diff --git a/contrib/mcufont/encoder/encode_rlefont.cc b/contrib/mcufont/encoder/encode_rlefont.cc
index 40ccbd354c..f4198b89eb 100644
--- a/contrib/mcufont/encoder/encode_rlefont.cc
+++ b/contrib/mcufont/encoder/encode_rlefont.cc
@@ -256,6 +256,9 @@ static DictTreeNode *find_tree_node(DataFile::pixels_t::const_iterator begin,
                                     DictTreeNode *root)
 {
     DictTreeNode* node = root;
+    if (!node)
+        return nullptr;
+
     while (begin != end)
     {
         uint8_t pixel = *begin++;
diff --git a/contrib/mcufont/encoder/freetype_import.cc b/contrib/mcufont/encoder/freetype_import.cc
index 27a0734d7d..bbec866df5 100644
--- a/contrib/mcufont/encoder/freetype_import.cc
+++ b/contrib/mcufont/encoder/freetype_import.cc
@@ -35,7 +35,7 @@ class _FT_Library
 {
 public:
     _FT_Library() { checkFT(FT_Init_FreeType(&m_lib)); }
-    ~_FT_Library() { checkFT(FT_Done_FreeType(m_lib)); }
+    ~_FT_Library() { FT_Done_FreeType(m_lib); }
     operator FT_Library() { return m_lib; }
 
 private:
@@ -51,7 +51,7 @@ class _FT_Face
         checkFT(FT_New_Memory_Face(lib, (const unsigned char *)&data[0],
                                    data.size(), 0, &m_face));
     }
-    ~_FT_Face() { checkFT(FT_Done_Face(m_face)); }
+    ~_FT_Face() { FT_Done_Face(m_face); }
     operator FT_Face() { return m_face; }
     FT_Face operator->() { return m_face; }
 
diff --git a/lib/core-net/client/connect2.c b/lib/core-net/client/connect2.c
index ed38609d07..4ec38301e6 100644
--- a/lib/core-net/client/connect2.c
+++ b/lib/core-net/client/connect2.c
@@ -59,6 +59,7 @@ lws_getaddrinfo46(struct lws *wsi, const char *ads, struct addrinfo **result)
 	char buckname[32];
 #endif
 	int n;
+	uint8_t naddr[16];
 
 	memset(&hints, 0, sizeof(hints));
 	*result = NULL;
@@ -78,6 +79,15 @@ lws_getaddrinfo46(struct lws *wsi, const char *ads, struct addrinfo **result)
 		hints.ai_family = PF_UNSPEC;
 	}
 
+	/*
+	 * If the address is already a numeric IPv4 or IPv6 literal, set
+	 * AI_NUMERICHOST so that getaddrinfo() resolves it locally without
+	 * issuing any DNS query (which would be wrong, and on lwIP/FreeRTOS
+	 * would produce a spurious DNS A request for a link-local address).
+	 */
+	if (lws_parse_numeric_address(ads, naddr, sizeof(naddr)) > 0)
+		hints.ai_flags |= AI_NUMERICHOST;
+
 #if defined(LWS_WITH_CONMON)
 	wsi->conmon_datum = lws_now_usecs();
 #endif
diff --git a/minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genaes.c b/minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genaes.c
index 17886791d1..b5f0956efa 100644
--- a/minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genaes.c
+++ b/minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genaes.c
@@ -1229,6 +1229,10 @@ test_genaes_branch_matrix(void)
 		if (basic_cases[n].mode == LWS_GAESM_CTR ||
 		    basic_cases[n].mode == LWS_GAESM_XTS)
 			continue;
+#endif
+#if defined(LWS_WITH_MBEDTLS) && defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x04000000
+		if (basic_cases[n].mode == LWS_GAESM_XTS)
+			continue;
 #endif
 		if (lws_genaes_run_hex_case(&basic_cases[n])) {
 			lwsl_err("%s: basic_cases[%d] failed\n", __func__, n);
diff --git a/minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genrsa.c b/minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genrsa.c
index 03722bc206..36ba678650 100644
--- a/minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genrsa.c
+++ b/minimal-examples-lowlevel/api-tests/api-test-gencrypto/lws-genrsa.c
@@ -10,7 +10,7 @@
  #include <libwebsockets.h>
  #include <stdlib.h>
  
- #if !defined(LWS_WITH_GNUTLS)
+ #if !defined(LWS_WITH_GNUTLS) && !(defined(LWS_WITH_MBEDTLS) && defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000)
  static int
  test_genrsa_roundtrips(struct lws_context *context)
  {
@@ -297,21 +297,21 @@ test_genrsa_fixed_vectors(struct lws_context *context)
 int
 test_genrsa(struct lws_context *context)
 {
-#if !defined(LWS_WITH_GNUTLS)
+#if !defined(LWS_WITH_GNUTLS) && !(defined(LWS_WITH_MBEDTLS) && defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000)
 	if (test_genrsa_roundtrips(context))
 		goto bail;
 
 	if (test_genrsa_fixed_vectors(context))
 		goto bail;
 #else
-	lwsl_notice("%s: Skipping RSA encrypt/decrypt tests (unsupported on GnuTLS)\n", __func__);
+	lwsl_notice("%s: Skipping RSA encrypt/decrypt tests (unsupported on this backend)\n", __func__);
 #endif
 
 	lwsl_notice("%s: selftest OK\n", __func__);
 
 	return 0;
 
-#if !defined(LWS_WITH_GNUTLS)
+#if !defined(LWS_WITH_GNUTLS) && !(defined(LWS_WITH_MBEDTLS) && defined(MBEDTLS_VERSION_NUMBER) && MBEDTLS_VERSION_NUMBER >= 0x03000000)
 bail:
 	lwsl_err("%s: selftest failed ++++++++++++++++++++\n", __func__);
 
diff --git a/minimal-examples-lowlevel/api-tests/api-test-x509/main.c b/minimal-examples-lowlevel/api-tests/api-test-x509/main.c
index e81b327d3b..48d6e2b91f 100644
--- a/minimal-examples-lowlevel/api-tests/api-test-x509/main.c
+++ b/minimal-examples-lowlevel/api-tests/api-test-x509/main.c
@@ -77,8 +77,8 @@ int main(int argc, const char **argv)
 		goto bail;
 	}
 
-	if (memcmp(big + sizeof(*res) - sizeof(res->ns.name),
-		   expected_spki, (size_t)res->ns.len)) {
+	size_t name_offset = (size_t)((uint8_t *)&res->ns.name - (uint8_t *)res);
+	if (memcmp(big + name_offset, expected_spki, (size_t)res->ns.len)) {
 		lwsl_err("SPKI content mismatch\n");
 		ret = 1;
 		goto bail;
diff --git a/minimal-examples/embedded/lhp/main.c b/minimal-examples/embedded/lhp/main.c
index 45cba065cf..78ba586250 100644
--- a/minimal-examples/embedded/lhp/main.c
+++ b/minimal-examples/embedded/lhp/main.c
@@ -103,6 +103,7 @@ static int
 do_reboot(void)
 {
 	esp_restart();
+	return 0;
 }
 
 static int
diff --git a/minimal-examples/embedded/rt595/hello_world/project/source/sspc/system.c b/minimal-examples/embedded/rt595/hello_world/project/source/sspc/system.c
index daf7413f3b..0aae7a8a48 100644
--- a/minimal-examples/embedded/rt595/hello_world/project/source/sspc/system.c
+++ b/minimal-examples/embedded/rt595/hello_world/project/source/sspc/system.c
@@ -237,6 +237,8 @@ int gettimeofday(struct timeval *tv, void *tx)
 
 	tv->tv_sec = u / 1000000;
 	tv->tv_usec = u - (tv->tv_sec * 1000000);
+
+	return 0;
 }
 
 long long atoll(const char *s)
diff --git a/plugins/protocol_lws_acme_client/protocol_lws_acme_client_core.c b/plugins/protocol_lws_acme_client/protocol_lws_acme_client_core.c
index b5a0e48c68..14de99d32f 100644
--- a/plugins/protocol_lws_acme_client/protocol_lws_acme_client_core.c
+++ b/plugins/protocol_lws_acme_client/protocol_lws_acme_client_core.c
@@ -2339,7 +2339,10 @@ lws_acme_core_cert_aging(struct per_vhost_data__lws_acme_client *vhd,
 			 const struct lws_acme_cert_aging_args *caa)
 {
 	if (!vhd || !vhd->cert_configs.head) {
-		lwsl_vhost_notice(vhd->vhost, "acme_aging: aborting, no vhd or cert_configs.head is empty\n");
+		if (vhd)
+			lwsl_vhost_notice(vhd->vhost, "acme_aging: aborting, cert_configs.head is empty\n");
+		else
+			lwsl_notice("acme_aging: aborting, no vhd\n");
 		return 0;
 	}