diff --git a/docs/ENVIRONMENT.md b/docs/ENVIRONMENT.md
index b9a96be82c..0113fd59fa 100644
--- a/docs/ENVIRONMENT.md
+++ b/docs/ENVIRONMENT.md
@@ -253,7 +253,8 @@ All tools:
   udev manager process waits for a worker process kills slow programs specified
   by IMPORT{program}=, PROGRAM=, or RUN=, and finalizes the processing event.
   If the worker process cannot finalize the event within the specified timespan,
-  the worker process is killed by the manager process. Defaults to 10 seconds.
+  the worker process is killed by the manager process. Defaults to 10 seconds,
+  maximum allowed is 5 hours.
 
 `udevadm` and `systemd-hwdb`:
 
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 411f59d55d..3cd0490255 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -216,7 +216,7 @@ int cgroup_context_add_io_device_limit_dup(CGroupContext *c, CGroupIODeviceLimit
         assert(l);
 
         n = new0(CGroupIODeviceLimit, 1);
-        if (!l)
+        if (!n)
                 return -ENOMEM;
 
         n->path = strdup(l->path);
@@ -353,7 +353,7 @@ int cgroup_context_copy(CGroupContext *dst, const CGroupContext *src) {
         dst->tasks_accounting = src->tasks_accounting;
         dst->ip_accounting = src->ip_accounting;
 
-        dst->memory_oom_group = dst->memory_oom_group;
+        dst->memory_oom_group = src->memory_oom_group;
 
         dst->cpu_weight = src->cpu_weight;
         dst->startup_cpu_weight = src->startup_cpu_weight;
@@ -4572,7 +4572,7 @@ static uint64_t unit_get_effective_limit_one(Unit *u, CGroupLimitType type) {
                                 assert_not_reached();
                 }
 
-        cc = unit_get_cgroup_context(u);
+        cc = ASSERT_PTR(unit_get_cgroup_context(u));
         switch (type) {
                 /* Note: on legacy/hybrid hierarchies memory_max stays CGROUP_LIMIT_MAX unless configured
                  * explicitly. Effective value of MemoryLimit= (cgroup v1) is not implemented. */
diff --git a/src/dissect/dissect.c b/src/dissect/dissect.c
index 10af26888e..ce4a99bc0b 100644
--- a/src/dissect/dissect.c
+++ b/src/dissect/dissect.c
@@ -1709,6 +1709,8 @@ static int action_detach(const char *path) {
         struct stat st;
         int r;
 
+        assert(path);
+
         fd = open(path, O_PATH|O_CLOEXEC);
         if (fd < 0)
                 return log_error_errno(errno, "Failed to open '%s': %m", path);
diff --git a/src/libsystemd-network/sd-dhcp-client-id.c b/src/libsystemd-network/sd-dhcp-client-id.c
index 6feec25adf..da5fcaa450 100644
--- a/src/libsystemd-network/sd-dhcp-client-id.c
+++ b/src/libsystemd-network/sd-dhcp-client-id.c
@@ -135,6 +135,8 @@ int sd_dhcp_client_id_to_string(const sd_dhcp_client_id *client_id, char **ret)
                         r = asprintf(&t, "IAID:0x%x/DUID", iaid);
                 }
                 break;
+        default:
+                assert_not_reached();
         }
         if (r < 0)
                 return -ENOMEM;
diff --git a/src/udev/udev-manager.c b/src/udev/udev-manager.c
index 5bf00bb262..31944c2247 100644
--- a/src/udev/udev-manager.c
+++ b/src/udev/udev-manager.c
@@ -335,6 +335,7 @@ static int on_event_timeout_warning(sd_event_source *s, uint64_t usec, void *use
 static usec_t extra_timeout_usec(void) {
         static usec_t saved = 10 * USEC_PER_SEC;
         static bool parsed = false;
+        usec_t timeout;
         const char *e;
         int r;
 
@@ -347,10 +348,15 @@ static usec_t extra_timeout_usec(void) {
         if (!e)
                 return saved;
 
-        r = parse_sec(e, &saved);
+        r = parse_sec(e, &timeout);
         if (r < 0)
                 log_debug_errno(r, "Failed to parse $SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC=%s, ignoring: %m", e);
 
+        if (timeout > 5 * USEC_PER_HOUR) /* Add an arbitrary upper bound */
+                log_debug("Parsed $SYSTEMD_UDEV_EXTRA_TIMEOUT_SEC=%s is too large, ignoring.", e);
+        else
+                saved = timeout;
+
         return saved;
 }