diff --git a/usr.sbin/bhyve/pci_ahci.c b/usr.sbin/bhyve/pci_ahci.c
index d4000b7a63c6..4571f4caeffb 100644
--- a/usr.sbin/bhyve/pci_ahci.c
+++ b/usr.sbin/bhyve/pci_ahci.c
@@ -615,8 +615,10 @@ ahci_build_iov(struct ahci_port *p, struct ahci_ioreq *aior,
     struct ahci_prdt_entry *prdt, uint16_t prdtl)
 {
 	struct blockif_req *breq = &aior->io_req;
-	int i, j, skip, todo, left, extra;
-	uint32_t dbcsz;
+	uint32_t dbcsz, extra, left, skip, todo;
+	int i, j;
+
+	assert(aior->len >= aior->done);
 
 	/* Copy part of PRDT between 'done' and 'len' bytes into the iov. */
 	skip = aior->done;
@@ -785,12 +787,14 @@ ahci_handle_flush(struct ahci_port *p, int slot, uint8_t *cfis)
 }
 
 static inline void
-read_prdt(struct ahci_port *p, int slot, uint8_t *cfis, void *buf, int size)
+read_prdt(struct ahci_port *p, int slot, uint8_t *cfis, void *buf,
+    unsigned int size)
 {
 	struct ahci_cmd_hdr *hdr;
 	struct ahci_prdt_entry *prdt;
 	uint8_t *to;
-	int i, len;
+	unsigned int len;
+	int i;
 
 	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
 	len = size;
@@ -799,7 +803,7 @@ read_prdt(struct ahci_port *p, int slot, uint8_t *cfis, void *buf, int size)
 	for (i = 0; i < hdr->prdtl && len; i++) {
 		uint8_t *ptr;
 		uint32_t dbcsz;
-		int sublen;
+		unsigned int sublen;
 
 		dbcsz = (prdt->dbc & DBCMASK) + 1;
 		ptr = paddr_guest2host(ahci_ctx(p->pr_sc), prdt->dba, dbcsz);
@@ -898,12 +902,14 @@ ahci_handle_dsm_trim(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done
 }
 
 static inline void
-write_prdt(struct ahci_port *p, int slot, uint8_t *cfis, void *buf, int size)
+write_prdt(struct ahci_port *p, int slot, uint8_t *cfis, void *buf,
+    unsigned int size)
 {
 	struct ahci_cmd_hdr *hdr;
 	struct ahci_prdt_entry *prdt;
 	uint8_t *from;
-	int i, len;
+	unsigned int len;
+	int i;
 
 	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
 	len = size;
@@ -1140,7 +1146,7 @@ atapi_inquiry(struct ahci_port *p, int slot, uint8_t *cfis)
 {
 	uint8_t buf[36];
 	uint8_t *acmd;
-	int len;
+	unsigned int len;
 	uint32_t tfd;
 
 	acmd = cfis + 0x40;
@@ -1202,7 +1208,7 @@ atapi_read_toc(struct ahci_port *p, int slot, uint8_t *cfis)
 {
 	uint8_t *acmd;
 	uint8_t format;
-	int len;
+	unsigned int len;
 
 	acmd = cfis + 0x40;
 
@@ -1211,7 +1217,8 @@ atapi_read_toc(struct ahci_port *p, int slot, uint8_t *cfis)
 	switch (format) {
 	case 0:
 	{
-		int msf, size;
+		size_t size;
+		int msf;
 		uint64_t sectors;
 		uint8_t start_track, buf[20], *bp;
 
@@ -1285,7 +1292,8 @@ atapi_read_toc(struct ahci_port *p, int slot, uint8_t *cfis)
 	}
 	case 2:
 	{
-		int msf, size;
+		size_t size;
+		int msf;
 		uint64_t sectors;
 		uint8_t *bp, buf[50];
 
@@ -1448,7 +1456,7 @@ atapi_request_sense(struct ahci_port *p, int slot, uint8_t *cfis)
 {
 	uint8_t buf[64];
 	uint8_t *acmd;
-	int len;
+	unsigned int len;
 
 	acmd = cfis + 0x40;
 	len = acmd[4];
@@ -1494,7 +1502,7 @@ atapi_mode_sense(struct ahci_port *p, int slot, uint8_t *cfis)
 	uint8_t *acmd;
 	uint32_t tfd;
 	uint8_t pc, code;
-	int len;
+	unsigned int len;
 
 	acmd = cfis + 0x40;
 	len = be16dec(acmd + 7);
@@ -1579,7 +1587,7 @@ atapi_get_event_status_notification(struct ahci_port *p, int slot,
 		tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
 	} else {
 		uint8_t buf[8];
-		int len;
+		unsigned int len;
 
 		len = be16dec(acmd + 7);
 		if (len > sizeof(buf))
@@ -2202,7 +2210,7 @@ pci_ahci_write(struct vmctx *ctx __unused, int vcpu __unused,
 
 	if (offset < AHCI_OFFSET)
 		pci_ahci_host_write(sc, offset, value);
-	else if (offset < AHCI_OFFSET + sc->ports * AHCI_STEP)
+	else if (offset < (uint64_t)AHCI_OFFSET + sc->ports * AHCI_STEP)
 		pci_ahci_port_write(sc, offset, value);
 	else
 		WPRINTF("pci_ahci: unknown i/o write offset 0x%"PRIx64"", offset);
@@ -2300,7 +2308,7 @@ pci_ahci_read(struct vmctx *ctx __unused, int vcpu __unused,
 	offset = regoff & ~0x3;	    /* round down to a multiple of 4 bytes */
 	if (offset < AHCI_OFFSET)
 		value = pci_ahci_host_read(sc, offset);
-	else if (offset < AHCI_OFFSET + sc->ports * AHCI_STEP)
+	else if (offset < (uint64_t)AHCI_OFFSET + sc->ports * AHCI_STEP)
 		value = pci_ahci_port_read(sc, offset);
 	else {
 		value = 0;