diff --git a/librz/arch/isa/c166/c166_disas.c b/librz/arch/isa/c166/c166_disas.c
index 1bbcd46ad3..6ddac79477 100644
--- a/librz/arch/isa/c166/c166_disas.c
+++ b/librz/arch/isa/c166/c166_disas.c
@@ -561,9 +561,6 @@ static ut8 c166_instr_mov_nm(C166_Inst *instr) {
 		swap = true;
 		format = FMT3;
 		break;
-	case C166_MOV_oRwn_oRwm: ///< 0xC8             [Rwn], [Rwm]
-	case C166_MOVB_oRwn_oRwm: ///< 0xC9            [Rwn], [Rwm]
-		format = FMT4;
 		break;
 	case C166_MOV_oRwnp_oRwm: ///< 0xD8            [Rwn+], [Rwm]
 	case C166_MOVB_oRwnp_oRwm: ///< 0xD9           [Rwn+], [Rwm]
@@ -573,7 +570,11 @@ static ut8 c166_instr_mov_nm(C166_Inst *instr) {
 	case C166_MOVB_oRwn_oRwmp: ///< 0xE9           [Rwn], [Rwm+]
 		format = FMT6;
 		break;
-	default: break;
+	case C166_MOV_oRwn_oRwm: ///< 0xC8             [Rwn], [Rwm]
+	case C166_MOVB_oRwn_oRwm: ///< 0xC9            [Rwn], [Rwm]
+	default:
+		format = FMT4;
+		break;
 	}
 	// clang-format on
 	if (swap) {
@@ -979,10 +980,6 @@ static const char *c166_instr_extended_name(C166_Inst *instr) {
 		return "CoNEG";
 	}
 
-	if ((opcode == 0x83) && (extID == 0x9A)) {
-		return "CoSHR";
-	}
-
 	if ((opcode == 0x93) && (extID == 0x5A)) {
 		return "CoNOP";
 	}
@@ -1391,8 +1388,6 @@ static ut8 c166_instr_extended(C166_Inst *instr) {
 		goto end;
 	} else if ((opcode == 0xA3) && (extID == 0x32)) {
 		goto end;
-	} else if ((opcode == 0xA3) && (extID == 0xB2)) {
-		goto end;
 	} else if ((opcode == 0x83) && (extID == 0x8A)) {
 		OPERANDS("[r%i]", m); // ????? CoSHL [RWm*]
 		goto end;
diff --git a/librz/arch/p/analysis/analysis_c166.c b/librz/arch/p/analysis/analysis_c166.c
index 3260f310c3..d63443d299 100644
--- a/librz/arch/p/analysis/analysis_c166.c
+++ b/librz/arch/p/analysis/analysis_c166.c
@@ -495,10 +495,6 @@ static void c166_op_call_seg_caddr(RzAnalysis *analysis, RzAnalysisOp *op, const
 	op->stackop = RZ_ANALYSIS_STACK_INC;
 	op->stackptr = 4;
 
-	ut8 SP = (ut8)GET_A_SP;
-	SET_A_SP((ut64)SP - 2);
-	SP = (ut8)GET_A_SP;
-
 	const ut8 SGTDIS = (ut8)GET_A_SGTDIS;
 	if (SGTDIS == 0) {
 		if (!SET_A_CSP((ut64)seg)) {
@@ -538,12 +534,6 @@ static void c166_op_pcall_reg_caddr(RzAnalysis *analysis, RzAnalysisOp *op, cons
 	const ut16 caddr = rz_read_at_le16(buf, 2);
 	op->stackop = RZ_ANALYSIS_STACK_INC;
 	op->stackptr = 4;
-
-	ut8 SP = (ut8)GET_A_SP;
-	SET_A_SP((ut64)SP - 2);
-	SP = (ut8)GET_A_SP;
-	SET_A_IP((ut64)caddr);
-
 	op->type = RZ_ANALYSIS_OP_TYPE_UCALL;
 	c166_set_jump_target_from_caddr(op, caddr);
 	c166_set_mimo_addr_from_reg(op, buf[1]);
diff --git a/librz/arch/p/asm/asm_c166.c b/librz/arch/p/asm/asm_c166.c
index e0bb99ad58..ed0f520542 100644
--- a/librz/arch/p/asm/asm_c166.c
+++ b/librz/arch/p/asm/asm_c166.c
@@ -342,11 +342,13 @@ static st32 disassemble(const RzAsm *a, RzAsmOp *op, const ut8 *buf, st32 len) {
 		return op->size;
 	}
 
-	C166State *state = (C166State *)a->plugin_data;
-	if (!state) {
+	if (!a->plugin_data) {
 		RZ_LOG_FATAL("C166State was NULL.\n");
+		return -1;
 	}
 
+	C166State *state = (C166State *)a->plugin_data;
+
 	C166_Inst inst = RZ_EMPTY;
 	inst.addr = (ut32)a->pc;
 	if (check_unused_opcode(buf[0])) {
@@ -360,8 +362,6 @@ static st32 disassemble(const RzAsm *a, RzAsmOp *op, const ut8 *buf, st32 len) {
 		rz_asm_op_setf_asm(op, FMT_2WORD, buf[0], buf[1], buf[2], 0x00);
 	} else if (op->size == 4 && len == 2) {
 		rz_asm_op_setf_asm(op, FMT_2WORD, buf[0], buf[1], 0x00, 0x00);
-	} else if (op->size == 2 && len == 1) {
-		rz_asm_op_setf_asm(op, FMT_WORD, buf[0], 0x00);
 	} else if (RZ_STR_EQ(inst.instr, "invalid")) {
 		if (op->size == 2)
 			rz_asm_op_setf_asm(op, FMT_WORD, buf[0], buf[1]);
diff --git a/librz/bin/format/omf/omf166.c b/librz/bin/format/omf/omf166.c
index 3a12e080d1..cb241d697f 100644
--- a/librz/bin/format/omf/omf166.c
+++ b/librz/bin/format/omf/omf166.c
@@ -584,7 +584,7 @@ static int load_linnum_data(const rz_bin_omf166_obj *obj, const ut8 *buf, const
 		}
 		linnum->LineNumber = rz_read_le16_offset(buf, &ct); // start with ct = 5
 		const ut16 offset = rz_read_le16_offset(buf, &ct);
-		linnum->address = (FrameNumber << 16) | offset;
+		linnum->address = ((ut64)FrameNumber << 16) | offset;
 		OMF_coments *comment = rz_pvector_tail(obj->coments_vec);
 		if (!comment) {
 			RZ_FREE(linnum);
@@ -686,6 +686,9 @@ static int load_omf_unk4(const ut8 *buf, const size_t buf_size, const OMF_record
 	RZ_LOG_DEBUG("load_omf = UNKNOWN4  =  [%05d] [0x%08" PFMT64x "] 0x%02x (%10" PFMTSZu ")\n", record->size, global_ct, record->type, buf_size);
 	size_t ct = 3;
 	const ut16 count = rz_read_le16_offset(buf, &ct);
+	if (count == 0 || count > UINT16_MAX) {
+		return false;
+	}
 
 	RZ_LOG_DEBUG("count: %2d [%02x %02x]\n%02x %02x\n",
 		count, buf[ct], buf[ct + 1], buf[ct + 2], buf[ct + 3]);
@@ -833,9 +836,13 @@ static int load_omf_typnew(rz_bin_omf166_obj *obj, const ut8 *buf) {
 		 *  0x20 | NrOfComp16 | Components [*]  { TI16 | OFFS32 | REP8 | POS8 | n,’name’ }
 		 * \endcode
 		 */
+		const ut16 raw_count = rz_read_le16_offset(buf, &cct);
+		if (raw_count == 0 || raw_count > UINT16_MAX) {
+			return false;
+		}
 		newtype->label = rz_str_dup("COMPONENT_LIST_DESCRIPTOR");
 		newtype->descriptor.components.index = obj->TI_INDEX;
-		newtype->descriptor.components.count = rz_read_le16_offset(buf, &cct);
+		newtype->descriptor.components.count = raw_count;
 		newtype->descriptor.components.comp =
 			RZ_NEWS0(OMF_component, newtype->descriptor.components.count);
 		if (!newtype->descriptor.components.comp) {
@@ -844,7 +851,7 @@ static int load_omf_typnew(rz_bin_omf166_obj *obj, const ut8 *buf) {
 			return false;
 		}
 
-		for (int i = 0; i < newtype->descriptor.components.count; i++) {
+		for (ut16 i = 0; i < newtype->descriptor.components.count; i++) {
 			OMF_component *component = newtype->descriptor.components.comp + i;
 			component->index = obj->TI_INDEX;
 			component->ti = rz_read_le16_offset(buf, &cct);
@@ -1074,7 +1081,11 @@ static OMF_record *rz_bin_format_omf166_load_record(rz_bin_omf166_obj *obj, cons
 	}
 	size_t offset = 0;
 	new->type = rz_read_le8_offset(buf, &offset);
-	new->size = rz_read_le16_offset(buf, &offset);
+	const ut16 raw_count = rz_read_le16_offset(buf, &offset);
+	if (raw_count == 0 || raw_count > UINT16_MAX) {
+		return false;
+	}
+	new->size = raw_count;
 
 	// at least a record has a type, a size and a checksum
 	if (new->size > (buf_size - offset) || buf_size < (offset + 1)) {
@@ -1082,7 +1093,7 @@ static OMF_record *rz_bin_format_omf166_load_record(rz_bin_omf166_obj *obj, cons
 		RZ_FREE(new);
 		return NULL;
 	}
-	if (!(rz_bin_format_omf166_load_content(obj, new, buf, global_ct, buf_size))) {
+	if (!rz_bin_format_omf166_load_content(obj, new, buf, global_ct, buf_size)) {
 		RZ_FREE(new);
 		return NULL;
 	}
diff --git a/librz/bin/p/bin_omf166.c b/librz/bin/p/bin_omf166.c
index d45ce8470c..f05eb7faef 100644
--- a/librz/bin/p/bin_omf166.c
+++ b/librz/bin/p/bin_omf166.c
@@ -55,7 +55,7 @@ static void destroy(RzBinFile *bf) {
 	}
 
 	rz_bin_omf166_obj *omf_obj = (rz_bin_omf166_obj *)bf->o->bin_obj;
-	if (omf_obj) {
+	if (!omf_obj) {
 		return;
 	}
 	ht_up_free(omf_obj->ht_types);