b));
-	}
+    if (b) {
+	(void) expandT(mb, b, strlen(b));
+    }
 }
 
 /**
@@ -1017,7 +1042,8 @@ doFoo(MacroBuf *mb, int negate, const char *f, size_t fn, const char *g, size_t
  * @return		0 on success, 1 on failure
  */
 static int
-expandMacro(MacroBuf *mb)
+expandMacro(MacroBuf mb)
+	/*@modifies mb @*/
 {
     MacroEntry *mep;
     MacroEntry me;
@@ -1332,93 +1358,97 @@ expandMacro(MacroBuf *mb)
 /* =============================================================== */
 
 int
-expandMacros(void *spec, MacroContext mc, char *s, size_t slen)
+expandMacros(void * spec, MacroContext mc, char * s, size_t slen)
 {
-	MacroBuf macrobuf, *mb = &macrobuf;
-	char *tbuf;
-	int rc;
+    MacroBuf mb = alloca(sizeof(*mb));
+    char *tbuf;
+    int rc;
 
-	if (s == NULL || slen <= 0)
-		return 0;
-	if (mc == NULL) mc = &rpmGlobalMacroContext;
+    if (s == NULL || slen <= 0)
+	return 0;
+    if (mc == NULL) mc = &rpmGlobalMacroContext;
 
-	tbuf = alloca(slen + 1);
-	memset(tbuf, 0, (slen + 1));
+    tbuf = alloca(slen + 1);
+    memset(tbuf, 0, (slen + 1));
 
-	/*@-temptrans@*/
-	mb->s = s;
-	/*@=temptrans@*/
-	mb->t = tbuf;
-	mb->nb = slen;
-	mb->depth = 0;
-	mb->macro_trace = print_macro_trace;
-	mb->expand_trace = print_expand_trace;
+    /*@-temptrans -assignexpose@*/
+    mb->s = s;
+    /*@=temptrans =assignexpose@*/
+    mb->t = tbuf;
+    mb->nb = slen;
+    mb->depth = 0;
+    mb->macro_trace = print_macro_trace;
+    mb->expand_trace = print_expand_trace;
 
-	/*@-temptrans@*/
-	mb->spec = spec;	/* (future) %file expansion info */
-	mb->mc = mc;
-	/*@=temptrans@*/
+    /*@-temptrans -assignexpose@*/
+    mb->spec = spec;	/* (future) %file expansion info */
+    mb->mc = mc;
+    /*@=temptrans =assignexpose@*/
 
-	rc = expandMacro(mb);
+    rc = expandMacro(mb);
 
-	if (mb->nb <= 0)
-		rpmError(RPMERR_BADSPEC, _("Target buffer overflow\n"));
+    if (mb->nb <= 0)
+	rpmError(RPMERR_BADSPEC, _("Target buffer overflow\n"));
 
-	tbuf[slen] = '\0';	/* XXX just in case */
-	strncpy(s, tbuf, (slen - mb->nb + 1));
+    tbuf[slen] = '\0';	/* XXX just in case */
+    strncpy(s, tbuf, (slen - mb->nb + 1));
 
-	return rc;
+    return rc;
 }
 
 void
-addMacro(MacroContext mc, const char *n, const char *o, const char *b, int level)
+addMacro(MacroContext mc,
+	const char * n, const char * o, const char * b, int level)
 {
-	MacroEntry *mep;
+    MacroEntry * mep;
 
-	if (mc == NULL) mc = &rpmGlobalMacroContext;
+    if (mc == NULL) mc = &rpmGlobalMacroContext;
 
-	/* If new name, expand macro table */
-	if ((mep = findEntry(mc, n, 0)) == NULL) {
-		if (mc->firstFree == mc->macrosAllocated)
-			expandMacroTable(mc);
-		mep = mc->macroTable + mc->firstFree++;
-	}
+    /* If new name, expand macro table */
+    if ((mep = findEntry(mc, n, 0)) == NULL) {
+	if (mc->firstFree == mc->macrosAllocated)
+	    expandMacroTable(mc);
+	if (mc->macroTable != NULL)
+	    mep = mc->macroTable + mc->firstFree++;
+    }
 
+    if (mep != NULL) {
 	/* Push macro over previous definition */
 	pushMacro(mep, n, o, b, level);
 
 	/* If new name, sort macro table */
 	if ((*mep)->prev == NULL)
-		sortMacroTable(mc);
+	    sortMacroTable(mc);
+    }
 }
 
 void
-delMacro(MacroContext mc, const char *n)
+delMacro(MacroContext mc, const char * n)
 {
-	MacroEntry *mep;
-
-	if (mc == NULL) mc = &rpmGlobalMacroContext;
-	/* If name exists, pop entry */
-	if ((mep = findEntry(mc, n, 0)) != NULL) {
-		popMacro(mep);
-		/* If deleted name, sort macro table */
-		if (!(mep && *mep))
-			sortMacroTable(mc);
-	}
+    MacroEntry * mep;
+
+    if (mc == NULL) mc = &rpmGlobalMacroContext;
+    /* If name exists, pop entry */
+    if ((mep = findEntry(mc, n, 0)) != NULL) {
+	popMacro(mep);
+	/* If deleted name, sort macro table */
+	if (!(mep && *mep))
+	    sortMacroTable(mc);
+    }
 }
 
 int
-rpmDefineMacro(MacroContext mc, const char *macro, int level)
+rpmDefineMacro(MacroContext mc, const char * macro, int level)
 {
-	MacroBuf macrobuf, *mb = &macrobuf;
-
-	memset(mb, 0, sizeof(*mb));
-	/* XXX just enough to get by */
-	/*@-temptrans@*/
-	mb->mc = (mc ? mc : &rpmGlobalMacroContext);
-	/*@=temptrans@*/
-	(void)doDefine(mb, macro, level, 0);
-	return 0;
+    MacroBuf mb = alloca(sizeof(*mb));
+
+    memset(mb, 0, sizeof(*mb));
+    /* XXX just enough to get by */
+    /*@-temptrans -assignexpose@*/
+    mb->mc = (mc ? mc : &rpmGlobalMacroContext);
+    /*@=temptrans =assignexpose@*/
+    (void)doDefine(mb, macro, level, 0);
+    return 0;
 }
 
 void
@@ -1457,7 +1487,7 @@ rpmInitMacros(MacroContext mc, const char *macrofiles)
 
 	for (me = mfile; (me = strchr(me, ':')) != NULL; me++) {
 	    if (!(me[1] == '/' && me[2] == '/'))
-		break;
+		/*@innerbreak@*/ break;
 	}
 
 	if (me && *me == ':')
@@ -1535,7 +1565,7 @@ rpmFreeMacros(MacroContext mc)
 /*@=globstate@*/
 
 /* =============================================================== */
-int isCompressed(const char *file, rpmCompressedMagic *compressed)
+int isCompressed(const char * file, rpmCompressedMagic * compressed)
 {
     FD_t fd;
     ssize_t nb;
@@ -1660,7 +1690,7 @@ char *rpmCleanPath(char * path)
 	case '/':
 	    /* Move parent dir forward */
 	    for (se = te + 1; se < t && *se != '/'; se++)
-		;
+		{};
 	    if (se < t && *se == '/') {
 		te = se;
 /*fprintf(stderr, "*** next pdir \"%.*s\"\n", (te-path), path); */
@@ -1692,7 +1722,7 @@ char *rpmCleanPath(char * path)
 		/* Move parent dir forward */
 		if (te > path)
 		    for (--te; te > path && *te != '/'; te--)
-			;
+			{};
 /*fprintf(stderr, "*** prev pdir \"%.*s\"\n", (te-path), path); */
 		s++;
 		s++;
@@ -1712,7 +1742,7 @@ char *rpmCleanPath(char * path)
     *t = '\0';
 
 /*fprintf(stderr, "\t%s\n", path); */
-    /*@-temptrans@*/ return path; /*@=temptrans@*/
+    /*@-temptrans -retalias@*/ return path; /*@=temptrans =retalias@*/
 }
 
 /* Return concatenated and expanded canonical path. */
@@ -1761,14 +1791,16 @@ const char * rpmGenPath(const char * urlroot, const char * urlmdir,
     int nurl = 0;
     int ut;
 
-if (_debug)
-fprintf(stderr, "*** RGP xroot %s xmdir %s xfile %s\n", xroot, xmdir, xfile);
+#if 0
+if (_debug) fprintf(stderr, "*** RGP xroot %s xmdir %s xfile %s\n", xroot, xmdir, xfile);
+#endif
     ut = urlPath(xroot, &root);
     if (url == NULL && ut > URL_IS_DASH) {
 	url = xroot;
 	nurl = root - xroot;
-if (_debug)
-fprintf(stderr, "*** RGP ut %d root %s nurl %d\n", ut, root, nurl);
+#if 0
+if (_debug) fprintf(stderr, "*** RGP ut %d root %s nurl %d\n", ut, root, nurl);
+#endif
     }
     if (root == NULL || *root == '\0') root = "/";
 
@@ -1776,8 +1808,9 @@ fprintf(stderr, "*** RGP ut %d root %s nurl %d\n", ut, root, nurl);
     if (url == NULL && ut > URL_IS_DASH) {
 	url = xmdir;
 	nurl = mdir - xmdir;
-if (_debug)
-fprintf(stderr, "*** RGP ut %d mdir %s nurl %d\n", ut, mdir, nurl);
+#if 0
+if (_debug) fprintf(stderr, "*** RGP ut %d mdir %s nurl %d\n", ut, mdir, nurl);
+#endif
     }
     if (mdir == NULL || *mdir == '\0') mdir = "/";
 
@@ -1785,8 +1818,9 @@ fprintf(stderr, "*** RGP ut %d mdir %s nurl %d\n", ut, mdir, nurl);
     if (url == NULL && ut > URL_IS_DASH) {
 	url = xfile;
 	nurl = file - xfile;
-if (_debug)
-fprintf(stderr, "*** RGP ut %d file %s nurl %d\n", ut, file, nurl);
+#if 0
+if (_debug) fprintf(stderr, "*** RGP ut %d file %s nurl %d\n", ut, file, nurl);
+#endif
     }
 
     if (url && nurl > 0) {
@@ -1801,8 +1835,9 @@ fprintf(stderr, "*** RGP ut %d file %s nurl %d\n", ut, file, nurl);
     xroot = _free(xroot);
     xmdir = _free(xmdir);
     xfile = _free(xfile);
-if (_debug)
-fprintf(stderr, "*** RGP result %s\n", result);
+#if 0
+if (_debug) fprintf(stderr, "*** RGP result %s\n", result);
+#endif
     return result;
 }
 
@@ -1817,39 +1852,39 @@ char *macrofiles = "/usr/lib/rpm/macros:/etc/rpm/macros:~/.rpmmacros";
 int
 main(int argc, char *argv[])
 {
-	int c;
-	int errflg = 0;
-	extern char *optarg;
-	extern int optind;
-
-	while ((c = getopt(argc, argv, "f:")) != EOF ) {
-	    switch (c) {
-	    case 'f':
-		macrofiles = optarg;
-		break;
-	    case '?':
-	    default:
-		errflg++;
-		break;
-	    }
-	}
-	if (errflg || optind >= argc) {
-	    fprintf(stderr, "Usage: %s [-f macropath ] macro ...\n", argv[0]);
-	    exit(1);
+    int c;
+    int errflg = 0;
+    extern char *optarg;
+    extern int optind;
+
+    while ((c = getopt(argc, argv, "f:")) != EOF ) {
+	switch (c) {
+	case 'f':
+	    macrofiles = optarg;
+	    break;
+	case '?':
+	default:
+	    errflg++;
+	    break;
 	}
+    }
+    if (errflg || optind >= argc) {
+	fprintf(stderr, "Usage: %s [-f macropath ] macro ...\n", argv[0]);
+	exit(1);
+    }
 
-	rpmInitMacros(NULL, macrofiles);
-	for ( ; optind < argc; optind++) {
-	    const char *val;
+    rpmInitMacros(NULL, macrofiles);
+    for ( ; optind < argc; optind++) {
+	const char *val;
 
-	    val = rpmGetPath(argv[optind], NULL);
-	    if (val) {
-		fprintf(stdout, "%s:\t%s\n", argv[optind], val);
-		val = _free(val);
-	    }
+	val = rpmGetPath(argv[optind], NULL);
+	if (val) {
+	    fprintf(stdout, "%s:\t%s\n", argv[optind], val);
+	    val = _free(val);
 	}
-	rpmFreeMacros(NULL);
-	return 0;
+    }
+    rpmFreeMacros(NULL);
+    return 0;
 }
 
 #else	/* !EVAL_MACROS */
@@ -1860,30 +1895,30 @@ char *testfile = "./test";
 int
 main(int argc, char *argv[])
 {
-	char buf[BUFSIZ];
-	FILE *fp;
-	int x;
+    char buf[BUFSIZ];
+    FILE *fp;
+    int x;
 
-	rpmInitMacros(NULL, macrofiles);
-	rpmDumpMacroTable(NULL, NULL);
+    rpmInitMacros(NULL, macrofiles);
+    rpmDumpMacroTable(NULL, NULL);
 
-	if ((fp = fopen(testfile, "r")) != NULL) {
-		while(rdcl(buf, sizeof(buf), fp, 1)) {
-			x = expandMacros(NULL, NULL, buf, sizeof(buf));
-			fprintf(stderr, "%d->%s\n", x, buf);
-			memset(buf, 0, sizeof(buf));
-		}
-		fclose(fp);
+    if ((fp = fopen(testfile, "r")) != NULL) {
+	while(rdcl(buf, sizeof(buf), fp, 1)) {
+	    x = expandMacros(NULL, NULL, buf, sizeof(buf));
+	    fprintf(stderr, "%d->%s\n", x, buf);
+	    memset(buf, 0, sizeof(buf));
 	}
+	fclose(fp);
+    }
 
-	while(rdcl(buf, sizeof(buf), stdin, 1)) {
-		x = expandMacros(NULL, NULL, buf, sizeof(buf));
-		fprintf(stderr, "%d->%s\n <-\n", x, buf);
-		memset(buf, 0, sizeof(buf));
-	}
-	rpmFreeMacros(NULL);
+    while(rdcl(buf, sizeof(buf), stdin, 1)) {
+	x = expandMacros(NULL, NULL, buf, sizeof(buf));
+	fprintf(stderr, "%d->%s\n <-\n", x, buf);
+	memset(buf, 0, sizeof(buf));
+    }
+    rpmFreeMacros(NULL);
 
-	return 0;
+    return 0;
 }
 #endif	/* EVAL_MACROS */
 #endif	/* DEBUG_MACROS */
diff --git a/rpmio/rpmio.c b/rpmio/rpmio.c
index 657b40de7..16fdc8ef1 100644
--- a/rpmio/rpmio.c
+++ b/rpmio/rpmio.c
@@ -99,7 +99,8 @@ int _rpmio_debug = 0;
  * @retval		NULL always
  */
 /*@unused@*/ static inline /*@null@*/ void *
-_free(/*@only@*/ /*@null@*/ const void * p) /*@modifies p@*/
+_free(/*@only@*/ /*@null@*/ const void * p)
+	/*@modifies p@*/
 {
     if (p != NULL)	free((void *)p);
     return NULL;
@@ -108,6 +109,7 @@ _free(/*@only@*/ /*@null@*/ const void * p) /*@modifies p@*/
 /* =============================================================== */
 
 static /*@observer@*/ const char * fdbg(/*@null@*/ FD_t fd)
+	/*@modifies fileSystem @*/
 {
     static char buf[BUFSIZ];
     char *be = buf;
@@ -168,7 +170,8 @@ static /*@observer@*/ const char * fdbg(/*@null@*/ FD_t fd)
 }
 
 /* =============================================================== */
-off_t fdSize(FD_t fd) {
+off_t fdSize(FD_t fd)
+{
     struct stat sb;
     off_t rc = -1; 
 
@@ -192,7 +195,8 @@ DBGIO(0, (stderr, "==>\tfdSize(%p) rc %ld\n", fd, (long)rc));
     return rc;
 }
 
-FD_t fdDup(int fdno) {
+FD_t fdDup(int fdno)
+{
     FD_t fd;
     int nfdno;
 
@@ -204,14 +208,18 @@ DBGIO(fd, (stderr, "==> fdDup(%d) fd %p %s\n", fdno, (fd ? fd : NULL), fdbg(fd))
     /*@-refcounttrans@*/ return fd; /*@=refcounttrans@*/
 }
 
-static inline /*@unused@*/ int fdSeekNot(void * cookie,  /*@unused@*/ _libio_pos_t pos,  /*@unused@*/ int whence) {
+static inline /*@unused@*/ int fdSeekNot(void * cookie,
+		/*@unused@*/ _libio_pos_t pos,  /*@unused@*/ int whence)
+	/*@*/
+{
     FD_t fd = c2f(cookie);
     FDSANE(fd);		/* XXX keep gcc quiet */
     return -2;
 }
 
 #ifdef UNUSED
-FILE *fdFdopen(void * cookie, const char *fmode) {
+FILE *fdFdopen(void * cookie, const char *fmode)
+{
     FD_t fd = c2f(cookie);
     int fdno;
     FILE * fp;
@@ -233,10 +241,15 @@ DBGIO(fd, (stderr, "==> fdFdopen(%p,\"%s\") fdno %d -> fp %p fdno %d\n", cookie,
 #endif
 
 /* =============================================================== */
-static inline /*@null@*/ FD_t XfdLink(void * cookie, const char *msg, const char *file, unsigned line) {
+static inline /*@null@*/ FD_t XfdLink(void * cookie, const char * msg,
+		const char * file, unsigned line)
+	/*@modifies internalState @*/
+{
     FD_t fd;
 if (cookie == NULL)
+    /*@-castexpose@*/
 DBGREFS(0, (stderr, "--> fd  %p ++ %d %s at %s:%u\n", cookie, FDNREFS(cookie)+1, msg, file, line));
+    /*@=castexpose@*/
     fd = c2f(cookie);
     if (fd) {
 	fd->nrefs++;
@@ -245,14 +258,17 @@ DBGREFS(fd, (stderr, "--> fd  %p ++ %d %s at %s:%u %s\n", fd, fd->nrefs, msg, fi
     return fd;
 }
 
-static inline /*@null@*/ FD_t XfdFree( /*@killref@*/ FD_t fd, const char *msg, const char *file, unsigned line) {
+static inline /*@null@*/ FD_t XfdFree( /*@killref@*/ FD_t fd, const char *msg,
+		const char *file, unsigned line)
+	/*@modifies fd @*/
+{
 if (fd == NULL)
 DBGREFS(0, (stderr, "--> fd  %p -- %d %s at %s:%u\n", fd, FDNREFS(fd), msg, file, line));
     FDSANE(fd);
     if (fd) {
 DBGREFS(fd, (stderr, "--> fd  %p -- %d %s at %s:%u %s\n", fd, fd->nrefs, msg, file, line, fdbg(fd)));
 	if (--fd->nrefs > 0)
-	    /*@-refcounttrans@*/ return fd; /*@=refcounttrans@*/
+	    /*@-refcounttrans -retalias@*/ return fd; /*@=refcounttrans =retalias@*/
 	fd->stats = _free(fd->stats);
 	fd->digest = _free(fd->digest);
 	/*@-refcounttrans@*/ free(fd); /*@=refcounttrans@*/
@@ -260,7 +276,10 @@ DBGREFS(fd, (stderr, "--> fd  %p -- %d %s at %s:%u %s\n", fd, fd->nrefs, msg, fi
     return NULL;
 }
 
-static inline /*@null@*/ FD_t XfdNew(const char *msg, const char *file, unsigned line) {
+static inline /*@null@*/ FD_t XfdNew(const char * msg,
+		const char * file, unsigned line)
+	/*@*/
+{
     FD_t fd = (FD_t) xmalloc(sizeof(struct _FD_s));
     if (fd == NULL) /* XXX xmalloc never returns NULL */
 	return NULL;
@@ -272,7 +291,9 @@ static inline /*@null@*/ FD_t XfdNew(const char *msg, const char *file, unsigned
     fd->nfps = 0;
     memset(fd->fps, 0, sizeof(fd->fps));
 
+    /*@-assignexpose@*/
     fd->fps[0].io = fdio;
+    /*@=assignexpose@*/
     fd->fps[0].fp = NULL;
     fd->fps[0].fdno = -1;
 
@@ -295,7 +316,8 @@ static inline /*@null@*/ FD_t XfdNew(const char *msg, const char *file, unsigned
     return XfdLink(fd, msg, file, line);
 }
 
-ssize_t fdRead(void * cookie, /*@out@*/ char * buf, size_t count) {
+ssize_t fdRead(void * cookie, /*@out@*/ char * buf, size_t count)
+{
     FD_t fd = c2f(cookie);
     ssize_t rc;
 
@@ -312,7 +334,8 @@ DBGIO(fd, (stderr, "==>\tfdRead(%p,%p,%ld) rc %ld %s\n", cookie, buf, (long)coun
     return rc;
 }
 
-ssize_t fdWrite(void * cookie, const char * buf, size_t count) {
+ssize_t fdWrite(void * cookie, const char * buf, size_t count)
+{
     FD_t fd = c2f(cookie);
     int fdno = fdFileno(fd);
     ssize_t rc;
@@ -344,7 +367,9 @@ DBGIO(fd, (stderr, "==>\tfdWrite(%p,%p,%ld) rc %ld %s\n", cookie, buf, (long)cou
     return rc;
 }
 
-static inline int fdSeek(void * cookie, _libio_pos_t pos, int whence) {
+static inline int fdSeek(void * cookie, _libio_pos_t pos, int whence)
+	/*@modifies internalState, fileSystem @*/
+{
 #ifdef USE_COOKIE_SEEK_POINTER
     _IO_off64_t p = *pos;
 #else
@@ -363,7 +388,8 @@ DBGIO(fd, (stderr, "==>\tfdSeek(%p,%ld,%d) rc %lx %s\n", cookie, (long)p, whence
     return rc;
 }
 
-int fdClose( /*@only@*/ void * cookie) {
+int fdClose( /*@only@*/ void * cookie)
+{
     FD_t fd;
     int fdno;
     int rc;
@@ -384,7 +410,8 @@ DBGIO(fd, (stderr, "==>\tfdClose(%p) rc %lx %s\n", (fd ? fd : NULL), (unsigned l
     return rc;
 }
 
-/*@null@*/ FD_t fdOpen(const char *path, int flags, mode_t mode) {
+/*@null@*/ FD_t fdOpen(const char *path, int flags, mode_t mode)
+{
     FD_t fd;
     int fdno;
 
@@ -616,7 +643,9 @@ const char *urlStrerror(const char *url)
 }
 
 #if !defined(USE_ALT_DNS) || !USE_ALT_DNS 
-static int mygethostbyname(const char * host, struct in_addr * address)
+static int mygethostbyname(const char * host,
+		/*@out@*/ struct in_addr * address)
+	/*@modifies *address, fileSystem @*/
 {
     struct hostent * hostinfo;
 
@@ -630,7 +659,8 @@ static int mygethostbyname(const char * host, struct in_addr * address)
 }
 #endif
 
-static int getHostAddress(const char * host, struct in_addr * address)
+static int getHostAddress(const char * host, /*@out@*/ struct in_addr * address)
+	/*@modifies *address, fileSystem @*/
 {
     if (xisdigit(host[0])) {
 	if (! /*@-unrecog@*/ inet_aton(host, address) /*@=unrecog@*/ )
@@ -646,6 +676,7 @@ static int getHostAddress(const char * host, struct in_addr * address)
 }
 
 static int tcpConnect(FD_t ctrl, const char * host, int port)
+	/*@modifies ctrl, fileSystem @*/
 {
     struct sockaddr_in sin;
     int fdno = -1;
@@ -691,7 +722,9 @@ errxit:
     return rc;
 }
 
-static int checkResponse(void * uu, FD_t ctrl, /*@out@*/ int *ecp, /*@out@*/ char ** str)
+static int checkResponse(void * uu, FD_t ctrl,
+		/*@out@*/ int *ecp, /*@out@*/ char ** str)
+	/*@modifies ctrl, *ecp, *str, fileSystem @*/
 {
     urlinfo u = uu;
     char *buf;
@@ -740,7 +773,7 @@ static int checkResponse(void * uu, FD_t ctrl, /*@out@*/ int *ecp, /*@out@*/ cha
 		if (se > s && se[-1] == '\r')
 		   se[-1] = '\0';
 		if (*se == '\0')
-		    break;
+		    /*@innerbreak@*/ break;
 
 if (_ftp_debug)
 fprintf(stderr, "<- %s\n", s);
@@ -748,7 +781,7 @@ fprintf(stderr, "<- %s\n", s);
 		/* HTTP: header termination on empty line */
 		if (*s == '\0') {
 		    moretodo = 0;
-		    break;
+		    /*@innerbreak@*/ break;
 		}
 		*se++ = '\0';
 
@@ -774,7 +807,7 @@ fprintf(stderr, "<- %s\n", s);
 
 		/* HTTP: look for "token: ..." */
 		for (e = s; *e && !(*e == ' ' || *e == ':'); e++)
-		    ;
+		    {};
 		if (e > s && *e++ == ':') {
 		    size_t ne = (e - s);
 		    while (*e && *e == ' ') e++;
@@ -852,6 +885,7 @@ fprintf(stderr, "<- %s\n", s);
 }
 
 static int ftpCheckResponse(urlinfo u, /*@out@*/ char ** str)
+	/*@modifies u, *str, fileSystem @*/
 {
     int ec = 0;
     int rc;
@@ -876,6 +910,7 @@ static int ftpCheckResponse(urlinfo u, /*@out@*/ char ** str)
 }
 
 static int ftpCommand(urlinfo u, char ** str, ...)
+	/*@modifies u, *str, fileSystem @*/
 {
     va_list ap;
     int len = 0;
@@ -912,6 +947,7 @@ fprintf(stderr, "-> %s", t);
 }
 
 static int ftpLogin(urlinfo u)
+	/*@modifies u, fileSystem @*/
 {
     const char * host;
     const char * user;
@@ -1180,6 +1216,7 @@ int ufdCopy(FD_t sfd, FD_t tfd)
 }
 
 static int urlConnect(const char * url, /*@out@*/ urlinfo * uret)
+	/*@modifies *uret, fileSystem @*/
 {
     urlinfo u;
     int rc = 0;
@@ -1234,7 +1271,8 @@ int ufdGetFile(FD_t sfd, FD_t tfd)
     return rc;
 }
 
-int ftpCmd(const char * cmd, const char * url, const char * arg2) {
+int ftpCmd(const char * cmd, const char * url, const char * arg2)
+{
     urlinfo u;
     int rc;
     const char * path;
@@ -1263,7 +1301,9 @@ int ftpCmd(const char * cmd, const char * url, const char * arg2) {
 #define	SHUT_RDWR	1+1
 #endif
 
-static int ftpAbort(urlinfo u, FD_t data) {
+static int ftpAbort(urlinfo u, FD_t data)
+	/*@modifies u, data, fileSystem @*/
+{
     static unsigned char ipbuf[3] = { IAC, IP, IAC };
     FD_t ctrl;
     int rc;
@@ -1299,7 +1339,7 @@ static int ftpAbort(urlinfo u, FD_t data) {
 	data->rd_timeoutsecs = 10;
 	if (fdReadable(data, data->rd_timeoutsecs) > 0) {
 	    while (timedRead(data, u->buf, u->bufAlloced) > 0)
-		;
+		u->buf[0] = '\0';
 	}
 	data->rd_timeoutsecs = tosecs;
 	/* XXX ftp abort needs to close the data channel to receive status */
@@ -1322,6 +1362,7 @@ static int ftpAbort(urlinfo u, FD_t data) {
 }
 
 static int ftpFileDone(urlinfo u, FD_t data)
+	/*@modifies u, data, fileSystem @*/
 {
     int rc = 0;
 
@@ -1338,6 +1379,7 @@ static int ftpFileDone(urlinfo u, FD_t data)
 }
 
 static int httpResp(urlinfo u, FD_t ctrl, /*@out@*/ char ** str)
+	/*@modifies ctrl, *str, fileSystem @*/
 {
     int ec = 0;
     int rc;
@@ -1360,6 +1402,7 @@ fprintf(stderr, "*** httpResp: rc %d ec %d\n", rc, ec);
 }
 
 static int httpReq(FD_t ctrl, const char * httpCmd, const char * httpArg)
+	/*@modifies ctrl, fileSystem @*/
 {
     urlinfo u = ctrl->url;
     const char * host;
@@ -1464,7 +1507,8 @@ errxit2:
 }
 
 /* XXX DYING: unused */
-void * ufdGetUrlinfo(FD_t fd) {
+void * ufdGetUrlinfo(FD_t fd)
+{
     FDSANE(fd);
     if (fd->url == NULL)
 	return NULL;
@@ -1472,7 +1516,9 @@ void * ufdGetUrlinfo(FD_t fd) {
 }
 
 /* =============================================================== */
-static ssize_t ufdRead(void * cookie, /*@out@*/ char * buf, size_t count) {
+static ssize_t ufdRead(void * cookie, /*@out@*/ char * buf, size_t count)
+	/*@modifies internalState, *buf, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     int bytesRead;
     int total;
@@ -1534,6 +1580,7 @@ fprintf(stderr, "*** read: rc %d errno %d %s \"%s\"\n", rc, errno, strerror(errn
 }
 
 static ssize_t ufdWrite(void * cookie, const char * buf, size_t count)
+	/*@modifies internalState, fileSystem @*/
 {
     FD_t fd = c2f(cookie);
     int bytesWritten;
@@ -1596,7 +1643,9 @@ fprintf(stderr, "*** write: rc %d errno %d %s \"%s\"\n", rc, errno, strerror(err
     return count;
 }
 
-static inline int ufdSeek(void * cookie, _libio_pos_t pos, int whence) {
+static inline int ufdSeek(void * cookie, _libio_pos_t pos, int whence)
+	/*@modifies internalState, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
 
     switch (fd->urlType) {
@@ -1731,6 +1780,7 @@ fprintf(stderr, "-> \r\n");
 /*@-nullstate@*/	/* FIX: u->{ctrl,data}->url undef after XurlLink. */
 /*@null@*/ FD_t ftpOpen(const char *url, /*@unused@*/ int flags,
 		/*@unused@*/ mode_t mode, /*@out@*/ urlinfo *uret)
+	/*@modifies *uret, fileSystem @*/
 {
     urlinfo u = NULL;
     FD_t fd = NULL;
@@ -1768,6 +1818,7 @@ exit:
 /*@-nullstate@*/	/* FIX: u->{ctrl,data}->url undef after XurlLink. */
 static /*@null@*/ FD_t httpOpen(const char * url, /*@unused@*/ int flags,
 		/*@unused@*/ mode_t mode, /*@out@*/ urlinfo * uret)
+	/*@modifies *uret, fileSystem @*/
 {
     urlinfo u = NULL;
     FD_t fd = NULL;
@@ -1807,7 +1858,8 @@ exit:
 }
 /*@=nullstate@*/
 
-static /*@null@*/ FD_t ufdOpen(const char *url, int flags, mode_t mode)
+static /*@null@*/ FD_t ufdOpen(const char * url, int flags, mode_t mode)
+	/*@modifies fileSystem @*/
 {
     FD_t fd = NULL;
     const char * cmd;
@@ -1904,7 +1956,9 @@ FDIO_t ufdio = /*@-compmempass@*/ &ufdio_s /*@=compmempass@*/ ;
 
 #include <zlib.h>
 
-static inline /*@dependent@*/ /*@null@*/ void * gzdFileno(FD_t fd) {
+static inline /*@dependent@*/ /*@null@*/ void * gzdFileno(FD_t fd)
+	/*@*/
+{
     void * rc = NULL;
     int i;
 
@@ -1920,7 +1974,9 @@ static inline /*@dependent@*/ /*@null@*/ void * gzdFileno(FD_t fd) {
     return rc;
 }
 
-static /*@null@*/ FD_t gzdOpen(const char *path, const char *fmode) {
+static /*@null@*/ FD_t gzdOpen(const char * path, const char * fmode)
+	/*@modifies fileSystem @*/
+{
     FD_t fd;
     gzFile *gzfile;
     if ((gzfile = gzopen(path, fmode)) == NULL)
@@ -1932,7 +1988,9 @@ DBGIO(fd, (stderr, "==>\tgzdOpen(\"%s\", \"%s\") fd %p %s\n", path, fmode, (fd ?
     return fdLink(fd, "gzdOpen");
 }
 
-static /*@null@*/ FD_t gzdFdopen(void * cookie, const char *fmode) {
+static /*@null@*/ FD_t gzdFdopen(void * cookie, const char *fmode)
+	/*@modifies internalState, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     int fdno;
     gzFile *gzfile;
@@ -1949,12 +2007,17 @@ static /*@null@*/ FD_t gzdFdopen(void * cookie, const char *fmode) {
     return fdLink(fd, "gzdFdopen");
 }
 
-static int gzdFlush(FD_t fd) {
+static int gzdFlush(FD_t fd)
+	/*@modifies fileSystem @*/
+{
     return gzflush(gzdFileno(fd), Z_SYNC_FLUSH);	/* XXX W2DO? */
 }
 
 /* =============================================================== */
-static ssize_t gzdRead(void * cookie, /*@out@*/ char * buf, size_t count) {
+/*@-mustmod@*/		/* LCL: *buf is modified */
+static ssize_t gzdRead(void * cookie, /*@out@*/ char * buf, size_t count)
+	/*@modifies internalState, *buf, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     gzFile *gzfile;
     ssize_t rc;
@@ -1981,8 +2044,11 @@ DBGIO(fd, (stderr, "==>\tgzdRead(%p,%p,%u) rc %lx %s\n", cookie, buf, (unsigned)
     }
     return rc;
 }
+/*@=mustmod@*/
 
-static ssize_t gzdWrite(void * cookie, const char * buf, size_t count) {
+static ssize_t gzdWrite(void * cookie, const char * buf, size_t count)
+	/*@modifies internalState, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     gzFile *gzfile;
     ssize_t rc;
@@ -2009,7 +2075,9 @@ DBGIO(fd, (stderr, "==>\tgzdWrite(%p,%p,%u) rc %lx %s\n", cookie, buf, (unsigned
 }
 
 /* XXX zlib-1.0.4 has not */
-static inline int gzdSeek(void * cookie, _libio_pos_t pos, int whence) {
+static inline int gzdSeek(void * cookie, _libio_pos_t pos, int whence)
+	/*@modifies internalState, fileSystem @*/
+{
 #ifdef USE_COOKIE_SEEK_POINTER
     _IO_off64_t p = *pos;
 #else
@@ -2042,7 +2110,9 @@ DBGIO(fd, (stderr, "==>\tgzdSeek(%p,%ld,%d) rc %lx %s\n", cookie, (long)p, whenc
     return rc;
 }
 
-static int gzdClose( /*@only@*/ void * cookie) {
+static int gzdClose( /*@only@*/ void * cookie)
+	/*@modifies internalState, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     gzFile *gzfile;
     int rc;
@@ -2101,7 +2171,9 @@ FDIO_t gzdio = /*@-compmempass@*/ &gzdio_s /*@=compmempass@*/ ;
 # define bzwrite BZ2_bzwrite
 #endif /* HAVE_BZ2_1_0 */
 
-static inline /*@dependent@*/ void * bzdFileno(FD_t fd) {
+static inline /*@dependent@*/ void * bzdFileno(FD_t fd)
+	/*@*/
+{
     void * rc = NULL;
     int i;
 
@@ -2117,7 +2189,9 @@ static inline /*@dependent@*/ void * bzdFileno(FD_t fd) {
     return rc;
 }
 
-static /*@null@*/ FD_t bzdOpen(const char *path, const char *mode) {
+static /*@null@*/ FD_t bzdOpen(const char * path, const char * mode)
+	/*@modifies fileSystem @*/
+{
     FD_t fd;
     BZFILE *bzfile;;
     if ((bzfile = bzopen(path, mode)) == NULL)
@@ -2127,7 +2201,9 @@ static /*@null@*/ FD_t bzdOpen(const char *path, const char *mode) {
     return fdLink(fd, "bzdOpen");
 }
 
-static /*@null@*/ FD_t bzdFdopen(void * cookie, const char * fmode) {
+static /*@null@*/ FD_t bzdFdopen(void * cookie, const char * fmode)
+	/*@modifies internalState, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     int fdno;
     BZFILE *bzfile;
@@ -2144,12 +2220,17 @@ static /*@null@*/ FD_t bzdFdopen(void * cookie, const char * fmode) {
     return fdLink(fd, "bzdFdopen");
 }
 
-static int bzdFlush(FD_t fd) {
+static int bzdFlush(FD_t fd)
+	/*@modifies fileSystem @*/
+{
     return bzflush(bzdFileno(fd));
 }
 
 /* =============================================================== */
-static ssize_t bzdRead(void * cookie, /*@out@*/ char * buf, size_t count) {
+/*@-mustmod@*/		/* LCL: *buf is modified */
+static ssize_t bzdRead(void * cookie, /*@out@*/ char * buf, size_t count)
+	/*@modifies internalState, *buf, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     BZFILE *bzfile;
     ssize_t rc = 0;
@@ -2173,8 +2254,11 @@ static ssize_t bzdRead(void * cookie, /*@out@*/ char * buf, size_t count) {
     }
     return rc;
 }
+/*@=mustmod@*/
 
-static ssize_t bzdWrite(void * cookie, const char * buf, size_t count) {
+static ssize_t bzdWrite(void * cookie, const char * buf, size_t count)
+	/*@modifies internalState, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     BZFILE *bzfile;
     ssize_t rc;
@@ -2196,14 +2280,18 @@ static ssize_t bzdWrite(void * cookie, const char * buf, size_t count) {
 }
 
 static inline int bzdSeek(void * cookie, /*@unused@*/ _libio_pos_t pos,
-			/*@unused@*/ int whence) {
+			/*@unused@*/ int whence)
+	/*@*/
+{
     FD_t fd = c2f(cookie);
 
     BZDONLY(fd);
     return -2;
 }
 
-static int bzdClose( /*@only@*/ void * cookie) {
+static int bzdClose( /*@only@*/ void * cookie)
+	/*@modifies internalState, fileSystem @*/
+{
     FD_t fd = c2f(cookie);
     BZFILE *bzfile;
     int rc;
@@ -2243,7 +2331,9 @@ FDIO_t bzdio = /*@-compmempass@*/ &bzdio_s /*@=compmempass@*/ ;
 #endif	/* HAVE_BZLIB_H */
 
 /* =============================================================== */
-/*@observer@*/ static const char * getFdErrstr (FD_t fd) {
+/*@observer@*/ static const char * getFdErrstr (FD_t fd)
+	/*@*/
+{
     const char *errstr = NULL;
 
 #ifdef	HAVE_ZLIB_H
@@ -2267,7 +2357,8 @@ FDIO_t bzdio = /*@-compmempass@*/ &bzdio_s /*@=compmempass@*/ ;
 
 /* =============================================================== */
 
-const char *Fstrerror(FD_t fd) {
+const char *Fstrerror(FD_t fd)
+{
     if (fd == NULL)
 	return strerror(errno);
     FDSANE(fd);
@@ -2302,7 +2393,8 @@ DBGIO(fd, (stderr, "==> Fread(%p,%u,%u,%p) %s\n", buf, (unsigned)size, (unsigned
     return rc;
 }
 
-size_t Fwrite(const void *buf, size_t size, size_t nmemb, FD_t fd) {
+size_t Fwrite(const void *buf, size_t size, size_t nmemb, FD_t fd)
+{
     fdio_write_function_t *_write;
     int rc;
 
@@ -2356,7 +2448,8 @@ DBGIO(fd, (stderr, "==> Fseek(%p,%ld,%d) %s\n", fd, (long)offset, whence, fdbg(f
     return rc;
 }
 
-int Fclose(FD_t fd) {
+int Fclose(FD_t fd)
+{
     int rc = 0, ec = 0;
 
     FDSANE(fd);
@@ -2436,6 +2529,7 @@ static inline void cvtfmode (const char *m,
 				/*@out@*/ char *stdio, size_t nstdio,
 				/*@out@*/ char *other, size_t nother,
 				/*@out@*/ const char **end, /*@out@*/ int * f)
+	/*@modifies *stdio, *other, *end, *f @*/
 {
     int flags = 0;
     char c;
@@ -2519,7 +2613,7 @@ fprintf(stderr, "*** Fdopen(%p,%s) %s\n", fd, fmode, fdbg(fd));
     strncat(zstdio, other, sizeof(zstdio) - strlen(zstdio));
 
     if (end == NULL && other[0] == '\0')
-	/*@-refcounttrans@*/ return fd; /*@=refcounttrans@*/
+	/*@-refcounttrans -retalias@*/ return fd; /*@=refcounttrans =retalias@*/
 
     if (end && *end) {
 	if (!strcmp(end, "fdio")) {
@@ -2557,14 +2651,14 @@ fprintf(stderr, "*** Fdopen fpio fp %p\n", (void *)fp);
 	}
     } else if (other[0] != '\0') {
 	for (end = other; *end && strchr("0123456789fh", *end); end++)
-	    ;
+	    {};
 	if (*end == '\0') {
 	    iof = gzdio;
 	    fd = gzdFdopen(fd, zstdio);
 	}
     }
     if (iof == NULL)
-	/*@-refcounttrans@*/ return fd; /*@=refcounttrans@*/
+	/*@-refcounttrans -retalias@*/ return fd; /*@=refcounttrans =retalias@*/
 
     if (!noLibio) {
 	FILE * fp = NULL;
@@ -2592,7 +2686,7 @@ DBGIO(fd, (stderr, "==> fopencookie(%p,\"%s\",*%p) returns fp %p\n", fd, stdio,
     }
 
 DBGIO(fd, (stderr, "==> Fdopen(%p,\"%s\") returns fd %p %s\n", ofd, fmode, (fd ? fd : NULL), fdbg(fd)));
-    /*@-refcounttrans@*/ return fd; /*@=refcounttrans@*/
+    /*@-refcounttrans -retalias@*/ return fd; /*@=refcounttrans =retalias@*/
 }
 
 FD_t Fopen(const char *path, const char *fmode)
@@ -2688,7 +2782,8 @@ int Fflush(FD_t fd)
     return 0;
 }
 
-int Ferror(FD_t fd) {
+int Ferror(FD_t fd)
+{
     int i, rc = 0;
 
     if (fd == NULL) return -1;
@@ -2718,7 +2813,8 @@ DBGIO(fd, (stderr, "==> Ferror(%p) rc %d %s\n", fd, rc, fdbg(fd)));
     return rc;
 }
 
-int Fileno(FD_t fd) {
+int Fileno(FD_t fd)
+{
     int i, rc = -1;
 
     for (i = fd->nfps ; rc == -1 && i >= 0; i--) {
@@ -2729,7 +2825,8 @@ DBGIO(fd, (stderr, "==> Fileno(%p) rc %d %s\n", (fd ? fd : NULL), rc, fdbg(fd)))
 }
 
 /* XXX this is naive */
-int Fcntl(FD_t fd, int op, void *lip) {
+int Fcntl(FD_t fd, int op, void *lip)
+{
     return fcntl(Fileno(fd), op, lip);
 }
 
@@ -2738,13 +2835,15 @@ int Fcntl(FD_t fd, int op, void *lip) {
  */
 
 /* XXX falloc.c: analogues to pread(3)/pwrite(3). */
-ssize_t Pread(FD_t fd, void * buf, size_t count, _libio_off_t offset) {
+ssize_t Pread(FD_t fd, void * buf, size_t count, _libio_off_t offset)
+{
     if (Fseek(fd, offset, SEEK_SET) < 0)
 	return -1;
     return Fread(buf, sizeof(char), count, fd);
 }
 
-ssize_t Pwrite(FD_t fd, const void * buf, size_t count, _libio_off_t offset) {
+ssize_t Pwrite(FD_t fd, const void * buf, size_t count, _libio_off_t offset)
+{
     if (Fseek(fd, offset, SEEK_SET) < 0)
 	return -1;
     return Fwrite(buf, sizeof(char), count, fd);
diff --git a/rpmio/rpmio.h b/rpmio/rpmio.h
index 53737a983..468f0fa03 100644
--- a/rpmio/rpmio.h
+++ b/rpmio/rpmio.h
@@ -309,13 +309,13 @@ int Access(const char * path, int amode)
 int Glob(const char * pattern, int flags,
 		int errfunc(const char * epath, int eerrno),
 		/*@out@*/ glob_t * pglob)
-	/*@modifies *pglob @*/;
+	/*@modifies *pglob, fileSystem @*/;
 
 /** \ingroup rpmrpc
  * globfree(3) clone.
  */
 void Globfree( /*@only@*/ glob_t * pglob)
-	/*@modifies *pglob @*/;
+	/*@modifies *pglob, fileSystem @*/;
 
 
 /** \ingroup rpmrpc
@@ -435,7 +435,8 @@ typedef enum ftperrCode_e {
 /** \ingroup rpmio
  */
 /*@unused@*/
-/*@dependent@*/ /*@null@*/ void * ufdGetUrlinfo(FD_t fd)	/*@*/;
+/*@dependent@*/ /*@null@*/ void * ufdGetUrlinfo(FD_t fd)
+	/*@modifies fd @*/;
 
 /** \ingroup rpmio
  */
diff --git a/rpmio/rpmio_internal.h b/rpmio/rpmio_internal.h
index 98103d1ff..05cae0515 100644
--- a/rpmio/rpmio_internal.h
+++ b/rpmio/rpmio_internal.h
@@ -142,14 +142,19 @@ extern int _rpmio_debug;
 extern "C" {
 #endif
 
-int fdFgets(FD_t fd, char * buf, size_t len);
+int fdFgets(FD_t fd, char * buf, size_t len)
+	/*@modifies *buf, fd, fileSystem @*/;
 
 /*@null@*/ FD_t ftpOpen(const char *url, /*@unused@*/ int flags,
-                /*@unused@*/ mode_t mode, /*@out@*/ urlinfo *uret);
-int ftpReq(FD_t data, const char * ftpCmd, const char * ftpArg);
-int ftpCmd(const char * cmd, const char * url, const char * arg2);
+                /*@unused@*/ mode_t mode, /*@out@*/ urlinfo *uret)
+	/*@modifies *uret, fileSystem @*/;
+int ftpReq(FD_t data, const char * ftpCmd, const char * ftpArg)
+	/*@modifies data, fileSystem @*/;
+int ftpCmd(const char * cmd, const char * url, const char * arg2)
+	/*@modifies fileSystem @*/;
 
-int ufdClose( /*@only@*/ void * cookie);
+int ufdClose( /*@only@*/ void * cookie)
+	/*@modified cookie, fileSystem @*/;
 
 /** \ingroup rpmio
  */
@@ -168,7 +173,9 @@ void fdSetIo(FD_t fd, /*@kept@*/ /*@null@*/ FDIO_t io)
 	/*@modifies fd @*/
 {
     FDSANE(fd);
+    /*@-assignexpose@*/
     fd->fps[fd->nfps].io = io;
+    /*@=assignexpose@*/
 }
 
 /** \ingroup rpmio
@@ -178,9 +185,9 @@ void fdSetIo(FD_t fd, /*@kept@*/ /*@null@*/ FDIO_t io)
 	/*@*/
 {
     FDSANE(fd);
-    /*@+voidabstract@*/
+    /*@+voidabstract -retexpose@*/
     return ((FILE *)fd->fps[fd->nfps].fp);
-    /*@=voidabstract@*/
+    /*@=voidabstract =retexpose@*/
 }
 
 /** \ingroup rpmio
@@ -190,7 +197,9 @@ void fdSetIo(FD_t fd, /*@kept@*/ /*@null@*/ FDIO_t io)
 	/*@*/
 {
     FDSANE(fd);
+    /*@-retexpose@*/
     return fd->fps[fd->nfps].fp;
+    /*@=retexpose@*/
 }
 
 /** \ingroup rpmio
@@ -200,7 +209,9 @@ void fdSetFp(FD_t fd, /*@kept@*/ /*@null@*/ void * fp)
 	/*@modifies fd @*/
 {
     FDSANE(fd);
+    /*@-assignexpose@*/
     fd->fps[fd->nfps].fp = fp;
+    /*@=assignexpose@*/
 }
 
 /** \ingroup rpmio
@@ -316,7 +327,7 @@ void fdstat_exit(/*@null@*/ FD_t fd, int opx, ssize_t rc)
  */
 /*@unused@*/ static inline
 void fdstat_print(/*@null@*/ FD_t fd, const char * msg, FILE * fp)
-	/*@modifies *fp @*/
+	/*@modifies *fp, fileSystem @*/
 {
     int opx;
     if (fd == NULL || fd->stats == NULL) return;
@@ -352,7 +363,9 @@ void fdSetSyserrno(FD_t fd, int syserrno, /*@kept@*/ const void * errcookie)
 {
     FDSANE(fd);
     fd->syserrno = syserrno;
+    /*@-assignexpose@*/
     fd->errcookie = errcookie;
+    /*@=assignexpose@*/
 }
 
 /** \ingroup rpmio
@@ -391,9 +404,11 @@ void fdSetCpioPos(FD_t fd, long int cpioPos)
 FD_t c2f(/*@null@*/ void * cookie)
 	/*@*/
 {
+    /*@-castexpose@*/
     FD_t fd = (FD_t) cookie;
+    /*@=castexpose@*/
     FDSANE(fd);
-    /*@-refcounttrans@*/ return fd; /*@=refcounttrans@*/
+    /*@-refcounttrans -retalias@*/ return fd; /*@=refcounttrans =retalias@*/
 }
 
 /** \ingroup rpmio
diff --git a/rpmio/rpmlog.c b/rpmio/rpmlog.c
index 65c48fba1..088448868 100644
--- a/rpmio/rpmlog.c
+++ b/rpmio/rpmlog.c
@@ -51,6 +51,7 @@ void rpmlogPrint(FILE *f)
     if (f == NULL)
 	f = stderr;
 
+    if (recs)
     for (i = 0; i < nrecs; i++) {
 	rpmlogRec rec = recs + i;
 	if (rec->message && *rec->message)
@@ -62,6 +63,7 @@ void rpmlogClose (void)
 {
     int i;
 
+    if (recs)
     for (i = 0; i < nrecs; i++) {
 	rpmlogRec rec = recs + i;
 	rec->message = _free(rec->message);
@@ -95,7 +97,8 @@ rpmlogCallback rpmlogSetCallback(rpmlogCallback cb)
     return ocb;
 }
 
-static char *rpmlogMsgPrefix[] = {
+/*@-readonlytrans@*/	/* FIX: double indeirection. */
+/*@observer@*/ static char *rpmlogMsgPrefix[] = {
     N_("fatal error: "),/*!< RPMLOG_EMERG */
     N_("fatal error: "),/*!< RPMLOG_ALERT */
     N_("fatal error: "),/*!< RPMLOG_CRIT */
@@ -105,6 +108,7 @@ static char *rpmlogMsgPrefix[] = {
     "",			/*!< RPMLOG_INFO */
     "D: ",		/*!< RPMLOG_DEBUG */
 };
+/*@=readonlytrans@*/
 
 #if !defined(HAVE_VSNPRINTF)
 static inline int vsnprintf(char * buf, /*@unused@*/ int nb,
@@ -115,6 +119,7 @@ static inline int vsnprintf(char * buf, /*@unused@*/ int nb,
 #endif
 
 static void vrpmlog (unsigned code, const char *fmt, va_list ap)
+	/*@modifies internalState @*/
 {
     int pri = RPMLOG_PRI(code);
     int mask = RPMLOG_MASK(pri);
diff --git a/rpmio/rpmrpc.c b/rpmio/rpmrpc.c
index 21eed127e..f3d67a769 100644
--- a/rpmio/rpmrpc.c
+++ b/rpmio/rpmrpc.c
@@ -16,7 +16,9 @@ extern int _rpmio_debug;
 /*@=redecl@*/
 
 /* =============================================================== */
-static int ftpMkdir(const char * path, /*@unused@*/ mode_t mode) {
+static int ftpMkdir(const char * path, /*@unused@*/ mode_t mode)
+	/*@modifies fileSystem @*/
+{
     int rc;
     if ((rc = ftpCmd("MKD", path, NULL)) != 0)
 	return rc;
@@ -29,28 +31,37 @@ static int ftpMkdir(const char * path, /*@unused@*/ mode_t mode) {
     return rc;
 }
 
-static int ftpChdir(const char * path) {
+static int ftpChdir(const char * path)
+	/*@modifies fileSystem @*/
+{
     return ftpCmd("CWD", path, NULL);
 }
 
-static int ftpRmdir(const char * path) {
+static int ftpRmdir(const char * path)
+	/*@modifies fileSystem @*/
+{
     return ftpCmd("RMD", path, NULL);
 }
 
-static int ftpRename(const char * oldpath, const char * newpath) {
+static int ftpRename(const char * oldpath, const char * newpath)
+	/*@modifies fileSystem @*/
+{
     int rc;
     if ((rc = ftpCmd("RNFR", oldpath, NULL)) != 0)
 	return rc;
     return ftpCmd("RNTO", newpath, NULL);
 }
 
-static int ftpUnlink(const char * path) {
+static int ftpUnlink(const char * path)
+	/*@modifies fileSystem @*/
+{
     return ftpCmd("DELE", path, NULL);
 }
 
 /* =============================================================== */
 /* XXX rebuilddb.c: analogues to mkdir(2)/rmdir(2). */
-int Mkdir (const char *path, mode_t mode) {
+int Mkdir (const char * path, mode_t mode)
+{
     const char * lpath;
     int ut = urlPath(path, &lpath);
 
@@ -72,7 +83,8 @@ int Mkdir (const char *path, mode_t mode) {
     return mkdir(path, mode);
 }
 
-int Chdir (const char *path) {
+int Chdir (const char * path)
+{
     const char * lpath;
     int ut = urlPath(path, &lpath);
 
@@ -94,7 +106,8 @@ int Chdir (const char *path) {
     return chdir(path);
 }
 
-int Rmdir (const char *path) {
+int Rmdir (const char * path)
+{
     const char * lpath;
     int ut = urlPath(path, &lpath);
 
@@ -118,7 +131,8 @@ int Rmdir (const char *path) {
 
 /* XXX rpmdb.c: analogue to rename(2). */
 
-int Rename (const char *oldpath, const char * newpath) {
+int Rename (const char * oldpath, const char * newpath)
+{
     const char *oe = NULL;
     const char *ne = NULL;
     int oldut, newut;
@@ -164,7 +178,8 @@ fprintf(stderr, "*** rename old %*s new %*s\n", (int)(oe - oldpath), oldpath, (i
     return rename(oldpath, newpath);
 }
 
-int Link (const char *oldpath, const char * newpath) {
+int Link (const char * oldpath, const char * newpath)
+{
     const char *oe = NULL;
     const char *ne = NULL;
     int oldut, newut;
@@ -249,6 +264,7 @@ static int   column_ptr [MAXCOLS]; /* Index from 0 to the starting positions of
 
 static int
 vfs_split_text (char *p)
+	/*@modifies *p, columns, column_ptr @*/
 {
     char *original = p;
     int  numcols;
@@ -269,6 +285,7 @@ vfs_split_text (char *p)
 
 static int
 is_num (int idx)
+	/*@*/
 {
     if (!columns [idx] || columns [idx][0] < '0' || columns [idx][0] > '9')
 	return 0;
@@ -277,6 +294,7 @@ is_num (int idx)
 
 static int
 is_dos_date(/*@null@*/ const char *str)
+	/*@*/
 {
     if (str != NULL && strlen(str) == 8 &&
 		str[2] == str[5] && strchr("\\-/", (int)str[2]) != NULL)
@@ -286,6 +304,7 @@ is_dos_date(/*@null@*/ const char *str)
 
 static int
 is_week (/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
+	/*@modifies *tim @*/
 {
 /*@observer@*/ static const char * week = "SunMonTueWedThuFriSat";
     const char * pos;
@@ -302,6 +321,7 @@ is_week (/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
 
 static int
 is_month (/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
+	/*@modifies *tim @*/
 {
 /*@observer@*/ static const char * month = "JanFebMarAprMayJunJulAugSepOctNovDec";
     const char * pos;
@@ -318,6 +338,7 @@ is_month (/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
 
 static int
 is_time (/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
+	/*@modifies *tim @*/
 {
     const char * p, * p2;
 
@@ -336,6 +357,7 @@ is_time (/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
 }
 
 static int is_year(/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
+	/*@modifies *tim @*/
 {
     long year;
 
@@ -367,6 +389,7 @@ static int is_year(/*@null@*/ const char * str, /*@out@*/ struct tm * tim)
 
 static int
 vfs_parse_filetype (char c)
+	/*@*/
 {
     switch (c) {
         case 'd': return S_IFDIR; 
@@ -385,6 +408,7 @@ vfs_parse_filetype (char c)
 }
 
 static int vfs_parse_filemode (const char *p)
+	/*@*/
 {	/* converts rw-rw-rw- into 0666 */
     int res = 0;
     switch (*(p++)) {
@@ -443,6 +467,7 @@ static int vfs_parse_filemode (const char *p)
 }
 
 static int vfs_parse_filedate(int idx, time_t *t)
+	/*@modifies *t @*/
 {	/* This thing parses from idx in columns[] array */
 
     char *p;
@@ -551,6 +576,7 @@ static int
 vfs_parse_ls_lga (char * p, /*@out@*/ struct stat * st,
 		/*@out@*/ const char ** filename,
 		/*@out@*/ const char ** linkname)
+	/*@modifies *st, *filename, *linkname @*/
 {
     int idx, idx2, num_cols;
     int i;
@@ -763,7 +789,8 @@ static /*@only@*/ char * ftpBuf = NULL;
 #define alloca_strdup(_s)       strcpy(alloca(strlen(_s)+1), (_s))
 
 static int ftpNLST(const char * url, ftpSysCall_t ftpSysCall,
-	/*@out@*/ struct stat * st, char * rlbuf, size_t rlbufsiz)
+		/*@out@*/ struct stat * st, char * rlbuf, size_t rlbufsiz)
+	/*@modifies *st, *rlbuf, fileSystem @*/
 {
     FD_t fd;
     const char * path;
@@ -858,7 +885,8 @@ static int ftpNLST(const char * url, ftpSysCall_t ftpSysCall,
 
 	    while (*se && *se != '\n') se++;
 	    if (se > s && se[-1] == '\r') se[-1] = '\0';
-	    if (*se == '\0') break;
+	    if (*se == '\0') 
+		/*@innerbreak@*/ break;
 	    *se++ = '\0';
 
 	    if (!strncmp(s, "total ", sizeof("total ")-1)) continue;
@@ -871,25 +899,28 @@ static int ftpNLST(const char * url, ftpSysCall_t ftpSysCall,
 		    break;
 		case ' ':
 		    if (o || !(n[-3] == ' ' && n[-2] == '-' && n[-1] == '>')) {
-			while (*(++n) == ' ');
+			while (*(++n) == ' ')
+			    {};
 			bingo++;
 			break;
 		    }
-		    for (o = n + 1; *o == ' '; o++);
+		    for (o = n + 1; *o == ' '; o++)
+			{};
 		    n -= 3;
 		    ne = n;
 		    break;
 		default:
 		    break;
 		}
-		if (bingo) break;
+		if (bingo)
+		    /*@innerbreak@*/ break;
 	    }
 
 	    if (nbn != (ne - n))	continue;	/* Same name length? */
 	    if (strncmp(n, bn, nbn))	continue;	/* Same name? */
 
 	    moretodo = 0;
-	    break;
+	    /*@innerbreak@*/ break;
 	}
 
         if (moretodo && se > s) {
@@ -940,11 +971,14 @@ exit:
 }
 
 static int ftpStat(const char * path, /*@out@*/ struct stat *st)
+	/*@modifies *st @*/
 {
     return ftpNLST(path, DO_FTP_STAT, st, NULL, 0);
 }
 
-static int ftpLstat(const char * path, /*@out@*/ struct stat *st) {
+static int ftpLstat(const char * path, /*@out@*/ struct stat *st)
+	/*@modifies *st @*/
+{
     int rc;
     rc = ftpNLST(path, DO_FTP_LSTAT, st, NULL, 0);
 if (_rpmio_debug)
@@ -952,13 +986,16 @@ fprintf(stderr, "*** ftpLstat(%s) rc %d\n", path, rc);
     return rc;
 }
 
-static int ftpReadlink(const char * path, char * buf, size_t bufsiz) {
+static int ftpReadlink(const char * path, char * buf, size_t bufsiz)
+	/*@modifies *buf @*/
+{
     return ftpNLST(path, DO_FTP_READLINK, NULL, buf, bufsiz);
 }
 
 static int ftpGlob(const char * path, int flags,
 		int errfunc(const char * epath, int eerno),
 		/*@out@*/ glob_t * pglob)
+	/*@modifies *pglob, fileSystem @*/
 {
     int rc;
 
@@ -976,7 +1013,9 @@ fprintf(stderr, "*** ftpGlob(%s,0x%x,%p,%p) ftpNLST rc %d\n", path, (unsigned)fl
     return rc;
 }
 
-static void ftpGlobfree(glob_t * pglob) {
+static void ftpGlobfree(glob_t * pglob)
+	/*@modifies *pglob @*/
+{
 if (_rpmio_debug)
 fprintf(stderr, "*** ftpGlobfree(%p)\n", pglob);
     if (pglob->gl_offs == -1) {	/* XXX HACK HACK HACK */
@@ -985,7 +1024,8 @@ fprintf(stderr, "*** ftpGlobfree(%p)\n", pglob);
     }
 }
 
-int Stat(const char * path, struct stat * st) {
+int Stat(const char * path, struct stat * st)
+{
     const char * lpath;
     int ut = urlPath(path, &lpath);
 
@@ -1009,7 +1049,8 @@ fprintf(stderr, "*** Stat(%s,%p)\n", path, st);
     return stat(path, st);
 }
 
-int Lstat(const char * path, struct stat * st) {
+int Lstat(const char * path, struct stat * st)
+{
     const char * lpath;
     int ut = urlPath(path, &lpath);
 
@@ -1033,7 +1074,8 @@ fprintf(stderr, "*** Lstat(%s,%p)\n", path, st);
     return lstat(path, st);
 }
 
-int Readlink(const char * path, char * buf, size_t bufsiz) {
+int Readlink(const char * path, char * buf, size_t bufsiz)
+{
     const char * lpath;
     int ut = urlPath(path, &lpath);
 
@@ -1055,7 +1097,8 @@ int Readlink(const char * path, char * buf, size_t bufsiz) {
     return readlink(path, buf, bufsiz);
 }
 
-int Access(const char * path, int amode) {
+int Access(const char * path, int amode)
+{
     const char * lpath;
     int ut = urlPath(path, &lpath);
 
diff --git a/rpmio/rpmurl.h b/rpmio/rpmurl.h
index f862de5aa..a08b565db 100644
--- a/rpmio/rpmurl.h
+++ b/rpmio/rpmurl.h
@@ -58,8 +58,8 @@ extern int url_iobuf_size;
  * @param msg		debugging identifier (unused)
  * @return		new instance
  */
-urlinfo	urlNew(const char * msg);
-urlinfo	XurlNew(const char * msg, const char * file, unsigned line);
+urlinfo	urlNew(const char * msg)	/*@*/;
+urlinfo	XurlNew(const char * msg, const char * file, unsigned line)	/*@*/;
 #define	urlNew(_msg) XurlNew(_msg, __FILE__, __LINE__)
 
 /**
@@ -68,8 +68,10 @@ urlinfo	XurlNew(const char * msg, const char * file, unsigned line);
  * @param msg		debugging identifier (unused)
  * @return		referenced instance
  */
-urlinfo	urlLink(urlinfo u, const char * msg);
-urlinfo	XurlLink(urlinfo u, const char * msg, const char * file, unsigned line);
+urlinfo	urlLink(urlinfo u, const char * msg)
+	/*@modifies u @*/;
+urlinfo	XurlLink(urlinfo u, const char * msg, const char * file, unsigned line)
+	/*@modifies u @*/;
 #define	urlLink(_u, _msg) XurlLink(_u, _msg, __FILE__, __LINE__)
 
 /**
@@ -78,21 +80,26 @@ urlinfo	XurlLink(urlinfo u, const char * msg, const char * file, unsigned line);
  * @param msg		debugging identifier (unused)
  * @return		dereferenced instance (NULL if freed)
  */
-urlinfo	urlFree( /*@killref@*/ urlinfo u, const char * msg);
-urlinfo	XurlFree( /*@killref@*/ urlinfo u, const char * msg, const char * file, unsigned line);
+urlinfo	urlFree( /*@killref@*/ urlinfo u, const char * msg)
+	/*@modifies u @*/;
+urlinfo	XurlFree( /*@killref@*/ urlinfo u, const char * msg,
+		const char * file, unsigned line)
+	/*@modifies u @*/;
 #define	urlFree(_u, _msg) XurlFree(_u, _msg, __FILE__, __LINE__)
 
 /**
  * Free cached URL control structures.
  */
-void	urlFreeCache(void);
+void urlFreeCache(void)
+	/*@modifies internalState @*/;
 
 /**
  * Return type of URL.
  * @param url		url string
  * @return		type of url
  */
-urltype	urlIsURL(const char * url)	/*@*/;
+urltype	urlIsURL(const char * url)
+	/*@*/;
 
 /**
  * Return path component of URL.
@@ -109,8 +116,8 @@ urltype	urlPath(const char * url, /*@out@*/ const char ** pathp)
  * @retval u		address of new control instance pointer
  * @return		0 on success, -1 on error
  */
-int 	urlSplit(const char * url, /*@out@*/ urlinfo * u)
-		/*@modifies *u @*/;
+int urlSplit(const char * url, /*@out@*/ urlinfo * u)
+	/*@modifies *u @*/;
 
 /**
  * Copy data from URL to local file.
@@ -118,7 +125,8 @@ int 	urlSplit(const char * url, /*@out@*/ urlinfo * u)
  * @param dest		file name of destination
  * @return		0 on success, otherwise FTPERR_* code
  */
-int	urlGetFile(const char * url, /*@null@*/ const char * dest);
+int urlGetFile(const char * url, /*@null@*/ const char * dest)
+	/*@modifies fileSystem @*/;
 
 #ifdef __cplusplus
 }
diff --git a/rpmio/ugid.h b/rpmio/ugid.h
index 9c5ea46bd..b0b07ffec 100644
--- a/rpmio/ugid.h
+++ b/rpmio/ugid.h
@@ -9,15 +9,23 @@
 extern "C" {
 #endif
 
-/* These may be called w/ a NULL argument to flush the cache -- they return
-   -1 if the user can't be found */
-int     unameToUid(const char * thisUname, /*@out@*/ uid_t * uid);
-int     gnameToGid(const char * thisGname, /*@out@*/ gid_t * gid);
+/*
+ * These may be called w/ a NULL argument to flush the cache -- they return
+ * -1 if the user can't be found.
+ */
+int     unameToUid(const char * thisUname, /*@out@*/ uid_t * uid)
+	/*@modifies *uid @*/;
+int     gnameToGid(const char * thisGname, /*@out@*/ gid_t * gid)
+	/*@modifies *gid @*/;
 
-/* Call w/ -1 to flush the cache, returns NULL if the user can't be found */
-/*@observer@*/ /*@null@*/ char * uidToUname(uid_t uid);
+/*
+ * Call w/ -1 to flush the cache, returns NULL if the user can't be found.
+ */
+/*@observer@*/ /*@null@*/ char * uidToUname(uid_t uid)
+	/*@*/;
 /*@unused@*/
-/*@observer@*/ /*@null@*/ char * gidToGname(gid_t gid);
+/*@observer@*/ /*@null@*/ char * gidToGname(gid_t gid)
+	/*@*/;
 
 #ifdef __cplusplus
 }
diff --git a/rpmio/url.c b/rpmio/url.c
index 72af1a048..d7d040b74 100644
--- a/rpmio/url.c
+++ b/rpmio/url.c
@@ -56,7 +56,7 @@ urlinfo XurlLink(urlinfo u, const char *msg, const char *file, unsigned line)
     URLSANE(u);
     u->nrefs++;
 URLDBGREFS(0, (stderr, "--> url %p ++ %d %s at %s:%u\n", u, u->nrefs, msg, file, line));
-    return u;
+    /*@-refcounttrans@*/ return u; /*@=refcounttrans@*/
 }
 
 urlinfo XurlNew(const char *msg, const char *file, unsigned line)
@@ -84,7 +84,7 @@ urlinfo XurlFree(urlinfo u, const char *msg, const char *file, unsigned line)
     URLSANE(u);
 URLDBGREFS(0, (stderr, "--> url %p -- %d %s at %s:%u\n", u, u->nrefs, msg, file, line));
     if (--u->nrefs > 0)
-	/*@-refcounttrans@*/ return u; /*@=refcounttrans@*/
+	/*@-refcounttrans -retalias@*/ return u; /*@=refcounttrans =retalias@*/
     if (u->ctrl) {
 #ifndef	NOTYET
 	void * fp = fdGetFp(u->ctrl);
@@ -159,6 +159,7 @@ void urlFreeCache(void)
 }
 
 static int urlStrcmp(/*@null@*/ const char * str1, /*@null@*/ const char * str2)
+	/*@*/
 {
     if (str1 && str2)
 	/*@-nullpass@*/		/* LCL: 2nd arg claims to be NULL */
@@ -169,7 +170,8 @@ static int urlStrcmp(/*@null@*/ const char * str1, /*@null@*/ const char * str2)
     return 0;
 }
 
-static void urlFind(/*@null@*/ /*@in@*/ /*@out@*/ urlinfo *uret, int mustAsk)
+static void urlFind(/*@null@*/ /*@in@*/ /*@out@*/ urlinfo * uret, int mustAsk)
+	/*@modifies *uret @*/
 {
     urlinfo u;
     int ucx;
@@ -305,7 +307,7 @@ static void urlFind(/*@null@*/ /*@in@*/ /*@out@*/ urlinfo *uret, int mustAsk)
 }
 
 static struct urlstring {
-    const char *leadin;
+/*@observer@*/ /*@null@*/ const char * leadin;
     urltype	ret;
 } urlstrings[] = {
     { "file://",	URL_IS_PATH },
@@ -315,7 +317,8 @@ static struct urlstring {
     { NULL,		URL_IS_UNKNOWN }
 };
 
-urltype urlIsURL(const char * url) {
+urltype urlIsURL(const char * url)
+{
     struct urlstring *us;
 
     if (url && *url) {
@@ -456,7 +459,8 @@ int urlSplit(const char * url, urlinfo *uret)
     return 0;
 }
 
-int urlGetFile(const char * url, const char * dest) {
+int urlGetFile(const char * url, const char * dest)
+{
     int rc;
     FD_t sfd = NULL;
     FD_t tfd = NULL;
diff --git a/rpmqv.c b/rpmqv.c
index 6aba36e3d..7cf1c75f0 100755
--- a/rpmqv.c
+++ b/rpmqv.c
@@ -96,9 +96,9 @@ extern int _url_debug;
 extern int _noDirTokens;
 
 /*@-varuse@*/
-extern const char * rpmNAME;
+/*@observer@*/ extern const char * rpmNAME;
 /*@=varuse@*/
-extern const char * rpmEVR;
+/*@observer@*/ extern const char * rpmEVR;
 /*@-varuse@*/
 extern int rpmFLAGS;
 /*@=varuse@*/
@@ -110,10 +110,10 @@ extern struct MacroContext_s rpmCLIMacroContext;
 
 static int help = 0;
 static int noUsageMsg = 0;
-/*@null@*/ static const char * pipeOutput = NULL;
+/*@observer@*/ /*@null@*/ static const char * pipeOutput = NULL;
 static int quiet = 0;
-/*@null@*/ static const char * rcfile = NULL;
-/*@null@*/ static char * rootdir = "/";
+/*@observer@*/ /*@null@*/ static const char * rcfile = NULL;
+/*@observer@*/ /*@null@*/ static char * rootdir = "/";
 static int showrc = 0;
 static int showVersion = 0;
 
@@ -401,21 +401,28 @@ long _stksize = 64 * 1024L;
 #endif
 
 /*@exits@*/ static void argerror(const char * desc)
+	/*@modifies fileSystem @*/
 {
     fprintf(stderr, _("rpm: %s\n"), desc);
     exit(EXIT_FAILURE);
 }
 
-static void printVersion(void) {
+static void printVersion(void)
+	/*@modifies fileSystem @*/
+{
     fprintf(stdout, _("RPM version %s\n"), rpmEVR);
 }
 
-static void printBanner(void) {
+static void printBanner(void)
+	/*@modifies fileSystem @*/
+{
     (void) puts(_("Copyright (C) 1998-2000 - Red Hat, Inc."));
     (void) puts(_("This program may be freely redistributed under the terms of the GNU GPL"));
 }
 
-static void printUsage(void) {
+static void printUsage(void)
+	/*@modifies fileSystem @*/
+{
     FILE * fp;
     printVersion();
     printBanner();
@@ -456,7 +463,9 @@ static void printUsage(void) {
 }
 
 #ifdef	DYING
-static void printHelpLine(char * prefix, char * help) {
+static void printHelpLine(char * prefix, char * help)
+	/*@modifies fileSystem @*/
+{
     int indentLength = strlen(prefix) + 3;
     int lineLength = 79 - indentLength;
     int helpLength = strlen(help);
@@ -862,9 +871,9 @@ int main(int argc, const char ** argv)
 	  case 'i':
 #ifdef	IAM_RPMQV
 	    if (bigMode == MODE_QUERY) {
-		/*@-nullassign@*/
+		/*@-nullassign -readonlytrans@*/
 		const char * infoCommand[] = { "--info", NULL };
-		/*@=nullassign@*/
+		/*@=nullassign =readonlytrans@*/
 		(void) poptStuffArgs(optCon, infoCommand);
 	    }
 #endif
@@ -872,9 +881,9 @@ int main(int argc, const char ** argv)
 	    if (bigMode == MODE_INSTALL)
 		/*@-ifempty@*/ ;
 	    if (bigMode == MODE_UNKNOWN) {
-		/*@-nullassign@*/
+		/*@-nullassign -readonlytrans@*/
 		const char * installCommand[] = { "--install", NULL };
-		/*@=nullassign@*/
+		/*@=nullassign =readonlytrans@*/
 		(void) poptStuffArgs(optCon, installCommand);
 	    }
 #endif
@@ -1342,7 +1351,7 @@ int main(int argc, const char ** argv)
 
 	    ec = rpmInstallSource("", pkg, &specFile, &cookie);
 	    if (ec)
-		break;
+		/*@loopbreak@*/ break;
 
 	    ba->rootdir = rootdir;
 	    ec = build(specFile, ba, passPhrase, cookie, rcfile);
@@ -1352,7 +1361,7 @@ int main(int argc, const char ** argv)
 	    specFile = NULL;
 
 	    if (ec)
-		break;
+		/*@loopbreak@*/ break;
 	}
       }	break;
 
@@ -1403,7 +1412,7 @@ int main(int argc, const char ** argv)
 	    ba->rootdir = rootdir;
 	    ec = build(pkg, ba, passPhrase, NULL, rcfile);
 	    if (ec)
-		break;
+		/*@loopbreak@*/ break;
 	    rpmFreeMacros(NULL);
 	    (void) rpmReadConfigFiles(rcfile, NULL);
 	}
diff --git a/system.h b/system.h
index 5f9ceec48..1e16e32a2 100644
--- a/system.h
+++ b/system.h
@@ -43,6 +43,9 @@ typedef	unsigned int u_int32_t;
 typedef	unsigned short u_int16_t;
 typedef	unsigned char u_int8_t;
 typedef	int int32_t;
+/*@-declundef@*/
+/*@only@*/ void * alloca (size_t size)	/*@modifies internalState @*/;
+/*@=declundef@*/
 #endif
 
 /* Since major is a function on SVR4, we can't use `ifndef major'.  */
@@ -102,9 +105,9 @@ extern int errno;
 #endif
 
 #ifdef STDC_HEADERS
-/*@-macrounrecog -incondefs -globuse@*/	/* FIX: shrug */
+/*@-macrounrecog -incondefs -globuse -mustmod@*/	/* FIX: shrug */
 #define getopt system_getopt
-/*@=macrounrecog =incondefs =globuse@*/
+/*@=macrounrecog =incondefs =globuse =mustmod@*/
 /*@-skipansiheaders@*/
 #include <stdlib.h>
 /*@=skipansiheaders@*/