diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 416a3eaa5c..daf7a923dd 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -2291,7 +2291,7 @@ setup_lookup(dig_lookup_t *lookup) {
 
 		if (lookup->ecs_addr != NULL) {
 			uint8_t addr[16];
-			uint16_t family;
+			uint16_t family = 0;
 			uint32_t plen;
 			struct sockaddr *sa;
 			struct sockaddr_in *sin;
diff --git a/bin/named/server.c b/bin/named/server.c
index 4f14900f7f..93924b2afe 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2718,7 +2718,7 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	catz_chgzone_event_t *event;
 	isc_task_t *task;
 	isc_result_t result;
-	isc_taskaction_t action;
+	isc_taskaction_t action = NULL;
 
 	switch (type) {
 	case DNS_EVENT_CATZADDZONE:
@@ -4356,7 +4356,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		obj2 = cfg_tuple_get(obj, "response");
 		if (!cfg_obj_isvoid(obj2)) {
 			const char *resp = cfg_obj_asstring(obj2);
-			isc_result_t r;
+			isc_result_t r = DNS_R_SERVFAIL;
 
 			if (strcasecmp(resp, "drop") == 0)
 				r = DNS_R_DROP;
@@ -5036,7 +5036,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj2 = cfg_tuple_get(obj, "response");
 	if (!cfg_obj_isvoid(obj2)) {
 		const char *resp = cfg_obj_asstring(obj2);
-		isc_result_t r;
+		isc_result_t r = DNS_R_SERVFAIL;
 
 		if (strcasecmp(resp, "drop") == 0)
 			r = DNS_R_DROP;
@@ -5281,7 +5281,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		const char *empty_dbtype[4] =
 				    { "_builtin", "empty", NULL, NULL };
 		int empty_dbtypec = 4;
-		dns_zonestat_level_t statlevel;
+		dns_zonestat_level_t statlevel = dns_zonestat_none;
 
 		name = dns_fixedname_initname(&fixed);
 
@@ -9920,7 +9920,7 @@ static void
 named_server_reload(isc_task_t *task, isc_event_t *event) {
 	named_server_t *server = (named_server_t *)event->ev_arg;
 
-	INSIST(task = server->task);
+	INSIST(task == server->task);
 	UNUSED(task);
 
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -12586,7 +12586,7 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	const char *viewname = NULL;
 	dns_rdataclass_t rdclass;
 	dns_view_t *view = NULL;
-	const char *bn;
+	const char *bn = NULL;
 
 	REQUIRE(viewp != NULL && *viewp == NULL);
 	REQUIRE(zoneobjp != NULL && *zoneobjp == NULL);
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 52264239e0..f01004a8ba 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -903,7 +903,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const dns_master_style_t *masterstyle = &dns_master_style_default;
 	isc_stats_t *zoneqrystats;
 	dns_stats_t *rcvquerystats;
-	dns_zonestat_level_t statlevel;
+	dns_zonestat_level_t statlevel = dns_zonestat_none;
 	int seconds;
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
 	isc_dscp_t dscp;
diff --git a/bin/tests/system/rpz/dnsrps.c b/bin/tests/system/rpz/dnsrps.c
index 06da69144d..0ad3add41a 100644
--- a/bin/tests/system/rpz/dnsrps.c
+++ b/bin/tests/system/rpz/dnsrps.c
@@ -82,10 +82,11 @@ main(int argc, char **argv) {
 			}
 #ifdef USE_DNSRPS
 			printf("%s\n", librpz->dnsrpzd_path);
-			return (0);
 #else
 			INSIST(0);
+			ISC_UNREACHABLE();
 #endif
+			return (0);
 
 		case 'n':
 			if (!link_dnsrps(&emsg)) {
@@ -132,10 +133,11 @@ main(int argc, char **argv) {
 			librpz->rsp_detach(&rsp);
 			librpz->client_detach(&client);
 			printf("%u\n", serial);
-			return (0);
 #else
 			INSIST(0);
+			ISC_UNREACHABLE();
 #endif
+			return (0);
 
 		case 'w':
 			seconds = strtod(optarg, &p);
diff --git a/config.h.in b/config.h.in
index 8fccd17b65..0ac0deb2f7 100644
--- a/config.h.in
+++ b/config.h.in
@@ -60,6 +60,9 @@
 /* Define to 1 if the compiler supports __builtin_expect. */
 #undef HAVE_BUILTIN_EXPECT
 
+/* define if the compiler supports __builtin_unreachable(). */
+#undef HAVE_BUILTIN_UNREACHABLE
+
 /* Define to 1 if you have the `catgets' function. */
 #undef HAVE_CATGETS
 
diff --git a/configure b/configure
index 90cffa9ec4..5576d75ccb 100755
--- a/configure
+++ b/configure
@@ -18161,6 +18161,38 @@ fi
 done
 
 
+#
+# Check for __builtin_unreachable
+#
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for __builtin_unreachable()" >&5
+$as_echo_n "checking compiler support for __builtin_unreachable()... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+__builtin_unreachable();
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define HAVE_BUILTIN_UNREACHABLE 1" >>confdefs.h
+
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
 #
 # Check for __builtin_expect
 #
diff --git a/configure.ac b/configure.ac
index d100ae29ac..55e65150bd 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2017,6 +2017,21 @@ LIBS="$LIBS $ISC_ATOMIC_LIBS"
 
 AC_CHECK_HEADERS([uchar.h])
 
+#
+# Check for __builtin_unreachable
+#
+AC_MSG_CHECKING([compiler support for __builtin_unreachable()])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM(
+     [[]],
+     [[__builtin_unreachable();]]
+   )],
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE([HAVE_BUILTIN_UNREACHABLE], [1], [define if the compiler supports __builtin_unreachable().])
+  ],
+  [AC_MSG_RESULT([no])
+  ])
+
 #
 # Check for __builtin_expect
 #
diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index b9b26580d6..3368d90105 100644
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -700,6 +700,7 @@ dnstap_type(dns_dtmsgtype_t msgtype) {
 		return (DNSTAP__MESSAGE__TYPE__UPDATE_RESPONSE);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
diff --git a/lib/dns/iptable.c b/lib/dns/iptable.c
index 36bad9bf58..c4e3b0d06f 100644
--- a/lib/dns/iptable.c
+++ b/lib/dns/iptable.c
@@ -67,7 +67,7 @@ dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
 	int i;
 
 	INSIST(DNS_IPTABLE_VALID(tab));
-	INSIST(tab->radix);
+	INSIST(tab->radix != NULL);
 
 	NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
 
diff --git a/lib/dns/master.c b/lib/dns/master.c
index c4025832cf..8b39beca3b 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -549,8 +549,6 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
 
 	lctx->format = format;
 	switch (format) {
-	default:
-		INSIST(0);
 	case dns_masterformat_text:
 		lctx->openfile = openfile_text;
 		lctx->load = load_text;
@@ -563,6 +561,9 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
 		lctx->openfile = openfile_map;
 		lctx->load = load_map;
 		break;
+	default:
+		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (lex != NULL) {
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 00751923e2..7a70ce2b4d 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -567,8 +567,8 @@ adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 		const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
 		bool inc)
 {
-	dns_rpz_trigger_counter_t *cnt;
-	dns_rpz_zbits_t *have;
+	dns_rpz_trigger_counter_t *cnt = 0;
+	dns_rpz_zbits_t *have = 0;
 
 	switch (rpz_type) {
 	case DNS_RPZ_TYPE_CLIENT_IP:
@@ -611,6 +611,7 @@ adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (inc) {
@@ -2477,7 +2478,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 	dns_rpz_addr_zbits_t tgt_set;
 	dns_rpz_cidr_node_t *found;
 	isc_result_t result;
-	dns_rpz_num_t rpz_num;
+	dns_rpz_num_t rpz_num = 0;
 	dns_rpz_have_t have;
 	int i;
 
diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
index 2343bebd97..6c5c32dee4 100644
--- a/lib/isc/include/isc/util.h
+++ b/lib/isc/include/isc/util.h
@@ -203,6 +203,12 @@
  */
 #include <isc/likely.h>
 
+#ifdef HAVE_BUILTIN_UNREACHABLE
+#define ISC_UNREACHABLE() __builtin_unreachable();
+#else
+#define ISC_UNREACHABLE()
+#endif
+
 #ifdef UNIT_TESTING
 extern void mock_assert(const int result, const char* const expression,
 			const char * const file, const int line);
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
index 6b77ed9fea..c405e61608 100644
--- a/lib/isc/pk11.c
+++ b/lib/isc/pk11.c
@@ -667,6 +667,7 @@ pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt) {
 		break;
 	}
 	INSIST(0);
+	ISC_UNREACHABLE();
 }
 
 CK_ATTRIBUTE *
diff --git a/lib/isc/random.c b/lib/isc/random.c
index c682cbc3f7..54a60a072e 100644
--- a/lib/isc/random.c
+++ b/lib/isc/random.c
@@ -114,7 +114,7 @@ isc_random_buf(void *buf, size_t buflen) {
 	int i;
 	uint32_t r;
 
-	REQUIRE(buf);
+	REQUIRE(buf != NULL);
 	REQUIRE(buflen > 0);
 
 	RUNTIME_CHECK(isc_once_do(&isc_random_once,
diff --git a/lib/ns/client.c b/lib/ns/client.c
index 7df2336c1b..6a8d208498 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -1686,7 +1686,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		isc_buffer_t buf;
 		uint8_t addr[16];
 		uint32_t plen, addrl;
-		uint16_t family;
+		uint16_t family = 0;
 
 		/* Add CLIENT-SUBNET option. */
 
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 937da5d68e..71aa3824d9 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2587,7 +2587,7 @@ rpz_get_zbits(ns_client_t *client,
 	      dns_rdatatype_t ip_type, dns_rpz_type_t rpz_type)
 {
 	dns_rpz_st_t *st;
-	dns_rpz_zbits_t zbits;
+	dns_rpz_zbits_t zbits = 0;
 
 	REQUIRE(client != NULL);
 	REQUIRE(client->query.rpz_st != NULL);