Add necessary include.

sys/cam/scsi/scsi_cd.c

@@ -2528,7 +2528,7 @@ cdioctl(struct disk *dp, u_long cmd, void *addr, int flag, struct thread *td)
 
 			error = cdgetmode(periph, &params, AUDIO_PAGE);
 			if (error) {
-				free(&params, M_SCSICD);
+				free(&params.mode_buf, M_SCSICD);
 				cam_periph_unlock(periph);
 				break;
 			}

sys/contrib/dev/acpica/executer/exfldio.c

@@ -992,6 +992,7 @@ AcpiExInsertIntoField (
 
     /* Get initial Datum from the input buffer */
 
+    /* XXX: Flexelint sees arg 9 for bufferlen 8 */
     ACPI_MEMCPY (&RawDatum, Buffer,
         ACPI_MIN(ObjDesc->CommonField.AccessByteWidth,
             BufferLength - BufferOffset));

sys/dev/aac/aac.c

@@ -3556,7 +3556,7 @@ aac_supported_features(struct aac_softc *sc, caddr_t uptr)
 	 * associated with the feature in the data field or perform whatever
 	 * action needed indicates in the data field.
 	 */
-	 if (f.feat.fValue == 0) {
+	if (f.feat.fValue == 0) {
 		f.feat.fBits.largeLBA =
 		    (sc->flags & AAC_FLAGS_LBA_64BIT) ? 1 : 0;
 		/* TODO: In the future, add other features state here as well */

sys/dev/ae/if_ae.c

@@ -1662,6 +1662,7 @@ ae_stop_rxmac(ae_softc_t *sc)
 	/*
 	 * Wait for IDLE state.
 	 */
+	/* XXX: Flexelint  "<" test with -- */
 	for (i = 0; i < AE_IDLE_TIMEOUT; i--) {
 		val = AE_READ_4(sc, AE_IDLE_REG);
 		if ((val & (AE_IDLE_RXMAC | AE_IDLE_DMAWRITE)) == 0)
@@ -1698,6 +1699,7 @@ ae_stop_txmac(ae_softc_t *sc)
 	/*
 	 * Wait for IDLE state.
 	 */
+	/* XXX: Flexelint  "<" test with -- */
 	for (i = 0; i < AE_IDLE_TIMEOUT; i--) {
 		val = AE_READ_4(sc, AE_IDLE_REG);
 		if ((val & (AE_IDLE_TXMAC | AE_IDLE_DMAREAD)) == 0)

sys/dev/amr/amr.c

@@ -527,7 +527,7 @@ amr_rescan_drives(struct cdev *dev)
 		sc->amr_drive[i].al_disk)) != 0)
 		goto shutdown_out;
 
-	     sc->amr_drive[i].al_disk = 0;
+	    sc->amr_drive[i].al_disk = 0;
 	}
     }
 

sys/dev/ata/ata-raid.c

@@ -407,7 +407,7 @@ ata_raid_strategy(struct bio *bp)
 	    if (rdp->status & AR_S_REBUILDING)
 		blk = ((lba / rdp->interleave) * rdp->width) * rdp->interleave +
 		      (rdp->interleave * (drv % rdp->width)) +
-		      lba % rdp->interleave;;
+		      lba % rdp->interleave;
 
 	    if (bp->bio_cmd == BIO_READ) {
 		int src_online =
@@ -1138,6 +1138,7 @@ ata_raid_create(struct ata_ioc_raid_config *config)
 	rdp->type == AR_T_RAID5) {
 	int bit = 0;
 
+	/* XXX: Flexelint not happy */
 	while (config->interleave >>= 1)
 	    bit++;
 	rdp->interleave = 1 << bit;

sys/dev/ata/chipsets/ata-acerlabs.c

@@ -127,6 +127,7 @@ ata_ali_chipinit(device_t dev)
 		    RF_ACTIVE);
 		if (res->bars[i] == NULL) {
 			device_printf(dev, "Failed to allocate BAR %d\n", i);
+			/* XXX: Flexelint: Reuse of for loop variable 'i' at 'line 124' could cause chaos */
 			for (i--; i >=0; i--)
 				bus_release_resource(dev, SYS_RES_IOPORT,
 				    PCIR_BAR(i), res->bars[i]);

sys/dev/ata/chipsets/ata-marvell.c

@@ -153,7 +153,7 @@ ata_marvell_pata_ch_attach(device_t dev)
 	return ENXIO;
  
     /* dont use 32 bit PIO transfers */
-	ch->flags |= ATA_USE_16BIT;
+    ch->flags |= ATA_USE_16BIT;
 
     return 0;
 }

sys/dev/ath/ah_osdep.c

@@ -107,6 +107,7 @@ ath_hal_malloc(size_t size)
 	return malloc(size, M_ATH_HAL, M_NOWAIT | M_ZERO);
 }
 
+/* XXX: FlexeLint return in void function ? */
 void
 ath_hal_free(void* p)
 {

sys/dev/ath/ath_hal/ah.c

@@ -566,6 +566,7 @@ ath_hal_getregdump(struct ath_hal *ah, const HAL_REGRANGE *regs,
 	uint32_t *dp = dstbuf;
 	int i;
 
+	/* XXX: FlexeLint: ">" test with ++ */
 	for (i = 0; space >= 2*sizeof(uint32_t); i++) {
 		u_int r = regs[i].start;
 		u_int e = regs[i].end;

sys/dev/ath/ath_hal/ah_eeprom_v3.c

@@ -1753,6 +1753,8 @@ legacyEepromGetSpurChan(struct ath_hal *ah, int ix, HAL_BOOL is2GHz)
 /*
  * Reclaim any EEPROM-related storage.
  */
+
+/* XXX: FlexeLint: return in void function */
 static void
 legacyEepromDetach(struct ath_hal *ah)
 {

sys/dev/bce/if_bce.c

@@ -608,17 +608,17 @@ bce_print_adapter_info(struct bce_softc *sc)
 #endif
     if (sc->bce_flags & BCE_USING_MSI_FLAG) {
         if (i > 0) printf("|");
-		printf("MSI"); i++;
+	printf("MSI"); i++;
     }
 
     if (sc->bce_flags & BCE_USING_MSIX_FLAG) {
         if (i > 0) printf("|");
-		printf("MSI-X "); i++;
+	printf("MSI-X "); i++;
     }
 
     if (sc->bce_phy_flags & BCE_PHY_2_5G_CAPABLE_FLAG) {
         if (i > 0) printf("|");
-		printf("2.5G"); i++;
+	printf("2.5G"); i++;
     }
 
     if (sc->bce_flags & BCE_MFW_ENABLE_FLAG) {
@@ -628,7 +628,7 @@ bce_print_adapter_info(struct bce_softc *sc)
         printf(")\n");
     }
 
-	DBEXIT(BCE_VERBOSE_LOAD);
+    DBEXIT(BCE_VERBOSE_LOAD);
 }
 
 

sys/dev/e1000/if_em.c

@@ -2826,7 +2826,7 @@ em_allocate_pci_resources(struct adapter *adapter)
  *  Setup the Legacy or MSI Interrupt handler
  *
  **********************************************************************/
-int
+static int
 em_allocate_legacy(struct adapter *adapter)
 {
 	device_t dev = adapter->dev;

sys/dev/ep/if_ep.c

@@ -666,6 +666,7 @@ rescan:
 						sc->tx_underrun++;
 #endif
 					} else {
+						/* XXX: FlexeLint doesn't like ; */
 						if (status & TXS_JABBER);
 						else
 							++ifp->if_collisions;

sys/dev/ep/if_epreg.h

@@ -315,7 +315,11 @@
 				 S_TX_AVAIL|S_RX_COMPLETE|S_RX_EARLY)
 #define S_COMMAND_IN_PROGRESS	(u_short) (0x1000)
 
-#define EP_BUSY_WAIT(sc) while (CSR_READ_2(sc, EP_STATUS) & S_COMMAND_IN_PROGRESS)
+#define EP_BUSY_WAIT(sc) 							\
+	do {									\
+		while (CSR_READ_2(sc, EP_STATUS) & S_COMMAND_IN_PROGRESS)	\
+			continue;						\
+	} while (0)
 
 /* Address Config. Register.
  * Window 0/Port 06

sys/dev/firewire/fwcrom.c

@@ -454,9 +454,9 @@ crom_add_simple_text(struct crom_src *src, struct crom_chunk *parent,
 	len = strlen(buf);
 	if (len > MAX_TEXT) {
 #if defined(__DragonFly__) || __FreeBSD_version < 500000
-		printf("text(%d) trancated to %d.\n", len, MAX_TEXT);
+		printf("text(%d) truncated to %d.\n", len, MAX_TEXT);
 #else
-		printf("text(%d) trancated to %td.\n", len, MAX_TEXT);
+		printf("text(%d) truncated to %td.\n", len, MAX_TEXT);
 #endif
 		len = MAX_TEXT;
 	}

sys/dev/firewire/fwdev.c

@@ -844,6 +844,7 @@ out:
 		err = copyout(ptr, crom_buf->ptr, len);
 		if (fwdev == NULL)
 			/* myself */
+			/* XXX: Flexelint no sure about modified pointer */
 			free(ptr, M_FW);
 		break;
 	default:

sys/dev/fxp/if_fxp.c

@@ -1597,6 +1597,7 @@ fxp_encap(struct fxp_softc *sc, struct mbuf **m_head)
 		cbp->tbd_number = nseg;
 	/* Configure TSO. */
 	if (m->m_pkthdr.csum_flags & CSUM_TSO) {
+		/* XXX: FlexeLint: negative subscript */
 		cbp->tbd[-1].tb_size = htole32(m->m_pkthdr.tso_segsz << 16);
 		cbp->tbd[1].tb_size |= htole32(tcp_payload << 16);
 		cbp->ipcb_ip_schedule |= FXP_IPCB_LARGESEND_ENABLE |

sys/dev/hptiop/hptiop.c

@@ -432,6 +432,7 @@ srb_complete:
 					sg_list), (u_int8_t *)&ccb->csio.sense_data, 
 					MIN(dxfer, sizeof(ccb->csio.sense_data)));
 			} else {
+				/* XXX: Flexelint arg2 is 16 bytes, arg3 is 32 */
 				memcpy(&ccb->csio.sense_data, &req->sg_list, 
 					MIN(dxfer, sizeof(ccb->csio.sense_data)));
 			}
@@ -575,6 +576,7 @@ static void hptiop_request_callback_mv(struct hpt_iop_hba * hba,
 			ccb->ccb_h.status = CAM_BUSY;
 			break;
 		case IOP_RESULT_CHECK_CONDITION:
+			/* XXX: FlexeLint: arg2=16b arg3=32 */
 			memcpy(&ccb->csio.sense_data, &req->sg_list, 
 				MIN(req->dataxfer_length, sizeof(ccb->csio.sense_data)));
 			ccb->ccb_h.status = CAM_SCSI_STATUS_ERROR;

sys/dev/iir/iir.c

@@ -1203,6 +1203,7 @@ gdt_internal_cache_cmd(struct gdt_softc *gdt,union ccb *ccb)
                 bzero( ccb->csio.data_ptr+copylen,
                        ccb->csio.dxfer_len - copylen );
             page=((struct scsi_mode_sense_6 *)ccb->csio.cdb_io.cdb_bytes)->page;
+	    /* XXX: FlexeLint: why ?? */
             switch (page) {
               default:
                 GDT_DPRINTF(GDT_D_MISC, ("MODE_SENSE_6: page 0x%x\n", page));

sys/dev/mpt/mpt_raid.c

@@ -562,6 +562,7 @@ mpt_raid_reply_frame_handler(struct mpt_softc *mpt, request_t *req,
 		break;
 	}
 	action_result = REQ_TO_RAID_ACTION_RESULT(req);
+	/* XXX: FlexeLint: ActionData is only 4 bytes */
 	memcpy(&action_result->action_data, &reply->ActionData,
 	    sizeof(action_result->action_data));
 	action_result->action_status = le16toh(reply->ActionStatus);

sys/dev/msk/if_msk.c

@@ -118,26 +118,21 @@ __FBSDID("$FreeBSD$");
 #include <net/bpf.h>
 #include <net/ethernet.h>
 #include <net/if.h>
-#include <net/if_arp.h>
 #include <net/if_dl.h>
 #include <net/if_media.h>
 #include <net/if_types.h>
 #include <net/if_vlan_var.h>
 
 #include <netinet/in.h>
-#include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/tcp.h>
-#include <netinet/udp.h>
 
 #include <machine/bus.h>
 #include <machine/in_cksum.h>
 #include <machine/resource.h>
 #include <sys/rman.h>
 
-#include <dev/mii/mii.h>
 #include <dev/mii/miivar.h>
-#include <dev/mii/brgphyreg.h>
 
 #include <dev/pci/pcireg.h>
 #include <dev/pci/pcivar.h>

sys/dev/usb/wlan/if_rum.c

@@ -42,12 +42,9 @@ __FBSDID("$FreeBSD$");
 #include <sys/kdb.h>
 
 #include <machine/bus.h>
-#include <machine/resource.h>
-#include <sys/rman.h>
 
 #include <net/bpf.h>
 #include <net/if.h>
-#include <net/if_arp.h>
 #include <net/ethernet.h>
 #include <net/if_dl.h>
 #include <net/if_media.h>
@@ -1489,7 +1486,7 @@ rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
 		return;
 	}
 
-	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
+	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | ((val & 0xfffff) << 2) |
 	    (reg & 3);
 	rum_write(sc, RT2573_PHY_CSR4, tmp);
 

sys/dev/usb/wlan/if_rumreg.h

@@ -139,7 +139,7 @@
 #define RT2573_BBP_BUSY	(1 << 16)
 /* possible flags for register PHY_CSR4 */
 #define RT2573_RF_20BIT	(20 << 24)
-#define RT2573_RF_BUSY	(1 << 31)
+#define RT2573_RF_BUSY	(1U << 31)
 
 /* LED values */
 #define RT2573_LED_RADIO	(1 << 8)

sys/dev/wi/if_wi.c

@@ -1673,6 +1673,7 @@ wi_read_nicid(struct wi_softc *sc)
 		memset(ident, 0, sizeof(ident));
 		len = sizeof(ident);
 		/* value should be the format like "V2.00-11" */
+		/* XXX: Flexelint: ident is local, p is arg */
 		if (wi_read_rid(sc, WI_RID_SYMBOL_IDENTITY, ident, &len) == 0 &&
 		    *(p = (char *)ident) >= 'A' &&
 		    p[2] == '.' && p[5] == '-' && p[8] == '\0') {

sys/fs/msdosfs/msdosfs_conv.c

@@ -266,6 +266,7 @@ dos2unixfn(dn, un, lower, pmp)
 		*un++ = c;
 		thislong++;
 	}
+	/* XXX: FlexeLint: Not kosher, dn is an array, not a pointer */
 	dn += i;
 
 	/*

sys/kern/kern_jail.c

@@ -1641,6 +1641,7 @@ kern_jail_set(struct thread *td, struct uio *optuio, int flags)
 #ifdef INET6
 	while (redo_ip6) {
 		ip6s = pr->pr_ip6s;
+		/* XXX: FlexeLint claims mem leak */
 		ip6 = malloc(ip6s * sizeof(*ip6), M_PRISON, M_WAITOK);
 		mtx_lock(&pr->pr_mtx);
 		redo_ip6 = 0;

sys/kern/kern_linker.c

@@ -1875,6 +1875,7 @@ linker_search_kld(const char *name)
 		return (linker_strdup(name));
 
 	/* traverse the linker path */
+	/* XXX: FlexeLint: this is not safe, ep will count past NUL */
 	len = strlen(name);
 	for (ep = linker_path; *ep; ep++) {
 		cp = ep;

sys/kern/kern_lock.c

@@ -312,6 +312,7 @@ lock_lockmgr(struct lock_object *lock, int how)
 	panic("lockmgr locks do not support sleep interlocking");
 }
 
+/* XXX: flexelint retval */
 static int
 unlock_lockmgr(struct lock_object *lock)
 {

sys/kern/kern_mutex.c

@@ -133,28 +133,28 @@ struct lock_class lock_class_mtx_spin = {
 struct mtx blocked_lock;
 struct mtx Giant;
 
-void
+static void
 assert_mtx(struct lock_object *lock, int what)
 {
 
 	mtx_assert((struct mtx *)lock, what);
 }
 
-void
+static void
 lock_mtx(struct lock_object *lock, int how)
 {
 
 	mtx_lock((struct mtx *)lock);
 }
 
-void
+static void
 lock_spin(struct lock_object *lock, int how)
 {
 
 	panic("spin locks can only use msleep_spin");
 }
 
-int
+static int
 unlock_mtx(struct lock_object *lock)
 {
 	struct mtx *m;
@@ -165,7 +165,8 @@ unlock_mtx(struct lock_object *lock)
 	return (0);
 }
 
-int
+/* XXX: FlexeLint retval */
+static int
 unlock_spin(struct lock_object *lock)
 {
 

sys/net80211/ieee80211_action.c

@@ -105,7 +105,7 @@ ieee80211_send_action_register(int cat, int act, ieee80211_send_action_func *f)
 		meshlm_send_action[act] = f;
 		return 0;
 	case IEEE80211_ACTION_CAT_MESHPATH:
-		if (act > N(hwmp_send_action))
+		if (act >= N(hwmp_send_action))
 			break;
 		hwmp_send_action[act] = f;
 		return 0;

sys/net80211/ieee80211_proto.h

@@ -315,7 +315,7 @@ struct ieee80211_beacon_offsets {
 	uint8_t		*bo_ath;	/* start of ATH parameters */
 	uint8_t		*bo_appie;	/* start of AppIE element */
 	uint16_t	bo_appie_len;	/* AppIE length in bytes */
-	uint16_t	bo_csa_trailer_len;;
+	uint16_t	bo_csa_trailer_len;
 	uint8_t		*bo_csa;	/* start of CSA element */
 	uint8_t		*bo_spare[4];
 };

sys/security/audit/audit_bsm_token.c

@@ -36,6 +36,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include <sys/param.h>
 #include <sys/types.h>
 #include <sys/endian.h>
 #include <sys/queue.h>