Retire splint from our set of static analyzers.

The proximate cause was that we've been seing emission of error
messages that were randomly and disturbingly variable across different
environments - notably Raspbian and Gentoo splint gave nontrivially
different results than Ubuntu 14.10 splint. And this was *not* due to
Ubuntu patches!  A pristine splint built from the 3.1.2 tarball on
Ubuntu didn't match the Raspbian and Gentoo results either.

But this has been coming for a while.  Easy access to more modern
static analyzers such as coverity, scan-build and cppcheck has been
decreasing the utility of splint, which is unmaintained  and somewhat
buggy and not easy to use.

Only file not cleaned is ppsthread.c, because Gary has been working
on it during this cleanup.

All regression tests pass. PPS observed live on GR601-W.

105 files changed, 371 insertions, 3764 deletions

diff --git a/.splintrc b/.splintrc
deleted file mode 100644
index 17fefad9..00000000
--- a/.splintrc
+++ /dev/null
@@ -1,28 +0,0 @@
--I. 
-+unixlib
-+charindex
-+charintliteral
--realcompare
--exitarg
--booltype bool
--paramuse
--predboolint
--nestedextern
--abstract
--fixedformalarray
-
--Ddbus_uint32_t=uint
--Disgps30bits_t=uint
--DFD_SETSIZE=31
--DB230400=010000
--DB57600=010001
--DB115200=0010011
--DCRTSCTS=0x00020000
--DONLCR=0x00000002
--DINET6_ADDRSTRLEN=48
--D__gnuc_va_list=va_list
--D__signed__=signed
--D__pid_t=int
--D__size_t=size_t
--Dpps_handle_t=int
-
diff --git a/NEWS b/NEWS
index 13e89cf4..1b126efd 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 			GPSD project news
 Repository head:
   Fixed incorrect decode of south latitudes in AIS Type 17 messages.
+  splint has been retired; this removes almost 2KLOC of annotations.
 
 3.14: 2015-03-14 (Eric S. Raymond <esr@snark.thyrsus.com>)
   The Pi Day release, 3.14 on 3/14 2015 at 9:26. Longer timeouts on test clients.
diff --git a/SConstruct b/SConstruct
index 5c9d8eb6..09adb4f7 100644
--- a/SConstruct
+++ b/SConstruct
@@ -1435,54 +1435,10 @@ def Utility(target, source, action):
     env.Precious(target)
     return target
 
-# Report splint warnings
-# Note: test_bits.c is unsplintable because of the PRI64 macros.
-# If you get preprocessor or fatal errors, add +showscan.
-# explicitly force splint to only use our splintrc file
-splintopts = "-I/usr/include/libusb-1.0 +quiet +nof -f .splintrc"
-if sys.platform.startswith('darwin'):
-    splintopts = splintopts + " +skip-sys-headers"
-
-# splint does not know about multi-arch, work around that
-ma_status, ma = _getstatusoutput('dpkg-architecture -qDEB_HOST_MULTIARCH')
-if ma_status == 0:
-    splintopts = '-I/usr/include/%s %s' %(ma.strip(),splintopts)
-env['SPLINTOPTS']=splintopts
-
-def Splint(target,sources, description, params):
-    return Utility(target,sources+generated_sources,[
-            '@echo "Running splint on %s..."'%description,
-            '-splint $SPLINTOPTS %s %s'%(" ".join(params)," ".join(sources)),
-            ])
-
-splint_table = [
-    ('splint-daemon',gpsd_sources,'daemon', ['-exportlocal', '-redef']),
-    ('splint-libgpsd',libgpsd_sources,'libgpsd', ['-exportlocal', '-redef']),
-    ('splint-libgps',libgps_sources,'user-side libraries', ['-exportlocal',
-                                                            '-fileextensions',
-                                                            '-redef']),
-    ('splint-cgps',['cgps.c'],'cgps', ['-exportlocal']),
-    ('splint-gpsctl',['gpsctl.c'],'gpsctl', ['']),
-    ('splint-gpsdctl',['gpsdctl.c'],'gpsdctl', ['']),
-    ('splint-gpsmon',gpsmon_sources,'gpsmon', ['-exportlocal']),
-    ('splint-gpspipe',['gpspipe.c'],'gpspipe', ['']),
-    ('splint-gps2udp',['gps2udp.c'],'gps2udp', ['']),
-    ('splint-gpsdecode',['gpsdecode.c'],'gpsdecode', ['']),
-    ('splint-gpxlogger',['gpxlogger.c'],'gpxlogger', ['']),
-    ('splint-ntpshmmon',['ntpshmmon.c'],'ntpshmmon', ['']),
-    ('splint-test_packet',['test_packet.c'],'test_packet test harness', ['']),
-    ('splint-test_mktime',['test_mktime.c'],'test_mktime test harness', ['']),
-    ('splint-test_geoid',['test_geoid.c'],'test_geoid test harness', ['']),
-    ('splint-test_json',['test_json.c'],'test_json test harness', ['']),
-    ]
-
-for (target,sources,description,params) in splint_table:
-    env.Alias('splint',Splint(target,sources,description,params))
-
 # Putting in all these -U flags speeds up cppcheck and allows it to look
 # at configurations we actually care about.
 Utility("cppcheck", ["gpsd.h", "packet_names.h"],
-        "cppcheck -U__UNUSED__ -UUSE_QT -US_SPLINT_S -U__COVERITY__ -U__future__ -ULIMITED_MAX_CLIENTS -ULIMITED_MAX_DEVICES -UAF_UNSPEC -UINADDR_ANY -UFIXED_PORT_SPEED -UFIXED_STOP_BITS -U_WIN32 -U__CYGWIN__ -UPATH_MAX -UHAVE_STRLCAT -UHAVE_STRLCPY -UIPTOS_LOWDELAY -UIPV6_TCLASS -UTCP_NODELAY -UTIOCMIWAIT --template gcc --enable=all --inline-suppr --suppress='*:driver_proto.c' --force $SRCDIR")
+        "cppcheck -U__UNUSED__ -UUSE_QT -U__COVERITY__ -U__future__ -ULIMITED_MAX_CLIENTS -ULIMITED_MAX_DEVICES -UAF_UNSPEC -UINADDR_ANY -UFIXED_PORT_SPEED -UFIXED_STOP_BITS -U_WIN32 -U__CYGWIN__ -UPATH_MAX -UHAVE_STRLCAT -UHAVE_STRLCPY -UIPTOS_LOWDELAY -UIPV6_TCLASS -UTCP_NODELAY -UTIOCMIWAIT --template gcc --enable=all --inline-suppr --suppress='*:driver_proto.c' --force $SRCDIR")
 
 # Experimental check with clang analyzer
 Utility("scan-build", ["gpsd.h", "packet_names.h"],
@@ -1513,8 +1469,7 @@ Utility("deheader", generated_sources, [
 
 # Perform all local code-sanity checks (but not the Coverity scan).
 audit = env.Alias('audit',
-                  ['splint',
-                   'cppcheck',
+                  ['cppcheck',
                    'pylint',
                    'xmllint',
                    'valgrind-audit',
diff --git a/SConstruct.orig b/SConstruct.orig
deleted file mode 100644
index f4ea1450..00000000
--- a/SConstruct.orig
+++ /dev/null
@@ -1,2058 +0,0 @@
-## SCons build recipe for the GPSD project
-
-# Important targets:
-#
-# build     - build the software (default)
-# dist      - make distribution tarball
-# install   - install programs, libraries, and manual pages
-# uninstall - undo an install
-#
-# check     - run regression and unit tests.
-# audit     - run code-auditing tools
-# testbuild - test-build the code from a tarball
-# website   - refresh the website
-# release   - ship a release
-#
-# clean     - clean all normal build targets
-# distclean - clean up to a state like a fresh repo pull
-#
-# Setting the DESTDIR environment variable will prefix the install destinations
-# without changing the --prefix prefix.
-
-# Unfinished items:
-# * Out-of-directory builds: see http://www.scons.org/wiki/UsingBuildDir
-# * Coveraging mode: gcc "-coverage" flag requires a hack for building the python bindings
-
-# Release identification begins here
-gpsd_version = "3.15~dev"
-
-# library version
-libgps_version_current   = 22
-libgps_version_revision  = 0
-libgps_version_age       = 0
-libgpsd_version_current  = 22
-libgpsd_version_revision = 0
-libgpsd_version_age      = 0
-
-# Release identification ends here
-
-# Hosting information (mainly used for templating web pages) begins here
-# Each variable foo has a corresponding @FOO@ expanded in .in files.
-# There are no project-dependent URLs or references to the hosting site
-# anywhere else in the distribution; preserve this property!
-sitename   = "Savannah"
-sitesearch = "catb.org"
-website    = "http://catb.org/gpsd" 
-mainpage   = "https://savannah.nongnu.org/projects/gpsd/"
-webupload  = "login.ibiblio.org:/public/html/catb/gpsd"
-cgiupload  = "thyrsus.com:/home/www/thyrsus.com/cgi-bin/"
-scpupload  = "dl.sv.nongnu.org:/releases/gpsd/"
-mailman    = "http://lists.nongnu.org/mailman/listinfo/"
-admin      = "https://savannah.nongnu.org/project/admin/?group=gpsd"
-download   = "http://download-mirror.savannah.gnu.org/releases/gpsd/"
-bugtracker = "https://savannah.nongnu.org/bugs/?group=gpsd"
-browserepo = "http://git.savannah.gnu.org/cgit/gpsd.git"
-clonerepo  = "https://savannah.nongnu.org/git/?group=gpsd"
-gitrepo    = "git://git.savannah.nongnu.org/gpsd.git"
-webform    = "http://www.thyrsus.com/cgi-bin/gps_report.cgi"
-formserver = "www@thyrsus.com"
-devmail    = "gpsd-dev@lists.nongnu.org"
-usermail   = "gpsd-users@lists.nongnu.org"
-annmail    = "gpsd-announce@nongnu.org"
-ircchan    = "irc://chat.freenode.net/#gpsd"
-tiplink    = "<a href='http://gratipay.com/esr'>leave a tip at Gratipay</a>"
-tipwidget  = "<script data-gratipay-username='esr' \
-	data-gratipay-widget='button' src='//gttp.co/v1.js'></script>"
-# Hosting information ends here
-
-EnsureSConsVersion(2,0,1)
-
-import copy, os, sys, glob, re, platform, time
-from distutils import sysconfig
-from distutils.util import get_platform
-import SCons
-
-# replacement for functions from the commands module, which is deprecated.
-from subprocess import PIPE, STDOUT, Popen
-def _getstatusoutput(cmd, input=None, cwd=None, env=None):
-    pipe = Popen(cmd, shell=True, cwd=cwd, env=env, stdout=PIPE, stderr=STDOUT)
-    (output, errout) = pipe.communicate(input=input)
-    status = pipe.returncode
-    return (status, output)
-def _getoutput(cmd, input=None, cwd=None, env=None):
-    return _getstatusoutput(cmd, input, cwd, env)[1]
-
-
-#
-# Build-control options
-#
-
-# Start by reading configuration variables from the cache
-opts = Variables('.scons-option-cache')
-
-systemd_dir = '/lib/systemd/system'
-systemd = os.path.exists(systemd_dir)
-
-# Set distribution-specific defaults here
-imloads = True
-
-boolopts = (
-    # GPS protocols
-    ("nmea0183",      True,  "NMEA0183 support"),
-    ("ashtech",       True,  "Ashtech support"),
-    ("earthmate",     True,  "DeLorme EarthMate Zodiac support"),
-    ("evermore",      True,  "EverMore binary support"),
-    ("fv18",          True,  "San Jose Navigation FV-18 support"),
-    ("garmin",        True,  "Garmin kernel driver support"),
-    ("garmintxt",     True,  "Garmin Simple Text support"),
-    ("geostar",       True,  "Geostar Protocol support"),
-    ("itrax",         True,  "iTrax hardware support"),
-    ("mtk3301",       True,  "MTK-3301 support"),
-    ("navcom",        True,  "Navcom NCT support"),
-    ("oncore",        True,  "Motorola OnCore chipset support"),
-    ("sirf",          True,  "SiRF chipset support"),
-    ("superstar2",    True,  "Novatel SuperStarII chipset support"),
-    ("tnt",           True,  "True North Technologies support"),
-    ("tripmate",      True,  "DeLorme TripMate support"),
-    ("tsip",          True,  "Trimble TSIP support"),
-    ("ublox",         True,  "u-blox Protocol support"),
-    ("fury",          True,  "Jackson Labs Fury and Firefly support"),
-    ("nmea2000",      True,  "NMEA2000/CAN support"),
-    # Non-GPS protocols
-    ("aivdm",         True,  "AIVDM support"),
-    ("gpsclock",      True,  "GPSClock support"),
-    ("ntrip",         True,  "NTRIP support"),
-    ("oceanserver",   True,  "OceanServer support"),
-    ("rtcm104v2",     True,  "rtcm104v2 support"),
-    ("rtcm104v3",     True,  "rtcm104v3 support"),
-    ("passthrough",   True,  "build support for passing through JSON"),
-    # Time service
-    ("ntp",           True,  "NTP time hinting support"),
-    ("ntpshm",        True,  "NTP time hinting via shared memory"),
-    ("pps",           True,  "PPS time syncing support"),
-    # Export methods
-    ("socket_export", True,  "data export over sockets"),
-    ("dbus_export",   True,  "enable DBUS export support"),
-    ("shm_export",    True,  "export via shared memory"),
-    # Communication
-    ('usb',           True,  "libusb support for USB devices"),
-    ("bluez",         True,  "BlueZ support for Bluetooth devices"),
-    ("ipv6",          True,  "build IPv6 support"),
-    ("netfeed",       True,  "build support for handling TCP/IP data sources"),
-    # Other daemon options
-    ("force_global",  False, "force daemon to listen on all addressses"),
-    ("timing",        False, "latency timing support"),
-    ("control_socket",True,  "control socket for hotplug notifications"),
-    ("systemd",       systemd, "systemd socket activation"),
-    # Client-side options
-    ("clientdebug",   True,  "client debugging support"),
-    ("ncurses",       True,  "build with ncurses"),
-    ("libgpsmm",      True,  "build C++ bindings"),
-    ("qt",            True,  "build QT bindings"),
-    # Daemon options
-    ("reconfigure",   True,  "allow gpsd to change device settings"),
-    ("controlsend",   True,  "allow gpsctl/gpsmon to change device settings"),
-    ("nofloats",      False, "float ops are expensive, suppress error estimates"),
-    ("squelch",       False, "squelch gpsd_log/gpsd_hexdump to save cpu"),
-    # Build control
-    ("shared",        True,  "build shared libraries, not static"),
-    ("implicit_link", imloads,"implicit linkage is supported in shared libs"),
-    ("python",        True,  "build Python support and modules."),
-    ("debug",         False, "include debug information in build"),
-    ("profiling",     False, "build with profiling enabled"),
-    ("coveraging",    False, "build with code coveraging enabled"),
-    ("nostrip",       False, "don't symbol-strip binaries at link time"),
-    ("chrpath",       False, "use chrpath to edit library load paths"),
-    ("manbuild",      True,  "build help in man and HTML formats"),
-    ("leapfetch",     True,  "fetch up-to-date data on leap seconds."),
-    ("minimal",       False, "turn off every option not set on the command line"), 
-    # Test control
-    ("slow",          False, "run tests with realistic (slow) delays"),
-    )
-for (name, default, help) in boolopts:
-    opts.Add(BoolVariable(name, help, default))
-
-# Gentoo, Fedora, opensuse systems use uucp for ttyS* and ttyUSB*
-if os.path.exists("/etc/gentoo-release"):
-   def_group = "uucp"
-else:
-   def_group = "dialout"
-
-nonboolopts = (
-    ("gpsd_user",           "nobody",      "privilege revocation user",),
-    ("gpsd_group",          def_group,     "privilege revocation group"),
-    ("prefix",              "/usr/local",  "installation directory prefix"),
-    ("python_libdir",       sysconfig.get_python_lib(plat_specific=1),
-                                           "Python module directory prefix"),
-    ("max_clients",         '64',          "maximum allowed clients"),
-    ("max_devices",         '4',           "maximum allowed devices"),
-    ("fixed_port_speed",    0,             "fixed serial port speed"),
-    ("fixed_stop_bits",     0,             "fixed serial port stop bits"),
-    ("target",              "",            "cross-development target"),
-    ("sysroot",             "",            "cross-development system root"),
-    )
-for (name, default, help) in nonboolopts:
-    opts.Add(name, help, default)
-
-pathopts = (
-    ("sysconfdir",          "etc",           "system configuration directory"),
-    ("bindir",              "bin",           "application binaries directory"),
-    ("includedir",          "include",       "header file directory"),
-    ("libdir",              "lib",           "system libraries"),
-    ("sbindir",             "sbin",          "system binaries directory"),
-    ("mandir",              "share/man",     "manual pages directory"),
-    ("docdir",              "share/doc",     "documents directory"),
-    ("udevdir",             "/lib/udev",     "udev rules directory"),
-    ("pkgconfig",           "$libdir/pkgconfig", "pkgconfig file directory"),
-    )
-for (name, default, help) in pathopts:
-    opts.Add(PathVariable(name, help, default, PathVariable.PathAccept))
-
-#
-# Environment creation
-#
-import_env = (
-    "MACOSX_DEPLOYMENT_TARGET", # Required by MacOSX 10.4 (and probably earlier)
-    "DISPLAY",         # Required for dia to run under scons
-    "GROUPS",          # Required by gpg
-    "HOME",            # Required by gpg
-    "LOGNAME",         # LOGNAME is required for the flocktest production.
-    'PATH',            # Required for ccache and Coverity scan-build
-    'PKG_CONFIG_PATH', # Set .pc file directory in a crossbuild
-    'PKG_CONFIG_SYSROOT_DIR', # Pass more environment variables to pkg-config (required for crossbuilds)
-    'PKG_CONFIG_LIBDIR',      # Pass more environment variables to pkg-config (required for crossbuilds)
-    'STAGING_DIR',     # Required by the OpenWRT and CeroWrt builds.
-    'STAGING_PREFIX',  # Required by the OpenWRT and CeroWrt builds.
-    'WRITE_PAD',       # So we can test WRITE_PAD values on the fly.
-    )
-envs = {}
-for var in import_env:
-    if var in os.environ:
-        envs[var] = os.environ[var]
-envs["GPSD_HOME"] = os.getcwd()
-envs["LD_LIBRARY_PATH"] = os.getcwd()
-
-env = Environment(tools=["default", "tar", "textfile"], options=opts, ENV=envs)
-opts.Save('.scons-option-cache', env)
-env.SConsignFile(".sconsign.dblite")
-
-#  Minimal build turns off every option not set on the command line,
-if env['minimal']:
-    for (name, default, help) in boolopts:
-        if default == True and not ARGUMENTS.get(name):
-            env[name] = False
-
-# NTPSHM requires NTP
-if env['ntpshm']:
-    env['ntp'] = True
-
-for (name, default, help) in pathopts:
-    env[name] = env.subst(env[name])
-
-env['VERSION'] = gpsd_version
-env['PYTHON'] = sys.executable
-
-# Set defaults from environment.  Note that scons doesn't cope well
-# with multi-word CPPFLAGS/LDFLAGS/SHLINKFLAGS values; you'll have to
-# explicitly quote them or (better yet) use the "=" form of GNU option
-# settings.
-env['STRIP'] = "strip"
-env['PKG_CONFIG'] = "pkg-config"
-env['CHRPATH'] = 'chrpath'
-for i in ["AR", "ARFLAGS", "CCFLAGS", "CFLAGS", "CC", "CXX", "CXXFLAGS", "LINKFLAGS", "STRIP", "PKG_CONFIG", "CHRPATH", "LD", "TAR"]:
-    if os.environ.has_key(i):
-        j = i
-        if i == "LD":
-            i = "SHLINK"
-        if i in ("CFLAGS", "CCFLAGS", "LINKFLAGS"):
-            env.Replace(**{j: Split(os.getenv(i))})
-        else:
-            env.Replace(**{j: os.getenv(i)})
-for flag in ["LDFLAGS", "SHLINKFLAGS", "CPPFLAGS"]:
-    if os.environ.has_key(flag):
-        env.MergeFlags({flag : [os.getenv(flag)]})
-
-
-# Keep scan-build options in the environment
-for key, value in os.environ.iteritems():
-    if key.startswith('CCC_'):
-        env.Append(ENV={key:value})
-
-# Placeholder so we can kluge together something like VPATH builds.
-# $SRCDIR replaces occurrences for $(srcdir) in the autotools build.
-env['SRCDIR'] = '.'
-
-# We may need to force slow regression tests to get around race
-# conditions in the pty layer, especially on a loaded machine.
-if env["slow"]:
-    env['REGRESSOPTS'] = "-S"
-else:
-    env['REGRESSOPTS'] = ""
-
-def announce(msg):
-    if not env.GetOption("silent"):
-        print msg
-
-# DESTDIR environment variable means user wants to prefix the installation root.
-DESTDIR = os.environ.get('DESTDIR', '')
-
-def installdir(dir, add_destdir=True):
-    # use os.path.join to handle absolute paths properly.
-    wrapped = os.path.join(env['prefix'], env[dir])
-    if add_destdir:
-        wrapped = os.path.normpath(DESTDIR + os.path.sep + wrapped)
-    wrapped.replace("/usr/etc", "/etc")
-    wrapped.replace("/usr/lib/systemd", "/lib/systemd")
-    return wrapped
-
-# Honor the specified installation prefix in link paths.
-if env["sysroot"]:
-    env.Prepend(LIBPATH=[env["sysroot"] + installdir('libdir', add_destdir=False)])
-
-# Don't hack RPATH unless libdir points somewhere that is not on the
-# minimum default load path.
-if env["shared"]:
-    if env["libdir"] not in ["/usr/lib", "/lib"]:
-        env.Prepend(RPATH=[installdir('libdir')])
-
-# Give deheader a way to set compiler flags
-if 'MORECFLAGS' in os.environ:
-    env.Append(CFLAGS=Split(os.environ['MORECFLAGS']))
-
-# Don't change CFLAGS if already set by environment.
-if not 'CFLAGS' in os.environ:
-    if '-Wmissing-prototypes' not in env['CFLAGS']:
-        env.Append(CFLAGS=['-Wmissing-prototypes'])
-
-# Don't change CCFLAGS if already set by environment.
-if not 'CCFLAGS' in os.environ:
-    env.Append(CCFLAGS=['-Wmissing-declarations'])
-    # Should we build with profiling?
-    if env['profiling']:
-        env.Append(CCFLAGS=['-pg'])
-        env.Append(LDFLAGS=['-pg'])
-    # Should we build with coveraging?
-    if env['coveraging']:
-        env.Append(CFLAGS=['-coverage'])
-        env.Append(LDFLAGS=['-coverage'])
-        env.Append(LINKFLAGS=['-coverage'])
-    # Should we build with debug symbols?
-    if env['debug']:
-        env.Append(CCFLAGS=['-g'])
-    # Should we build with optimisation?
-    if env['debug'] or env['coveraging']:
-        env.Append(CCFLAGS=['-O0'])
-    else:
-        env.Append(CCFLAGS=['-O2'])
-
-# Get a slight speedup by not doing automatic RCS and SCCS fetches.
-env.SourceCode('.', None)
-
-## Cross-development
-
-devenv = (("ADDR2LINE", "addr2line"),
-          ("AR","ar"),
-          ("AS","as"),
-          ("CHRPATH", "chrpath"),
-          ("CXX","c++"),
-          ("CXXFILT","c++filt"),
-          ("CPP","cpp"),
-          ("GXX","g++"),
-          ("CC","gcc"),
-          ("GCCBUG","gccbug"),
-          ("GCOV","gcov"),
-          ("GPROF","gprof"),
-          ("LD", "ld"),
-          ("NM", "nm"),
-          ("OBJCOPY","objcopy"),
-          ("OBJDUMP","objdump"),
-          ("RANLIB", "ranlib"),
-          ("READELF","readelf"),
-          ("SIZE", "size"),
-          ("STRINGS", "strings"),
-          ("STRIP", "strip"))
-
-if env['target']:
-    for (name, toolname) in devenv:
-        env[name] = env['target'] + '-' + toolname
-
-if env['sysroot']:
-    env.MergeFlags({"CFLAGS": ["--sysroot=%s" % env['sysroot']]})
-    env.MergeFlags({"LINKFLAGS": ["--sysroot=%s" % env['sysroot']]})
-
-## Build help
-
-Help("""Arguments may be a mixture of switches and targets in any order.
-Switches apply to the entire build regardless of where they are in the order.
-Important switches include:
-
-    prefix=/usr     probably what you want for production tools
-
-Options are cached in a file named .scons-option-cache and persist to later
-invocations.  The file is editable.  Delete it to start fresh.  Current option
-values can be listed with 'scons -h'.
-
-""" + opts.GenerateHelpText(env, sort=cmp))
-
-## Configuration
-
-def CheckPKG(context, name):
-    context.Message( 'Checking for %s... ' % name )
-    ret = context.TryAction('%s --exists \'%s\'' % (env['PKG_CONFIG'], name))[0]
-    context.Result( ret )
-    return ret
-
-# Stylesheet URLs for making HTML and man pages from DocBook XML.
-docbook_url_stem = 'http://docbook.sourceforge.net/release/xsl/current/'
-docbook_man_uri = docbook_url_stem + 'manpages/docbook.xsl'
-docbook_html_uri = docbook_url_stem + 'html/docbook.xsl'
-
-def CheckXsltproc(context):
-    context.Message('Checking that xsltproc can make man pages... ')
-    ofp = open("xmltest.xml", "w")
-    ofp.write('''
-       <refentry id="foo.1">
-      <refmeta>
-        <refentrytitle>foo</refentrytitle>
-        <manvolnum>1</manvolnum>
-        <refmiscinfo class='date'>9 Aug 2004</refmiscinfo>
-      </refmeta>
-      <refnamediv id='name'>
-        <refname>foo</refname>
-        <refpurpose>check man page generation from docbook source</refpurpose>
-      </refnamediv>
-    </refentry>
-''')
-    ofp.close()
-    probe = "xsltproc --nonet --noout '%s' xmltest.xml" % (docbook_man_uri,)
-    ret = context.TryAction(probe)[0]
-    os.remove("xmltest.xml")
-    if os.path.exists("foo.1"):
-        os.remove("foo.1")
-    context.Result( ret )
-    return ret
-
-def CheckCompilerOption(context, option):
-    context.Message( 'Checking if compiler accepts %s ...' % (option,) )
-    old_CFLAGS=context.env['CFLAGS']
-    context.env.Append(CFLAGS=option)
-    ret = context.TryLink("""
-        int main(int argc, char **argv) {
-            return 0;
-        }
-    """,'.c')
-    if not ret:
-        context.env.Replace(CFLAGS=old_CFLAGS)
-    context.Result(ret)
-    return ret
-
-def CheckHeaderDefines(context, file, define):
-    context.Message( 'Checking if %s supplies %s ...' % (file,define) )
-    ret = context.TryLink("""
-        #include <%s>
-        #ifndef %s
-        #error %s is not defined
-        #endif
-        int main(int argc, char **argv) {
-            return 0;
-        }
-    """ % (file, define, define),'.c')
-    context.Result(ret)
-    return ret
-
-def CheckCompilerDefines(context, define):
-    context.Message( 'Checking if compiler supplies %s ...' % (define,) )
-    ret = context.TryLink("""
-        #ifndef %s
-        #error %s is not defined
-        #endif
-        int main(int argc, char **argv) {
-            return 0;
-        }
-    """ % (define, define),'.c')
-    context.Result(ret)
-    return ret
-
-# Check if this compiler is C11 or better
-def CheckC11(context):
-    context.Message( 'Checking if compiler is C11 ...' )
-    ret = context.TryLink("""
-	#if (__STDC_VERSION__ < 201112L) 
-        #error Not C11
-        #endif
-        int main(int argc, char **argv) {
-            return 0;
-        }
-    """,'.c')
-    context.Result(ret)
-    return ret
-
-def GetLoadPath(context):
-    context.Message("Getting system load path ...")
-
-if env.GetOption("clean") or env.GetOption("help"):
-    dbus_libs = []
-    rtlibs = []
-    usblibs = []
-    bluezlibs = []
-    ncurseslibs = []
-    confdefs = []
-    manbuilder = False
-    htmlbuilder = False
-    qt_env = None
-else:
-    config = Configure(env, custom_tests = { 'CheckPKG' : CheckPKG,
-                                             'CheckXsltproc' : CheckXsltproc,
-                                             'CheckCompilerOption' : CheckCompilerOption,
-                                             'CheckCompilerDefines' : CheckCompilerDefines,
-                                             'CheckC11' : CheckC11,
-                                             'CheckHeaderDefines' : CheckHeaderDefines})
-
-
-    # If supported by the compiler, enable all warnings except uninitialized and
-    # missing-field-initializers, which we can't help triggering because
-    # of the way some of the JSON-parsing code is generated.
-    # Also not including -Wcast-qual and -Wimplicit-function-declaration,
-    # because we can't seem to keep scons from passing it to g++.
-    for option in ('-Wextra','-Wall', '-Wno-uninitialized','-Wno-missing-field-initializers',
-                   '-Wcast-align','-Wmissing-declarations', '-Wmissing-prototypes',
-                   '-Wstrict-prototypes', '-Wpointer-arith', '-Wreturn-type'):
-        if option not in config.env['CFLAGS']:
-            config.CheckCompilerOption(option)
-
-    # OS X aliases gcc to clang
-    # clang accepts -pthread, then warns it is unused.
-    if config.CheckCompilerOption("-pthread") and not sys.platform.startswith('darwin'):
-        env.MergeFlags("-pthread")
-
-    env.Prepend(LIBPATH=[os.path.realpath(os.curdir)])
-    if env["shared"] and env["chrpath"]:
-        if WhereIs('chrpath'):
-            # Tell generated binaries to look in the current directory
-            # for shared libraries so we can run ad-hoc tests without
-            # hassle (the regression tests *don't* need this as
-            # they're run in a controlled environment where we can set
-            # LD_LIBRARY_PATH). Should be handled sanely by scons on
-            # all systems.  Not good to use '.' or a relative path
-            # here; it's a security risk.  At install time we use
-            # chrpath to edit this out of RPATH.
-            env.Prepend(RPATH=[os.path.realpath(os.curdir)])
-        else:
-            print "chrpath is not available; please build with chrpath=no."
-
-    confdefs = ["/* gpsd_config.h.  Generated by scons, do not hand-hack.  */\n"]
-
-    confdefs.append('#ifndef GPSD_CONFIG_H\n')
-
-    confdefs.append('#define VERSION "%s"\n' % gpsd_version)
-
-    confdefs.append('#define GPSD_URL "%s"\n' % website)
-
-    cxx = config.CheckCXX()
-    if not cxx and env["libgpsmm"]:
-        announce("C++ doesn't work, suppressing libgpsmm build.")
-        env["libgpsmm"] = False
-
-    # define a helper function for pkg-config - we need to pass
-    # --static for static linking, too.
-    if env["shared"]:
-        pkg_config = lambda pkg: ['!%s --cflags --libs %s' %(env['PKG_CONFIG'], pkg, )]
-    else:
-        pkg_config = lambda pkg: ['!%s --cflags --libs --static %s' %(env['PKG_CONFIG'], pkg, )]
-
-    # The actual distinction here is whether the platform has ncurses in the
-    # base system or not. If it does, pkg-config is not likely to tell us
-    # anything useful. FreeBSD does, Linux doesn't. Most likely other BSDs
-    # are like FreeBSD.
-    ncurseslibs= []
-    if env['ncurses']:
-        if config.CheckPKG('ncurses'):
-            ncurseslibs = pkg_config('ncurses')
-        elif WhereIs('ncurses5-config'):
-            ncurseslibs = ['!ncurses5-config --libs --cflags']
-        elif WhereIs('ncursesw5-config'):
-            ncurseslibs = ['!ncursesw5-config --libs --cflags']
-        elif sys.platform.startswith('freebsd'):
-            ncurseslibs= [ '-lncurses' ]
-        elif sys.platform.startswith('openbsd'):
-            ncurseslibs= [ '-lcurses' ]
-        elif sys.platform.startswith('darwin'):
-            ncurseslibs= [ '-lcurses' ]
-
-    if env['usb']:
-        # In FreeBSD except version 7, USB libraries are in the base system
-        if config.CheckPKG('libusb-1.0'):
-            confdefs.append("#define HAVE_LIBUSB 1\n")
-            try:
-                usblibs = pkg_config('libusb-1.0')
-            except OSError:
-                announce("pkg_config is confused about the state of libusb-1.0.")
-                usblibs = []
-        elif sys.platform.startswith("freebsd"):
-            confdefs.append("#define HAVE_LIBUSB 1\n")
-            usblibs = [ "-lusb"]
-        else:
-            confdefs.append("/* #undef HAVE_LIBUSB */\n")
-            usblibs = []
-    else:
-        confdefs.append("/* #undef HAVE_LIBUSB */\n")
-        usblibs = []
-        env["usb"] = False
-
-    if config.CheckLib('librt'):
-        confdefs.append("#define HAVE_LIBRT 1\n")
-        # System library - no special flags
-        rtlibs = ["-lrt"]
-    else:
-        confdefs.append("/* #undef HAVE_LIBRT */\n")
-        rtlibs = []
-
-    if env['dbus_export'] and config.CheckPKG('dbus-1'):
-        confdefs.append("#define HAVE_DBUS 1\n")
-        dbus_libs = ["-ldbus-1"]
-        env.MergeFlags(pkg_config("dbus-1"))
-    else:
-        confdefs.append("/* #undef HAVE_DBUS */\n")
-        dbus_libs = []
-        if env["dbus_export"]:
-            announce("Turning off dbus-export support, library not found.")
-        env["dbus_export"] = False
-
-    if env['bluez'] and config.CheckPKG('bluez'):
-        confdefs.append("#define ENABLE_BLUEZ 1\n")
-        bluezlibs = pkg_config('bluez')
-    else:
-        confdefs.append("/* #undef ENABLE_BLUEZ */\n")
-        bluezlibs = []
-        if env["bluez"]:
-            announce("Turning off Bluetooth support, library not found.")
-        env["bluez"] = False
-
-    #in_port_t is not defined on Android
-    if not config.CheckType("in_port_t","#include <netinet/in.h>"):
-        announce("Did not find in_port_t typedef, assuming unsigned short int")
-        confdefs.append("typedef unsigned short int in_port_t;\n")
-
-    #SUN_LEN is not defined on Android
-    if not config.CheckDeclaration("SUN_LEN", "#include <sys/un.h>") and not config.CheckDeclaration("SUN_LEN", "#include <linux/un.h>"):
-        announce("SUN_LEN is not system-defined, using local definition")
-        confdefs.append("#ifndef SUN_LEN\n")
-        confdefs.append("#define SUN_LEN(ptr) ((size_t) (((struct sockaddr_un *) 0)->sun_path) + strlen((ptr)->sun_path))\n")
-        confdefs.append("#endif /* SUN_LEN */\n")
-
-    if config.CheckHeader(["bits/sockaddr.h", "linux/can.h"]):
-        confdefs.append("#define HAVE_LINUX_CAN_H 1\n")
-        announce("You have kernel CANbus available.")
-    else:
-        confdefs.append("/* #undef HAVE_LINUX_CAN_H */\n")
-        announce("You do not have kernel CANbus available.")
-        env["nmea2000"] = False
-
-    # check for C11 or better, and __STDC__NO_ATOMICS__ is no defined
-    # before looking for stdatomic.h
-    if config.CheckC11() and  not config.CheckCompilerDefines("__STDC_NO_ATOMICS__") and config.CheckHeader("stdatomic.h"):
-        confdefs.append("#define HAVE_STDATOMIC_H 1\n")
-    else:
-	confdefs.append("/* #undef HAVE_STDATOMIC_H */\n")
-	if config.CheckHeader("libkern/OSAtomic.h"):
-	    confdefs.append("#define HAVE_OSATOMIC_H 1\n")
-        else:
-	    confdefs.append("/* #undef HAVE_OSATOMIC_H */\n")
-	    announce("No memory barriers - SHM export and time hinting may not be reliable.")
-
-    # endian.h is required for rtcm104v2 unless the compiler defines
-    # __ORDER_BIG_ENDIAN__, __ORDER_LITTLE_ENDIAN__ and __BYTE_ORDER__
-    if config.CheckCompilerDefines("__ORDER_BIG_ENDIAN__") \
-    and config.CheckCompilerDefines("__ORDER_LITTLE_ENDIAN__") \
-    and config.CheckCompilerDefines("__BYTE_ORDER__"):
-        confdefs.append("#define HAVE_BUILTIN_ENDIANNESS 1\n")
-        confdefs.append("/* #undef HAVE_ENDIAN_H */\n")
-        confdefs.append("/* #undef HAVE_SYS_ENDIAN_H */\n")
-        announce("Your compiler has built-in endianness support.")
-    else:
-        confdefs.append("/* #undef HAVE_BUILTIN_ENDIANNESS\n */")
-        if config.CheckHeader("endian.h"):
-            confdefs.append("#define HAVE_ENDIAN_H 1\n")
-            confdefs.append("/* #undef HAVE_SYS_ENDIAN_H */\n")
-            confdefs.append("/* #undef HAVE_MACHINE_ENDIAN_H */\n")
-        elif config.CheckHeader("sys/endian.h"):
-            confdefs.append("/* #undef HAVE_ENDIAN_H */\n")
-            confdefs.append("#define HAVE_SYS_ENDIAN_H 1\n")
-            confdefs.append("/* #undef HAVE_MACHINE_ENDIAN_H */\n")
-        elif config.CheckHeader("machine/endian.h"):
-            confdefs.append("/* #undef HAVE_ENDIAN_H */\n")
-            confdefs.append("/* #undef HAVE_SYS_ENDIAN_H */\n")
-            confdefs.append("#define HAVE_MACHINE_ENDIAN_H 1\n")
-        else:
-            confdefs.append("/* #undef HAVE_ENDIAN_H */\n")
-            confdefs.append("/* #undef HAVE_SYS_ENDIAN_H */\n")
-            confdefs.append("/* #undef HAVE_MACHINE_ENDIAN_H */\n")
-            announce("You do not have the endian.h header file. RTCM V2 support disabled.")
-            env["rtcm104v2"] = False
-
-    # check function after libraries, because some function require library
-    # for example clock_gettime() require librt on Linux
-    for f in ("daemon", "strlcpy", "strlcat", "clock_gettime"):
-        if config.CheckFunc(f):
-            confdefs.append("#define HAVE_%s 1\n" % f.upper())
-        else:
-            confdefs.append("/* #undef HAVE_%s */\n" % f.upper())
-
-    # Map options to libraries required to support them that might be absent.
-    optionrequires = {
-        "bluez": ["libbluetooth"],
-        "dbus_export" : ["libdbus-1"],
-        }
-
-    keys = map(lambda x: (x[0],x[2]), boolopts) + map(lambda x: (x[0],x[2]), nonboolopts) + map(lambda x: (x[0],x[2]), pathopts)
-    keys.sort()
-    for (key,help) in keys:
-        value = env[key]
-        if value and key in optionrequires:
-            for required in optionrequires[key]:
-                if not config.CheckLib(required):
-                    announce("%s not found, %s cannot be enabled." % (required,key))
-                    value = False
-                    break
-
-        confdefs.append("/* %s */" % help)
-        if type(value) == type(True):
-            if value:
-                confdefs.append("#define %s_ENABLE 1\n" % key.upper())
-            else:
-                confdefs.append("/* #undef %s_ENABLE */\n" % key.upper())
-        elif value in (0, "", "(undefined)"):
-            confdefs.append("/* #undef %s */\n" % key.upper())
-        else:
-            if value.isdigit():
-                confdefs.append("#define %s %s\n" % (key.upper(), value))
-            else:
-                confdefs.append("#define %s \"%s\"\n" % (key.upper(), value))
-
-    if config.CheckHeader(["sys/types.h", "sys/time.h", "sys/timepps.h"]):
-        confdefs.append("#define HAVE_SYS_TIMEPPS_H 1\n")
-        kpps = True
-    else:
-        confdefs.append("/* #undef HAVE_SYS_TIMEPPS_H */\n")
-        kpps = False
-    tiocmiwait = config.CheckHeaderDefines("sys/ioctl.h", "TIOCMIWAIT")
-    if env["pps"] and not tiocmiwait and not kpps:
-        announce("Forcing pps=no (neither TIOCMIWAIT nor RFC2783 API is available)")
-        env["pps"] = False
-
-    confdefs.append('''\
-/* Some libcs do not have strlcat/strlcpy. Local copies are provided */
-#ifndef HAVE_STRLCAT
-# ifdef __cplusplus
-extern "C" {
-# endif
-#include <string.h>
-size_t strlcat(/*@out@*/char *dst, /*@in@*/const char *src, size_t size);
-# ifdef __cplusplus
-}
-# endif
-#endif
-#ifndef HAVE_STRLCPY
-# ifdef __cplusplus
-extern "C" {
-# endif
-#include <string.h>
-size_t strlcpy(/*@out@*/char *dst, /*@in@*/const char *src, size_t size);
-# ifdef __cplusplus
-}
-# endif
-#endif
-#ifndef HAVE_CLOCK_GETTIME
-# ifdef __cplusplus
-extern "C" {
-# endif
-#ifndef clockid_t
-typedef int clockid_t;
-# endif
-/* OS X uses _STRUCT_TIMESPEC, but no clock_gettime */
-#ifndef _STRUCT_TIMESPEC
-struct timespec {
-    time_t  tv_sec;
-    long    tv_nsec;
-};
-#endif
-#define CLOCK_REALTIME	0
-int clock_gettime(clockid_t, struct timespec *);
-# ifdef __cplusplus
-}
-# endif
-#endif
-
-#define GPSD_CONFIG_H
-#endif /* GPSD_CONFIG_H */
-''')
-
-
-    manbuilder = mangenerator = htmlbuilder = None
-    if env['manbuild']:
-        if config.CheckXsltproc():
-            mangenerator = 'xsltproc'
-            build = "xsltproc --nonet %s $SOURCE >$TARGET"
-            htmlbuilder = build % docbook_html_uri
-            manbuilder = build % docbook_man_uri
-        elif WhereIs("xmlto"):
-            mangenerator = 'xmlto'
-            xmlto = "xmlto %s $SOURCE || mv `basename $TARGET` `dirname $TARGET`"
-            htmlbuilder = xmlto % "html-nochunks"
-            manbuilder = xmlto % "man"
-        else:
-            announce("Neither xsltproc nor xmlto found, documentation cannot be built.")
-    else:
-        announce("Build of man and HTML documentation is disabled.")
-    if manbuilder:
-        env['BUILDERS']["Man"] = Builder(action=manbuilder)
-        env['BUILDERS']["HTML"] = Builder(action=htmlbuilder,
-                                          src_suffix=".xml", suffix=".html")
-
-    # Determine if Qt network libraries are present, and if not, force qt to off
-    qt_network = config.CheckPKG('QtNetwork')
-    if not qt_network:
-        env["qt"] = False
-
-    env = config.Finish()
-
-    # Be explicit about what we're doing.
-    changelatch = False 
-    for (name, default, help) in boolopts + nonboolopts + pathopts:
-        if env[name] != env.subst(default):
-            if not changelatch:
-                announce("Altered configuration variables:")
-                changelatch = True
-            announce("%s = %s (default %s): %s" % (name, env[name], env.subst(default), help))
-    if not changelatch:
-        announce("All configuration flags are defaulted.")
-
-    # Gentoo systems can have a problem with the Python path
-    if os.path.exists("/etc/gentoo-release"):
-        announce("This is a Gentoo system.")
-        announce("Adjust your PYTHONPATH to see library directories under /usr/local/lib")
-
-    # Should we build the Qt binding?
-    if env["qt"]:
-        qt_env = env.Clone()
-        qt_env.MergeFlags('-DUSE_QT')
-        try:
-            qt_env.MergeFlags(pkg_config('QtNetwork'))
-        except OSError:
-            announce("pkg_config is confused about the state of QtNetwork.")
-            qt_env = None
-    else:
-        qt_env = None
-
-## Two shared libraries provide most of the code for the C programs
-
-libgps_version_soname = libgps_version_current - libgps_version_age
-libgps_version = "%d.%d.%d" %(libgps_version_soname, libgps_version_age, libgps_version_revision)
-libgpsd_version_soname = libgpsd_version_current - libgpsd_version_age
-libgpsd_version = "%d.%d.%d" %(libgpsd_version_soname, libgpsd_version_age, libgpsd_version_revision)
-
-libgps_sources = [
-    "ais_json.c",
-    "bits.c",
-    "clock_gettime.c",
-    "daemon.c",
-    "gpsutils.c",
-    "gpsdclient.c",
-    "gps_maskdump.c",
-    "hex.c",
-    "json.c",
-    "libgps_core.c",
-    "libgps_dbus.c",
-    "libgps_json.c",
-    "libgps_shm.c",
-    "libgps_sock.c",
-    "netlib.c",
-    "ntpshmread.c",
-    "ntpshmwrite.c",
-    "rtcm2_json.c",
-    "rtcm3_json.c",
-    "shared_json.c",
-    "strl.c",
-]
-
-if env['libgpsmm']:
-    libgps_sources.append("libgpsmm.cpp")
-
-libgpsd_sources = [
-    "bsd_base64.c",
-    "crc24q.c",
-    "gpsd_json.c",
-    "geoid.c",
-    "isgps.c",
-    "libgpsd_core.c",
-    "matrix.c",
-    "net_dgpsip.c",
-    "net_gnss_dispatch.c",
-    "net_ntrip.c",
-    "ppsthread.c",
-    "packet.c",
-    "pseudonmea.c",
-    "pseudoais.c",
-    "serial.c",
-    "subframe.c",
-    "timebase.c",
-    "timespec_str.c",
-    "drivers.c",
-    "driver_ais.c",
-    "driver_evermore.c",
-    "driver_garmin.c",
-    "driver_garmin_txt.c",
-    "driver_geostar.c",
-    "driver_italk.c",
-    "driver_navcom.c",
-    "driver_nmea0183.c",
-    "driver_nmea2000.c",
-    "driver_oncore.c",
-    "driver_rtcm2.c",
-    "driver_rtcm3.c",
-    "driver_sirf.c",
-    "driver_superstar2.c",
-    "driver_tsip.c",
-    "driver_ubx.c",
-    "driver_zodiac.c",
-]
-
-# Cope with scons's failure to set SONAME in its builtins.
-# Inspired by Richard Levitte's (slightly buggy) code at
-# http://markmail.org/message/spttz3o4xrsftofr
-
-def VersionedSharedLibrary(env, libname, version, lib_objs=[], parse_flags=[]):
-    platform = env.subst('$PLATFORM')
-    shlib_pre_action = None
-    shlib_suffix = env.subst('$SHLIBSUFFIX')
-    shlib_post_action = None
-    shlink_flags = SCons.Util.CLVar(env.subst('$SHLINKFLAGS'))
-
-    if platform == 'posix':
-        ilib_suffix = shlib_suffix + '.' + version
-        (major, age, revision) = version.split(".")
-        soname = "lib" + libname + shlib_suffix + "." + major
-        shlink_flags += [ '-Wl,-Bsymbolic', '-Wl,-soname=%s' % soname ]
-    elif platform == 'cygwin':
-        ilib_suffix = shlib_suffix
-        shlink_flags += [ '-Wl,-Bsymbolic',
-                          '-Wl,--out-implib,${TARGET.base}.a' ]
-    elif platform == 'darwin':
-        ilib_suffix = '.' + version + shlib_suffix
-        shlink_flags += [ '-current_version', '%s' % version,
-                          '-compatibility_version', '%s' % version,
-                          '-undefined', 'dynamic_lookup' ]
-
-    ilib = env.SharedLibrary(libname,lib_objs,
-                            SHLIBSUFFIX=ilib_suffix,
-                            SHLINKFLAGS=shlink_flags, parse_flags=parse_flags)
-
-    if platform == 'darwin':
-        if version.count(".") != 2:
-            # We need a library name in libfoo.x.y.z.dylib form to proceed
-            raise ValueError
-        lib = 'lib' + libname + '.' + version + '.dylib'
-        lib_no_ver = 'lib' + libname + '.dylib'
-        # Link libfoo.x.y.z.dylib to libfoo.dylib
-        env.AddPostAction(ilib, 'rm -f %s; ln -s %s %s' % (
-            lib_no_ver, lib, lib_no_ver))
-        env.Clean(lib, lib_no_ver)
-    elif platform == 'posix':
-        if version.count(".") != 2:
-            # We need a library name in libfoo.so.x.y.z form to proceed
-            raise ValueError
-        lib = "lib" + libname + ".so." + version
-        suffix_re = '%s\\.[0-9\\.]*$' % re.escape(shlib_suffix)
-        # For libfoo.so.x.y.z, links libfoo.so libfoo.so.x.y libfoo.so.x
-        major_name = shlib_suffix + "." + lib.split(".")[2]
-        minor_name = major_name + "." + lib.split(".")[3]
-        for linksuffix in [shlib_suffix, major_name, minor_name]:
-            linkname = re.sub(suffix_re, linksuffix, lib)
-            env.AddPostAction(ilib, 'rm -f %s; ln -s %s %s' % (
-                linkname, lib, linkname))
-            env.Clean(lib, linkname)
-
-    return ilib
-
-def VersionedSharedLibraryInstall(env, destination, libs):
-    platform = env.subst('$PLATFORM')
-    shlib_suffix = env.subst('$SHLIBSUFFIX')
-    ilibs = env.Install(destination, libs)
-    if platform == 'posix':
-        suffix_re = '%s\\.[0-9\\.]*$' % re.escape(shlib_suffix)
-        for lib in map(str, libs):
-            if lib.count(".") != 4:
-                # We need a library name in libfoo.so.x.y.z form to proceed
-                raise ValueError
-            # For libfoo.so.x.y.z, links libfoo.so libfoo.so.x.y libfoo.so.x
-            major_name = shlib_suffix + "." + lib.split(".")[2]
-            minor_name = major_name + "." + lib.split(".")[3]
-            for linksuffix in [shlib_suffix, major_name, minor_name]:
-                linkname = re.sub(suffix_re, linksuffix, lib)
-                env.AddPostAction(ilibs, 'cd %s; rm -f %s; ln -s %s %s' % (destination, linkname, lib, linkname))
-                env.Clean(lib, linkname)
-    return ilibs
-
-if not env["shared"]:
-    def Library(env, target, sources, version, parse_flags=[]):
-        return env.StaticLibrary(target, sources, parse_flags=parse_flags)
-    LibraryInstall = lambda env, libdir, sources: env.Install(libdir, sources)
-else:
-    def Library(env, target, sources, version, parse_flags=[]):
-        return VersionedSharedLibrary(env=env,
-                                     libname=target,
-                                     version=version,
-                                     lib_objs=sources,
-                                     parse_flags=parse_flags)
-    LibraryInstall = lambda env, libdir, sources: \
-                     VersionedSharedLibraryInstall(env, libdir, sources)
-
-# Klugery to handle sonames ends
-
-compiled_gpslib = Library(env=env,
-                          target="gps",
-                          sources=libgps_sources,
-                          version=libgps_version,
-                          parse_flags=rtlibs)
-env.Clean(compiled_gpslib, "gps_maskdump.c")
-
-compiled_gpsdlib = Library(env=env,
-                           target="gpsd",
-                           sources=libgpsd_sources,
-                           version=libgpsd_version,
-                           parse_flags=usblibs + rtlibs + bluezlibs + ["-lgps"])
-
-libraries = [compiled_gpslib, compiled_gpsdlib]
-
-if qt_env:
-    qtobjects = []
-    qt_flags = qt_env['CFLAGS']
-    for c_only in ('-Wmissing-prototypes', '-Wstrict-prototypes'):
-        if c_only in qt_flags:
-            qt_flags.remove(c_only)
-    # Qt binding object files have to be renamed as they're built to avoid
-    # name clashes with the plain non-Qt object files. This prevents the
-    # infamous "Two environments with different actions were specified
-    # for the same target" error.
-    for src in libgps_sources:
-        if src not in ('ais_json.c','json.c','libgps_json.c','rtcm2_json.c','rtcm3_json.c','shared_json.c'):
-            compile_with = qt_env['CXX']
-            compile_flags = qt_flags
-        else:
-            compile_with = qt_env['CC']
-            compile_flags = qt_env['CFLAGS']
-        qtobjects.append(qt_env.SharedObject(src.split(".")[0] + '-qt', src,
-                                             CC=compile_with,
-                                             CFLAGS=compile_flags))
-    compiled_qgpsmmlib = Library(qt_env, "Qgpsmm", qtobjects, libgps_version)
-    libraries.append(compiled_qgpsmmlib)
-
-# The libraries have dependencies on system libraries
-# libdbus appears multiple times because the linker only does one pass.
-
-gpslibs = ["-lgps", "-lm"] + dbus_libs
-gpsdlibs = ["-lgpsd"] + usblibs + bluezlibs + gpslibs
-
-# Source groups
-
-gpsd_sources = ['gpsd.c','timehint.c', 'shmexport.c','dbusexport.c']
-
-if env['systemd']:
-    gpsd_sources.append("sd_socket.c")
-
-gpsmon_sources = [
-    'gpsmon.c',
-    'monitor_italk.c',
-    'monitor_nmea0183.c',
-    'monitor_oncore.c',
-    'monitor_sirf.c',
-    'monitor_superstar2.c',
-    'monitor_tnt.c',
-    'monitor_ubx.c',
-    'monitor_garmin.c',
-    ]
-
-## Production programs
-
-gpsd_env = env.Clone()
-
-gpsd = gpsd_env.Program('gpsd', gpsd_sources, parse_flags = gpsdlibs)
-env.Depends(gpsd, [compiled_gpsdlib, compiled_gpslib])
-
-gpsdecode = env.Program('gpsdecode', ['gpsdecode.c'], parse_flags=gpsdlibs)
-env.Depends(gpsdecode, [compiled_gpsdlib, compiled_gpslib])
-
-gpsctl = env.Program('gpsctl', ['gpsctl.c'], parse_flags=gpsdlibs)
-env.Depends(gpsctl, [compiled_gpsdlib, compiled_gpslib])
-
-gpsdctl = env.Program('gpsdctl', ['gpsdctl.c'], parse_flags=gpslibs)
-env.Depends(gpsdctl, compiled_gpslib)
-
-gpsmon = env.Program('gpsmon', gpsmon_sources,
-                     parse_flags=gpsdlibs + ncurseslibs + ['-lm'])
-env.Depends(gpsmon, [compiled_gpsdlib, compiled_gpslib])
-
-gpspipe = env.Program('gpspipe', ['gpspipe.c'], parse_flags=gpslibs)
-env.Depends(gpspipe, compiled_gpslib)
-
-gps2udp = env.Program('gps2udp', ['gps2udp.c'], parse_flags=gpslibs)
-env.Depends(gps2udp, compiled_gpslib)
-
-gpxlogger = env.Program('gpxlogger', ['gpxlogger.c'], parse_flags=gpslibs)
-env.Depends(gpxlogger, compiled_gpslib)
-
-lcdgps = env.Program('lcdgps', ['lcdgps.c'], parse_flags=gpslibs)
-env.Depends(lcdgps, compiled_gpslib)
-
-cgps = env.Program('cgps', ['cgps.c'], parse_flags=gpslibs + ncurseslibs)
-env.Depends(cgps, compiled_gpslib)
-
-ntpshmmon = env.Program('ntpshmmon', ['ntpshmmon.c'], parse_flags=gpslibs)
-env.Depends(ntpshmmon, compiled_gpslib)
-
-binaries = [gpsd, gpsdecode, gpsctl, gpsdctl, gpspipe, gps2udp, gpxlogger, lcdgps, ntpshmmon]
-if env["ncurses"]:
-    binaries += [cgps, gpsmon]
-
-# Test programs
-test_float = env.Program('test_float', ['test_float.c'])
-test_geoid = env.Program('test_geoid', ['test_geoid.c'], parse_flags=gpsdlibs)
-test_json = env.Program('test_json', ['test_json.c'], parse_flags=gpslibs)
-env.Depends(test_json, compiled_gpslib)
-test_mktime = env.Program('test_mktime', ['test_mktime.c'], parse_flags=gpslibs)
-env.Depends(test_mktime, compiled_gpslib)
-test_trig = env.Program('test_trig', ['test_trig.c'], parse_flags=["-lm"])
-test_packet = env.Program('test_packet', ['test_packet.c'], parse_flags=gpsdlibs)
-env.Depends(test_packet, [compiled_gpsdlib, compiled_gpslib])
-test_bits = env.Program('test_bits', ['test_bits.c'], parse_flags=gpslibs)
-env.Depends(test_bits, [compiled_gpsdlib, compiled_gpslib])
-test_matrix = env.Program('test_matrix', ['test_matrix.c'], parse_flags=gpsdlibs)
-env.Depends(test_matrix, [compiled_gpsdlib, compiled_gpslib])
-test_gpsmm = env.Program('test_gpsmm', ['test_gpsmm.cpp'], parse_flags=gpslibs)
-env.Depends(test_gpsmm, compiled_gpslib)
-test_libgps = env.Program('test_libgps', ['test_libgps.c'], parse_flags=gpslibs)
-env.Depends(test_libgps, compiled_gpslib)
-testprogs = [test_float, test_trig, test_bits, test_matrix, test_packet,
-             test_mktime, test_geoid, test_libgps]
-if env['socket_export']:
-    testprogs.append(test_json)
-if env["libgpsmm"]:
-    testprogs.append(test_gpsmm)
-
-# Python programs
-if not env['python']:
-    python_built_extensions = []
-    python_targets = []
-    python_progs = []
-else:
-    python_progs = ["gpscat", "gpsfake", "gpsprof", "xgps", "xgpsspeed", "gegps"]
-    python_modules = Glob('gps/*.py') 
-
-    # Build Python binding
-    #
-    python_extensions = {
-        "gps" + os.sep + "packet" : ["gpspacket.c", "packet.c", "isgps.c",
-                                        "driver_rtcm2.c", "strl.c", "hex.c", "crc24q.c"],
-        "gps" + os.sep + "clienthelpers" : ["gpsclient.c", "geoid.c", "gpsdclient.c", "strl.c"]
-    }
-
-    python_env = env.Clone()
-    vars = sysconfig.get_config_vars('CC', 'CXX', 'OPT', 'BASECFLAGS', 'CCSHARED', 'LDSHARED', 'SO', 'INCLUDEPY', 'LDFLAGS')
-    for i in range(len(vars)):
-        if vars[i] is None:
-            vars[i] = []
-    (cc, cxx, opt, basecflags, ccshared, ldshared, so_ext, includepy, ldflags) = vars
-    # FIXME: build of python wrappers doesn't pickup flags set for coveraging, manually add them here
-    if env['coveraging']:
-        basecflags += ' -coverage'
-        ldflags += ' -coverage'
-        ldshared += ' -coverage'
-    # in case CC/CXX was set to the scan-build wrapper,
-    # ensure that we build the python modules with scan-build, too
-    if env['CC'] is None or env['CC'].find('scan-build') < 0:
-        python_env['CC'] = cc
-    else:
-        python_env['CC'] = ' '.join([env['CC']] + cc.split()[1:])
-    if env['CXX'] is None or env['CXX'].find('scan-build') < 0:
-        python_env['CXX'] = cxx
-    else:
-        python_env['CXX'] = ' '.join([env['CXX']] + cxx.split()[1:])
-
-    ldshared=ldshared.replace('-fPIE', '')
-    ldshared=ldshared.replace('-pie', '')
-    python_env.Replace(SHLINKFLAGS=[],
-                       LDFLAGS=ldflags,
-                       LINK = ldshared,
-                       SHLIBPREFIX="",
-                       SHLIBSUFFIX=so_ext,
-                       CPPPATH=[includepy],
-                       CPPFLAGS=opt,
-                       CFLAGS=basecflags,
-                       CXXFLAGS=basecflags)
-
-    python_objects={}
-    python_compiled_libs = {}
-    for ext, sources in python_extensions.iteritems():
-        python_objects[ext] = []
-        for src in sources:
-            python_objects[ext].append(
-                python_env.NoCache(
-                    python_env.SharedObject(
-                        src.split(".")[0] + '-py_' + '_'.join(['%s' %(x) for x in sys.version_info]) + so_ext, src
-                    )
-                )
-            )
-        python_compiled_libs[ext] = python_env.SharedLibrary(ext, python_objects[ext])
-    python_egg_info_source = """Metadata-Version: 1.0
-Name: gps
-Version: %s
-Summary: Python libraries for the gpsd service daemon
-Home-page: %s
-Author: the GPSD project
-Author-email: %s
-License: BSD
-Description: The gpsd service daemon can monitor one or more GPS devices connected to a host computer, making all data on the location and movements of the sensors available to be queried on TCP port 2947.
-Platform: UNKNOWN
-""" %(gpsd_version, website, devmail)
-    python_egg_info = python_env.Textfile(target="gps-%s.egg-info" %(gpsd_version, ), source=python_egg_info_source)
-    python_built_extensions = python_compiled_libs.values()
-    python_targets = python_built_extensions + [python_egg_info]
-
-env.Command(target = "packet_names.h", source="packet_states.h", action="""
-    rm -f $TARGET &&\
-    sed -e '/^ *\([A-Z][A-Z0-9_]*\),/s//   \"\\1\",/' <$SOURCE >$TARGET &&\
-    chmod a-w $TARGET""")
-
-# timebase.h - always built in order to include current GPS week
-def timebase_h(target, source, env):
-    from leapsecond import make_leapsecond_include
-    f = open(target[0].abspath, 'w')
-    f.write(make_leapsecond_include(source[0].abspath))
-    f.close()
-timebase = env.Command(target="timebase.h",
-                       source=["leapseconds.cache"], action=timebase_h)
-env.AlwaysBuild(timebase)
-
-env.Textfile(target="gpsd_config.h", source=confdefs)
-env.Textfile(target="gpsd.h", source=[File("gpsd.h-head"), File("gpsd_config.h"), File("gpsd.h-tail")])
-
-env.Command(target="gps_maskdump.c", source=["maskaudit.py", "gps.h", "gpsd.h"], action='''
-    rm -f $TARGET &&\
-        $PYTHON $SOURCE -c $SRCDIR >$TARGET &&\
-        chmod a-w $TARGET''')
-
-env.Command(target="ais_json.i", source="jsongen.py", action='''\
-    rm -f $TARGET &&\
-    $PYTHON $SOURCE --ais --target=parser >$TARGET &&\
-    chmod a-w $TARGET''')
-
-# generate revision.h
-if 'dev' in gpsd_version:
-    (st, rev) = _getstatusoutput('git describe --tags')
-    if st != 0:
-        from datetime import datetime
-        rev = datetime.now().isoformat()[:-4]
-else:
-    rev = gpsd_version
-revision='#define REVISION "%s"\n' %(rev.strip(),)
-env.Textfile(target="revision.h", source=[revision])
-
-generated_sources = ['packet_names.h', 'timebase.h', 'gpsd.h', "ais_json.i",
-                     'gps_maskdump.c', 'revision.h', 'gpsd.php']
-
-# leapseconds.cache is a local cache for information on leapseconds issued
-# by the U.S. Naval observatory. It gets kept in the repository so we can
-# build without Internet access.
-from leapsecond import conditional_leapsecond_fetch
-
-def leapseconds_cache_rebuild(target, source, env):
-    if not env["leapfetch"]:
-        sys.stdout.write("Leapsecond fetch suppressed by leapfetch=no.\n")
-    elif not conditional_leapsecond_fetch(target[0].abspath, timeout=15):
-        sys.stdout.write("try building with leapfetch=no.\n")
-if 'dev' in gpsd_version or not os.path.exists('leapseconds.cache'):
-    leapseconds_cache = env.Command(target="leapseconds.cache",
-                                source="leapsecond.py",
-                                action=leapseconds_cache_rebuild)
-    env.Clean(leapseconds_cache, "leapsecond.pyc")
-    env.NoClean(leapseconds_cache)
-    env.Precious(leapseconds_cache)
-    env.AlwaysBuild(leapseconds_cache)
-
-if env['systemd']:
-    udevcommand = 'TAG+="systemd", ENV{SYSTEMD_WANTS}="gpsdctl@%k.service"'
-else:
-    udevcommand = 'RUN+="%s/gpsd.hotplug"' %(env['udevdir'], )
-
-
-# Instantiate some file templates.  We'd like to use the Substfile builtin
-# but it doesn't seem to work in scons 1.20
-def substituter(target, source, env):
-    substmap = (
-        ('@VERSION@',    gpsd_version),
-        ('@prefix@',     env['prefix']),
-        ('@libdir@',     env['libdir']),
-        ('@udevcommand@',    udevcommand),
-        ('@PYTHON@',     sys.executable),
-        ('@DATE@',       time.asctime()),
-        ('@MASTER@',     'DO NOT HAND_HACK! THIS FILE IS GENERATED'),
-        ('@SITENAME@',   sitename),
-        ('@SITESEARCH@', sitesearch),
-        ('@WEBSITE@',    website),
-        ('@MAINPAGE@',   mainpage),
-        ('@WEBUPLOAD@',  webupload),
-        ('@CGIUPLOAD@',  cgiupload),
-        ('@SCPUPLOAD@',  scpupload),
-        ('@MAILMAN@',    mailman),
-        ('@ADMIN@',      admin),
-        ('@DOWNLOAD@',   download),
-        ('@BUGTRACKER@', bugtracker),
-        ('@BROWSEREPO@', browserepo),
-        ('@CLONEREPO@',  clonerepo),
-        ('@GITREPO@',    gitrepo),
-        ('@WEBFORM@',    webform),
-        ('@FORMSERVER@', formserver),
-        ('@USERMAIL@',   usermail),
-        ('@DEVMAIL@',    devmail),
-        ('@ANNOUNCE@',   annmail),
-        ('@IRCCHAN@',    ircchan),
-        ('@LIBGPSVERSION@', libgps_version),
-        ('@TIPLINK@',    tiplink),
-        ('@TIPWIDGET@',  tipwidget),
-        )
-    sfp = open(str(source[0]))
-    content = sfp.read()
-    sfp.close()
-    for (s, t) in substmap:
-        content = content.replace(s, t)
-    m = re.search("@[A-Z]+@", content)
-    if m and m.group(0) not in map(lambda x: x[0], substmap):
-        print >>sys.stderr, "Unknown subst token %s in %s." % (m.group(0), sfp.name)
-    tfp = open(str(target[0]), "w")
-    tfp.write(content)
-    tfp.close()
-
-templated = glob.glob("*.in") + glob.glob("*/*.in") + glob.glob("*/*/*.in")
-
-# ignore files in subfolder called 'debian' - the Debian packaging
-# tools will handle them.
-templated = [ x for x in templated if not x.startswith('debian/') ]
-
-
-for fn in templated:
-    builder = env.Command(source=fn, target=fn[:-3], action=substituter)
-    env.AddPostAction(builder, 'chmod -w $TARGET')
-    if fn.endswith(".py.in"):
-        env.AddPostAction(builder, 'chmod +x $TARGET')
-
-# Documentation
-
-base_manpages = {
-    "gpsd.8" : "gpsd.xml",
-    "gpsd_json.5" : "gpsd_json.xml",
-    "gps.1" : "gps.xml",
-    "cgps.1" : "gps.xml",
-    "gpsinit.8": "gpsinit.xml",
-    "lcdgps.1" : "gps.xml",
-    "libgps.3" : "libgps.xml",
-    "libgpsmm.3" : "libgpsmm.xml",
-    "libQgpsmm.3" : "libgpsmm.xml",
-    "libgpsd.3" : "libgpsd.xml",
-    "gpsmon.1": "gpsmon.xml",
-    "gpsctl.1" : "gpsctl.xml",
-    "gpsdctl.8" : "gpsdctl.xml",
-    "gpspipe.1" : "gpspipe.xml",
-    "gps2udp.1" : "gps2udp.xml",
-    "gpsdecode.1" : "gpsdecode.xml",
-    "srec.5" : "srec.xml",
-    "ntpshmmon.1" : "ntpshmmon.xml",
-    }
-python_manpages = {
-    "gpsprof.1" : "gpsprof.xml",
-    "gpsfake.1" : "gpsfake.xml",
-    "gpscat.1" : "gpscat.xml",
-    "xgpsspeed.1" : "gps.xml",
-    "xgps.1" : "gps.xml",
-    "gegps.1" : "gps.xml",
-    }
-
-manpage_targets = []
-if manbuilder:
-    for (man, xml) in base_manpages.items() + python_manpages.items():
-        manpage_targets.append(env.Man(source=xml, target=man))
-
-## Where it all comes together
-
-build = env.Alias('build',
-                  [libraries, binaries, python_targets,
-                   "gpsd.php", manpage_targets,
-                   "libgps.pc", "libgpsd.pc", "gpsd.rules"])
-env.Default(*build)
-
-if qt_env:
-    build_qt = qt_env.Alias('build', [compiled_qgpsmmlib])
-    qt_env.Default(*build_qt)
-
-if env['python']:
-    build_python = python_env.Alias('build', python_targets)
-    python_env.Default(*build_python)
-
-## Installation and deinstallation
-
-# Not here because too distro-specific: udev rules, desktop files, init scripts
-
-# It's deliberate that we don't install gpsd.h. It's full of internals that
-# third-party client programs should not see.
-headerinstall = [ env.Install(installdir('includedir'), x) for x in ("libgpsmm.h", "gps.h")]
-
-binaryinstall = []
-binaryinstall.append(env.Install(installdir('sbindir'), [gpsd, gpsdctl]))
-binaryinstall.append(env.Install(installdir('bindir'),  [gpsdecode, gpsctl, gpspipe, gps2udp,
-                                                         gpxlogger, lcdgps, ntpshmmon]))
-if env["ncurses"]:
-    binaryinstall.append(env.Install(installdir('bindir'), [cgps, gpsmon]))
-binaryinstall.append(LibraryInstall(env, installdir('libdir'), compiled_gpslib))
-binaryinstall.append(LibraryInstall(env, installdir('libdir'), compiled_gpsdlib))
-if qt_env:
-    binaryinstall.append(LibraryInstall(qt_env, installdir('libdir'), compiled_qgpsmmlib))
-
-if env["shared"] and env["chrpath"]:
-    env.AddPostAction(binaryinstall, '$CHRPATH -r "%s" "$TARGET"' \
-                      % (installdir('libdir', False), ))
-
-if not env['debug'] and not env['profiling'] and not env['nostrip'] and not sys.platform.startswith('darwin'):
-    env.AddPostAction(binaryinstall, '$STRIP $TARGET')
-
-if not env['python']:
-    python_install = []
-else:
-    python_lib_dir = env['python_libdir']
-    python_module_dir = python_lib_dir + os.sep + 'gps'
-    python_extensions_install = python_env.Install( DESTDIR + python_module_dir,
-                                                    python_built_extensions)
-    if not env['debug'] and not env['profiling'] and not env['nostrip'] and not sys.platform.startswith('darwin'):
-        python_env.AddPostAction(python_extensions_install, '$STRIP $TARGET')
-
-    python_modules_install = python_env.Install( DESTDIR + python_module_dir,
-                                                python_modules)
-
-    python_progs_install = python_env.Install(installdir('bindir'), python_progs)
-
-    python_egg_info_install = python_env.Install(DESTDIR + python_lib_dir,
-                                                 python_egg_info)
-    python_install = [  python_extensions_install,
-                        python_modules_install,
-                        python_progs_install,
-                        python_egg_info_install]
-
-pc_install = [ env.Install(installdir('pkgconfig'), x) for x in ("libgps.pc", "libgpsd.pc") ]
-if qt_env:
-    pc_install.append(qt_env.Install(installdir('pkgconfig'), 'Qgpsmm.pc'))
-    pc_install.append(qt_env.Install(installdir('libdir'), 'libQgpsmm.prl'))
-
-
-
-maninstall = []
-for manpage in base_manpages.keys() + python_manpages.keys():
-    if not manbuilder and not os.path.exists(manpage):
-        continue
-    section = manpage.split(".")[1]
-    dest = os.path.join(installdir('mandir'), "man"+section, manpage)
-    maninstall.append(env.InstallAs(source=manpage, target=dest))
-install = env.Alias('install', binaryinstall + maninstall + python_install + pc_install + headerinstall)
-
-def Uninstall(nodes):
-    deletes = []
-    for node in nodes:
-        if node.__class__ == install[0].__class__:
-            deletes.append(Uninstall(node.sources))
-        else:
-            deletes.append(Delete(str(node)))
-    return deletes
-uninstall = env.Command('uninstall', '', Flatten(Uninstall(Alias("install"))) or "")
-env.AlwaysBuild(uninstall)
-env.Precious(uninstall)
-
-# Target selection for '.' is badly broken. This is a general scons problem,
-# not a glitch in this particular recipe. Avoid triggering the bug.
-
-def error_action(target, source, env):
-    from SCons.Errors import UserError
-    raise UserError, "Target selection for '.' is broken."
-AlwaysBuild(Alias(".", [], error_action))
-
-# Utility productions
-
-def Utility(target, source, action):
-    target = env.Command(target=target, source=source, action=action)
-    env.AlwaysBuild(target)
-    env.Precious(target)
-    return target
-
-# Report splint warnings
-# Note: test_bits.c is unsplintable because of the PRI64 macros.
-# If you get preprocessor or fatal errors, add +showscan.
-splintopts = "-I/usr/include/libusb-1.0 +quiet"
-# splint does not know about multi-arch, work around that
-ma_status, ma = _getstatusoutput('dpkg-architecture -qDEB_HOST_MULTIARCH')
-if ma_status == 0:
-    splintopts = '-I/usr/include/%s %s' %(ma.strip(),splintopts)
-env['SPLINTOPTS']=splintopts
-
-def Splint(target,sources, description, params):
-    return Utility(target,sources+generated_sources,[
-            '@echo "Running splint on %s..."'%description,
-            '-splint $SPLINTOPTS %s %s'%(" ".join(params)," ".join(sources)),
-            ])
-
-splint_table = [
-    ('splint-daemon',gpsd_sources,'daemon', ['-exportlocal', '-redef']),
-    ('splint-libgpsd',libgpsd_sources,'libgpsd', ['-exportlocal', '-redef']),
-    ('splint-libgps',libgps_sources,'user-side libraries', ['-exportlocal',
-                                                            '-fileextensions',
-                                                            '-redef']),
-    ('splint-cgps',['cgps.c'],'cgps', ['-exportlocal']),
-    ('splint-gpsctl',['gpsctl.c'],'gpsctl', ['']),
-    ('splint-gpsdctl',['gpsdctl.c'],'gpsdctl', ['']),
-    ('splint-gpsmon',gpsmon_sources,'gpsmon', ['-exportlocal']),
-    ('splint-gpspipe',['gpspipe.c'],'gpspipe', ['']),
-    ('splint-gps2udp',['gps2udp.c'],'gps2udp', ['']),
-    ('splint-gpsdecode',['gpsdecode.c'],'gpsdecode', ['']),
-    ('splint-gpxlogger',['gpxlogger.c'],'gpxlogger', ['']),
-    ('splint-ntpshmmon',['ntpshmmon.c'],'ntpshmmon', ['']),
-    ('splint-test_packet',['test_packet.c'],'test_packet test harness', ['']),
-    ('splint-test_mktime',['test_mktime.c'],'test_mktime test harness', ['']),
-    ('splint-test_geoid',['test_geoid.c'],'test_geoid test harness', ['']),
-    ('splint-test_json',['test_json.c'],'test_json test harness', ['']),
-    ]
-
-for (target,sources,description,params) in splint_table:
-    env.Alias('splint',Splint(target,sources,description,params))
-
-# Putting in all these -U flags speeds up cppcheck and allows it to look
-# at configurations we actually care about.
-Utility("cppcheck", ["gpsd.h", "packet_names.h"],
-        "cppcheck -U__UNUSED__ -UUSE_QT -US_SPLINT_S -U__COVERITY__ -U__future__ -ULIMITED_MAX_CLIENTS -ULIMITED_MAX_DEVICES -UAF_UNSPEC -UINADDR_ANY -UFIXED_PORT_SPEED -UFIXED_STOP_BITS -U_WIN32 -U__CYGWIN__ -UPATH_MAX -UHAVE_STRLCAT -UHAVE_STRLCPY -UIPTOS_LOWDELAY -UIPV6_TCLASS -UTCP_NODELAY -UTIOCMIWAIT --template gcc --enable=all --inline-suppr --suppress='*:driver_proto.c' --force $SRCDIR")
-
-# Experimental check with clang analyzer
-Utility("scan-build", ["gpsd.h", "packet_names.h"],
-        "scan-build scons")
-
-# Sanity-check Python code.
-pylint = Utility("pylint", ["jsongen.py", "maskaudit.py", python_built_extensions],
-        ['''pylint --rcfile=/dev/null --dummy-variables-rgx='^_' --msg-template="{path}:{line}: [{msg_id}({symbol}), {obj}] {msg}" --reports=n --disable=F0001,C0103,C0111,C1001,C0301,C0302,C0322,C0324,C0323,C0321,C0330,R0201,R0801,R0902,R0903,R0904,R0911,R0912,R0913,R0914,R0915,W0110,W0201,W0121,W0123,W0232,W0234,W0401,W0403,W0141,W0142,W0603,W0614,W0640,W0621,E1101,E1102,E1103,F0401 gps/*.py *.py ''' + " ".join(python_progs)])
-
-# Additional Python readablity style checks
-pep8 = Utility("pep8", ["jsongen.py", "maskaudit.py", python_built_extensions],
-        ['''pep8 --ignore=E501,W602,E122,E241,E401 {} gps/[a-zA-Z]*.py *.py'''.format(" ".join(python_progs))])
-
-# Additional Python readablity style checks
-flake8 = Utility("flake8", ["jsongen.py", "maskaudit.py", python_built_extensions],
-        ['''flake8 --ignore=E501,W602,E122,E241,E401 {} gps/[a-zA-Z]*.py *.py'''.format(" ".join(python_progs))])
-
-
-# Check the documentation for bogons, too
-Utility("xmllint", glob.glob("*.xml"),
-    "for xml in $SOURCES; do xmllint --nonet --noout --valid $$xml; done")
-
-# Use deheader to remove headers not required.  If the statistics line
-# ends with other than '0 removed' there's work to be done.
-Utility("deheader", generated_sources, [
-    'deheader -x cpp -x contrib -x gpspacket.c -x gpsclient.c -x monitor_proto.c -i gpsd_config.h -i gpsd.h -m "MORECFLAGS=\'-Werror -Wfatal-errors -DDEBUG -DPPS_ENABLE\' scons -Q"',
-        ])
-
-# Perform all local code-sanity checks (but not the Coverity scan).
-audit = env.Alias('audit',
-                  ['splint',
-                   'cppcheck',
-                   'pylint',
-                   'xmllint',
-                   'valgrind-audit',
-                   ])
-
-#
-# Regression tests begin here
-#
-# Note that the *-makeregress targets re-create the *.log.chk source
-# files from the *.log source files.
-
-# Unit-test the bitfield extractor
-bits_regress = Utility('bits-regress', [test_bits], [
-    '$SRCDIR/test_bits --quiet'
-    ])
-
-# Unit-test the bitfield extractor
-matrix_regress = Utility('matrix-regress', [test_matrix], [
-    '$SRCDIR/test_matrix --quiet'
-    ])
-
-# Check that all Python modules compile properly 
-if env['python']:
-    def check_compile(target, source, env):
-        for pyfile in source:
-            'cp %s tmp.py'%(pyfile)
-            '%s -tt -m py_compile tmp.py' %(sys.executable, )
-            'rm -f tmp.py tmp.pyc'
-    python_compilation_regress = Utility('python-compilation-regress',
-            Glob('*.py') + python_modules + python_progs + ['SConstruct'], check_compile)
-else:
-    python_compilation_regress = None
-
-# using regress-drivers requires socket_export being enabled.
-if not env['socket_export']:
-    announce("GPS regression tests suppressed because socket_export is off.")
-    gps_regress = None
-else:
-    # Regression-test the daemon. But first:
-    # (1) Clear GPSD's SHM segment in case a previous abort didn't.  This
-    # prevents spurious error messages.
-    # (2) Dump the platform and its delay parameters.
-    # The ":;" in this production and the next one forestalls an attempt by
-    # SCons to install up to date versions of gpsfake and gpsctl if it can
-    # find older versions of them in a directory on your $PATH.
-    gps_regress = Utility("gps-regress", [gpsd, gpsctl, python_built_extensions],
-            ':; $SRCDIR/gpsfake -T; $SRCDIR/regress-driver $REGRESSOPTS test/daemon/*.log')
-
-    # Build the regression tests for the daemon.
-    # Note: You'll have to do this whenever the default leap second
-    # changes in timebase.h.  The problem is in the SiRF tests;
-    # that driver relies on the default until it gets the current
-    # offset from subframe data.
-    Utility('gps-makeregress', [gpsd, gpsctl, python_built_extensions],
-        ':; $SRCDIR/gpsfake -T; $SRCDIR/regress-driver -b $REGRESSOPTS test/daemon/*.log')
-
-# To build an individual test for a load named foo.log, put it in
-# test/daemon and do this:
-#    regress-driver -b test/daemon/foo.log
-
-# Regression-test the RTCM decoder.
-if not env["rtcm104v2"]:
-    announce("RTCM2 regression tests suppressed because rtcm104v2 is off.")
-    rtcm_regress = None
-else:
-    rtcm_regress = Utility('rtcm-regress', [gpsdecode], [
-        '@echo "Testing RTCM decoding..."',
-        '@for f in $SRCDIR/test/*.rtcm2; do '
-            'echo "Testing $${f}..."; '
-            'TMPFILE=`mktemp -t gpsd-test-XXXXXXXXXXXXXX.chk`; '
-            '$SRCDIR/gpsdecode -u -j <$${f} >$${TMPFILE}; '
-            'diff -ub $${f}.chk $${TMPFILE}; '
-            'rm -f $${TMPFILE}; '
-        'done;',
-        '@echo "Testing idempotency of JSON dump/decode for RTCM2"',
-        '@TMPFILE=`mktemp -t gpsd-test-XXXXXXXXXXXXXX.chk`; '
-        '$SRCDIR/gpsdecode -u -e -j <test/synthetic-rtcm2.json >$${TMPFILE}; '
-            'grep -v "^#" test/synthetic-rtcm2.json | diff -ub - $${TMPFILE}; '
-            'rm -f $${TMPFILE}; ',
-        ])
-
-# Rebuild the RTCM regression tests.
-Utility('rtcm-makeregress', [gpsdecode], [
-    'for f in $SRCDIR/test/*.rtcm2; do '
-        '$SRCDIR/gpsdecode -j <$${f} >$${f}.chk; '
-    'done'
-        ])
-
-# Regression-test the AIVDM decoder.
-if not env["aivdm"]:
-    announce("AIVDM regression tests suppressed because aivdm is off.")
-    aivdm_regress = None
-else:
-    aivdm_regress = Utility('aivdm-regress', [gpsdecode], [
-        '@echo "Testing AIVDM decoding w/ CSV format..."',
-        '@for f in $SRCDIR/test/*.aivdm; do '
-            'echo "Testing $${f}..."; '
-            'TMPFILE=`mktemp -t gpsd-test-XXXXXXXXXXXXXX.chk`; '
-            '$SRCDIR/gpsdecode -u -c <$${f} >$${TMPFILE}; '
-            'diff -ub $${f}.chk $${TMPFILE} || echo "Test FAILED!"; '
-            'rm -f $${TMPFILE}; '
-        'done;',
-        '@echo "Testing AIVDM decoding w/ JSON unscaled format..."',
-        '@for f in $SRCDIR/test/*.aivdm; do '
-            'echo "  Testing $${f}..."; '
-            'TMPFILE=`mktemp -t gpsd-test-XXXXXXXXXXXXXX.chk`; '
-            '$SRCDIR/gpsdecode -u -j <$${f} >$${TMPFILE}; '
-            'diff -ub $${f}.ju.chk $${TMPFILE} || echo "Test FAILED!"; '
-            'rm -f $${TMPFILE}; '
-        'done;',
-        '@echo "Testing AIVDM decoding w/ JSON scaled format..."',
-        '@for f in $SRCDIR/test/*.aivdm; do '
-            'echo "  Testing $${f}..."; '
-            'TMPFILE=`mktemp -t gpsd-test-XXXXXXXXXXXXXX.chk`; '
-            '$SRCDIR/gpsdecode -j <$${f} >$${TMPFILE}; '
-            'diff -ub $${f}.js.chk $${TMPFILE} || echo "Test FAILED!"; '
-            'rm -f $${TMPFILE}; '
-        'done;',
-        '@echo "Testing idempotency of unscaled JSON dump/decode for AIS"',
-        '@TMPFILE=`mktemp -t gpsd-test-XXXXXXXXXXXXXX.chk`; '
-        '$SRCDIR/gpsdecode -u -e -j <$SRCDIR/test/sample.aivdm.ju.chk >$${TMPFILE}; '
-            'grep -v "^#" $SRCDIR/test/sample.aivdm.ju.chk | diff -ub - $${TMPFILE}; '
-            'rm -f $${TMPFILE}; ',
-        # Parse the unscaled json reference, dump it as scaled json, 
-        # and finally compare it with the scaled json reference
-        '@echo "Testing idempotency of scaled JSON dump/decode for AIS"',
-        '@TMPFILE=`mktemp -t gpsd-test-XXXXXXXXXXXXXX.chk`; '
-        '$SRCDIR/gpsdecode -e -j <$SRCDIR/test/sample.aivdm.ju.chk >$${TMPFILE}; '
-            'grep -v "^#" $SRCDIR/test/sample.aivdm.js.chk | diff -ub - $${TMPFILE}; '
-            'rm -f $${TMPFILE}; ',
-        ])
-
-# Rebuild the AIVDM regression tests.
-Utility('aivdm-makeregress', [gpsdecode], [
-    'for f in $SRCDIR/test/*.aivdm; do '
-        '$SRCDIR/gpsdecode -u -c <$${f} > $${f}.chk; '
-        '$SRCDIR/gpsdecode -u -j <$${f} > $${f}.ju.chk; '
-        '$SRCDIR/gpsdecode -j  <$${f} > $${f}.js.chk; '
-    'done',
-        ])
-
-# Regression-test the packet getter.
-packet_regress = Utility('packet-regress', [test_packet], [
-    '@echo "Testing detection of invalid packets..."',
-    '$SRCDIR/test_packet | diff -u $SRCDIR/test/packet.test.chk -',
-    ])
-
-# Rebuild the packet-getter regression test
-Utility('packet-makeregress', [test_packet], [
-    '$SRCDIR/test_packet >$SRCDIR/test/packet.test.chk',
-    ])
-
-# Rebuild the geoid test
-Utility('geoid-makeregress', [test_geoid], [
-    '$SRCDIR/test_geoid 37.371192 122.014965 >$SRCDIR/test/geoid.test.chk'])
-
-# Regression-test the geoid tester.
-geoid_regress = Utility('geoid-regress', [test_geoid], [
-    '@echo "Testing the geoid model..."',
-    '$SRCDIR/test_geoid 37.371192 122.014965 | diff -u $SRCDIR/test/geoid.test.chk -',
-    ])
-
-# Regression-test the Maidenhead Locator
-maidenhead_locator_regress = Utility('maidenhead-locator-regress', [python_built_extensions], [
-    '@echo "Testing the Maidenhead Locator conversion..."',
-    '$SRCDIR/test_maidenhead.py >/dev/null',
-    ])
-
-# Regression-test the calendar functions
-time_regress = Utility('time-regress', [test_mktime], [
-    '$SRCDIR/test_mktime'
-    ])
-
-# Regression test the unpacking code in libgps
-unpack_regress = Utility('unpack-regress', [test_libgps], [
-    '@echo "Testing the client-library sentence decoder..."',
-    '$SRCDIR/regress-driver -c $SRCDIR/test/clientlib/*.log',
-    ])
-
-# Build the regression test for the sentence unpacker
-Utility('unpack-makeregress', [test_libgps], [
-    '@echo "Rebuilding the client sentence-unpacker tests..."',
-    '$SRCDIR/regress-driver -c -b $SRCDIR/test/clientlib/*.log'
-    ])
-
-# Unit-test the JSON parsing
-json_regress = Utility('json-regress', [test_json], [
-    '$SRCDIR/test_json'
-    ])
-
-# consistency-check the driver methods
-method_regress = Utility('packet-regress', [test_packet], [
-    '@echo "Consistency-checking driver methods..."',
-    '$SRCDIR/test_packet -c >/dev/null',
-    ])
-
-# Run a valgrind audit on the daemon  - not in normal tests
-valgrind_audit = Utility('valgrind-audit',
-    ['$SRCDIR/valgrind-audit.py', python_built_extensions, gpsd],
-    './valgrind-audit.py'
-    )
-
-# Run test builds on remote machines
-flocktest = Utility("flocktest", [], "cd devtools; ./flocktest " + gitrepo)
-
-
-# Run all normal regression tests
-describe = Utility('describe', [],
-                   ['@echo "Run normal regression tests for %s..."' %(rev.strip(),)])
-testclean = Utility('test_cleanup', [],
-                    'rm -f test_bits test_matrix test_geoid test_json test_libgps test_mktime test_packet')
-check = env.Alias('check', [
-    describe,
-    python_compilation_regress,
-    method_regress,
-    bits_regress,
-    matrix_regress,
-    gps_regress,
-    rtcm_regress,
-    aivdm_regress,
-    packet_regress,
-    geoid_regress,
-    maidenhead_locator_regress,
-    time_regress,
-    unpack_regress,
-    json_regress,
-    testclean,
-    ])
-
-env.Alias('testregress', check)
-
-# The website directory
-#
-# None of these productions are fired by default.
-# The content they handle is the GPSD website, not included in release tarballs.
-
-# asciidoc documents
-if env.WhereIs('asciidoc'):
-    txtfiles = ['AIVDM', 'NMEA',
-                'protocol-evolution',
-                'protocol-transition',
-                'gpsd-time-service-howto',
-                'time-service-intro',
-                'client-howto']
-    asciidocs = ["www/" + stem + ".html" for stem in txtfiles] \
-                + ["www/installation.html"]
-    for stem in txtfiles:
-        env.Command('www/%s.html' % stem, 'www/%s.txt' % stem,    
-                    ['asciidoc -a toc -o www/%s.html www/%s.txt' % (stem,stem)])
-    env.Command("www/installation.html",
-                "INSTALL",
-                ["asciidoc -o www/installation.html INSTALL"])
-else:
-    announce("Part of the website build requires asciidoc, not installed.")
-    asciidocs = []
-
-htmlpages = Split('''www/installation.html
-    www/gpscat.html www/gpsctl.html www/gpsdecode.html 
-    www/gpsd.html www/gpsd_json.html www/gpsfake.html www/gpsmon.html 
-    www/gpspipe.html www/gps2udp.html www/gpsprof.html www/gps.html 
-    www/libgpsd.html www/libgpsmm.html www/libgps.html
-    www/srec.html www/writing-a-driver.html www/hardware.html
-    www/performance/performance.html www/internals.html
-    www/cycle.svg
-    ''')
-
-webpages = htmlpages + asciidocs + map(lambda f: f[:-3], glob.glob("www/*.in"))
-
-www = env.Alias('www', webpages)
-
-# Paste 'scons --quiet validation-list' to a batch validator such as
-# http://htmlhelp.com/tools/validator/batch.html.en 
-def validation_list(target, source, env):
-    for page in glob.glob("www/*.html"):
-        if not '-head' in page:
-            fp = open(page)
-            if "Valid HTML" in fp.read():
-                print os.path.join(website, os.path.basename(page))
-            fp.close()
-Utility("validation-list", [www], validation_list)
-
-# How to update the website
-upload_web = Utility("website", [www],
-                     ['rsync --exclude="*.in" -avz www/ ' + webupload,
-                      'scp README TODO NEWS ' + webupload,
-                      'chmod ug+w,a+x www/gps_report.cgi',
-                      'scp www/gps_report.cgi ' + cgiupload + "gps_report.cgi"])
-
-# When the URL declarations change, so must the generated web pages
-for fn in glob.glob("www/*.in"):
-    env.Depends(fn[:-3], "SConstruct")
-
-if htmlbuilder:
-    # Manual pages
-    for xml in glob.glob("*.xml"):
-        env.HTML('www/%s.html' % xml[:-4], xml)
-    
-    # DocBook documents
-    for stem in ['writing-a-driver', 'performance/performance']:
-        env.HTML('www/%s.html' % stem, 'www/%s.xml' % stem)
-
-    # The internals manual.
-    # Doesn't capture dependencies on the subpages
-    env.HTML('www/internals.html', '$SRCDIR/doc/internals.xml')
-
-# The hardware page
-env.Command('www/hardware.html', ['gpscap.py',
-                                  'www/hardware-head.html',
-                                  'gpscap.ini',
-                                  'www/hardware-tail.html'],
-            ['(cat www/hardware-head.html; $PYTHON gpscap.py; cat www/hardware-tail.html) >www/hardware.html'])
-
-# The diagram editor dia is required in order to edit the diagram masters
-# Utility("www/cycle.svg", ["www/cycle.dia"], ["dia -e www/cycle.svg www/cycle.dia"])
-
-# Experimenting with pydoc.  Not yet fired by any other productions.
-
-if env['python']:
-    env.Alias('pydoc', "www/pydoc/index.html")
-
-    # We need to run epydoc with the Python version we built the modules for.
-    # So we define our own epydoc instead of using /usr/bin/epydoc
-    EPYDOC = "python -c 'from epydoc.cli import cli; cli()'"
-    env.Command('www/pydoc/index.html', python_progs + glob.glob("*.py")  + glob.glob("gps/*.py"), [
-        'mkdir -p www/pydoc',
-        EPYDOC + " -v --html --graph all -n GPSD $SOURCES -o www/pydoc",
-            ])
-
-# Productions for setting up and performing udev tests.
-#
-# Requires root. Do "udev-install", then "tail -f /var/log/syslog" in
-# another window, then run 'scons udev-test', then plug and unplug the
-# GPS ad libitum.  All is well when you get fix reports each time a GPS
-# is plugged in.
-#
-# In case you are a systemd user you might also need to watch the
-# journalctl output. Instead of the hotplug script the gpsdctl@.service
-# unit will handle hotplugging together with the udev rules.
-#
-# Note that a udev event can be triggered with an invocation like:
-# udevadm trigger --sysname-match=ttyUSB0 --action add
-
-if env['systemd']:
-    systemdinstall_target = [ env.Install(DESTDIR + systemd_dir, "systemd/%s" %(x,)) for x in ("gpsdctl@.service", "gpsd.service", "gpsd.socket") ]
-    systemd_install = env.Alias('systemd_install', systemdinstall_target)
-    systemd_uninstall = env.Command('systemd_uninstall', '', Flatten(Uninstall(Alias("systemd_install"))) or "")
-
-    env.AlwaysBuild(systemd_uninstall)
-    env.Precious(systemd_uninstall)
-
-
-if env['systemd']:
-    hotplug_wrapper_install = []
-else:
-    hotplug_wrapper_install = [
-        'cp $SRCDIR/gpsd.hotplug ' + DESTDIR + env['udevdir'],
-        'chmod a+x ' + DESTDIR + env['udevdir'] + '/gpsd.hotplug'
-    ]
-
-udev_install = Utility('udev-install', 'install', [
-    'mkdir -p ' + DESTDIR + env['udevdir'] + '/rules.d',
-    'cp $SRCDIR/gpsd.rules ' + DESTDIR + env['udevdir'] + '/rules.d/25-gpsd.rules',
-    ] + hotplug_wrapper_install)
-
-if env['systemd']:
-    systemctl_daemon_reload = Utility('systemctl-daemon-reload', '', [ 'systemctl daemon-reload || true'])
-    env.AlwaysBuild(systemctl_daemon_reload)
-    env.Precious(systemctl_daemon_reload)
-    env.Requires(udev_install, systemd_install)
-    env.Requires(systemctl_daemon_reload, systemd_install)
-    env.Requires(udev_install, systemctl_daemon_reload)
-
-
-Utility('udev-uninstall', '', [
-    'rm -f %s/gpsd.hotplug' % env['udevdir'],
-    'rm -f %s/rules.d/25-gpsd.rules' % env['udevdir'],
-        ])
-
-Utility('udev-test', '', [
-    '$SRCDIR/gpsd -N -n -F /var/run/gpsd.sock -D 5',
-        ])
-
-# Cleanup
-
-# Ordinary cleanup
-clean = env.Clean(build,
-          map(glob.glob,("*.[oa]", "*.[1358]", "*.os", "*.os.*", "*.gcno", "*.pyc", "gps/*.pyc", "TAGS", "config.log")) + testprogs + \
-          generated_sources + base_manpages.keys() + \
-          map(lambda f: f[:-3], templated))
-
-# Clean up web directory
-webclean = env.Clean(www, [])
-
-# Clean up to a close approximation of a fresh repository pull
-distclean = env.Alias('distclean', [clean, testclean, webclean])
-
-# Tags for Emacs and vi
-misc_sources = ['cgps.c', 'gpsctl.c', 'gpsdctl.c', 'gpspipe.c',
-                'gps2udp.c', 'gpsdecode.c', 'gpxlogger.c', 'ntpshmmon.c']
-sources = libgpsd_sources + libgps_sources \
-          + gpsd_sources + gpsmon_sources + misc_sources
-env.Command('TAGS', sources, ['etags ' + " ".join(sources)])
-
-# Release machinery begins here
-#
-# We need to be in the actual project repo (i.e. not doing a -Y build)
-# for these productions to work.
-
-if os.path.exists("gpsd.c") and os.path.exists(".gitignore"):
-    distfiles = _getoutput(r"git ls-files | grep -v '^www/'").split()
-    if ".gitignore" in distfiles:
-        distfiles.remove(".gitignore")
-    distfiles += generated_sources
-    distfiles += base_manpages.keys() + python_manpages.keys()
-    distfiles.remove("gpsd.h")
-    if "packaging/rpm/gpsd.spec" not in distfiles:
-        distfiles.append("packaging/rpm/gpsd.spec")
-
-    # How to build a zip file.
-    zip = env.Command('zip', distfiles, [
-        '@zip -r gpsd-${VERSION}.zip $SOURCES',
-        '@ls -l gpsd-${VERSION}.zip',
-        ])
-    env.Clean(zip, ["gpsd-${VERSION}.zip", "packaging/rpm/gpsd.spec"])
-
-    # How to build a tarball.
-    tarball = env.Command('tarball', distfiles, [
-        '@tar --transform "s:^:gpsd-${VERSION}/:" -czf gpsd-${VERSION}.tar.gz $SOURCES',
-        '@ls -l gpsd-${VERSION}.tar.gz',
-        ])
-    env.Clean(tarball, ["gpsd-${VERSION}.tar.gz", "packaging/rpm/gpsd.spec"])
-
-    # Make RPM from the specfile in packaging
-    Utility('dist-rpm', tarball, 'rpmbuild -ta gpsd-${VERSION}.tar.gz')
-
-    # Make sure build-from-tarball works.
-    testbuild = Utility('testbuild', [tarball], [
-        'tar -xzvf gpsd-${VERSION}.tar.gz',
-        'cd gpsd-${VERSION}; scons',
-        'rm -fr gpsd-${VERSION}',
-        ])
-
-    releasecheck = env.Alias('releasecheck', [
-        testbuild,
-        check,
-        audit,
-        flocktest,
-        ])
-
-    # This is how to ship a release to the hosting site.
-    # The chmod copes with the fact that scp will give a
-    # replacement the permissions of the *original*...
-    upload_release = Utility('upload-release', [tarball], [
-            'gpg -b gpsd-${VERSION}.tar.gz',
-            'chmod ug=rw,o=r gpsd-${VERSION}.tar.gz gpsd-${VERSION}.tar.gz.sig',
-            'scp gpsd-${VERSION}.tar.gz gpsd-${VERSION}.tar.gz.sig ' + scpupload,
-            ])
-
-    # How to tag a release
-    tag_release = Utility('tag-release', [], [
-        'git tag -s -m "Tagged for external release ${VERSION}" release-${VERSION}'
-        ])
-    upload_tags = Utility('upload-tags', [], ['git push --tags'])
-
-    # Local release preparation. This production will require Internet access,
-    # but it doesn't do any uploads or public repo mods.
-    #
-    # Note that tag_release has to fire early, otherwise the value of REVISION
-    # won't be right when revision.h is generated for the tarball. 
-    releaseprep = env.Alias("releaseprep",
-                            [Utility("distclean", [], ["rm -f revision.h"]),
-                             tag_release,
-                             tarball])
-    # Undo local release preparation
-    Utility("undoprep", [], ['rm -f gpsd-${VERSION}.tar.gz;',
-                             'git tag -d release-${VERSION};'])
-
-    # All a buildup to this.
-    env.Alias("release", [releaseprep,
-                          upload_release,
-                          upload_tags,
-                          upload_web])
-
-    # Experimental release mechanics using shipper
-    # This will ship a freecode metadata update
-    Utility("ship", [tarball, "control"], ['shipper version=%s | sh -e -x' % gpsd_version])
-
-# The following sets edit modes for GNU EMACS
-# Local Variables:
-# mode:python
-# End:
diff --git a/Tachometer.c b/Tachometer.c
index 3113f16b..059d9600 100644
--- a/Tachometer.c
+++ b/Tachometer.c
@@ -36,7 +36,6 @@ typedef struct
     XPoint point_list[5];
 } StringRec;
 
-/*@ +charint @*/
 /*	Number character database - like an LED */
 static DigitRec num_segment[] = {
     {{1, 1, 1, 1, 1, 1, 0}},
@@ -61,7 +60,6 @@ static XSegment offset[] = {
     {-10, 0, 10, 0}
 };
 
-/*@ -initallelements @*/
 /*	" X 10 %" character database	*/
 static StringRec char_data[] = {
     {2,				/* "X" */
@@ -81,10 +79,7 @@ static StringRec char_data[] = {
       {2, -5}}}
 };
 
-/*@ -initallelements @*/
-/*@ -charint @*/
 
-/*@ -nullderef -immediatetrans -type -nullassign @*/
 #define offst(field) XtOffset(TachometerWidget, field)
 static XtResource resources[] = {
     {XtNforeground, XtCForeground, XtRPixel, sizeof(Pixel),
@@ -114,7 +109,6 @@ static XtResource resources[] = {
     ,
 };
 
-/*@ -nullderef -immediatetrans +type +nullassign @*/
 
 static void Initialize(Widget request, Widget new),
 Realize(Widget w, Mask * valueMask, XSetWindowAttributes * attributes),
@@ -122,7 +116,6 @@ Resize(Widget w), Redisplay(Widget w, XEvent * event, Region region),
 Destroy(Widget w);
 static Boolean SetValues(Widget current, Widget request UNUSED, Widget new);
 
-/*@ -fullinitblock @*/
 TachometerClassRec tachometerClassRec = {
     {
 /* core_class fields */
@@ -168,7 +161,6 @@ TachometerClassRec tachometerClassRec = {
 
 };
 
-/*@ +fullinitblock @*/
 WidgetClass tachometerWidgetClass = (WidgetClass) & tachometerClassRec;
 
 /* Private procedures */
@@ -177,7 +169,6 @@ static void FastFillCircle(Display * d, Drawable w, GC gc,
 			   Cardinal center_x, Cardinal center_y,
 			   Cardinal radius_x, Cardinal radius_y)
 {
-    /*@ -compdef @*/
     XPoint points[360];
     Cardinal angle;
 
@@ -188,7 +179,6 @@ static void FastFillCircle(Display * d, Drawable w, GC gc,
 				  (double)radius_y + (double)center_y);
     }
     (void)XFillPolygon(d, w, gc, points, 360, Complex, CoordModeOrigin);
-    /*@ +compdef @*/
 }
 
 static void DrawSingleNumber(TachometerWidget w, int which, Cardinal x,
@@ -203,7 +193,6 @@ static void DrawSingleNumber(TachometerWidget w, int which, Cardinal x,
     if ((width == 0) || (height == 0))
 	return;
 
-    /*@ +charint -compdef */
     for (count = 0, nsegments = 0; count < 7; count++)
 	if (num_segment[which].digit[count] == 1) {
 	    segments[nsegments].x1 = (short)
@@ -219,7 +208,6 @@ static void DrawSingleNumber(TachometerWidget w, int which, Cardinal x,
 
     (void)XDrawSegments(XtDisplay(w), XtWindow(w),
 			w->tachometer.scale_GC, segments, (int)nsegments);
-    /*@ -charint +compdef */
 }
 
 static void DrawNumbers(TachometerWidget w, int which, Cardinal x, Cardinal y)
@@ -247,7 +235,6 @@ static void DrawLabelString(TachometerWidget w)
 
     ry = (Cardinal) (radius_y * 0.35 + center_y);
     gc = w->tachometer.scale_GC;
-    /*@ -compdef @*/
     for (char_count = 0; char_count < 4; char_count++) {
 	for (data_count = 0; data_count < char_data[char_count].nofline;
 	     data_count++) {
@@ -261,7 +248,6 @@ static void DrawLabelString(TachometerWidget w)
 	(void)XDrawLines(XtDisplay(w), XtWindow(w), gc, points,
 			 char_data[char_count].nofline, CoordModeOrigin);
     }
-    /*@ +compdef @*/
 }
 
 static void DrawGauge(TachometerWidget w)
@@ -272,7 +258,6 @@ static void DrawGauge(TachometerWidget w)
     GC gc;
     double step, jump = 1.0;
 
-    /*@ -type -unsignedcompare -compdef @*/
     center_x = w->core.width / 2;
     center_y = w->core.height / 2;
     radius_x = center_x - w->tachometer.internal_border;
@@ -318,7 +303,6 @@ static void DrawGauge(TachometerWidget w)
 			    in_gauge_y, out_gauge_x, out_gauge_y);
 	}
     }
-    /*@ +type +unsignedcompare +compdef @*/
 
     DrawLabelString(w);
 }
@@ -329,7 +313,6 @@ static void DrawNeedle(TachometerWidget w, int load)
     double cur_theta1, cur_theta2, cur_theta3, cur_theta4, cur_theta5;
     Cardinal center_x, center_y, radius_x, radius_y;
 
-    /*@ -type -unsignedcompare -compdef @*/
     center_x = w->core.width / 2;
     center_y = w->core.height / 2;
     radius_x = center_x - w->tachometer.internal_border;
@@ -354,21 +337,17 @@ static void DrawNeedle(TachometerWidget w, int load)
     points[3].y = (short)(cos(cur_theta5) * radius_y * 0.1 + center_y);
     points[4].x = (short)(sin(cur_theta3) * radius_x * 0.7 + center_x);
     points[4].y = (short)(cos(cur_theta3) * radius_y * 0.7 + center_y);
-    /*@ -usedef @*/
     points[5].x = points[0].x;
     points[5].y = points[0].y;
-    /*@ +usedef @*/
 
     (void)XDrawLines(XtDisplay(w), XtWindow(w),
 		     w->tachometer.needle_GC, points, 6, CoordModeOrigin);
-    /*@ +type +unsignedcompare +compdef @*/
 }
 
 static void DrawTachometer(TachometerWidget w)
 {
     Cardinal center_x, center_y, radius_x, radius_y;
 
-    /*@ -type -unsignedcompare -compdef @*/
     center_x = w->core.width / 2;
     center_y = w->core.height / 2;
     radius_x = center_x - w->tachometer.internal_border;
@@ -391,7 +370,6 @@ static void DrawTachometer(TachometerWidget w)
     /* Draw the details */
     DrawGauge(w);
     DrawNeedle(w, w->tachometer.value);
-    /*@ +type +unsignedcompare +compdef @*/
 }
 
 static void MoveNeedle(TachometerWidget w, int new)
@@ -408,7 +386,6 @@ static void MoveNeedle(TachometerWidget w, int new)
     else
 	step = (w->tachometer.speed ? -w->tachometer.speed : new - old);
 
-    /*@ -usedef @*/
     if (old < new) {
 	for (loop = old; loop < new; loop += step)
 	    DrawNeedle(w, loop);
@@ -423,7 +400,6 @@ static void MoveNeedle(TachometerWidget w, int new)
 
     if (loop != new + step)	/* The final needle wasn't printed */
 	DrawNeedle(w, new);
-    /*@ +usedef @*/
 
     w->tachometer.value = new;
 }
@@ -435,11 +411,9 @@ static void GetneedleGC(TachometerWidget ta)
     values.background = ta->core.background_pixel;
     values.foreground = ta->tachometer.needle ^ ta->core.background_pixel;
     values.function = GXxor;
-    /*@ -type -compdef -mustfreeonly @*/
     ta->tachometer.needle_GC = XtGetGC((Widget) ta,
 				       (unsigned)GCFunction | GCBackground |
 				       GCForeground, &values);
-    /*@ +type +compdef +mustfreeonly @*/
 }
 
 static void GetscaleGC(TachometerWidget ta)
@@ -448,11 +422,9 @@ static void GetscaleGC(TachometerWidget ta)
 
     values.foreground = ta->tachometer.scale;
     values.background = ta->core.background_pixel;
-    /*@ -type -compdef -mustfreeonly @*/
     ta->tachometer.scale_GC = XtGetGC((Widget) ta,
 				      (unsigned)GCForeground | GCBackground,
 				      &values);
-    /*@ +type +compdef +mustfreeonly @*/
 }
 
 static void GetcircleGC(TachometerWidget ta)
@@ -461,11 +433,9 @@ static void GetcircleGC(TachometerWidget ta)
 
     values.foreground = ta->tachometer.circle;
     values.background = ta->core.background_pixel;
-    /*@ -type -compdef -mustfreeonly @*/
     ta->tachometer.circle_GC = XtGetGC((Widget) ta,
 				       (unsigned)GCForeground | GCBackground,
 				       &values);
-    /*@ +type +compdef +mustfreeonly @*/
 }
 
 static void GetbackgroundGC(TachometerWidget ta)
@@ -474,11 +444,9 @@ static void GetbackgroundGC(TachometerWidget ta)
 
     values.foreground = ta->core.background_pixel;
     values.background = ta->core.background_pixel;
-    /*@ -type -compdef -mustfreeonly @*/
     ta->tachometer.background_GC = XtGetGC((Widget) ta,
 					   (unsigned)GCForeground |
 					   GCBackground, &values);
-    /*@ +type +compdef +mustfreeonly @*/
 }
 
 static void Initialize(Widget request UNUSED, Widget new)
@@ -531,7 +499,6 @@ static void Resize(Widget w)
 static Boolean SetValues(Widget current, Widget request UNUSED, Widget new)
 /* Set specified arguments into widget */
 {
-    /*@ -type -boolops -predboolothers @*/
     Boolean back, changed = (Boolean) False;
 
     TachometerWidget curta = (TachometerWidget) current;
@@ -562,7 +529,6 @@ static Boolean SetValues(Widget current, Widget request UNUSED, Widget new)
 	MoveNeedle(newta, newta->tachometer.value);
 	changed = True;
     }
-    /*@ +type +boolops +predboolothers @*/
 
     return (changed);
 }
diff --git a/ais_json.c b/ais_json.c
index e2cc9745..59cf0afa 100644
--- a/ais_json.c
+++ b/ais_json.c
@@ -23,11 +23,10 @@ representations to libgps structures.
 #include "libgps.h"
 
 /* kluge because we don't want to include gpsd.h here */
-extern int gpsd_hexpack(/*@in@*/const char *, /*@out@*/char *, size_t);
+extern int gpsd_hexpack(const char *, char *, size_t);
 
-/*@ -mustdefine @*/
 static void lenhex_unpack(const char *from,
-			  size_t * plen, /*@out@*/ char *to, size_t maxlen)
+			  size_t * plen, char *to, size_t maxlen)
 {
     char *colon = strchr(from, ':');
 
@@ -36,16 +35,13 @@ static void lenhex_unpack(const char *from,
 	(void)gpsd_hexpack(colon + 1, to, maxlen);
 }
 
-/*@ +mustdefine @*/
 
 int json_ais_read(const char *buf,
 		  char *path, size_t pathlen, struct ais_t *ais,
-		  /*@null@*/ const char **endptr)
+		  const char **endptr)
 {
     /* collected but not actually used yet */
     bool scaled;
-    /*@-compdef@*//* splint is confused by storage declared in the .i file */
-    /*@-nullstate@*/
 
 #define AIS_HEADER \
 	{"class",          t_check,    .dflt.check = "AIS"}, \
@@ -82,7 +78,6 @@ int json_ais_read(const char *buf,
 
     memset(ais, '\0', sizeof(struct ais_t));
 
-    /*@-usedef@*/
     if (strstr(buf, "\"type\":1,") != NULL
 	|| strstr(buf, "\"type\":2,") != NULL
 	|| strstr(buf, "\"type\":3,") != NULL) {
@@ -464,7 +459,6 @@ int json_ais_read(const char *buf,
 	return JSON_ERR_MISC;
     }
     return status;
-    /*@+compdef +usedef +nullstate@*/
 }
 #endif /* SOCKET_EXPORT_ENABLE */
 
diff --git a/bits.c b/bits.c
index cae3db17..ed6744c0 100644
--- a/bits.c
+++ b/bits.c
@@ -25,21 +25,19 @@ uint64_t ubits(unsigned char buf[], unsigned int start, unsigned int width, bool
     unsigned int i;
     unsigned end;
 
-    /*@i1@*/ assert(width <= sizeof(uint64_t) * CHAR_BIT);
+    assert(width <= sizeof(uint64_t) * CHAR_BIT);
     for (i = start / CHAR_BIT;
 	 i < (start + width + CHAR_BIT - 1) / CHAR_BIT; i++) {
-	/*@i1@*/ fld <<= CHAR_BIT;
+	fld <<= CHAR_BIT;
 	fld |= (unsigned char)buf[i];
     }
 
     end = (start + width) % CHAR_BIT;
     if (end != 0) {
-	/*@i1@*/ fld >>= (CHAR_BIT - end);
+	fld >>= (CHAR_BIT - end);
     }
 
-    /*@ -shiftimplementation @*/
     fld &= ~(-1LL << width);
-    /*@ +shiftimplementation @*/
 
     /* was extraction as a little-endian requested? */
     if (le)
@@ -69,14 +67,10 @@ int64_t sbits(signed char buf[], unsigned int start, unsigned int width, bool le
        is undefined for width <= 0 */
     assert(width > 0);
 
-    /*@ +relaxtypes */
     if (fld & (1LL << (width - 1))) {
-	/*@ -shiftimplementation @*/
 	fld |= (-1LL << (width - 1));
-	/*@ +shiftimplementation @*/
     }
     return (int64_t)fld;
-    /*@ -relaxtypes */
 }
 
 union int_float {
@@ -126,15 +120,12 @@ void putbef32(char *buf, int off, float val)
     union int_float i_f;
 
     i_f.f = val;
-    /*@-shiftimplementation +ignoresigns@*/
     putbe32(buf, off, i_f.i);
-    /*@+shiftimplementation -ignoresigns@*/
 }
 
 
 void shiftleft(unsigned char *data, int size, unsigned short left)
 {
-    /*@+matchanyintegral +ignoresigns -type -shiftnegative@*/
     unsigned char *byte;
 
     if (left >= CHAR_BIT) {
@@ -153,7 +144,6 @@ void shiftleft(unsigned char *data, int size, unsigned short left)
       *byte <<= left;
       *byte |= bits;
     }
-    /*@-matchanyintegral -ignoresigns +type +shiftnegative@*/
 }
 
 #ifdef __UNUSED__
@@ -162,10 +152,8 @@ void putbed64(char *buf, int off, double val)
     union long_double l_d;
 
     l_d.d = val;
-    /*@-shiftimplementation +ignoresigns@*/
     putbe32(buf, (off), (l_d.l) >> 32);
     putbe32(buf, (off)+4, (l_d.l));
-    /*@+shiftimplementation -ignoresigns@*/
 }
 
 u_int16_t swap_u16(u_int16_t i)
diff --git a/bsd_base64.c b/bsd_base64.c
index e3810ac6..a5301f0f 100644
--- a/bsd_base64.c
+++ b/bsd_base64.c
@@ -118,7 +118,6 @@ static const char Pad64 = '=';
 	   characters followed by one "=" padding character.
    */
 
-/*@ +matchanyintegral -type @*/
 int
 b64_ntop(unsigned char const *src, size_t srclength, char *target,
 	 size_t targsize)
diff --git a/cgps.c b/cgps.c
index 4c445702..ec3fe60d 100644
--- a/cgps.c
+++ b/cgps.c
@@ -93,9 +93,7 @@
 #include <curses.h>
 #include <time.h>
 #include <signal.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 #include <ctype.h>
 
 #include "gpsd_config.h"
@@ -174,7 +172,6 @@ static void die(int sig)
 
 static enum deg_str_type deg_type = deg_dd;
 
-/*@ -globstate @*/
 static void windowsetup(void)
 /* inotialize curses and set up screen windows */
 {
@@ -217,9 +214,7 @@ static void windowsetup(void)
 	    (void)mvprintw(0, 0,
 			   "Your screen must be at least 80x%d to run cgps.",
 			   MIN_COMPASS_DATAWIN_SIZE);
-	    /*@ -nullpass @*/
 	    (void)refresh();
-	    /*@ +nullpass @*/
 	    (void)sleep(5);
 	    die(0);
 	}
@@ -242,9 +237,7 @@ static void windowsetup(void)
 	    (void)mvprintw(0, 0,
 			   "Your screen must be at least 80x%d to run cgps.",
 			   MIN_GPS_DATAWIN_SIZE);
-	    /*@ -nullpass @*/
 	    (void)refresh();
-	    /*@ +nullpass @*/
 	    (void)sleep(5);
 	    die(0);
 	}
@@ -256,20 +249,16 @@ static void windowsetup(void)
     if (compass_flag) {
 	/* We're a compass, set up accordingly. */
 
-	/*@ -onlytrans @*/
 	datawin = newwin(window_length, DATAWIN_WIDTH, 0, 0);
 	(void)nodelay(datawin, (bool) TRUE);
 	if (raw_flag) {
 	    messages = newwin(0, 0, window_length, 0);
 
-	    /*@ +onlytrans @*/
 	    (void)scrollok(messages, true);
 	    (void)wsetscrreg(messages, 0, ysize - (window_length));
 	}
 
-	/*@ -nullpass @*/
 	(void)refresh();
-	/*@ +nullpass @*/
 
 	/* Do the initial field label setup. */
 	(void)mvwprintw(datawin, 1, DATAWIN_DESC_OFFSET, "Time:");
@@ -285,7 +274,6 @@ static void windowsetup(void)
     {
 	/* We're a GPS, set up accordingly. */
 
-	/*@ -onlytrans @*/
 	datawin = newwin(window_length, DATAWIN_WIDTH, 0, 0);
 	satellites =
 	    newwin(window_length, SATELLITES_WIDTH, 0, DATAWIN_WIDTH);
@@ -294,14 +282,11 @@ static void windowsetup(void)
 	    messages =
 		newwin(ysize - (window_length), xsize, window_length, 0);
 
-	    /*@ +onlytrans @*/
 	    (void)scrollok(messages, true);
 	    (void)wsetscrreg(messages, 0, ysize - (window_length));
 	}
 
-	/*@ -nullpass @*/
 	(void)refresh();
-	/*@ +nullpass @*/
 
 	/* Do the initial field label setup. */
 	(void)mvwprintw(datawin, 1, DATAWIN_DESC_OFFSET, "Time:");
@@ -341,7 +326,6 @@ static void windowsetup(void)
     }
 }
 
-/*@ +globstate @*/
 
 static void resize(int sig UNUSED)
 /* cope with terminal resize */
@@ -408,7 +392,6 @@ static void update_compass_panel(struct gps_data_t *gpsdata)
 }
 #endif /* TRUENORTH */
 
-/*@-mustfreefresh@*/
 static void update_gps_panel(struct gps_data_t *gpsdata)
 /* This gets called once for each new GPS sentence. */
 {
@@ -623,24 +606,20 @@ static void update_gps_panel(struct gps_data_t *gpsdata)
 	(void)mvwprintw(datawin, 14, DATAWIN_VALUE_OFFSET + 5, "%-*s", 22,
 			scr);
 	/* Fill in the grid square (esr thought *this* one was interesting). */
-	/*@-branchstate@*/
 	if (isnan(gpsdata->fix.longitude)==0 && isnan(gpsdata->fix.latitude)==0)
 	    s = maidenhead(gpsdata->fix.latitude,gpsdata->fix.longitude);
 	else
 	    s = "n/a";
 	(void)mvwprintw(datawin, 15, DATAWIN_VALUE_OFFSET + 5, "%-*s", 22, s);
-	/*@+branchstate@*/
     }
 
     /* Be quiet if the user requests silence. */
-    /*@-modobserver@*/
     if (!silent_flag && raw_flag && (s = (char *)gps_data(gpsdata)) != NULL) {
 	char *p;
 	for (p = s + strlen(s); --p > s && isspace((unsigned char) *p); *p = '\0')
 	    ;
 	(void)wprintw(messages, "%s\n", s);
     }
-    /*@+modobserver@*/
 
     /* Reset the status_timer if the state has changed. */
     if (newstate != state) {
@@ -654,7 +633,6 @@ static void update_gps_panel(struct gps_data_t *gpsdata)
 	(void)wrefresh(messages);
     }
 }
-/*@+mustfreefresh@*/
 
 static void usage(char *prog)
 {
@@ -684,7 +662,6 @@ int main(int argc, char *argv[])
     unsigned int flags = WATCH_ENABLE;
     int wait_clicks = 0;  /* cycles to wait before gpsd timeout */
 
-    /*@ -observertrans @*/
     switch (gpsd_units()) {
     case imperial:
 	altfactor = METERS_TO_FEET;
@@ -708,7 +685,6 @@ int main(int argc, char *argv[])
 	/* leave the default alone */
 	break;
     }
-    /*@ +observertrans @*/
 
     /* Process the options.  Print help if requested. */
     while ((option = getopt(argc, argv, "hVl:smu:D:")) != -1) {
@@ -726,7 +702,6 @@ int main(int argc, char *argv[])
 	    silent_flag = true;
 	    break;
 	case 'u':
-	    /*@ -observertrans @*/
 	    switch (optarg[0]) {
 	    case 'i':
 		altfactor = METERS_TO_FEET;
@@ -750,7 +725,6 @@ int main(int argc, char *argv[])
 		(void)fprintf(stderr, "Unknown -u argument: %s\n", optarg);
 	    }
 	    break;
-	    /*@ +observertrans @*/
 	case 'V':
 	    (void)fprintf(stderr, "%s: %s (revision %s)\n",
 			  argv[0], VERSION, REVISION);
@@ -768,7 +742,6 @@ int main(int argc, char *argv[])
 		continue;
 	    default:
 		(void)fprintf(stderr, "Unknown -l argument: %s\n", optarg);
-		/*@ -casebreak @*/
 	    }
 	    break;
 	case 'h':
diff --git a/compiler.h b/compiler.h
index 53902dc2..837c9354 100644
--- a/compiler.h
+++ b/compiler.h
@@ -65,22 +65,19 @@
         assert(locresult != -23); \
     } while (0)
 
-#ifndef S_SPLINT_S
 #ifdef HAVE_STDATOMIC_H
 #ifndef __COVERITY__	/* Coverity is confused by a GNU typedef */
 #include <stdatomic.h>
 #endif /* __COVERITY__ */
 #endif /* HAVE_STDATOMIC_H */
-#endif /* S_SPLINT_S */
 
 #ifdef HAVE_OSATOMIC_H
 #include <libkern/OSAtomic.h>
 #endif /* HAVE_STDATOMIC_H */
 
-static /*@unused@*/ inline void memory_barrier(void)
+static inline void memory_barrier(void)
 /* prevent instruction reordering across any call to this function */
 {
-#ifndef S_SPLINT_S
 #ifdef _STDATOMIC_H
 #ifndef __COVERITY__
     atomic_thread_fence(memory_order_seq_cst);
@@ -90,7 +87,6 @@ static /*@unused@*/ inline void memory_barrier(void)
 #elif defined(__GNUC__)
     asm volatile ("" : : : "memory");
 #endif /* STD_ATOMIC_H */
-#endif /* S_SPLINT_S */
 }
 
 #endif /* _GPSD_COMPILER_H_ */
diff --git a/daemon.c b/daemon.c
index f8804586..be1a90c2 100644
--- a/daemon.c
+++ b/daemon.c
@@ -2,9 +2,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd_config.h"
 #ifndef HAVE_DAEMON
@@ -21,7 +19,6 @@ int daemon(int nochdir, int noclose)
 {
     int fd;
 
-    /*@ -type @*//* weirdly, splint 3.1.2 is confused by fork() */
     switch (fork()) {
     case -1:
 	return -1;
@@ -30,13 +27,11 @@ int daemon(int nochdir, int noclose)
     default:			/* parent side */
 	exit(EXIT_SUCCESS);
     }
-    /*@ +type @*/
 
     if (setsid() == -1)
 	return -1;
     if ((nochdir==0) && (chdir("/") == -1))
 	return -1;
-    /*@ -nullpass @*/
     if ((noclose==0) && (fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) {
 	(void)dup2(fd, STDIN_FILENO);
 	(void)dup2(fd, STDOUT_FILENO);
@@ -44,7 +39,6 @@ int daemon(int nochdir, int noclose)
 	if (fd > 2)
 	    (void)close(fd);
     }
-    /*@ +nullpass @*/
     /* coverity[leaked_handle] Intentional handle duplication */
     return 0;
 }
diff --git a/dbusexport.c b/dbusexport.c
index e774dd21..07f9ab61 100644
--- a/dbusexport.c
+++ b/dbusexport.c
@@ -3,7 +3,7 @@
  * BSD terms apply: see the file COPYING in the distribution root for details.
  */
 #include "gpsd.h"
-#if defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S)
+#if defined(DBUS_EXPORT_ENABLE)
 #include <dbus/dbus.h>
 
 static DBusConnection *connection = NULL;
@@ -72,4 +72,4 @@ void send_dbus_fix(struct gps_device_t *channel)
     dbus_message_unref(message);
 }
 
-#endif /* defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S) */
+#endif /* defined(DBUS_EXPORT_ENABLE) */
diff --git a/driver_ais.c b/driver_ais.c
index efc897de..20b4a6ad 100644
--- a/driver_ais.c
+++ b/driver_ais.c
@@ -29,14 +29,8 @@
 static void from_sixbit(unsigned char *bitvec, uint start, int count, char *to)
 /* beginning at bitvec bit start, unpack count sixbit characters */
 {
-    /*@ +type @*/
-#ifdef S_SPLINT_S
-    /* the real string causes a splint internal error */
-    const char sixchr[] = "abcd";
-#else
     const char sixchr[64] =
 	"@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_ !\"#$%&'()*+,-./0123456789:;<=>?";
-#endif /* S_SPLINT_S */
     int i;
 
     /* six-bit to ASCII */
@@ -55,10 +49,8 @@ static void from_sixbit(unsigned char *bitvec, uint start, int count, char *to)
 	    to[i] = '\0';
 	else
 	    break;
-    /*@ -type @*/
 }
 
-/*@ +charint @*/
 bool ais_binary_decode(const struct gpsd_errout_t *errout,
 		       struct ais_t *ais,
 		       const unsigned char *bits, size_t bitlen,
@@ -67,9 +59,6 @@ bool ais_binary_decode(const struct gpsd_errout_t *errout,
 {
     unsigned int u; int i;
 
-#ifdef S_SPLINT_S
-    assert(type24_queue != NULL);
-#endif /* S_SPLINT_S */
 #define UBITS(s, l)	ubits((unsigned char *)bits, s, l, false)
 #define SBITS(s, l)	sbits((signed char *)bits, s, l, false)
 #define UCHARS(s, to)	from_sixbit((unsigned char *)bits, s, sizeof(to)-1, to)
@@ -439,12 +428,10 @@ bool ais_binary_decode(const struct gpsd_errout_t *errout,
 		mmsi[u] = UBITS(40 + 32*u, 30);
 	    else
 		mmsi[u] = 0;
-	/*@ -usedef @*/
 	ais->type7.mmsi1 = mmsi[0];
 	ais->type7.mmsi2 = mmsi[1];
 	ais->type7.mmsi3 = mmsi[2];
 	ais->type7.mmsi4 = mmsi[3];
-	/*@ +usedef @*/
 	break;
     }
     case 8: /* Binary Broadcast Message */
@@ -1098,6 +1085,5 @@ bool ais_binary_decode(const struct gpsd_errout_t *errout,
     /* data is fully decoded */
     return true;
 }
-/*@ -charint @*/
 
 /* driver_ais.c ends here */
diff --git a/driver_evermore.c b/driver_evermore.c
index 38d4eeaf..ba10611a 100644
--- a/driver_evermore.c
+++ b/driver_evermore.c
@@ -138,7 +138,6 @@
 
 #ifdef __UNUSED__
 
-/*@ +charint @*/
 gps_mask_t evermore_parse(struct gps_device_t * session, unsigned char *buf,
 			  size_t len)
 {
@@ -159,7 +158,6 @@ gps_mask_t evermore_parse(struct gps_device_t * session, unsigned char *buf,
     datalen = (size_t) * cp++;
     datalen -= 2;
 
-    /*@ -usedef @*/
     /* prevent 'Assigned value is garbage or undefined' from scan-build */
     memset(buf2, '\0', sizeof(buf2));
     tp = buf2;
@@ -170,12 +168,9 @@ gps_mask_t evermore_parse(struct gps_device_t * session, unsigned char *buf,
 	tp++;
     }
     type = (unsigned char)getub(buf2, 0);
-    /*@ +usedef @*/
 
-    /*@ -usedef -compdef @*/
     gpsd_log(&session->context->errout, LOG_RAW,
 	     "EverMore packet type 0x%02x (%zd bytes)\n", type, tp-buf2);
-    /*@ +usedef +compdef @*/
 
     session->cycle_end_reliable = true;
 
@@ -380,7 +375,6 @@ gps_mask_t evermore_parse(struct gps_device_t * session, unsigned char *buf,
     }
 }
 
-/*@ -charint @*/
 
 static gps_mask_t evermore_parse_input(struct gps_device_t *session)
 {
@@ -403,7 +397,6 @@ static gps_mask_t evermore_parse_input(struct gps_device_t *session)
 
 #endif /* __UNUSED__ */
 
-/*@ +charint -usedef -compdef @*/
 static ssize_t evermore_control_send(struct gps_device_t *session, char *buf,
 				     size_t len)
 {
@@ -411,7 +404,6 @@ static ssize_t evermore_control_send(struct gps_device_t *session, char *buf,
     size_t i;
     char *cp;
 
-    /*@ +charint +ignoresigns @*/
     /* prepare a DLE-stuffed copy of the message */
     cp = session->msgbuf;
     *cp++ = 0x10;		/* message starts with DLE STX */
@@ -442,16 +434,13 @@ static ssize_t evermore_control_send(struct gps_device_t *session, char *buf,
     *cp++ = 0x03;
 
     session->msgbuflen = (size_t) (cp - session->msgbuf);
-    /*@ -charint -ignoresigns @*/
 
     return gpsd_write(session, session->msgbuf, session->msgbuflen);
 }
 
-/*@ -charint +usedef +compdef @*/
 
 static bool evermore_protocol(struct gps_device_t *session, int protocol)
 {
-    /*@ +charint @*/
     char tmp8;
     char evrm_protocol_config[] = {
 	(char)0x84,		/* 0: msg ID, Protocol Configuration */
@@ -459,10 +448,9 @@ static bool evermore_protocol(struct gps_device_t *session, int protocol)
 	(char)0x00,		/* 2: reserved */
 	(char)0x00,		/* 3: reserved */
     };
-    /*@ -charint @*/
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "evermore_protocol(%d)\n", protocol);
-    /*@i1@*/ tmp8 = (protocol != 0) ? 1 : 0;
+    tmp8 = (protocol != 0) ? 1 : 0;
     /* NMEA : binary */
     evrm_protocol_config[1] = tmp8;
     return (evermore_control_send
@@ -476,7 +464,6 @@ static bool evermore_nmea_config(struct gps_device_t *session, int mode)
 /* mode = 2 : EverMore search, activate PEMT101 message */
 {
     unsigned char tmp8;
-    /*@ +charint */
     unsigned char evrm_nmeaout_config[] = {
 	0x8e,			/*  0: msg ID, NMEA Message Control */
 	0xff,			/*  1: NMEA sentence bitmask, GGA(0), GLL(1), GSA(2), GSV(3), ... */
@@ -490,13 +477,12 @@ static bool evermore_nmea_config(struct gps_device_t *session, int mode)
 	0,			/*  9: PEMT,101, interval 0-255s */
 	0, 0, 0, 0, 0, 0,	/* 10-15: reserved */
     };
-    /*@ -charint */
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "evermore_nmea_config(%d)\n", mode);
-    /*@i1@*/ tmp8 = (mode == 1) ? 5 : 1;
+    tmp8 = (mode == 1) ? 5 : 1;
     /* NMEA GPGSV, gpsd  */
     evrm_nmeaout_config[6] = tmp8;	/* GPGSV, 1s or 5s */
-    /*@i1@*/ tmp8 = (mode == 2) ? 1 : 0;
+    tmp8 = (mode == 2) ? 1 : 0;
     /* NMEA PEMT101 */
     evrm_nmeaout_config[9] = tmp8;	/* PEMT101, 1s or 0s */
     return (evermore_control_send(session, (char *)evrm_nmeaout_config,
@@ -548,7 +534,6 @@ static void evermore_event_hook(struct gps_device_t *session, event_t event)
 static bool evermore_speed(struct gps_device_t *session,
 			   speed_t speed, char parity, int stopbits)
 {
-    /*@ -type @*/
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "evermore_speed(%u%c%d)\n", (unsigned int)speed, parity,
 	     stopbits);
@@ -584,13 +569,11 @@ static bool evermore_speed(struct gps_device_t *session,
 	return (evermore_control_send(session, (char *)msg, sizeof(msg)) !=
 		-1);
     }
-    /*@ +type @*/
 }
 
 static bool evermore_rate_switcher(struct gps_device_t *session, double rate)
 /* change the sample rate of the GPS */
 {
-    /*@ +charint @*/
     if (rate < 1 || rate > 10) {
 	gpsd_log(&session->context->errout, LOG_ERROR,
 		 "valid rate range is 1-10.\n");
@@ -606,7 +589,6 @@ static bool evermore_rate_switcher(struct gps_device_t *session, double rate)
 	return (evermore_control_send(session, (char *)evrm_rate_config,
 				      sizeof(evrm_rate_config)) != -1);
     }
-    /*@ -charint @*/
 }
 #endif /* RECONFIGURE_ENABLE */
 
diff --git a/driver_garmin.c b/driver_garmin.c
index 21025468..36c0806f 100644
--- a/driver_garmin.c
+++ b/driver_garmin.c
@@ -85,9 +85,7 @@
 #include <string.h>
 #include <errno.h>
 #include <time.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd_config.h"
 
@@ -322,7 +320,6 @@ gps_mask_t PrintSERPacket(struct gps_device_t *session, unsigned char pkt_id,
 	break;
     case GARMIN_PKTID_L001_COMMAND_DATA:
 	prod_id = get_uint16((uint8_t *) buf);
-	/*@ -branchstate @*/
 	switch (prod_id) {
 	case CMND_ABORT:
 	    msg = "Abort current xfer";
@@ -342,7 +339,6 @@ gps_mask_t PrintSERPacket(struct gps_device_t *session, unsigned char pkt_id,
 	    msg = msg_buf;
 	    break;
 	}
-	/*@ +branchstate @*/
 	gpsd_log(&session->context->errout, LOG_PROG,
 		 "Garmin: Appl, Command Data: %s\n", msg);
 	break;
@@ -625,7 +621,6 @@ gps_mask_t PrintSERPacket(struct gps_device_t *session, unsigned char pkt_id,
 
 
 #if defined(HAVE_LIBUSB)
-/*@ -branchstate @*/
 // This works around cppcheck not looking into enough config branches
 // cppcheck-suppress unusedFunction
 static gps_mask_t PrintUSBPacket(struct gps_device_t *session, Packet_t * pkt)
@@ -732,11 +727,10 @@ static gps_mask_t PrintUSBPacket(struct gps_device_t *session, Packet_t * pkt)
     return mask;
 }
 
-/*@ +branchstate @*/
 #endif /* HAVE_LIBUSB */
 
 
-#if defined(HAVE_LIBUSB) && (defined(__linux__) || defined(S_SPLINT_S))
+#if defined(HAVE_LIBUSB) && defined(__linux__)
 /* build and send a packet w/ USB protocol */
 static void Build_Send_USB_Packet(struct gps_device_t *session,
 				  uint32_t layer_id, uint32_t pkt_id,
@@ -776,7 +770,7 @@ static void Build_Send_USB_Packet(struct gps_device_t *session,
 	(void)gpsd_write(session, n, 0);
     }
 }
-#endif /* HAVE_LIBUSB && (__linux__ || S_SPLINT_S) */
+#endif /* HAVE_LIBUSB && __linux__ */
 
 /* build and send a packet in serial protocol */
 /* layer_id unused */
@@ -848,7 +842,6 @@ static void Build_Send_SER_Packet(struct gps_device_t *session,
  *
  * libudev: http://www.kernel.org/pub/linux/utils/kernel/hotplug/libudev/
  */
-/*@-compdef -usedef -nullpass@*/
 // This works around cppcheck not looking into enough config branches
 // cppcheck-suppress unusedFunction
 static bool is_usb_device(const char *path UNUSED, int vendor, int product,
@@ -902,7 +895,6 @@ static bool is_usb_device(const char *path UNUSED, int vendor, int product,
     return found;
 }
 
-/*@-compdef -usedef -nullpass@*/
 #endif /* HAVE_LIBUSB */
 
 /*
@@ -932,7 +924,7 @@ static bool is_usb_device(const char *path UNUSED, int vendor, int product,
  */
 static bool garmin_usb_detect(struct gps_device_t *session UNUSED)
 {
-#if defined(__linux__) || defined(S_SPLINT_S)
+#if defined(__linux__)
     /*
      * Only perform this check if we're looking at a USB-serial
      * device.  This prevents drivers for attached serial GPSes
@@ -977,7 +969,7 @@ static bool garmin_usb_detect(struct gps_device_t *session UNUSED)
     }
 #else
     return false;
-#endif /* __linux__ || S_SPLINT_S */
+#endif /* __linux__ */
 }
 
 static void garmin_event_hook(struct gps_device_t *session, event_t event)
@@ -1021,7 +1013,6 @@ static void garmin_event_hook(struct gps_device_t *session, event_t event)
 #define Send_ACK()    Build_Send_SER_Packet(session, 0, ACK, 0, 0)
 #define Send_NAK()    Build_Send_SER_Packet(session, 0, NAK, 0, 0)
 
-/*@ +charint @*/
 gps_mask_t garmin_ser_parse(struct gps_device_t *session)
 {
     unsigned char *buf = session->lexer.outbuffer;
@@ -1154,7 +1145,6 @@ gps_mask_t garmin_ser_parse(struct gps_device_t *session)
     }
 
     /* debug */
-    /*@ -usedef -compdef @*/
     for (i = 0; i < data_index; i++) {
 	gpsd_log(&session->context->errout, LOG_RAW + 1,
 		 "Garmin: Char: %#02x\n", data_buf[i]);
@@ -1170,35 +1160,29 @@ gps_mask_t garmin_ser_parse(struct gps_device_t *session)
     // so send ACK last, after a pause
     (void)usleep(300);
     Send_ACK();
-    /*@ +usedef +compdef @*/
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "Garmin: garmin_ser_parse( )\n");
     return mask;
 }
 
-/*@ -charint @*/
 
 #ifdef RECONFIGURE_ENABLE
 static void settle(void)
 {
     struct timespec delay, rem;
-    /*@ -type -unrecog @*/
     memset(&delay, 0, sizeof(delay));
     delay.tv_sec = 0;
     delay.tv_nsec = 333000000L;
     nanosleep(&delay, &rem);
-    /*@ +type +unrecog @*/
 }
 
 static void garmin_switcher(struct gps_device_t *session, int mode)
 {
     if (mode == MODE_NMEA) {
-	/*@ +charint @*/
 	const char switcher[] =
 	    { 0x10, 0x0A, 0x02, 0x26, 0x00, 0xCE, 0x10, 0x03 };
 	// Note hard-coded string length in the next line...
 	ssize_t status = gpsd_write(session, switcher, sizeof(switcher));
-	/*@ -charint @*/
 	if (status == (ssize_t)sizeof(switcher)) {
 	    gpsd_log(&session->context->errout, LOG_PROG,
 		     "Garmin: => GPS: turn off binary %02x %02x %02x... \n",
@@ -1227,11 +1211,9 @@ static ssize_t garmin_control_send(struct gps_device_t *session,
 				   char *buf, size_t buflen)
 /* not used by the daemon, it's for gpsctl and friends */
 {
-    /*@ -mayaliasunique @*/
     session->msgbuflen = buflen;
     (void)memcpy(session->msgbuf, buf, buflen);
     return gpsd_write(session, session->msgbuf, session->msgbuflen);
-    /*@ +mayaliasunique @*/
 }
 #endif /* CONTROLSEND_ENABLE */
 
@@ -1344,12 +1326,10 @@ static int GetPacket(struct gps_device_t *session)
 	}
 
 
-	/*@ ignore @*/
 	delay.tv_sec = 0;
 	delay.tv_nsec = 3330000L;
 	while (nanosleep(&delay, &rem) == -1)
 	    continue;
-	/*@ end @*/
     }
     // dump the individual bytes, debug only
     // for ( x = 0; x < session->driver.garmin.BufferLen; x++ ) {
diff --git a/driver_garmin_txt.c b/driver_garmin_txt.c
index adeaf361..d7781159 100644
--- a/driver_garmin_txt.c
+++ b/driver_garmin_txt.c
@@ -141,7 +141,7 @@ invalid data.
 **************************************************************************/
 static int gar_decode(const struct gps_context_t *context,
 		      const char *data, const size_t length, 
-		      const char *prefix, const double dividor,	/*@out@*/
+		      const char *prefix, const double dividor,
 		      double *result)
 {
     char buf[10];
@@ -150,8 +150,6 @@ static int gar_decode(const struct gps_context_t *context,
     int offset = 1;		/* assume one character prefix (E,W,S,N,U,D, etc) */
     long int intresult;
 
-    /* splint is buggy here, thinks buf can be a null pointer */
-    /*@ -mustdefine -nullderef -nullpass @*/
     if (length >= sizeof(buf)) {
 	gpsd_log(&context->errout, LOG_ERROR, "internal buffer too small\n");
 	return -1;
@@ -196,7 +194,6 @@ static int gar_decode(const struct gps_context_t *context,
 	gpsd_log(&context->errout, LOG_WARN, "Invalid value %s\n", buf);
 	return -1;
     }
-    /*@ +mustdefine +nullderef +nullpass @*/
 
     intresult = atol(buf + offset);
     if (intresult == 0L)
@@ -216,12 +213,11 @@ static int gar_decode(const struct gps_context_t *context,
 static int gar_int_decode(const struct gps_context_t *context,
 			  const char *data, const size_t length,
 			  const unsigned int min, const unsigned int max,
-			  /*@out@*/ unsigned int *result)
+			  unsigned int *result)
 {
     char buf[6];
     unsigned int res;
 
-    /*@ -mustdefine @*/
     if (length >= sizeof(buf)) {
 	gpsd_log(&context->errout, LOG_ERROR, "internal buffer too small\n");
 	return -1;
@@ -236,7 +232,6 @@ static int gar_int_decode(const struct gps_context_t *context,
 	return -2;
     }
 
-    /*@ -nullpass @*//* splint bug */
     if (strspn(buf, "0123456789") != length) {
 	gpsd_log(&context->errout, LOG_WARN, "Invalid value %s\n", buf);
 	return -1;
@@ -252,7 +247,6 @@ static int gar_int_decode(const struct gps_context_t *context,
 		 max);
 	return -1;
     }
-    /*@ +mustdefine +nullpass @*/
 }
 
 
diff --git a/driver_geostar.c b/driver_geostar.c
index 03df4bc2..60d80eb4 100644
--- a/driver_geostar.c
+++ b/driver_geostar.c
@@ -48,10 +48,8 @@ static int geostar_write(struct gps_device_t *session,
     putbyte(session->msgbuf, 2, 'G');
     putbyte(session->msgbuf, 3, 'G');
 
-    /*@-shiftimplementation +ignoresigns@*/
     putbe16(session->msgbuf, 4, id);
     putbe16(session->msgbuf, 6, len);
-    /*@+shiftimplementation -ignoresigns@*/
 
     /* Copy content */
     memcpy(session->msgbuf + 8, data, len * 4);
@@ -63,9 +61,7 @@ static int geostar_write(struct gps_device_t *session,
 	cs ^= getleu32(session->msgbuf, i * 4);
     }
 
-    /*@-shiftimplementation +ignoresigns@*/
     putle32(session->msgbuf, len * 4, cs);
-    /*@+shiftimplementation -ignoresigns@*/
 
     len += 1; /* Checksum */
 
@@ -96,9 +92,7 @@ static bool geostar_detect(struct gps_device_t *session)
     myfd = session->gpsdata.gps_fd;
 
     /* request firmware revision and look for a valid response */
-    /*@-shiftimplementation +ignoresigns@*/
     putbe32(buf, 0, 0);
-    /*@+shiftimplementation +ignoresigns@*/
     if (geostar_write(session, 0xc1, buf, 1) == 0) {
 	unsigned int n;
 	for (n = 0; n < 3; n++) {
@@ -140,7 +134,6 @@ static gps_mask_t geostar_analyze(struct gps_device_t *session)
 	return 0;
     }
 
-    /*@ +charint @*/
     if (session->lexer.outbuflen < 12 || session->lexer.outbuffer[0] != 'P')
 	return 0;
 
@@ -155,7 +148,6 @@ static gps_mask_t geostar_analyze(struct gps_device_t *session)
 	str_appendf(buf2, sizeof(buf2),
 		       "%02x", buf[len++] = session->lexer.outbuffer[i]);
     }
-    /*@ -charint @*/
 
     id = (unsigned int)getleu16(session->lexer.outbuffer, OFFSET(0));
 
@@ -443,10 +435,8 @@ static gps_mask_t geostar_analyze(struct gps_device_t *session)
 	ul1 = getleu32(buf, OFFSET(2));
 	ul2 = getleu32(buf, OFFSET(3));
 	ul3 = getleu32(buf, OFFSET(4));
-	/*@ -formattype @*/
 	(void)snprintf(session->subtype, sizeof(session->subtype), "%d.%d %d.%d.%d %x %c-%d\n",
 		ul4>>16, ul4&0xFFFF, ul1>>9, (ul1>>5)&0xF, ul1&0x1F, ul2, ul3>>24, ul3&0x00FFFFFF);
-	/*@ +formattype @*/
 	gpsd_log(&session->context->errout, LOG_INF,
 		 "Response to Request FW version command: %s\n",
 		 session->subtype);
@@ -503,11 +493,9 @@ static ssize_t geostar_control_send(struct gps_device_t *session,
 
 static void geostar_init_query(struct gps_device_t *session)
 {
-    /*@-compdef@*/
     unsigned char buf[2 * 4];
     /* Poll Software Version */
     (void)geostar_write(session, 0xc1, buf, 1);
-    /*@+compdef@*/
 }
 
 static void geostar_event_hook(struct gps_device_t *session, event_t event)
@@ -517,7 +505,6 @@ static void geostar_event_hook(struct gps_device_t *session, event_t event)
     if (session->context->readonly)
 	return;
 
-    /*@-shiftimplementation +ignoresigns@*/
     if (event == event_identified || event == event_reactivate) {
 	/* Select binary packets */
 	putbe32(buf, 0, 0xffff0000);
@@ -552,7 +539,6 @@ static void geostar_event_hook(struct gps_device_t *session, event_t event)
 	putbe32(buf, 0, 3);
 	(void)geostar_write(session, 0xc2, buf, 1);
     }
-    /*@+shiftimplementation -ignoresigns@*/
 }
 
 #ifdef RECONFIGURE_ENABLE
@@ -577,12 +563,10 @@ static bool geostar_speed_switch(struct gps_device_t *session,
 	break;
     }
 
-    /*@-shiftimplementation@*/
     putbe32(buf, 0, session->driver.geostar.physical_port);
     putbe32(buf, 4, speed);
     putbe32(buf, 8, stopbits);
     putbe32(buf, 12, parity);
-    /*@+shiftimplementation@*/
     (void)geostar_write(session, 0x41, buf, 4);
 
     return true;	/* it would be nice to error-check this */
@@ -590,7 +574,6 @@ static bool geostar_speed_switch(struct gps_device_t *session,
 
 static void geostar_mode(struct gps_device_t *session, int mode)
 {
-    /*@-shiftimplementation@*/
     if (mode == MODE_NMEA) {
 	unsigned char buf[1 * 4];
 	/* Switch to NMEA mode */
@@ -603,7 +586,6 @@ static void geostar_mode(struct gps_device_t *session, int mode)
 	gpsd_log(&session->context->errout, LOG_ERROR,
 		 "unknown mode %i requested\n", mode);
     }
-    /*@+shiftimplementation@*/
 }
 #endif /* RECONFIGURE_ENABLE */
 
diff --git a/driver_italk.c b/driver_italk.c
index 4c42597d..c24c0346 100644
--- a/driver_italk.c
+++ b/driver_italk.c
@@ -13,9 +13,7 @@
 #include <stdbool.h>
 #include <string.h>
 #include <math.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #if defined(ITRAX_ENABLE) && defined(BINARY_ENABLE)
@@ -259,7 +257,6 @@ static gps_mask_t decode_itk_pseudo(struct gps_device_t *session,
 						 (unsigned short int)getleu16((char *)buf, 7 + 8),
 	(unsigned int)getleu32(buf, 7 + 38) / 1000.0);
 
-    /*@-type@*/
     for (i = 0; i < n; i++){
 	session->gpsdata.skyview[i].PRN = getleu16(buf, 7 + 26 + (i*36)) & 0xff;
 	session->gpsdata.skyview[i].ss = getleu16(buf, 7 + 26 + (i*36 + 2)) & 0x3f;
@@ -272,11 +269,9 @@ static gps_mask_t decode_itk_pseudo(struct gps_device_t *session,
 	session->gpsdata.raw.codephase[i] = NAN;
 	session->gpsdata.raw.deltarange[i] = NAN;
     }
-    /*@+type@*/
     return RAW_IS;
 }
 
-/*@ +charint @*/
 static gps_mask_t italk_parse(struct gps_device_t *session,
 			      unsigned char *buf, size_t len)
 {
@@ -383,7 +378,6 @@ static gps_mask_t italk_parse(struct gps_device_t *session,
     return mask | ONLINE_SET;
 }
 
-/*@ -charint @*/
 
 static gps_mask_t italk_parse_input(struct gps_device_t *session)
 {
diff --git a/driver_navcom.c b/driver_navcom.c
index 661cc854..601ee0ee 100644
--- a/driver_navcom.c
+++ b/driver_navcom.c
@@ -109,7 +109,6 @@ static void navcom_cmd_0x20(struct gps_device_t *session, uint8_t block_id,
 	     "- data block id = %02x at rate %02x\n", block_id, rate);
 }
 
-/*@ unused @*/
 // cppcheck-suppress unusedFunction
 static void UNUSED navcom_cmd_0x3f(struct gps_device_t *session)
 /* Changes the LED settings in the receiver */
@@ -196,7 +195,6 @@ static void navcom_event_hook(struct gps_device_t *session, event_t event)
 	 * unit from more than one port (which is entirely possible
 	 * although not necessarily a bright idea), there is a good
 	 * chance that we might misidentify our port */
-	/*@ +charint @*/
 	navcom_cmd_0x1c(session, 0x02, 0);	/* Test Support Block */
 	navcom_cmd_0x20(session, 0xae, 0x0000);	/* Identification Block */
 	navcom_cmd_0x20(session, 0x86, 0x000a);	/* Channel Status */
@@ -210,7 +208,6 @@ static void navcom_event_hook(struct gps_device_t *session, event_t event)
 	navcom_cmd_0x20(session, 0x86, 0x4000);	/* Channel Status */
 	navcom_cmd_0x20(session, 0x83, 0x4000);	/* Ionosphere and UTC Data */
 	navcom_cmd_0x20(session, 0xef, 0x0bb8);	/* Clock Drift - send every 5 min */
-	/*@ -charint @*/
     }
 }
 
@@ -265,7 +262,6 @@ static gps_mask_t handle_0x83(struct gps_device_t *session)
     uint8_t dn = getub(buf, 29);
     int8_t dtlsf = getsb(buf, 30);
 
-    /*@ +charint +relaxtypes @*/
     /* Ref.: ICD-GPS-200C 20.3.3.5.2.4 */
     if ((week % 256) * 604800 + tow / 1000.0 < wnlsf * 604800 + dn * 86400) {
 	/* Effectivity time is in the future, use dtls */
@@ -274,7 +270,6 @@ static gps_mask_t handle_0x83(struct gps_device_t *session)
 	/* Effectivity time is not in the future, use dtlsf */
 	session->context->leap_seconds = (int)dtlsf;
     }
-    /*@ -relaxtypes -charint @*/
 
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "Navcom: received packet type 0x83 (Ionosphere and UTC Data)\n");
@@ -324,11 +319,9 @@ static gps_mask_t handle_0x06(struct gps_device_t *session)
     session->driver.navcom.physical_port = port;	/* This tells us which serial port was used last */
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "Navcom: received packet type 0x06 (Acknowledgement (without error))\n");
-    /*@ -type @*/
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "Navcom: acknowledged command id 0x%02x on port %c\n",
 	     cmd_id, (port == 0 ? 'A' : (port == 1 ? 'B' : '?')));
-    /*@ +type @*/
     return 0;			/* Nothing updated */
 }
 
@@ -338,7 +331,6 @@ static gps_mask_t handle_0x15(struct gps_device_t *session)
     size_t n;
     unsigned char *buf = session->lexer.outbuffer + 3;
     size_t msg_len = (size_t) getleu16(buf, 1);
-    /*@ -type @*/
     uint8_t port, cmd_id = getub(buf, 3);
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "Navcom: received packet type 0x15 (Negative Acknowledge)\n");
@@ -353,7 +345,6 @@ static gps_mask_t handle_0x15(struct gps_device_t *session)
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "Navcom: negative acknowledge was for command id 0x%02x on port %c\n",
 	     cmd_id, (port == 0 ? 'A' : (port == 1 ? 'B' : '?')));
-    /*@ -type @*/
     return 0;			/* Nothing updated */
 }
 
@@ -450,14 +441,11 @@ static gps_mask_t handle_0xb1(struct gps_device_t *session)
     if (track < 0)
 	track += 2 * GPS_PI;
     session->newdata.track = track * RAD_2_DEG;
-    /*@ -evalorder @*/
     session->newdata.speed =
 	sqrt(pow(vel_east, 2) + pow(vel_north, 2)) * VEL_RES;
-    /*@ +evalorder @*/
     session->newdata.climb = vel_up * VEL_RES;
 
     /* Quality indicators */
-    /*@ -type @*/
     fom = getub(buf, 40);
     gdop = getub(buf, 41);
     pdop = getub(buf, 42);
@@ -490,7 +478,6 @@ static gps_mask_t handle_0xb1(struct gps_device_t *session)
 	     ((-nav_mode & 0x80)!='\0' ? "invalid" : "valid"), nav_mode,
 	     ((nav_mode & 0x40)!='\0' ? "3D" : "2D"),
 	     ((nav_mode & 0x03)!='\0' ? "DGPS" : "GPS"));
-    /*@ +type @*/
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "Navcom: latitude = %f, longitude = %f, altitude = %f, geoid = %f\n",
 	     session->newdata.latitude, session->newdata.longitude,
@@ -604,9 +591,7 @@ static gps_mask_t handle_0x81(struct gps_device_t *session)
     uint16_t toc = getleu16_be(buf, 28);
     int8_t af2 = getsb(buf, 30);
     int16_t af1 = getles16_be(buf, 31);
-    /*@ -shiftimplementation @*/
     int32_t af0 = getles3224_be(buf, 33) >> 2;
-    /*@ +shiftimplementation @*/
     /* Subframe 2, words 3 to 10 minus parity */
     uint8_t iode = getub(buf, 36);
     int16_t crs = getles16_be(buf, 37);
@@ -626,13 +611,11 @@ static gps_mask_t handle_0x81(struct gps_device_t *session)
     int16_t crc = getles16_be(buf, 72);
     int32_t omega = getles32_be(buf, 74);
     int32_t Omegadot = getles3224_be(buf, 78);
-    /*@ -predboolothers @*/
     /* Question: What is the proper way of shifting a signed int 2 bits to
      * the right, preserving sign? Answer: integer division by 4. */
     int16_t idot =
 	(int16_t) (((getles16_be(buf, 82) & 0xfffc) /
 		    4) | (getub(buf, 82) & 80 ? 0xc000 : 0x0000));
-    /*@ +predboolothers @*/
     session->context->gps_week = (unsigned short)wn;
     session->context->gps_tow = (double)(toc * SF_TOC);
     /* leap second? */
@@ -736,12 +719,10 @@ static gps_mask_t handle_0x86(struct gps_device_t *session)
 	session->gpsdata.status = STATUS_NO_FIX;
     }
 
-    /*@ -predboolothers @*/
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "Navcom: engine status = 0x%x, almanac = %s, time = 0x%x, pos = 0x%x\n",
 	     eng_status & 0x07, ((eng_status & 0x08) ? "valid" : "invalid"),
 	     eng_status & 0x30 >> 4, eng_status & 0xc0 >> 6);
-    /*@ +predboolothers @*/
 
     /* Satellite details */
     i = nsu = 0;
@@ -783,7 +764,6 @@ static gps_mask_t handle_0x86(struct gps_device_t *session)
 	dgps_age = getleu16(buf, n + 11);
 	hw_channel = getub(buf, n + 13);
 	s = (unsigned char)0;
-	/*@ -predboolothers +charint @*/
 	/* NOTE - In theory, I think one would check for hw channel number to
 	 * see if one is dealing with a GPS or other satellite, but the
 	 * channel numbers reported bear no resemblance to what the spec
@@ -793,9 +773,7 @@ static gps_mask_t handle_0x86(struct gps_device_t *session)
 	    session->gpsdata.skyview[i].PRN = (short)prn;
 	    session->gpsdata.skyview[i].elevation = (short)ele;
 	    session->gpsdata.skyview[i].azimuth = (short)azm;
-	    /*@ ignore @*//* splint is confused */
 	    s = session->gpsdata.skyview[i].ss = (p2_snr ? p2_snr : ca_snr) / 4.0;
-	    /*@ end @*/
 	    session->gpsdata.skyview[i++].used = (stat == 0xff);
 	    if (stat == 0xff)
 		nsu++;
@@ -814,7 +792,6 @@ static gps_mask_t handle_0x86(struct gps_device_t *session)
 		 ((sol_status & 0x04) ? "dgps" : "unaided"),
 		 ((sol_status & 0x08) ? "solved" : "constrained"),
 		 ((sol_status & 0x01) ? 0x00 : sol_status & 0x0f00 >> 8));
-	/*@ +predboolothers -charint @*/
     }
 
     gpsd_log(&session->context->errout, LOG_DATA,
@@ -842,7 +819,6 @@ static gps_mask_t handle_0xb0(struct gps_device_t *session)
 
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "Navcom: received packet type 0xb0 (Raw Meas. Data Block)\n");
-    /*@ -predboolothers @*/
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "Navcom: week = %u, tow = %.3f, time slew accumulator = %u (1/1023mS), status = 0x%02x "
 	     "(%sclock %s - %u blocks follow)\n",
@@ -851,7 +827,6 @@ static gps_mask_t handle_0xb0(struct gps_device_t *session)
 	     tm_slew_acc, status,
 	     ((status & 0x80) ? "channel time set - " : ""),
 	     ((status & 0x40) ? "stable" : "not stable"), status & 0x0f);
-    /*@ +predboolothers @*/
     for (n = 11; n < msg_len - 1; n += 16) {
 	uint8_t sv_status = getub(buf, n);
 	uint8_t ch_status = getub(buf, n + 1);
@@ -863,7 +838,6 @@ static gps_mask_t handle_0xb0(struct gps_device_t *session)
 	int16_t p2_ca_pseudorange = getles16(buf, n + 11);
 	int32_t l2_phase = getles3224(buf, n + 13) / 16;
 	uint8_t l2_slips = (uint8_t) (getles3224(buf, n + 13) & 0x0f);
-	/*@ -predboolothers +charint @*/
 	double c1 =
 	    ((sv_status & 0x80) ? (double)ca_pseudorange / 16.0 *
 	     LAMBDA_L1 : NAN);
@@ -894,7 +868,6 @@ static gps_mask_t handle_0xb0(struct gps_device_t *session)
 	gpsd_log(&session->context->errout, LOG_DATA + 1,
 		 "Navcom: >>> C1: %14.3f, L1: %14.3f, L2: %14.3f, P1: %14.3f, P2: %14.3f\n",
 		 c1, l1, l2, p1, p2);
-	/*@ +predboolothers -charint @*/
     }
 #undef LAMBDA_L1
     return 0;			/* Raw measurements not yet implemented in gpsd */
@@ -964,7 +937,6 @@ static gps_mask_t handle_0xd3(struct gps_device_t *session UNUSED)
 /* Identification Block */
 static gps_mask_t handle_0xae(struct gps_device_t *session)
 {
-    /*@-modobserver@*/
     char *engconfstr, *asicstr;
     unsigned char *buf = session->lexer.outbuffer + 3;
     size_t msg_len = (size_t) getleu16(buf, 1);
@@ -976,11 +948,9 @@ static gps_mask_t handle_0xae(struct gps_device_t *session)
     uint8_t dcclass = getub(buf, 9);
     uint16_t rfcser = getleu16(buf, 10);
     uint8_t rfcclass = getub(buf, 12);
-    /*@ -stringliteralnoroomfinalnull -type @*/
     uint8_t softtm[17] = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
     uint8_t bootstr[17] = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
     uint8_t ioptm[17] = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
-    /*@ +stringliteralnoroomfinalnull +type @*/
     uint8_t iopvermaj = (uint8_t) 0x00;
     uint8_t iopvermin = (uint8_t) 0x00;
     uint8_t picver = (uint8_t) 0x00;
@@ -1081,14 +1051,11 @@ static gps_mask_t handle_0xae(struct gps_device_t *session)
 		 iopvermin, iopsbn, picver, ioptm);
     }
 
-    /*@ -formattype @*/
     (void)snprintf(session->subtype, sizeof(session->subtype),
 		   "%s %s Ver. %u.%u.%u S/N %u.%u %u.%u",
 		   engconfstr, asicstr, swvermaj, swvermin, slsbn, dcser,
 		   dcclass, rfcser, rfcclass);
-    /*@ +formattype @*/
     return DEVICEID_SET;
-    /*@+modobserver@*/
 }
 
 /* Clock Drift and Offset */
@@ -1128,7 +1095,6 @@ static gps_mask_t handle_0xef(struct gps_device_t *session)
 }
 
 
-/*@ +charint @*/
 gps_mask_t navcom_parse(struct gps_device_t * session, unsigned char *buf,
 			size_t len)
 {
@@ -1142,10 +1108,8 @@ gps_mask_t navcom_parse(struct gps_device_t * session, unsigned char *buf,
     //payload = &buf[6];
     msg_len = (uint) getleu16(buf, 4);
 
-    /*@ -usedef -compdef @*/
     gpsd_log(&session->context->errout, LOG_RAW,
 	     "Navcom: packet type 0x%02x\n", cmd_id);
-    /*@ +usedef +compdef @*/
 
     session->cycle_end_reliable = true;
 
@@ -1180,7 +1144,6 @@ gps_mask_t navcom_parse(struct gps_device_t * session, unsigned char *buf,
     }
 }
 
-/*@ -charint @*/
 
 static gps_mask_t navcom_parse_input(struct gps_device_t *session)
 {
@@ -1199,7 +1162,6 @@ static gps_mask_t navcom_parse_input(struct gps_device_t *session)
 static ssize_t navcom_control_send(struct gps_device_t *session,
 				   char *buf, size_t len)
 {
-    /*@ +ignoresigns -mayaliasunique @*/
     putbyte(session->msgbuf, 0, 0x02);
     putbyte(session->msgbuf, 1, 0x99);
     putbyte(session->msgbuf, 2, 0x66);
@@ -1210,7 +1172,6 @@ static ssize_t navcom_control_send(struct gps_device_t *session,
 	    checksum((unsigned char *)session->msgbuf + 3, len + 5));
     putbyte(session->msgbuf, 7 + len, 0x03);
     session->msgbuflen = len + 9;
-    /*@ -ignoresigns +mayaliasunique @*/
     return gpsd_write(session, session->msgbuf, session->msgbuflen);
 }
 #endif /* CONTROLSEND_ENABLE */
@@ -1230,7 +1191,6 @@ static bool navcom_speed(struct gps_device_t *session,
 	    /* We still don't know which port we're connected to */
 	    return false;
 	}
-	/*@ +charint @*/
 	switch (speed) {
 	    /* NOTE - The spec says that certain baud combinations
 	     * on ports A and B are not allowed, those are
@@ -1264,7 +1224,6 @@ static bool navcom_speed(struct gps_device_t *session,
 	    /* Unsupported speed */
 	    return false;
 	}
-	/*@ -charint @*/
 
 	/* Proceed to construct our message */
 	port = session->driver.navcom.physical_port;
diff --git a/driver_nmea0183.c b/driver_nmea0183.c
index 81e5878e..0b817b9a 100644
--- a/driver_nmea0183.c
+++ b/driver_nmea0183.c
@@ -1336,7 +1336,6 @@ static gps_mask_t processMTK3301(int c UNUSED, char *field[],
  *
  **************************************************************************/
 
-/*@ -mayaliasunique @*/
 gps_mask_t nmea_parse(char *sentence, struct gps_device_t * session)
 /* parse an NMEA sentence, unpack it into a session structure */
 {
@@ -1349,7 +1348,6 @@ gps_mask_t nmea_parse(char *sentence, struct gps_device_t * session)
 	bool cycle_continue;	/* cycle continuer? */
 	nmea_decoder decoder;
     } nmea_phrase[] = {
-	/*@ -nullassign @*/
 	{"PGRMC", 0, false, NULL},	/* ignore Garmin Sensor Config */
 	{"PGRME", 7, false, processPGRME},
 	{"PGRMI", 0, false, NULL},	/* ignore Garmin Sensor Init */
@@ -1398,7 +1396,6 @@ gps_mask_t nmea_parse(char *sentence, struct gps_device_t * session)
 	{"TXT", 5,  false, processTXT},
 	{"ZDA", 4,  false, processZDA},
 	{"VTG", 0,  false, NULL},	/* ignore Velocity Track made Good */
-	/*@ +nullassign @*/
     };
 
     int count;
@@ -1422,7 +1419,6 @@ gps_mask_t nmea_parse(char *sentence, struct gps_device_t * session)
 	return ONLINE_SET;
     }
 
-    /*@ -usedef @*//* splint 3.1.1 seems to have a bug here */
     /* make an editable copy of the sentence */
     (void)strlcpy((char *)session->nmea.fieldcopy, sentence, sizeof(session->nmea.fieldcopy) - 1);
     /* discard the checksum part */
@@ -1441,13 +1437,11 @@ gps_mask_t nmea_parse(char *sentence, struct gps_device_t * session)
     /* while there is a search string and we haven't run off the buffer... */
     while ((p != NULL) && (p <= t)) {
 	session->nmea.field[count] = p;	/* we have a field. record it */
-	/*@ -compdef @*/
 	if ((p = strchr(p, ',')) != NULL) {	/* search for the next delimiter */
 	    *p = '\0';		/* replace it with a NUL */
 	    count++;		/* bump the counters and continue */
 	    p++;
 	}
-	/*@ +compdef @*/
     }
 
     /* point remaining fields at empty string, just in case */
@@ -1586,7 +1580,6 @@ gps_mask_t nmea_parse(char *sentence, struct gps_device_t * session)
     return retval;
 }
 
-/*@ +mayaliasunique @*/
 #endif /* NMEA_ENABLE */
 
 void nmea_add_checksum(char *sentence)
diff --git a/driver_nmea2000.c b/driver_nmea2000.c
index 957a55fb..3e5a26b4 100644
--- a/driver_nmea2000.c
+++ b/driver_nmea2000.c
@@ -13,22 +13,18 @@
 #include <time.h>
 #include <math.h>
 #include <fcntl.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
 #include <sys/socket.h>
 #include <net/if.h>
 #include <sys/ioctl.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #if defined(NMEA2000_ENABLE)
 #include "driver_nmea2000.h"
 #include "bits.h"
 
-#ifndef S_SPLINT_S
 #include <linux/can.h>
 #include <linux/can/raw.h>
-#endif /* S_SPLINT_S */
 
 #define LOG_FILE 1
 #define NMEA2000_NETS 4
@@ -51,7 +47,6 @@ typedef struct PGN
     const char    *name;
     } PGN;
 
-/*@-nullassign@*/
 
 #if LOG_FILE
 FILE *logFile = NULL;
@@ -67,7 +62,7 @@ static int scale_int(int32_t var, const int64_t factor)
 
         ret   = var;
         ret  *= factor;
-        /*@i1@*/ ret >>= 32;
+        ret >>= 32;
 
         return((int)ret);
 }
@@ -76,7 +71,6 @@ static void print_data(struct gps_context_t *context,
 		       unsigned char *buffer, int len, PGN *pgn)
 {
 #ifdef LIBGPS_DEBUG
-    /*@-bufferoverflowhigh@*/
     if ((libgps_debuglevel >= LOG_IO) != 0) {
 	int   l1, l2, ptr;
 	char  bu[128];
@@ -96,7 +90,6 @@ static void print_data(struct gps_context_t *context,
         }
         gpsd_log(&context->errout, LOG_IO,"%s\n", bu);
     }
-    /*@+bufferoverflowhigh@*/
 #else
     (void)context;
     (void)buffer;
@@ -273,10 +266,8 @@ static gps_mask_t hnd_129025(unsigned char *bu, int len, PGN *pgn, struct gps_de
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "pgn %6d(%3d):\n", pgn->pgn, session->driver.nmea2000.unit);
 
-    /*@-type@*//* splint has a bug here */
     session->newdata.latitude = getles32(bu, 0) * 1e-7;
     session->newdata.longitude = getles32(bu, 4) * 1e-7;
-    /*@+type@*/
 
     return LATLON_SET | get_mode(session);
 }
@@ -293,10 +284,8 @@ static gps_mask_t hnd_129026(unsigned char *bu, int len, PGN *pgn, struct gps_de
 
     session->driver.nmea2000.sid[0]  =  bu[0];
 
-    /*@-type@*//* splint has a bug here */
     session->newdata.track           =  getleu16(bu, 2) * 1e-4 * RAD_2_DEG;
     session->newdata.speed           =  getleu16(bu, 4) * 1e-2;
-    /*@+type@*/
 
     return SPEED_SET | TRACK_SET | get_mode(session);
 }
@@ -317,9 +306,7 @@ static gps_mask_t hnd_126992(unsigned char *bu, int len, PGN *pgn, struct gps_de
     //sid        = bu[0];
     //source     = bu[1] & 0x0f;
 
-    /*@-type@*//* splint has a bug here */
     session->newdata.time = getleu16(bu, 2)*24*60*60 + getleu32(bu, 4)/1e4;
-    /*@+type@*/
 
     return TIME_SET | get_mode(session);
 }
@@ -356,11 +343,9 @@ static gps_mask_t hnd_129539(unsigned char *bu, int len, PGN *pgn, struct gps_de
 
     session->driver.nmea2000.mode    = mode_tab[act_mode];
 
-    /*@-type@*//* splint has a bug here */
     session->gpsdata.dop.hdop        = getleu16(bu, 2) * 1e-2;
     session->gpsdata.dop.vdop        = getleu16(bu, 4) * 1e-2;
     session->gpsdata.dop.tdop        = getleu16(bu, 6) * 1e-2;
-    /*@+type@*/
     mask                            |= DOP_SET;
 
     gpsd_log(&session->context->errout, LOG_DATA,
@@ -395,11 +380,9 @@ static gps_mask_t hnd_129540(unsigned char *bu, int len, PGN *pgn, struct gps_de
         int    svt;
         double azi, elev, snr;
 
-	/*@-type@*//* splint has a bug here */
         elev  = getles16(bu, 3+12*l1+1) * 1e-4 * RAD_2_DEG;
         azi   = getleu16(bu, 3+12*l1+3) * 1e-4 * RAD_2_DEG;
         snr   = getles16(bu, 3+12*l1+5) * 1e-2;
-	/*@+type@*/
 
         svt   = (int)(bu[3+12*l1+11] & 0x0f);
 
@@ -431,20 +414,14 @@ static gps_mask_t hnd_129029(unsigned char *bu, int len, PGN *pgn, struct gps_de
     mask                             = 0;
     session->driver.nmea2000.sid[3]  = bu[0];
 
-    /*@-type@*//* splint has a bug here */
     session->newdata.time            = getleu16(bu,1) * 24*60*60 + getleu32(bu, 3)/1e4;
-    /*@+type@*/
     mask                            |= TIME_SET;
 
-    /*@-type@*//* splint has a bug here */
     session->newdata.latitude        = getles64(bu, 7) * 1e-16;
     session->newdata.longitude       = getles64(bu, 15) * 1e-16;
-    /*@+type@*/
     mask                            |= LATLON_SET;
 
-    /*@-type@*//* splint has a bug here */
     session->newdata.altitude        = getles64(bu, 23) * 1e-6;
-    /*@+type@*/
     mask                            |= ALTITUDE_SET;
 
 //  printf("mode %x %x\n", (bu[31] >> 4) & 0x0f, bu[31]);
@@ -469,17 +446,13 @@ static gps_mask_t hnd_129029(unsigned char *bu, int len, PGN *pgn, struct gps_de
     }
     mask                            |= STATUS_SET;
 
-    /*@-type@*//* splint has a bug here */
     session->gpsdata.separation      = getles32(bu, 38) / 100.0;
-    /*@+type@*/
     session->newdata.altitude       -= session->gpsdata.separation;
 
     session->gpsdata.satellites_used = (int)bu[33];
 
-    /*@-type@*//* splint has a bug here */
     session->gpsdata.dop.hdop        = getleu16(bu, 34) * 0.01;
     session->gpsdata.dop.pdop        = getleu16(bu, 36) * 0.01;
-    /*@+type@*/
     mask                            |= DOP_SET;
 
     return mask | get_mode(session);
@@ -976,7 +949,6 @@ static gps_mask_t hnd_127250(unsigned char *bu, int len, PGN *pgn, struct gps_de
   
     print_data(session->context, bu, len, pgn);
 
-    /*@-type@*/
     session->gpsdata.attitude.heading = getleu16(bu, 1) * RAD_2_DEG * 0.0001;
 //  printf("ATT 0:%8.3f\n",session->gpsdata.attitude.heading);
     aux = getles16(bu, 3);
@@ -988,7 +960,6 @@ static gps_mask_t hnd_127250(unsigned char *bu, int len, PGN *pgn, struct gps_de
     if (aux != 0x07fff) {
         session->gpsdata.attitude.heading += aux * RAD_2_DEG * 0.0001;
     }
-    /*@+type@*/
 //  printf("ATT 2:%8.3f %6x\n",session->gpsdata.attitude.heading, aux);
     session->gpsdata.attitude.mag_st = '\0';
     session->gpsdata.attitude.pitch = NAN;
@@ -1055,7 +1026,7 @@ static gps_mask_t hnd_128267(unsigned char *bu, int len, PGN *pgn, struct gps_de
     session->gpsdata.attitude.gyro_x = NAN;
     session->gpsdata.attitude.gyro_y = NAN;
     session->gpsdata.attitude.temp = NAN;
-    /*@i@*/session->gpsdata.attitude.depth = getleu32(bu, 1) *.01;
+    session->gpsdata.attitude.depth = getleu32(bu, 1) *.01;
 
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "pgn %6d(%3d):\n", pgn->pgn, session->driver.nmea2000.unit);
@@ -1147,7 +1118,6 @@ static gps_mask_t hnd_130311(unsigned char *bu, int len, PGN *pgn, struct gps_de
 }
 
 
-/*@-usereleased@*/
 static const char msg_059392[] = {"ISO  Acknowledgment"};
 static const char msg_060928[] = {"ISO  Address Claim"};
 static const char msg_126208[] = {"NMEA Command/Request/Acknowledge"};
@@ -1256,10 +1226,8 @@ static PGN navpgn[] = {{ 59392, 0, 0, hnd_059392, &msg_059392[0]},
 		       {0     , 0, 0, NULL,       &msg_error [0]}};
 
 
-/*@+usereleased@*/
 
-/*@-immediatetrans@*/
-static /*@null@*/ PGN *search_pgnlist(unsigned int pgn, PGN *pgnlist)
+static PGN *search_pgnlist(unsigned int pgn, PGN *pgnlist)
 {
     int l1;
     PGN *work;
@@ -1276,9 +1244,7 @@ static /*@null@*/ PGN *search_pgnlist(unsigned int pgn, PGN *pgnlist)
 	}
     return work;
 }
-/*@+immediatetrans@*/
 
-/*@-nullstate -branchstate -globstate -mustfreeonly@*/
 static void find_pgn(struct can_frame *frame, struct gps_device_t *session)
 {
     unsigned int can_net;
@@ -1291,7 +1257,6 @@ static void find_pgn(struct can_frame *frame, struct gps_device_t *session)
         return;
     }
 
-    /*@ignore@*//* because the CAN include files choke splint */
     if (frame->can_id & 0x80000000) {
 	// cppcheck-suppress unreadVariable
 #ifdef __UNUSED__
@@ -1321,15 +1286,12 @@ static void find_pgn(struct can_frame *frame, struct gps_device_t *session)
 	    fprintf(logFile, "\n");
 	}
 #endif /* of if LOG_FILE */
-	/*@end@*/
 	session->driver.nmea2000.can_msgcnt += 1;
-	/*@ignore@*//* because the CAN include files choke splint */
 	source_pgn = (frame->can_id >> 8) & 0x1ffff;
 #ifdef __UNUSED__
 	source_prio = (frame->can_id >> 26) & 0x7;
 #endif
 	source_unit = frame->can_id & 0x0ff;
-	/*@end@*/
 
 	if (((source_pgn & 0x0ff00) >> 8) < 240) {
 #ifdef __UNUSED__
@@ -1395,36 +1357,36 @@ static void find_pgn(struct can_frame *frame, struct gps_device_t *session)
 		    gpsd_log(&session->context->errout, LOG_DATA,
 			     "pgn %6d:%s \n", work->pgn, work->name);
 		    session->driver.nmea2000.workpgn = (void *) work;
-		    /*@i1@*/session->lexer.outbuflen =  frame->can_dlc & 0x0f;
+		    session->lexer.outbuflen =  frame->can_dlc & 0x0f;
 		    for (l2=0;l2<session->lexer.outbuflen;l2++) {
-		        /*@i3@*/session->lexer.outbuffer[l2]= frame->data[l2];
+		        session->lexer.outbuffer[l2]= frame->data[l2];
 		    }
-		/*@i2@*/} else if ((frame->data[0] & 0x1f) == 0) {
+		} else if ((frame->data[0] & 0x1f) == 0) {
 		    unsigned int l2;
 
-		    /*@i2@*/session->driver.nmea2000.fast_packet_len = frame->data[1];
-		    /*@i2@*/session->driver.nmea2000.idx = frame->data[0];
+		    session->driver.nmea2000.fast_packet_len = frame->data[1];
+		    session->driver.nmea2000.idx = frame->data[0];
 #if NMEA2000_FAST_DEBUG
 		    gpsd_log(&session->context->errout, LOG_ERROR,
 			     "Set idx    %2x    %2x %2x %6d\n",
-			     /*@i1@*/frame->data[0],
+			     frame->data[0],
 			     session->driver.nmea2000.unit,
-			     /*@i1@*/frame->data[1],
+			     frame->data[1],
 			     source_pgn);
 #endif /* of #if NMEA2000_FAST_DEBUG */
 		    session->lexer.inbuflen = 0;
 		    session->driver.nmea2000.idx += 1;
 		    for (l2=2;l2<8;l2++) {
-		        /*@i3@*/session->lexer.inbuffer[session->lexer.inbuflen++] = frame->data[l2];
+		        session->lexer.inbuffer[session->lexer.inbuflen++] = frame->data[l2];
 		    }
 		    gpsd_log(&session->context->errout, LOG_DATA,
 			     "pgn %6d:%s \n", work->pgn, work->name);
-		/*@i2@*/} else if (frame->data[0] == session->driver.nmea2000.idx) {
+		} else if (frame->data[0] == session->driver.nmea2000.idx) {
 		    unsigned int l2;
 
 		    for (l2=1;l2<8;l2++) {
 		        if (session->driver.nmea2000.fast_packet_len > session->lexer.inbuflen) {
-			    /*@i3@*/session->lexer.inbuffer[session->lexer.inbuflen++] = frame->data[l2];
+			    session->lexer.inbuffer[session->lexer.inbuflen++] = frame->data[l2];
 			}
 		    }
 		    if (session->lexer.inbuflen == session->driver.nmea2000.fast_packet_len) {
@@ -1432,7 +1394,7 @@ static void find_pgn(struct can_frame *frame, struct gps_device_t *session)
 		        gpsd_log(&session->context->errout, LOG_ERROR,
 				 "Fast done  %2x %2x %2x %2x %6d\n",
 				 session->driver.nmea2000.idx,
-				                                                   /*@i1@*/frame->data[0],
+				                                                   frame->data[0],
 				                                                   session->driver.nmea2000.unit,
 				                                                   (unsigned int) session->driver.nmea2000.fast_packet_len,
 				                                                   source_pgn);
@@ -1450,7 +1412,7 @@ static void find_pgn(struct can_frame *frame, struct gps_device_t *session)
 		    gpsd_log(&session->context->errout, LOG_ERROR,
 			     "Fast error %2x %2x %2x %2x %6d\n",
 			     session->driver.nmea2000.idx,
-			     /*@i2@*/frame->data[0],
+			     frame->data[0],
 			     session->driver.nmea2000.unit,
 			     (unsigned int) session->driver.nmea2000.fast_packet_len,
 				                                               source_pgn);
@@ -1479,7 +1441,6 @@ static void find_pgn(struct can_frame *frame, struct gps_device_t *session)
         // we got RTR or 2.0A CAN frame, not used
     }
 }
-/*@+nullstate +branchstate +globstate +mustfreeonly@*/
 
 
 static ssize_t nmea2000_get(struct gps_device_t *session)
@@ -1498,7 +1459,6 @@ static ssize_t nmea2000_get(struct gps_device_t *session)
     return 0;
 }
 
-/*@-mustfreeonly -nullstate@*/
 static gps_mask_t nmea2000_parse_input(struct gps_device_t *session)
 {
     gps_mask_t mask;
@@ -1516,11 +1476,7 @@ static gps_mask_t nmea2000_parse_input(struct gps_device_t *session)
 
     return mask;
 }
-/*@+mustfreeonly -nullstate@*/
 
-/*@+nullassign@*/
-
-#ifndef S_SPLINT_S
 
 int nmea2000_open(struct gps_device_t *session)
 {
@@ -1665,7 +1621,6 @@ int nmea2000_open(struct gps_device_t *session)
     session->gpsdata.dev.stopbits = 0;
     return session->gpsdata.gps_fd;
 }
-#endif /* of ifndef S_SPLINT_S */
 
 void nmea2000_close(struct gps_device_t *session)
 {
diff --git a/driver_oncore.c b/driver_oncore.c
index a14ad7bf..c27e08b0 100644
--- a/driver_oncore.c
+++ b/driver_oncore.c
@@ -9,7 +9,6 @@
 #if defined(ONCORE_ENABLE) && defined(BINARY_ENABLE)
 #include "bits.h"
 
-/*@ +charint @*/
 static char enableEa[] = { 'E', 'a', 1 };
 static char enableBb[] = { 'B', 'b', 1 };
 static char getfirmware[] = { 'C', 'j' };
@@ -28,7 +27,6 @@ static unsigned char pollEn[] = {
     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
 };
 
-/*@ -charint @*/
 
 /*
  * These routines are specific to this driver
@@ -80,7 +78,6 @@ oncore_msg_navsol(struct gps_device_t *session, unsigned char *buf,
 
     flags = (unsigned char)getub(buf, 72);
 
-    /*@ -predboolothers @*/
     if (flags & 0x20) {
 	session->gpsdata.status = STATUS_FIX;
 	session->newdata.mode = MODE_3D;
@@ -94,7 +91,6 @@ oncore_msg_navsol(struct gps_device_t *session, unsigned char *buf,
 	session->gpsdata.status = STATUS_NO_FIX;
     }
     mask |= MODE_SET;
-    /*@ +predboolothers @*/
 
     /* Unless we have seen non-zero utc offset data, the time is GPS time
      * and not UTC time.  Do not use it.
@@ -108,14 +104,10 @@ oncore_msg_navsol(struct gps_device_t *session, unsigned char *buf,
 	unpacked_date.tm_min = (int)getub(buf, 9);
 	unpacked_date.tm_sec = (int)getub(buf, 10);
 	unpacked_date.tm_isdst = 0;
-#ifdef S_SPLINT_S
 	unpacked_date.tm_wday = unpacked_date.tm_yday = 0;
-#endif /* S_SPLINT_S */
 	nsec = (uint) getbeu32(buf, 11);
 
-	/*@ -unrecog */
 	session->newdata.time = (timestamp_t)mkgmtime(&unpacked_date) + nsec * 1e-9;
-	/*@ +unrecog */
 	mask |= TIME_SET;
 	gpsd_log(&session->context->errout, LOG_DATA,
 		 "oncore NAVSOL - time: %04d-%02d-%02d %02d:%02d:%02d.%09d\n",
@@ -124,14 +116,12 @@ oncore_msg_navsol(struct gps_device_t *session, unsigned char *buf,
 		 unpacked_date.tm_min, unpacked_date.tm_sec, nsec);
     }
 
-    /*@-type@*/
     lat = getbes32(buf, 15) / 3600000.0f;
     lon = getbes32(buf, 19) / 3600000.0f;
     alt = getbes32(buf, 23) / 100.0f;
     speed = getbeu16(buf, 31) / 100.0f;
     track = getbeu16(buf, 33) / 10.0f;
     dop = getbeu16(buf, 35) / 10.0f;
-    /*@+type@*/
 
     gpsd_log(&session->context->errout, LOG_DATA,
 	     "oncore NAVSOL - %lf %lf %.2lfm-%.2lfm | %.2fm/s %.1fdeg dop=%.1f\n",
@@ -197,7 +187,6 @@ oncore_msg_navsol(struct gps_device_t *session, unsigned char *buf,
 	}
     }
     for (j = 0; (int)j < session->driver.oncore.visible; j++)
-	/*@ -boolops @*/
 	if (!(Bbused & (1 << j))) {
 	    session->gpsdata.skyview[st].PRN = (short)session->driver.oncore.PRN[j];
 	    session->gpsdata.skyview[st].elevation =
@@ -206,7 +195,6 @@ oncore_msg_navsol(struct gps_device_t *session, unsigned char *buf,
 		(short)session->driver.oncore.azimuth[j];
 	    st++;
 	}
-    /*@ +boolops @*/
     session->gpsdata.skyview_time = session->newdata.time;
     session->gpsdata.satellites_used = (int)nsv;
     session->gpsdata.satellites_visible = (int)st;
@@ -361,7 +349,6 @@ oncore_msg_firmware(struct gps_device_t *session UNUSED,
 /**
  * Parse the data from the device
  */
-/*@ +charint @*/
 gps_mask_t oncore_dispatch(struct gps_device_t * session, unsigned char *buf,
 			   size_t len)
 {
@@ -405,7 +392,6 @@ gps_mask_t oncore_dispatch(struct gps_device_t * session, unsigned char *buf,
     }
 }
 
-/*@ -charint @*/
 
 /**********************************************************
  *
@@ -416,7 +402,6 @@ gps_mask_t oncore_dispatch(struct gps_device_t * session, unsigned char *buf,
 /**
  * Write data to the device, doing any required padding or checksumming
  */
-/*@ +charint -usedef -compdef @*/
 static ssize_t oncore_control_send(struct gps_device_t *session,
 				   char *msg, size_t msglen)
 {
@@ -438,7 +423,6 @@ static ssize_t oncore_control_send(struct gps_device_t *session,
     return gpsd_write(session, session->msgbuf, session->msgbuflen);
 }
 
-/*@ -charint +usedef +compdef @*/
 
 static void oncore_event_hook(struct gps_device_t *session, event_t event)
 {
diff --git a/driver_proto.c b/driver_proto.c
index 1b44990a..d6c61c8d 100644
--- a/driver_proto.c
+++ b/driver_proto.c
@@ -269,7 +269,6 @@ _proto__msg_raw(struct gps_device_t *session, unsigned char *buf, size_t data_le
 /**
  * Parse the data from the device
  */
-/*@ +charint @*/
 gps_mask_t _proto__dispatch(struct gps_device_t *session, unsigned char *buf, size_t len)
 {
     size_t i;
@@ -305,7 +304,6 @@ gps_mask_t _proto__dispatch(struct gps_device_t *session, unsigned char *buf, si
 	return 0;
     }
 }
-/*@ -charint @*/
 
 /**********************************************************
  *
@@ -333,7 +331,6 @@ static bool _proto__probe_detect(struct gps_device_t *session)
 /**
  * Write data to the device, doing any required padding or checksumming
  */
-/*@ +charint -usedef -compdef @*/
 static ssize_t _proto__control_send(struct gps_device_t *session,
 			   char *msg, size_t msglen)
 {
@@ -355,7 +352,6 @@ static ssize_t _proto__control_send(struct gps_device_t *session,
 	       "writing _proto_ control type %02x\n");
    return gpsd_write(session, session->msgbuf, session->msgbuflen);
 }
-/*@ -charint +usedef +compdef @*/
 #endif /* CONTROLSEND_ENABLE */
 
 #ifdef RECONFIGURE_ENABLE
diff --git a/driver_rtcm2.c b/driver_rtcm2.c
index 74a5a61d..e491e19a 100644
--- a/driver_rtcm2.c
+++ b/driver_rtcm2.c
@@ -460,7 +460,6 @@ struct rtcm2_msg_t {
 #endif /* LITTLE_ENDIAN */
 
 #ifdef WORDS_BIGENDIAN
-#ifndef S_SPLINT_S	/* splint thinks it's a duplicate definition */
 
 struct rtcm2_msg_t {
     struct rtcm2_msghw1 {			/* header word 1 */
@@ -737,7 +736,6 @@ struct rtcm2_msg_t {
     } msg_type;
 } __attribute__((__packed__));
 
-#endif /* S_SPLINT_S */
 #endif /* BIG ENDIAN */
 
 #ifdef RTCM104V2_ENABLE
@@ -748,8 +746,7 @@ static unsigned int tx_speed[] = { 25, 50, 100, 110, 150, 200, 250, 300 };
 
 #define DIMENSION(a) (unsigned)(sizeof(a)/sizeof(a[0]))
 
-/*@-type */
-void rtcm2_unpack( /*@out@*/ struct rtcm2_t *tp, char *buf)
+void rtcm2_unpack(struct rtcm2_t *tp, char *buf)
 /* break out the raw bits into the content fields */
 {
     int len;
@@ -796,13 +793,11 @@ void rtcm2_unpack( /*@out@*/ struct rtcm2_t *tp, char *buf)
 		tp->gps_ranges.sat[n].ident = m->w6.satident3;
 		tp->gps_ranges.sat[n].udre = m->w6.udre3;
 		tp->gps_ranges.sat[n].iod = m->w7.iod3;
-		/*@ -shiftimplementation @*/
 		tp->gps_ranges.sat[n].prc =
 		    ((m->w6.prc3_h << 8) | (m->w7.prc3_l)) *
 		    (m->w6.scale3 ? PRCLARGE : PRCSMALL);
 		tp->gps_ranges.sat[n].rrc =
 		    m->w7.rrc3 * (m->w6.scale3 ? RRLARGE : RRSMALL);
-		/*@ +shiftimplementation @*/
 		n++;
 	    }
 	    len -= 5;
@@ -865,9 +860,7 @@ void rtcm2_unpack( /*@out@*/ struct rtcm2_t *tp, char *buf)
 	    csp->ident = m->sat_id;
 	    csp->iodl = m->issue_of_data_link != 0;
 	    csp->health = m->data_health;
-	    /*@+ignoresigns@*/
 	    csp->snr = (int)(m->cn0 ? (m->cn0 + CNR_OFFSET) : SNR_BAD);
-	    /*@-ignoresigns@*/
 	    csp->health_en = m->health_enable != 0;
 	    csp->new_data = m->new_nav_data != 0;
 	    csp->los_warning = m->loss_warn != 0;
@@ -881,9 +874,7 @@ void rtcm2_unpack( /*@out@*/ struct rtcm2_t *tp, char *buf)
 	    struct b_station_t *mp = &msg->msg_type.type7.almanac[w];
 
 	    np->latitude = mp->w3.lat * LA_SCALE;
-	    /*@-shiftimplementation@*/
 	    np->longitude = ((mp->w3.lon_h << 8) | mp->w4.lon_l) * LO_SCALE;
-	    /*@+shiftimplementation@*/
 	    np->range = mp->w4.range;
 	    np->frequency =
 		(((mp->w4.freq_h << 6) | mp->w5.freq_l) * FREQ_SCALE) +
@@ -910,7 +901,6 @@ void rtcm2_unpack( /*@out@*/ struct rtcm2_t *tp, char *buf)
 	tp->gpstime.leapsecs = msg->msg_type.type14.w1.leapsecs;
 	break;
     case 16:
-	/*@ -boolops @*/
 	for (w = 0; w < (unsigned)len; w++) {
 	    if (!msg->msg_type.type16.txt[w].byte1) {
 		break;
@@ -925,7 +915,6 @@ void rtcm2_unpack( /*@out@*/ struct rtcm2_t *tp, char *buf)
 	    }
 	    tp->message[n++] = (char)(msg->msg_type.type16.txt[w].byte3);
 	}
-	/*@ +boolops @*/
 	tp->message[n] = '\0';
 	break;
 
@@ -961,13 +950,11 @@ void rtcm2_unpack( /*@out@*/ struct rtcm2_t *tp, char *buf)
 		tp->glonass_ranges.sat[n].udre = m->w6.udre3;
 		tp->glonass_ranges.sat[n].change = (bool)m->w7.change3;
 		tp->glonass_ranges.sat[n].tod = m->w7.tod3;
-		/*@ -shiftimplementation @*/
 		tp->glonass_ranges.sat[n].prc =
 		    ((m->w6.prc3_h << 8) | (m->w7.prc3_l)) *
 		    (m->w6.scale3 ? PRCLARGE : PRCSMALL);
 		tp->glonass_ranges.sat[n].rrc =
 		    m->w7.rrc3 * (m->w6.scale3 ? RRLARGE : RRSMALL);
-		/*@ +shiftimplementation @*/
 		n++;
 	    }
 	    len -= 5;
@@ -995,7 +982,6 @@ static bool length_check(struct gps_lexer_t *lexer)
 	&& lexer->isgps.bufindex >=
 	((struct rtcm2_msg_t *)lexer->isgps.buf)->w2.frmlen + 2u;
 }
-/*@+type */
 
 enum isgpsstat_t rtcm2_decode(struct gps_lexer_t *lexer, unsigned int c)
 {
diff --git a/driver_rtcm3.c b/driver_rtcm3.c
index 11bc504d..a9e05903 100644
--- a/driver_rtcm3.c
+++ b/driver_rtcm3.c
@@ -63,10 +63,9 @@ BSD terms apply: see the file COPYING in the distribution root for details.
 
 /* Large case statements make GNU indent very confused */
 /* *INDENT-OFF* */
-/*@ -type @*//* re-enable when we're ready to take this live */
 
 void rtcm3_unpack(const struct gps_context_t *context,
-		  /*@out@*/ struct rtcm3_t *rtcm, char *buf)
+		  struct rtcm3_t *rtcm, char *buf)
 /* break out the raw bits into the scaled report-structure fields */
 {
     unsigned int n, n2, n3, n4;
@@ -74,7 +73,6 @@ void rtcm3_unpack(const struct gps_context_t *context,
     unsigned int i;
     signed long temp;
 
-    /*@ -evalorder -sefparams -mayaliasunique @*/
 #define ugrab(width)	(bitcount += width, ubits((unsigned char *)buf, bitcount-width, width, false))
 #define sgrab(width)	(bitcount += width, sbits((signed char *)buf, bitcount-width, width, false))
 #define GPS_PSEUDORANGE(fld, len) \
@@ -418,10 +416,8 @@ void rtcm3_unpack(const struct gps_context_t *context,
 #undef GPS_PSEUDORANGE
 #undef sgrab
 #undef ugrab
-    /*@ +evalorder +sefparams +mayaliasunique @*/
 }
 
 /* *INDENT-ON* */
-/*@ +type @*/
 
 #endif /* RTCM104V3_ENABLE */
diff --git a/driver_sirf.c b/driver_sirf.c
index de2a3ef1..0d0448b5 100644
--- a/driver_sirf.c
+++ b/driver_sirf.c
@@ -42,9 +42,7 @@
 #include <strings.h>
 #include <math.h>
 #include <ctype.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "bits.h"
@@ -60,7 +58,6 @@
  */
 #define SIRF_RETRY_TIME	6
 
-/*@ +charint @*/
 /* Poll Software Version MID 132 */
 static unsigned char versionprobe[] = {
     0xa0, 0xa2, 0x00, 0x02,
@@ -209,7 +206,6 @@ static unsigned char enablemid52[] = {
     0x00, 0xdb, 0xb0, 0xb3
 };
 #endif /* RECONFIGURE_ENABLE */
-/*@ -charint @*/
 
 
 static gps_mask_t sirf_msg_debug(struct gps_device_t *,
@@ -285,7 +281,6 @@ static bool sirf_write(struct gps_device_t *session, unsigned char *msg)
 static ssize_t sirf_control_send(struct gps_device_t *session, char *msg,
 				 size_t len)
 {
-    /*@ +charint +matchanyintegral -initallelements -mayaliasunique @*/
     session->msgbuf[0] = (char)0xa0;
     session->msgbuf[1] = (char)0xa2;
     session->msgbuf[2] = (len >> 8) & 0xff;
@@ -299,7 +294,6 @@ static ssize_t sirf_control_send(struct gps_device_t *session, char *msg,
     return sirf_write(session,
 	      (unsigned char *)session->msgbuf) ? (int)session->msgbuflen : -1;
     /* *INDENT-ON* */
-    /*@ -charint -matchanyintegral +initallelements +mayaliasunique @*/
 }
 #endif /* CONTROLSEND_ENABLE */
 
@@ -307,7 +301,6 @@ static ssize_t sirf_control_send(struct gps_device_t *session, char *msg,
 static bool sirfbin_speed(struct gps_device_t *session, speed_t speed, char parity, int stopbits)
 /* change speed in binary mode */
 {
-    /*@ +charint @*/
     static unsigned char msg[] = {
 	0xa0, 0xa2, 0x00, 0x09,
 	0x86,			/* byte 4:
@@ -320,7 +313,6 @@ static bool sirfbin_speed(struct gps_device_t *session, speed_t speed, char pari
 	0x00,			/* byte 12: reserved pad */
 	0x00, 0x00, 0xb0, 0xb3
     };
-    /*@ -charint @*/
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "SiRF: sirf_speed(%u,%c,%d)\n",
 	     (unsigned int)speed, parity, stopbits);
@@ -356,7 +348,6 @@ static bool sirfbin_speed(struct gps_device_t *session, speed_t speed, char pari
 static bool sirf_to_nmea(struct gps_device_t *session, speed_t speed)
 /* switch from binary to NMEA at specified baud */
 {
-    /*@ +charint @*/
     static unsigned char msg[] = { 0xa0, 0xa2, 0x00, 0x18,
 	0x81, 0x02,
 	0x01, 0x01,		/* GGA */
@@ -373,7 +364,6 @@ static bool sirf_to_nmea(struct gps_device_t *session, speed_t speed)
 	0x12, 0xc0,		/* 4800 bps */
 	0xb0, 0xb3
     };
-    /*@ -charint @*/
 
     if (speed >= 0xffff) {
 	gpsd_log(&session->context->errout, LOG_ERROR,
@@ -426,7 +416,6 @@ static gps_mask_t sirf_msg_debug(struct gps_device_t *device,
 
     bzero(msgbuf, (int)sizeof(msgbuf));
 
-    /*@ +charint @*/
     if (0xe1 == buf[0]) {	/* Development statistics messages */
 	for (i = 2; i < (int)len; i++)
 	    str_appendf(msgbuf, sizeof(msgbuf), "%c", buf[i] ^ 0xff);
@@ -442,7 +431,6 @@ static gps_mask_t sirf_msg_debug(struct gps_device_t *device,
 	gpsd_log(&device->context->errout, LOG_PROG,
 		 "SiRF: DBG 0xff: %s\n", msgbuf);
     }
-    /*@ -charint @*/
     return 0;
 }
 
@@ -886,13 +874,9 @@ static gps_mask_t sirf_msg_geodetic(struct gps_device_t *session,
 	unpacked_date.tm_min = (int)getub(buf, 16);
 	unpacked_date.tm_sec = 0;
 	unpacked_date.tm_isdst = 0;
-#ifdef S_SPLINT_S
 	unpacked_date.tm_wday = unpacked_date.tm_yday = 0;
-#endif /* S_SPLINT_S */
 	subseconds = getbeu16(buf, 17) * 1e-3;
-	/*@ -compdef -unrecog */
 	session->newdata.time = (timestamp_t)mkgmtime(&unpacked_date) + subseconds;
-	/*@ +compdef +unrecog */
 	gpsd_log(&session->context->errout, LOG_PROG,
 		 "SiRF: GND 0x29 UTC: %lf\n",
 		 session->newdata.time);
@@ -1019,13 +1003,9 @@ static gps_mask_t sirf_msg_ublox(struct gps_device_t *session,
 	unpacked_date.tm_min = (int)getub(buf, 31);
 	unpacked_date.tm_sec = 0;
 	unpacked_date.tm_isdst = 0;
-#ifdef S_SPLINT_S
 	unpacked_date.tm_wday = unpacked_date.tm_yday = 0;
-#endif /* S_SPLINT_S */
 	subseconds = ((unsigned short)getbeu16(buf, 32)) * 1e-3;
-	/*@ -compdef */
 	session->newdata.time = (timestamp_t)mkgmtime(&unpacked_date) + subseconds;
-	/*@ +compdef */
 #ifdef TIMEHINT_ENABLE
 	if (0 == (session->driver.sirf.time_seen & TIME_SEEN_UTC_2)) {
 	    gpsd_log(&session->context->errout, LOG_RAW,
@@ -1077,9 +1057,7 @@ static gps_mask_t sirf_msg_ppstime(struct gps_device_t *session,
 	unpacked_date.tm_mon = (int)getub(buf, 5) - 1;
 	unpacked_date.tm_year = (int)getbeu16(buf, 6) - 1900;
 	unpacked_date.tm_isdst = 0;
-	/*@ -compdef */
 	session->newdata.time = (timestamp_t)mkgmtime(&unpacked_date);
-	/*@ +compdef */
 	session->context->leap_seconds = (int)getbeu16(buf, 8);
 	session->context->valid |= LEAP_SECOND_VALID;
 #ifdef TIMEHINT_ENABLE
@@ -1531,7 +1509,6 @@ static void sirfbin_event_hook(struct gps_device_t *session, event_t event)
 
     if (event == event_deactivate) {
 
-	/*@ +charint @*/
 	static unsigned char moderevert[] = { 0xa0, 0xa2, 0x00, 0x0e,
 	    0x88,
 	    0x00, 0x00,		/* pad bytes */
@@ -1546,7 +1523,6 @@ static void sirfbin_event_hook(struct gps_device_t *session, event_t event)
 	    0x00,		/* track smoothing */
 	    0x00, 0x00, 0xb0, 0xb3
 	};
-	/*@ -charint -shiftimplementation @*/
 	putbyte(moderevert, 7, session->driver.sirf.degraded_mode);
 	putbe16(moderevert, 10, session->driver.sirf.altitude_source_input);
 	putbyte(moderevert, 12, session->driver.sirf.altitude_hold_mode);
@@ -1554,7 +1530,6 @@ static void sirfbin_event_hook(struct gps_device_t *session, event_t event)
 	putbyte(moderevert, 15, session->driver.sirf.degraded_timeout);
 	putbyte(moderevert, 16, session->driver.sirf.dr_timeout);
 	putbyte(moderevert, 17, session->driver.sirf.track_smooth_mode);
-	/*@ +shiftimplementation @*/
 	gpsd_log(&session->context->errout, LOG_PROG,
 		 "SiRF: Reverting navigation parameters...\n");
 	(void)sirf_write(session, moderevert);
diff --git a/driver_superstar2.c b/driver_superstar2.c
index b0003773..8de7ee03 100644
--- a/driver_superstar2.c
+++ b/driver_superstar2.c
@@ -86,11 +86,9 @@ superstar2_msg_navsol_lla(struct gps_device_t *session,
 	     "superstar2 #20 - user navigation data\n");
     mask = 0;
 
-    /*@ +charint @*/
     flags = (unsigned char)getub(buf, 72);
     if ((flags & 0x0f) != 0x03)	/* mode 3 is navigation */
 	return mask;
-    /*@ -charint @*/
 
     /* extract time data */
     (void)memset(&tm, '\0', sizeof(tm));
@@ -115,8 +113,8 @@ superstar2_msg_navsol_lla(struct gps_device_t *session,
     mask |= LATLON_SET | ALTITUDE_SET | SPEED_SET | TRACK_SET | CLIMB_SET;
 
     session->gpsdata.satellites_used = (int)getub(buf, 71) & 0x0f;
-    /*@i3@*/session->gpsdata.dop.hdop = getleu16(buf, 66) * 0.1;
-    /*@i3@*/session->gpsdata.dop.vdop = getleu16(buf, 68) * 0.1;
+    session->gpsdata.dop.hdop = getleu16(buf, 66) * 0.1;
+    session->gpsdata.dop.vdop = getleu16(buf, 68) * 0.1;
     /* other DOP if available */
     mask |= DOP_SET | USED_IS;
 
@@ -196,10 +194,8 @@ superstar2_msg_svinfo(struct gps_device_t *session,
 	session->gpsdata.skyview[i].azimuth = (short)getub(buf, off + 2) +
 	    (short)((unsigned short)(getub(buf, off + 3) & 0x1) << 1);
 	session->gpsdata.skyview[i].used = used;
-	/*@ +charint @*/
 	if (used)
 	    nsv++;
-	/*@ -charint @*/
 
 	if (session->gpsdata.skyview[i].PRN)
 	    st++;
@@ -221,11 +217,9 @@ superstar2_msg_version(struct gps_device_t *session,
 #define SZ 16
     char main_sw[SZ], hw_part[SZ], boot_sw[SZ], ser_num[SZ];
 
-    /*@ +charint @*/
     /* byte 98 is device type, value = 3 means superstar2 */
     if ((data_len != 101) || ((getub(buf, 98) & 0x0f) != 3))
 	return 0;
-    /*@ -charint @*/
 
     (void)snprintf(main_sw, 15, "%s", (char *)buf + 4);
     (void)snprintf(hw_part, 15, "%s", (char *)buf + 18);
@@ -257,10 +251,8 @@ superstar2_msg_timing(struct gps_device_t *session, unsigned char *buf,
 
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "superstar2 #113 - timing status\n");
-    /*@ +charint @*/
     if ((getub(buf, 55) & 0x30) != 0)
 	mask = 0;
-    /*@ -charint @*/
     else {
 	double d;
 	/* extract time data */
@@ -324,10 +316,8 @@ superstar2_msg_measurement(struct gps_device_t *session, unsigned char *buf,
 }
 
 /* request for ionospheric and utc time data #75 */
-/*@ +charint @*/
 static unsigned char iono_utc_msg[] = { 0x01, 0x4b, 0xb4, 0x00, 0x00, 0x01 };
 
-/*@ -charint @*/
 
 
 /**
@@ -444,7 +434,6 @@ static void superstar2_event_hook(struct gps_device_t *session, event_t event)
 	return;
 
     if (event == event_identified) {
-	/*@ +charint @*/
 	unsigned char version_msg[]    = { 0x01, 0x2d, 0xd2, 0x00, 0x00, 0x01 };
 	unsigned char svinfo_msg[]     = { 0x01, 0xa1, 0x5e, 0x00, 0x00, 0x01 };
 	unsigned char timing_msg[]     = { 0x01, 0xf1, 0x0e, 0x00, 0x00, 0x01 };
@@ -452,7 +441,6 @@ static void superstar2_event_hook(struct gps_device_t *session, event_t event)
 	unsigned char ephemeris_msg[]  = { 0x01, 0x96, 0x69, 0x00, 0x00, 0x01 };
 	unsigned char measurement_msg[] =
 	    { 0x01, 0x97, 0x68, 0x01, 0x00, 0x01, 0x01 };
-	/*@ -charint @*/
 
 	(void)superstar2_write(session, (char *)timing_msg,
 			       sizeof(timing_msg));
@@ -495,14 +483,12 @@ static ssize_t
 superstar2_control_send(struct gps_device_t *session, char *msg,
 			size_t msglen)
 {
-    /*@ +charint -mayaliasunique @*/
     session->msgbuf[0] = 0x1;	/* SOH */
     session->msgbuf[1] = msg[0];
     session->msgbuf[2] = msg[0] ^ 0xff;
     session->msgbuf[3] = (char)(msglen + 1);
     (void)memcpy(session->msgbuf + 4, msg + 1, msglen - 1);
     session->msgbuflen = (size_t) (msglen + 5);
-    /*@ -charint +mayaliasunique @*/
     return superstar2_write(session, session->msgbuf, session->msgbuflen);
 }
 #endif /* CONTROLSEND_ENABLE */
@@ -516,13 +502,11 @@ static bool superstar2_set_speed(struct gps_device_t *session,
 	|| stopbits != (int)session->gpsdata.dev.stopbits) {
 	return false;
     } else {
-	/*@ +charint @*/
 	unsigned char speed_msg[] =
 	    { 0x01, 0x48, 0xB7, 0x01, 0x00, 0x00, 0x00 };
 
 	/* high bit 0 in the mode word means set NMEA mode */
 	speed_msg[4] = (unsigned char)(speed / 300);
-	/*@ -charint @*/
 	return (superstar2_write(session, (char *)speed_msg, 7) == 7);
     }
 }
@@ -530,14 +514,12 @@ static bool superstar2_set_speed(struct gps_device_t *session,
 static void superstar2_set_mode(struct gps_device_t *session, int mode)
 {
     if (mode == MODE_NMEA) {
-	/*@ +charint @*/
 	unsigned char mode_msg[] =
 	    { 0x01, 0x48, 0xB7, 0x01, 0x00, 0x00, 0x00 };
 
 	/* high bit 0 in the mode word means set NMEA mode */
 	mode_msg[4] = (unsigned char)(session->gpsdata.dev.baudrate / 300);
 	(void)superstar2_write(session, (char *)mode_msg, 7);
-	/*@ -charint @*/
     } else {
 	session->back_to_nmea = false;
     }
diff --git a/driver_tsip.c b/driver_tsip.c
index 5fbecd16..037ba39f 100644
--- a/driver_tsip.c
+++ b/driver_tsip.c
@@ -17,9 +17,7 @@
 #include <stdbool.h>
 #include <math.h>
 #include <time.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "bits.h"
@@ -38,26 +36,21 @@ void configuration_packets_generic(struct gps_device_t *session);
 #define TSIP_CHANNELS	12
 
 static int tsip_write(struct gps_device_t *session,
-		      unsigned int id, /*@null@*/ unsigned char *buf,
-		      size_t len)
+		      unsigned int id, unsigned char *buf, size_t len)
 {
     char *ep, *cp;
 
-    /*@ +charint @*/
     session->msgbuf[0] = '\x10';
     session->msgbuf[1] = (char)id;
     ep = session->msgbuf + 2;
-    /*@ -nullderef @*/
     for (cp = (char *)buf; len-- > 0; cp++) {
 	if (*cp == '\x10')
 	    *ep++ = '\x10';
 	*ep++ = *cp;
     }
-    /*@ +nullderef @*/
     *ep++ = '\x10';
     *ep++ = '\x03';
     session->msgbuflen = (size_t) (ep - session->msgbuf);
-    /*@ -charint @*/
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "Sent TSIP packet id 0x%02x\n", id);
     if (gpsd_write(session, session->msgbuf, session->msgbuflen) !=
@@ -89,12 +82,10 @@ static bool tsip_detect(struct gps_device_t *session)
     gpsd_set_speed(session, 9600, 'O', 1);
 
     /* request firmware revision and look for a valid response */
-    /*@+ignoresigns@*/
     putbyte(buf, 0, 0x10);
     putbyte(buf, 1, 0x1f);
     putbyte(buf, 2, 0x10);
     putbyte(buf, 3, 0x03);
-    /*@+ignoresigns@*/
     myfd = session->gpsdata.gps_fd;
     if (write(myfd, buf, 4) == 4) {
 	unsigned int n;
@@ -145,7 +136,6 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	return 0;
     }
 
-    /*@ +charint @*/
     if (session->lexer.outbuflen < 4 || session->lexer.outbuffer[0] != 0x10)
 	return 0;
 
@@ -161,7 +151,6 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	str_appendf(buf2, sizeof(buf2),
 		       "%02x", buf[len++] = session->lexer.outbuffer[i]);
     }
-    /*@ -charint @*/
 
     id = (unsigned)session->lexer.outbuffer[1];
     gpsd_log(&session->context->errout, LOG_DATA,
@@ -208,11 +197,9 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 		}
 		buf2[i] = '\0';
 
-		/*@ -formattype @*/
 		(void)snprintf(session->subtype, sizeof(session->subtype),
 			       "sw %u %u %u %02u.%02u.%04u %s",
 			       u2, u3, u4, u6, u5, s1, buf2);
-		/*@ +formattype @*/
 		gpsd_log(&session->context->errout, LOG_INF,
 			 "Software version: %s\n", 
 			 session->subtype);
@@ -232,7 +219,6 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 		}
 		buf2[i] = '\0';
 
-		/*@ -formattype @*/
 		(void)snprintf(session->subtype, sizeof(session->subtype),
 			       "hw %u %02u.%02u.%04u %02u %u %s",
 			       ul1, u2, u3, s1, u4, s2, buf2);
@@ -297,7 +283,6 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
     case 0x45:			/* Software Version Information */
 	if (len != 10)
 	    break;
-	/*@ -formattype @*/
 	(void)snprintf(session->subtype, sizeof(session->subtype),
 		       "%d.%d %02d%02d%02d %d.%d %02d%02d%02d",
 		       getub(buf, 0), 
@@ -310,7 +295,6 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 		       getub(buf, 9),
 		       getub(buf, 7), 
 		       getub(buf, 8));
-	/*@ +formattype @*/
 	gpsd_log(&session->context->errout, LOG_INF,
 		 "Software version: %s\n", session->subtype);
 	mask |= DEVICEID_SET;
@@ -444,9 +428,7 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	f4 = getbef32((char *)buf, 12);	/* clock bias rate */
 	f5 = getbef32((char *)buf, 16);	/* time-of-fix */
 	session->newdata.climb = f3;
-	/*@ -evalorder @*/
 	session->newdata.speed = sqrt(pow(f2, 2) + pow(f1, 2));
-	/*@ +evalorder @*/
 	if ((session->newdata.track = atan2(f1, f2) * RAD_2_DEG) < 0)
 	    session->newdata.track += 360.0;
 	gpsd_log(&session->context->errout, LOG_INF,
@@ -467,10 +449,8 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	u2 = getub(buf, 1);	/* Mfg. diagnostic */
 	f1 = getbef32((char *)buf, 2);	/* gps_time */
 	s1 = getbes16(buf, 6);	/* tsip.gps_week */
-	/*@ +charint @*/
 	if (getub(buf, 0) == 0x01)	/* good current fix? */
 	    (void)gpsd_gpstime_resolve(session, (unsigned short)s1, (double)f1);
-	/*@ -charint @*/
 	gpsd_log(&session->context->errout, LOG_INF,
 		 "Fix info %02x %02x %d %f\n", u1, u2, s1, f1);
 	break;
@@ -569,20 +549,16 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	session->gpsdata.dop.hdop = getbef32((char *)buf, 5);
 	session->gpsdata.dop.vdop = getbef32((char *)buf, 9);
 	session->gpsdata.dop.tdop = getbef32((char *)buf, 13);
-	/*@ -evalorder @*/
 	session->gpsdata.dop.gdop =
 	    sqrt(pow(session->gpsdata.dop.pdop, 2) +
 		 pow(session->gpsdata.dop.tdop, 2));
-	/*@ +evalorder @*/
 
 	memset(session->driver.tsip.sats_used, 0, sizeof(session->driver.tsip.sats_used));
 	buf2[0] = '\0';
-	/*@ +charint @*/
 	for (i = 0; i < count; i++)
 	    str_appendf(buf2, sizeof(buf2),
 			   " %d", session->driver.tsip.sats_used[i] =
 			   (short)getub(buf, 17 + i));
-	/*@ -charint @*/
 	gpsd_log(&session->context->errout, LOG_DATA,
 		 "AIVSS: 0x6d status=%d used=%d "
 		 "pdop=%.1f hdop=%.1f vdop=%.1f tdop=%.1f gdup=%.1f\n",
@@ -599,10 +575,8 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	break;
 #ifdef __UNUSED__
     case 0x6f:			/* Synchronized Measurements Report */
-	/*@ +charint @*/
 	if (len < 20 || getub(buf, 0) != 1 || getub(buf, 1) != 2)
 	    break;
-	/*@ -charint @*/
 	s1 = getbes16(buf, 2);	/* number of bytes */
 	u1 = getub(buf, 20);	/* number of SVs */
 	break;
@@ -615,12 +589,10 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	if (len != 1)
 	    break;
 	u1 = getub(buf, 0);	/* fix mode */
-	/*@ +charint @*/
 	if (session->gpsdata.status == STATUS_FIX && (u1 & 0x01) != 0) {
 	    session->gpsdata.status = STATUS_DGPS_FIX;
 	    mask |= STATUS_SET;
 	}
-	/*@ -charint @*/
 	gpsd_log(&session->context->errout, LOG_DATA,
 		 "DPFM 0x82 status=%d\n", session->gpsdata.status);
 	break;
@@ -664,9 +636,7 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 		 session->newdata.altitude);
 	break;
     case 0x8f:			/* Super Packet.  Well...  */
-	/*@ +charint @*/
 	u1 = (uint8_t) getub(buf, 0);
-	/*@ -charint @*/
 	switch (u1) {		/* sub-packet ID */
 	case 0x15:		/* Current Datum Values */
 	    if (len != 43)
@@ -710,9 +680,7 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	    d1 = (double)s1 * d5;	/* east velocity m/s */
 	    d2 = (double)s2 * d5;	/* north velocity m/s */
 	    session->newdata.climb = (double)s3 * d5;	/* up velocity m/s */
-	    /*@ -evalorder @*/
 	    session->newdata.speed = sqrt(pow(d2, 2) + pow(d1, 2));
-	    /*@ +evalorder @*/
 	    if ((session->newdata.track = atan2(d1, d2) * RAD_2_DEG) < 0)
 		session->newdata.track += 360.0;
 	    session->newdata.latitude = (double)sl1 * SEMI_2_DEG;
@@ -809,10 +777,8 @@ static gps_mask_t tsip_parse_input(struct gps_device_t *session)
 	    d1 = (double)s2 * d5;	/* east velocity m/s */
 	    d2 = (double)s3 * d5;	/* north velocity m/s */
 	    session->newdata.climb = (double)s4 * d5;	/* up velocity m/s */
-	    /*@ -evalorder @*/
 	    session->newdata.speed =
 		sqrt(pow(d2, 2) + pow(d1, 2)) * MPS_TO_KNOTS;
-	    /*@ +evalorder @*/
 	    if ((session->newdata.track = atan2(d1, d2) * RAD_2_DEG) < 0)
 		session->newdata.track += 360.0;
 	    mask |=
@@ -1192,7 +1158,6 @@ void configuration_packets_generic(struct gps_device_t *session)
 	putbef32((char *)buf, 9, (float)8.0);
 	/* - PDOP switch */
 	putbef32((char *)buf, 13, (float)6.0);
-	/*@ +shiftimplementation @*/
 	(void)tsip_write(session, 0x2c, buf, 17);
 	/* Set Position Fix Mode (auto 2D/3D) */
 	putbyte(buf, 0, 0x00);
@@ -1219,10 +1184,8 @@ void configuration_packets_accutime_gold(struct gps_device_t *session)
 	putbyte(buf, 0, 0xa9); /* Subcode */
 	putbyte(buf, 1, 0x01); /* Self-Survey Enable = enable */
 	putbyte(buf, 2, 0x01); /* Position Save Flag = save position */
-	/*@-shiftimplementation@*/
 	putbe32(buf, 3, 2000); /* Self-Survey Length = 2000 */
 	putbe32(buf, 7, 0); /* Reserved */
-	/*@+shiftimplementation@*/
 	(void)tsip_write(session, 0x8e, buf, 11);
 	/* Set PPS Output Option */
 	putbyte(buf, 0, 0x4e); /* Subcode */
@@ -1242,12 +1205,10 @@ void configuration_packets_accutime_gold(struct gps_device_t *session)
 	putbyte(buf, 22, 0x0); /* Foliage Mode = default */
 	putbe16(buf, 23, 0xffff); /* Reserved */
 	putbe16(buf, 25, 0x0000); /* Measurement Rate and Position Fix Rate = default */
-	/*@-shiftimplementation@*/
 	putbe32(buf, 27, 0xffffffff); /* Reserved */
 	putbe32(buf, 31, 0xffffffff); /* Reserved */
 	putbe32(buf, 35, 0xffffffff); /* Reserved */
 	putbe32(buf, 39, 0xffffffff); /* Reserved */
-	/*@+shiftimplementation@*/
 	(void)tsip_write(session, 0xbb, buf, 43);
 	/* Set Packet Broadcast Mask */
 	putbyte(buf, 0, 0xa5); /* Subcode */
diff --git a/driver_ubx.c b/driver_ubx.c
index bcb7c941..dd5ecbda 100644
--- a/driver_ubx.c
+++ b/driver_ubx.c
@@ -24,9 +24,7 @@
 #include <assert.h>
 #include <string.h>
 #include <math.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #if defined(UBLOX_ENABLE) && defined(BINARY_ENABLE)
@@ -323,7 +321,6 @@ ubx_msg_nav_svinfo(struct gps_device_t *session, unsigned char *buf,
 		 "runt svinfo (datalen=%zd)\n", data_len);
 	return 0;
     }
-    /*@ +charint @*/
     nchan = (unsigned int)getub(buf, 4);
     if (nchan > MAXCHANNELS) {
 	gpsd_log(&session->context->errout, LOG_WARN,
@@ -331,7 +328,6 @@ ubx_msg_nav_svinfo(struct gps_device_t *session, unsigned char *buf,
 		 MAXCHANNELS);
 	return 0;
     }
-    /*@ -charint @*/
     gpsd_zero_satellites(&session->gpsdata);
     nsv = 0;
     for (i = st = 0; i < nchan; i++) {
@@ -346,12 +342,10 @@ ubx_msg_nav_svinfo(struct gps_device_t *session, unsigned char *buf,
 	session->gpsdata.skyview[st].used = used;
 	if (session->gpsdata.skyview[st].PRN == 0)
 	    continue;
-	/*@ -predboolothers */
 	if (used || session->gpsdata.skyview[st].PRN == (short)session->driver.ubx.sbas_in_use) {
 	    nsv++;
 	    session->gpsdata.skyview[st].used = true;
 	}
-	/*@ +predboolothers */
 	st++;
     }
 
@@ -444,7 +438,6 @@ static void ubx_msg_inf(struct gps_device_t *session, unsigned char *buf, size_t
     return;
 }
 
-/*@ +charint @*/
 gps_mask_t ubx_parse(struct gps_device_t * session, unsigned char *buf,
 		     size_t len)
 {
@@ -634,7 +627,6 @@ gps_mask_t ubx_parse(struct gps_device_t * session, unsigned char *buf,
     return mask | ONLINE_SET;
 }
 
-/*@ -charint @*/
 
 static gps_mask_t parse_input(struct gps_device_t *session)
 {
@@ -658,7 +650,6 @@ bool ubx_write(struct gps_device_t * session,
     size_t i;
     bool ok;
 
-    /*@ -type @*/
     session->msgbuf[0] = 0xb5;
     session->msgbuf[1] = 0x62;
 
@@ -677,7 +668,6 @@ bool ubx_write(struct gps_device_t * session,
 	CK_A += session->msgbuf[i];
 	CK_B += CK_A;
     }
-    /*@ -nullderef @*/
     if (msg != NULL)
 	for (i = 0; i < data_len; i++) {
 	    CK_A += msg[i];
@@ -687,7 +677,6 @@ bool ubx_write(struct gps_device_t * session,
     session->msgbuf[6 + data_len] = CK_A;
     session->msgbuf[7 + data_len] = CK_B;
     session->msgbuflen = data_len + 8;
-    /*@ +type @*/
 
 
     gpsd_log(&session->context->errout, LOG_PROG,
@@ -696,7 +685,6 @@ bool ubx_write(struct gps_device_t * session,
 	     CK_A, CK_B);
     count = gpsd_write(session, session->msgbuf, session->msgbuflen);
     ok = (count == (ssize_t) session->msgbuflen);
-    /*@ +nullderef @*/
     return (ok);
 }
 
@@ -713,10 +701,8 @@ static ssize_t ubx_control_send(struct gps_device_t *session, char *msg,
 
 static void ubx_init_query(struct gps_device_t *session)
 {
-    /*@ -type -compdef @*/
     /* MON_VER: query for version information */
     (void)ubx_write(session, UBX_CLASS_MON, 0x04, NULL, 0);
-    /*@ +type +compdef @*/
 }
 
 static void ubx_event_hook(struct gps_device_t *session, event_t event)
@@ -728,7 +714,6 @@ static void ubx_event_hook(struct gps_device_t *session, event_t event)
 
 	gpsd_log(&session->context->errout, LOG_DATA, "UBX configure\n");
 
-	/*@ -type @*/
 	msg[0] = 0x03;		/* SBAS mode enabled, accept testbed mode */
 	msg[1] = 0x07;		/* SBAS usage: range, differential corrections and integrity */
 	msg[2] = 0x03;		/* use the maximum search range: 3 channels */
@@ -738,7 +723,6 @@ static void ubx_event_hook(struct gps_device_t *session, event_t event)
 	msg[6] = 0x00;
 	msg[7] = 0x00;
 	(void)ubx_write(session, 0x06u, 0x16, msg, 8);
-	/*@ +type @*/
 
 #ifdef RECONFIGURE_ENABLE
 	/*
@@ -749,13 +733,11 @@ static void ubx_event_hook(struct gps_device_t *session, event_t event)
 	}
 #endif /* RECONFIGURE_ENABLE */
     } else if (event == event_deactivate) {
-	/*@ -type @*/
 	unsigned char msg[4] = {
 	    0x00, 0x00,		/* hotstart */
 	    0x01,		/* controlled software reset */
 	    0x00
 	};			/* reserved */
-	/*@ +type @*/
 
 	gpsd_log(&session->context->errout, LOG_DATA, "UBX revert\n");
 
@@ -775,7 +757,6 @@ static void ubx_cfg_prt(struct gps_device_t *session,
 
     memset(buf, '\0', UBX_CFG_LEN);
 
-    /*@ +ignoresigns +charint @*/
     /*
      * When this is called from gpsd, the initial probe for UBX should
      * have picked up the device's port number from the CFG_PRT response.
@@ -1029,7 +1010,6 @@ static void ubx_cfg_prt(struct gps_device_t *session,
 	buf[outProtoMask] &= ~NMEA_PROTOCOL_MASK;
 	buf[outProtoMask] |= UBX_PROTOCOL_MASK;
     }
-    /*@ -ignoresigns -charint @*/
 
     (void)ubx_write(session, 0x06u, 0x00, buf, sizeof(buf));
 }
@@ -1058,13 +1038,11 @@ static bool ubx_rate(struct gps_device_t *session, double cycletime)
 /* change the sample rate of the GPS */
 {
     unsigned short s;
-    /*@ -type @*/
     unsigned char msg[6] = {
 	0x00, 0x00,		/* U2: Measurement rate (ms) */
 	0x00, 0x01,		/* U2: Navigation rate (cycles) */
 	0x00, 0x00,		/* U2: Alignment to reference time: 0 = UTC, !0 = GPS */
     };
-    /*@ +type @*/
 
     /* clamp to cycle times that i know work on my receiver */
     if (cycletime > 1000.0)
diff --git a/driver_zodiac.c b/driver_zodiac.c
index 76f8d3f8..9d97bbf8 100644
--- a/driver_zodiac.c
+++ b/driver_zodiac.c
@@ -13,9 +13,7 @@
 #include <stdbool.h>
 #include <string.h>
 #include <math.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "bits.h"
@@ -145,13 +143,11 @@ static gps_mask_t handle1000(struct gps_device_t *session)
     /* ticks                      = getzlong(6); */
     /* sequence                   = getzword(8); */
     /* measurement_sequence       = getzword(9); */
-    /*@ -boolops -predboolothers @*/
     session->gpsdata.status = (getzword(10) & 0x1c) ? 0 : 1;
     if (session->gpsdata.status != 0)
 	session->newdata.mode = (getzword(10) & 1) ? MODE_2D : MODE_3D;
     else
 	session->newdata.mode = MODE_NO_FIX;
-    /*@ +boolops -predboolothers @*/
 
     /* solution_type                 = getzword(11); */
     session->gpsdata.satellites_used = (int)getzword(12);
@@ -167,10 +163,7 @@ static gps_mask_t handle1000(struct gps_device_t *session)
     unpacked_date.tm_sec = (int)getzword(24);
     unpacked_date.tm_isdst = 0;
     subseconds = (int)getzlong(25) / 1e9;
-    /*@ -compdef */
     session->newdata.time = (timestamp_t)mkgmtime(&unpacked_date) + subseconds;
-    /*@ +compdef */
-    /*@ -type @*/
     session->newdata.latitude = ((long)getzlong(27)) * RAD_2_DEG * 1e-8;
     session->newdata.longitude = ((long)getzlong(29)) * RAD_2_DEG * 1e-8;
     /*
@@ -179,7 +172,6 @@ static gps_mask_t handle1000(struct gps_device_t *session)
      * specify whether word 31 is geodetic or WGS 84.
      */
     session->newdata.altitude = ((long)getzlong(31)) * 1e-2;
-    /*@ +type @*/
     session->gpsdata.separation = ((short)getzword(33)) * 1e-2;
     session->newdata.altitude -= session->gpsdata.separation;
     session->newdata.speed = (int)getzlong(34) * 1e-2;
@@ -222,20 +214,16 @@ static gps_mask_t handle1002(struct gps_device_t *session)
     /* ticks                      = getzlong(6); */
     /* sequence                   = getzword(8); */
     /* measurement_sequence       = getzword(9); */
-    /*@+charint@*/
     int gps_week = getzword(10);
     int gps_seconds = getzlong(11);
     /* gps_nanoseconds            = getzlong(13); */
-    /*@-charint@*/
     /* Note: this week counter is not limited to 10 bits. */
     session->context->gps_week = (unsigned short)gps_week;
     session->gpsdata.satellites_used = 0;
     for (i = 0; i < ZODIAC_CHANNELS; i++) {
 	int status, prn;
-	/*@ -type @*/
 	session->driver.zodiac.Zv[i] = status = (int)getzword(15 + (3 * i));
 	session->driver.zodiac.Zs[i] = prn = (int)getzword(16 + (3 * i));
-	/*@ +type @*/
 
 	if (status & 1)
 	    session->gpsdata.satellites_used++;
@@ -397,7 +385,6 @@ static gps_mask_t zodiac_analyze(struct gps_device_t *session)
 static ssize_t zodiac_control_send(struct gps_device_t *session,
 				   char *msg, size_t len)
 {
-    /*@-usedef -compdef@*/
     unsigned short shortwords[256];
 
 #define min(x,y)	((x) < (y) ? x : y)
@@ -410,7 +397,6 @@ static ssize_t zodiac_control_send(struct gps_device_t *session,
     /* and if len isn't even, it's your own fault */
     return zodiac_spew(session, shortwords[0], shortwords + 1,
 		       (int)(len / 2 - 1));
-    /*@+usedef +compdef@*/
 }
 #endif /* CONTROLSEND_ENABLE */
 
diff --git a/drivers.c b/drivers.c
index b2190d67..f6794cd6 100644
--- a/drivers.c
+++ b/drivers.c
@@ -9,9 +9,7 @@
 #include <stdarg.h>
 #include <assert.h>
 #include <ctype.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "bits.h"		/* for getbeu16(), to extract big-endian words */
@@ -614,7 +612,6 @@ static void earthmate_event_hook(struct gps_device_t *session, event_t event)
     }
 }
 
-/*@ -redef @*/
 /* *INDENT-OFF* */
 static const struct gps_type_t driver_earthmate = {
     .type_name     = "Pre-2003 Delorme EarthMate",
@@ -641,7 +638,6 @@ static const struct gps_type_t driver_earthmate = {
     .time_offset     = NULL,		/* no method for NTP fudge factor */
 #endif /* TIMEHINT_ENABLE */
 };
-/*@ -redef @*/
 /* *INDENT-ON* */
 #endif /* EARTHMATE_ENABLE */
 
@@ -1163,7 +1159,6 @@ const struct gps_type_t driver_mtk3301 = {
  *
  **************************************************************************/
 
-/*@ -fixedformalarray -usedef -branchstate @*/
 static bool aivdm_decode(const char *buf, size_t buflen,
 		  struct gps_device_t *session,
 		  struct ais_t *ais,
@@ -1247,13 +1242,11 @@ static bool aivdm_decode(const char *buf, size_t buflen,
 		     "ignoring bogus AIS channel '12'.\n");
 	    return false;
 	}
-	/*@fallthrough@*/
     case 'A':
 	ais_context = &session->driver.aivdm.context[0];
 	session->driver.aivdm.ais_channel ='A';
 	break;
     case '2':
-	/*@fallthrough@*/
     case 'B':
 	ais_context = &session->driver.aivdm.context[1];
 	session->driver.aivdm.ais_channel ='B';
@@ -1295,7 +1288,6 @@ static bool aivdm_decode(const char *buf, size_t buflen,
     }
 
     /* wacky 6-bit encoding, shades of FIELDATA */
-    /*@ +charint @*/
     for (cp = data; cp < data + strlen((char *)data); cp++) {
 	unsigned char ch;
 	ch = *cp;
@@ -1306,7 +1298,6 @@ static bool aivdm_decode(const char *buf, size_t buflen,
 	gpsd_log(&session->context->errout, LOG_RAW,
 		 "%c: %s\n", *cp, sixbits[ch]);
 #endif /* __UNUSED_DEBUG__ */
-	/*@ -shiftnegative @*/
 	for (i = 5; i >= 0; i--) {
 	    if ((ch >> i) & 0x01) {
 		ais_context->bits[ais_context->bitlen / 8] |=
@@ -1319,11 +1310,9 @@ static bool aivdm_decode(const char *buf, size_t buflen,
 		return false;
 	    }
 	}
-	/*@ +shiftnegative @*/
     }
     if (isdigit(pad))
 	ais_context->bitlen -= (pad - '0');	/* ASCII assumption */
-    /*@ -charint @*/
 
     /* time to pass buffered-up data to where it's actually processed? */
     if (ifrag == nfrags) {
@@ -1351,7 +1340,6 @@ static bool aivdm_decode(const char *buf, size_t buflen,
     ais_context->decoded_frags++;
     return false;
 }
-/*@ +fixedformalarray +usedef +branchstate @*/
 
 static gps_mask_t aivdm_analyze(struct gps_device_t *session)
 {
@@ -1419,9 +1407,7 @@ static void path_rewrite(struct gps_device_t *session, char *prefix)
      */
     char *prefloc;
 
-#ifdef S_SPLINT_S
     assert(prefix != NULL && session->lexer.outbuffer != NULL);
-#endif /* S_SPLINT_S */
 
     /* possibly the rewrite has been done already, this comw up in gpsmon */
     if (strstr((char *)session->lexer.outbuffer, session->gpsdata.dev.path) != NULL)
@@ -1455,7 +1441,6 @@ static gps_mask_t json_pass_packet(struct gps_device_t *session)
 
     if (strstr(session->gpsdata.dev.path, ":/") != NULL && strstr(session->gpsdata.dev.path, "localhost") == NULL)
     {
-	/*@-nullpass@*/ /* required only because splint is buggy */
 	/* devices and paths need to be edited */
 	if (strstr((char *)session->lexer.outbuffer, "DEVICE") != NULL)
 	    path_rewrite(session, "\"path\":\"");
@@ -1481,7 +1466,6 @@ static gps_mask_t json_pass_packet(struct gps_device_t *session)
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "JSON, passing through %s\n",
 	     (char *)session->lexer.outbuffer);
-    /*@-nullpass@*/
     return PASSTHROUGH_IS;
 }
 
@@ -1529,7 +1513,6 @@ extern const struct gps_type_t driver_tsip;
 extern const struct gps_type_t driver_ubx;
 extern const struct gps_type_t driver_zodiac;
 
-/*@ -nullassign @*/
 /* the point of this rigamarole is to not have to export a table size */
 static const struct gps_type_t *gpsd_driver_array[] = {
     &driver_unknown,
@@ -1627,5 +1610,4 @@ static const struct gps_type_t *gpsd_driver_array[] = {
     NULL,
 };
 
-/*@ +nullassign @*/
 const struct gps_type_t **gpsd_drivers = &gpsd_driver_array[0];
diff --git a/geoid.c b/geoid.c
index 74cdb961..fc74e5df 100644
--- a/geoid.c
+++ b/geoid.c
@@ -41,7 +41,6 @@ double wgs84_separation(double lat, double lon)
 #define GEOID_ROW	19
 #define GEOID_COL	37
     /* *INDENT-OFF* */
-    /*@ +charint @*/
     const int geoid_delta[GEOID_COL*GEOID_ROW]={
 	/* 90S */ -30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30, -30,-30,-30,-30,-30,-30,-30,-30,-30,-30,-30,
 	/* 80S */ -53,-54,-55,-52,-48,-42,-38,-38,-29,-26,-26,-24,-23,-21,-19,-16,-12, -8, -4, -1,  1,  4,  4,  6,  5,  4,   2, -6,-15,-24,-33,-40,-48,-50,-53,-52,-53,
@@ -63,7 +62,6 @@ double wgs84_separation(double lat, double lon)
 	/* 80N */   3,  1, -2, -3, -3, -3, -1,  3,  1,  5,  9, 11, 19, 27, 31, 34, 33, 34, 33, 34, 28, 23, 17, 13,  9,  4,   4,  1, -2, -2,  0,  2,  3,  2,  1,  1,  3,
 	/* 90N */  13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13,  13, 13, 13, 13, 13, 13, 13, 13, 13, 13, 13
     };
-    /*@ -charint @*/
     /* *INDENT-ON* */
     int ilat, ilon;
     int ilat1, ilat2, ilon1, ilon2;
@@ -105,7 +103,6 @@ void ecef_to_wgs84fix(struct gps_fix_t *fix, double *separation,
 
     /* geodetic location */
     lambda = atan2(y, x);
-    /*@ -evalorder @*/
     p = sqrt(pow(x, 2) + pow(y, 2));
     theta = atan2(z * a, p * b);
     phi =
@@ -127,7 +124,6 @@ void ecef_to_wgs84fix(struct gps_fix_t *fix, double *separation,
 	vz * sin(phi);
     fix->speed = sqrt(pow(vnorth, 2) + pow(veast, 2));
     heading = atan2(fix_minuz(veast), fix_minuz(vnorth));
-    /*@ +evalorder @*/
     if (heading < 0)
 	heading += 2 * GPS_PI;
     fix->track = heading * RAD_2_DEG;
diff --git a/gps.h b/gps.h
index 5929be2e..76a3f17f 100644
--- a/gps.h
+++ b/gps.h
@@ -18,9 +18,7 @@ extern "C" {
 #include <time.h>
 #include <signal.h>
 #include <stdio.h>
-#ifndef S_SPLINT_S
 #include <pthread.h>	/* pacifies OpenBSD's compiler */
-#endif
 
 /*
  * 4.1 - Base version for initial JSON protocol (Dec 2009, release 2.90)
@@ -138,14 +136,12 @@ struct gst_t {
 /* RTCM104 doesn't specify this, so give it the largest reasonable value */
 #define MAXHEALTH	(RTCM2_WORDS_MAX-2)
 
-#ifndef S_SPLINT_S
 /*
  * A nominally 30-bit word (24 bits of data, 6 bits of parity)
  * used both in the GPS downlink protocol described in IS-GPS-200
  * and in the format for DGPS corrections used in RTCM-104v2.
  */
-typedef /*@unsignedintegraltype@*/ uint32_t isgps30bits_t;
-#endif /* S_SPLINT_S */
+typedef uint32_t isgps30bits_t;
 
 /*
  * Values for "system" fields.  Note, the encoding logic is senstive to the
@@ -830,11 +826,7 @@ struct subframe_t {
     };
 };
 
-#ifndef S_SPLINT_S
 typedef uint64_t gps_mask_t;
-#else
-typedef /*@unsignedintegraltype@*/ unsigned long long gps_mask_t;
-#endif /* S_SPLINT_S */
 
 /*
  * Is an MMSI number that of an auxiliary associated with a mother ship?
@@ -2025,45 +2017,43 @@ struct gps_data_t {
     void *privdata;
 };
 
-extern int gps_open(/*@null@*/const char *, /*@null@*/const char *,
-		      /*@out@*/struct gps_data_t *);
+extern int gps_open(const char *, const char *,
+		      struct gps_data_t *);
 extern int gps_close(struct gps_data_t *);
 extern int gps_send(struct gps_data_t *, const char *, ... );
-extern int gps_read(/*@out@*/struct gps_data_t *);
+extern int gps_read(struct gps_data_t *);
 extern int gps_unpack(char *, struct gps_data_t *);
 extern bool gps_waiting(const struct gps_data_t *, int);
-extern int gps_stream(struct gps_data_t *, unsigned int, /*@null@*/void *);
+extern int gps_stream(struct gps_data_t *, unsigned int, void *);
 extern int gps_mainloop(struct gps_data_t *, int,
 			void (*)(struct gps_data_t *));
-extern const char /*@null observer@*/ *gps_data(const struct gps_data_t *);
-extern const char /*@observer@*/ *gps_errstr(const int);
+extern const char *gps_data(const struct gps_data_t *);
+extern const char *gps_errstr(const int);
 
 int json_toff_read(const char *buf, struct gps_data_t *,
-		  /*@null@*/ const char **);
+		  const char **);
 int json_pps_read(const char *buf, struct gps_data_t *,
-		  /*@null@*/ const char **);
+		  const char **);
 
 /* dependencies on struct gpsdata_t end here */
 
 extern void libgps_trace(int errlevel, const char *, ...);
 
-extern void gps_clear_fix(/*@ out @*/struct gps_fix_t *);
-extern void gps_clear_dop( /*@out@*/ struct dop_t *);
-extern void gps_merge_fix(/*@ out @*/struct gps_fix_t *,
-			  gps_mask_t,
-			  /*@ in @*/struct gps_fix_t *);
+extern void gps_clear_fix(struct gps_fix_t *);
+extern void gps_clear_dop( struct dop_t *);
+extern void gps_merge_fix(struct gps_fix_t *, gps_mask_t, struct gps_fix_t *);
 extern void gps_enable_debug(int, FILE *);
-extern /*@observer@*/const char *gps_maskdump(gps_mask_t);
+extern const char *gps_maskdump(gps_mask_t);
 
 extern double safe_atof(const char *);
 extern time_t mkgmtime(register struct tm *);
 extern timestamp_t timestamp(void);
 extern timestamp_t iso8601_to_unix(char *);
-extern /*@observer@*/char *unix_to_iso8601(timestamp_t t, /*@ out @*/char[], size_t len);
+extern char *unix_to_iso8601(timestamp_t t, char[], size_t len);
 extern double earth_distance(double, double, double, double);
 extern double earth_distance_and_bearings(double, double, double, double,
-					  /*@null@*//*@out@*/double *,
-					  /*@null@*//*@out@*/double *);
+					  double *,
+					  double *);
 extern double wgs84_separation(double, double);
 
 /* some multipliers for interpreting GPS output */
diff --git a/gps2udp.c b/gps2udp.c
index 0f39a661..2bcb232d 100644
--- a/gps2udp.c
+++ b/gps2udp.c
@@ -28,23 +28,17 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/select.h>
-
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
 
 #include "gpsd.h"
 #include "gpsdclient.h"
 #include "revision.h"
 #include "strfuncs.h"
 
-#ifndef S_SPLINT_S
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netdb.h>
-#endif /* S_SPLINT_S */
-
 #define MAX_TIME_LEN 80
 #define MAX_GPSD_RETRY 10
 
@@ -62,8 +56,7 @@ static unsigned int flags;
 static int debug = 0;
 static bool aisonly = false;
 
-/*@-statictrans@*/
-/*@observer@*/static char* time2string(void)  
+static char* time2string(void)  
 /* return local time hh:mm:ss */
 {
    static char buffer[MAX_TIME_LEN];
@@ -81,7 +74,6 @@ static bool aisonly = false;
      
    return (buffer);
 }
-/*@+statictrans@*/
 
 static int send_udp (char *nmeastring, size_t ind)
 {
@@ -116,7 +108,6 @@ static int send_udp (char *nmeastring, size_t ind)
     }
 
     /* send message on udp channel */
-    /*@-type@*/
     for (channel=0; channel < udpchannel; channel ++) {
 	ssize_t status = sendto(sock[channel],
 				buffer,
@@ -129,7 +120,6 @@ static int send_udp (char *nmeastring, size_t ind)
 	    return -1;
 	}
     }
-    /*@=type@*/
     return 0;
 }
 
@@ -148,10 +138,8 @@ static int open_udp(char **hostport)
        struct hostent *hp;
 
        /* parse argument */
-       /*@-unrecog@*/
        hostname = strsep(&hostport[channel], ":");
        portname = strsep(&hostport[channel], ":");
-       /*@=unrecog@*/
        if ((hostname == NULL) || (portname == NULL)) {
 	   (void)fprintf(stderr, "gps2udp: syntax is [-u hostname:port]\n");
 	   return (-1);
@@ -159,12 +147,10 @@ static int open_udp(char **hostport)
 
        errno = 0;
        portnum = (int)strtol(portname, &endptr, 10);
-       /*@+charint@*/
        if (1 > portnum || 65535 < portnum || '\0' != *endptr || 0 != errno) {
 	   (void)fprintf(stderr, "gps2udp: syntax is [-u hostname:port] [%s] is not a valid port number\n",portname);
 	   return (-1);
        }
-       /*@-charint@*/
 
        sock[channel]= socket(AF_INET, SOCK_DGRAM, 0);
        if (sock[channel] < 0) {
@@ -235,7 +221,6 @@ static void connect2gpsd(bool restart)
     
 }
 
-/*@+voidabstract@*/
 static ssize_t read_gpsd(char *message, size_t len)
 /* get data from gpsd */
 {   
@@ -305,10 +290,8 @@ static ssize_t read_gpsd(char *message, size_t len)
 		connect2gpsd(true);
 		retry = 0;
 	    }
-	    /*@-sefparams@*/
 	    if (debug > 0)
 		ignore_return(write (1, ".", 1));
-	    /*@+sefparams@*/
 	    break;
 
         default:	/* we lost connection with gpsd */
@@ -320,7 +303,6 @@ static ssize_t read_gpsd(char *message, size_t len)
     (void)fprintf (stderr,"\n gps2udp: message too big [%s]\n", message);
     return(-1);
 }
-/*@=voidabstract@*/
 
 static unsigned char AISto6bit(unsigned char c)
 /* 6 bits decoding of AIS payload */
@@ -363,7 +345,6 @@ static unsigned int AISGetInt(unsigned char *bitbytes, unsigned int sp, unsigned
     return acc;
 }
 
-/*@-compdef -usedef@*/
 int main(int argc, char **argv)
 {
     bool daemonize = false;
@@ -440,7 +421,6 @@ int main(int argc, char **argv)
     }
 
     /* Daemonize if the user requested it. */
-    /*@-unrecog@*/
     if (daemonize) {
 	if (daemon(0, 0) != 0) {
 	    (void)fprintf(stderr, 
@@ -448,7 +428,6 @@ int main(int argc, char **argv)
 			  strerror(errno));
         }
     }
-    /*@=unrecog@*/
 
     /* infinite loop to get data from gpsd and push them to aggregators */
     for (;;)
@@ -511,10 +490,8 @@ int main(int argc, char **argv)
     } // end for (;;)
  
     // This is an infinite loop, should never be here
-    /*@-unreachable@*/
     fprintf (stderr, "gpsd2udp ERROR abnormal exit\n");
     exit (-1);
 }
-/*@=compdef =usedef@*/
 
 /* end */
diff --git a/gps_json.h b/gps_json.h
index 15eb0394..a77b2679 100644
--- a/gps_json.h
+++ b/gps_json.h
@@ -16,31 +16,31 @@ extern "C" {
 void json_data_report(const gps_mask_t,
 		      const struct gps_device_t *,
 		      const struct policy_t *,
-		      /*@out@*/char *, size_t);
-char *json_stringify(/*@out@*/char *, size_t, /*@in@*/const char *);
+		      char *, size_t);
+char *json_stringify(char *, size_t, const char *);
 void json_tpv_dump(const struct gps_device_t *,
-		   const struct policy_t *, /*@out@*/char *, size_t);
-void json_noise_dump(const struct gps_data_t *, /*@out@*/char *, size_t);
-void json_sky_dump(const struct gps_data_t *, /*@out@*/char *, size_t);
-void json_att_dump(const struct gps_data_t *, /*@out@*/char *, size_t);
-void json_subframe_dump(const struct gps_data_t *, /*@out@*/ char buf[], size_t);
-void json_device_dump(const struct gps_device_t *, /*@out@*/char *, size_t);
-void json_watch_dump(const struct policy_t *, /*@out@*/char *, size_t);
-int json_watch_read(const char *, /*@out@*/struct policy_t *,
-		    /*@null@*/const char **);
-int json_device_read(const char *, /*@out@*/struct devconfig_t *,
-		     /*@null@*/const char **);
-void json_version_dump(/*@out@*/char *, size_t);
-void json_aivdm_dump(const struct ais_t *, /*@null@*/const char *, bool,
-		     /*@out@*/char *, size_t);
+		   const struct policy_t *, char *, size_t);
+void json_noise_dump(const struct gps_data_t *, char *, size_t);
+void json_sky_dump(const struct gps_data_t *, char *, size_t);
+void json_att_dump(const struct gps_data_t *, char *, size_t);
+void json_subframe_dump(const struct gps_data_t *, char buf[], size_t);
+void json_device_dump(const struct gps_device_t *, char *, size_t);
+void json_watch_dump(const struct policy_t *, char *, size_t);
+int json_watch_read(const char *, struct policy_t *,
+		    const char **);
+int json_device_read(const char *, struct devconfig_t *,
+		     const char **);
+void json_version_dump(char *, size_t);
+void json_aivdm_dump(const struct ais_t *, const char *, bool,
+		     char *, size_t);
 int json_rtcm2_read(const char *, char *, size_t, struct rtcm2_t *,
-		    /*@null@*/const char **);
+		    const char **);
 int json_rtcm3_read(const char *, char *, size_t, struct rtcm3_t *,
-		    /*@null@*/const char **);
+		    const char **);
 int json_ais_read(const char *, char *, size_t, struct ais_t *,
-		  /*@null@*/const char **);
+		  const char **);
 int libgps_json_unpack(const char *, struct gps_data_t *,
-		       /*@null@*/const char **);
+		       const char **);
 #ifdef __cplusplus
 }
 #endif
diff --git a/gpsctl.c b/gpsctl.c
index 4e6c241b..425c6721 100644
--- a/gpsctl.c
+++ b/gpsctl.c
@@ -15,9 +15,7 @@
 #include <time.h>
 #include <sys/time.h>
 #include <sys/select.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "revision.h"
@@ -61,7 +59,7 @@ static void settle(struct gps_device_t *session)
  */
 #define NON_ERROR	0	/* must be distinct from any gps_mask_t value */
 
-static bool gps_query(/*@out@*/struct gps_data_t *gpsdata,
+static bool gps_query(struct gps_data_t *gpsdata,
 		       gps_mask_t expect,
 		       const int timeout,
 		       const char *fmt, ... )
@@ -86,12 +84,10 @@ static bool gps_query(/*@out@*/struct gps_data_t *gpsdata,
     va_end(ap);
     if (buf[strlen(buf)-1] != '\n')
 	(void)strlcat(buf, "\n", sizeof(buf));
-    /*@-usedef@*/
     if (write(gpsdata->gps_fd, buf, strlen(buf)) <= 0) {
 	gpsd_log(&context.errout, LOG_ERROR, "gps_query(), write failed\n");
 	return false;
     }
-    /*@+usedef@*/
     gpsd_log(&context.errout, LOG_PROG, "gps_query(), wrote, %s\n", buf);
 
     FD_ZERO(&rfds);
@@ -101,7 +97,6 @@ static bool gps_query(/*@out@*/struct gps_data_t *gpsdata,
 
 	gpsd_log(&context.errout, LOG_PROG, "waiting...\n");
 
-	/*@ -usedef -type -nullpass -compdef @*/
 	tv.tv_sec = 2;
 	tv.tv_nsec = 0;
 	if (pselect(gpsdata->gps_fd + 1, &rfds, NULL, NULL, &tv, &oldset) == -1) {
@@ -110,7 +105,6 @@ static bool gps_query(/*@out@*/struct gps_data_t *gpsdata,
 	    gpsd_log(&context.errout, LOG_ERROR, "select %s\n", strerror(errno));
 	    exit(EXIT_FAILURE);
 	}
-	/*@ +usedef +type +nullpass +compdef @*/
 
 	gpsd_log(&context.errout, LOG_PROG, "reading...\n");
 
@@ -120,7 +114,6 @@ static bool gps_query(/*@out@*/struct gps_data_t *gpsdata,
 	    return false;
 	}
 
-	/*@ +ignorequals @*/
 	if ((expect == NON_ERROR) || (expect & gpsdata->set) != 0)
 	    return true;
 	else if (timeout > 0 && (time(NULL) - starttime > timeout)) {
@@ -129,7 +122,6 @@ static bool gps_query(/*@out@*/struct gps_data_t *gpsdata,
 		     timeout);
 	    return false;
 	}
-	/*@ -ignorequals @*/
     }
 
     return false;
@@ -146,7 +138,7 @@ static void onsig(int sig)
     }
 }
 
-static char /*@observer@*/ *gpsd_id( /*@in@ */ struct gps_device_t *session)
+static char *gpsd_id(struct gps_device_t *session)
 /* full ID of the device for reports, including subtype */
 {
     static char buf[128];
@@ -178,7 +170,6 @@ static void ctlhook(struct gps_device_t *device UNUSED, gps_mask_t changed UNUSE
     }
 }
 
-/*@-mustfreeonly -observertrans -statictrans@*/
 int main(int argc, char **argv)
 {
     int option, status;
@@ -286,7 +277,6 @@ int main(int argc, char **argv)
 	    break;
 	case 'R':		/* remove the SHM export segment */
 #ifdef SHM_EXPORT_ENABLE
-	    /*@-nullpass@*/
 	    status = shmget(getenv("GPSD_SHM_KEY") ? (key_t)strtol(getenv("GPSD_SHM_KEY"), NULL, 0) : (key_t)GPSD_SHM_KEY, 0, 0);
 	    if (status == -1) {
 		gpsd_log(&context.errout, LOG_WARN,
@@ -301,7 +291,6 @@ int main(int argc, char **argv)
 		    exit(1);
 		}
 	    }
-	    /*@+nullpass@*/
 	    exit(0);
 #endif /* SHM_EXPORT_ENABLE */
 	case 'T':		/* set the timeout on packet recognition */
@@ -360,7 +349,6 @@ int main(int argc, char **argv)
     (void) signal(SIGTERM, onsig);
     (void) signal(SIGQUIT, onsig);
 
-    /*@-nullpass@*/ /* someday, add null annotation to the gpsopen() params */
     if (!lowlevel) {
 	/* Try to open the stream to gpsd. */
 	if (gps_open(NULL, NULL, &gpsdata) != 0) {
@@ -370,7 +358,6 @@ int main(int argc, char **argv)
 	    lowlevel = true;
 	}
     }
-    /*@-nullpass@*/
 
     if (!lowlevel) {
 	int i, devcount;
@@ -480,7 +467,6 @@ int main(int argc, char **argv)
 	    exit(EXIT_SUCCESS);
 	}
 
-	/*@-boolops@*/
 	/*
 	 * We used to wait on DEVICE_SET here.  That doesn't work
 	 * anymore because when the demon generates its response it
@@ -514,7 +500,6 @@ int main(int argc, char **argv)
 			 "%s mode change succeeded\n",
 			 gpsdata.dev.path);
 	}
-	/*@+boolops@*/
 	if (speed != NULL) {
 	    char parity = 'N';
 	    char stopbits = '1';
@@ -525,7 +510,6 @@ int main(int argc, char **argv)
 				 device, speed);
 	    else {
 		char *modespec = strchr(speed, ':');
-		/*@ +charint @*/
 		status = 0;
 		if (modespec!=NULL) {
 		    *modespec = '\0';
@@ -587,7 +571,6 @@ int main(int argc, char **argv)
 		exit(EXIT_FAILURE);
 	    }
 
-	/*@ -mustfreeonly -immediatetrans @*/
 	gps_context_init(&context, "gpsctl");
 	context.errout.debug = debuglevel;
 	session.context = &context;
@@ -609,7 +592,6 @@ int main(int argc, char **argv)
 		session.device_type->mode_switcher(&session, MODE_NMEA);
 	gpsd_wrap(&session);
 	exit(EXIT_SUCCESS);
-	/*@ +mustfreeonly +immediatetrans @*/
 #endif /* RECONFIGURE_ENABLE */
     } else {
 	/* access to the daemon failed, use the low-level facilities */
@@ -623,7 +605,6 @@ int main(int argc, char **argv)
 	 * that spuriously look like failure at high baud rates. 
 	 */
 
-	/*@ -mustfreeonly -immediatetrans @*/
 	gps_context_init(&context, "gpsctl");
 	context.errout.debug = debuglevel;
 	session.context = &context;	/* in case gps_init isn't called */
@@ -657,14 +638,13 @@ int main(int argc, char **argv)
 	    }
 	    gpsd_log(&context.errout, LOG_INF, 
 		     "device %s activated\n", session.gpsdata.dev.path);
-	    /*@i1@*/FD_SET(session.gpsdata.gps_fd, &all_fds);
+	    FD_SET(session.gpsdata.gps_fd, &all_fds);
 	    if (session.gpsdata.gps_fd > maxfd)
 		 maxfd = session.gpsdata.gps_fd;
 
 	    /* initialize the GPS context's time fields */
 	    gpsd_time_init(&context, time(NULL));
 
-	    /*@-compdef@*/
 	    /* grab packets until we time out, get sync, or fail sync */
 	    for (hunting = true; hunting; )
 	    {
@@ -704,7 +684,6 @@ int main(int argc, char **argv)
 		    break;
 		}
 	    }
-	    /*@+compdef@*/
 
 	    gpsd_log(&context.errout, LOG_PROG,
 		     "%s looks like a %s at %d.\n",
@@ -738,7 +717,6 @@ int main(int argc, char **argv)
 	/* now perform the actual control function */
 	status = 0;
 #ifdef RECONFIGURE_ENABLE
-	/*@ -nullderef @*/
 	if (to_nmea || to_binary) {
 	    bool write_enable = context.readonly;
 	    context.readonly = false;
@@ -764,7 +742,6 @@ int main(int argc, char **argv)
 	    char *modespec;
 
 	    modespec = strchr(speed, ':');
-	    /*@ +charint @*/
 	    status = 0;
 	    if (modespec!=NULL) {
 		*modespec = '\0';
@@ -834,7 +811,6 @@ int main(int argc, char **argv)
 	}
 #endif /* RECONFIGURE_ENABLE */
 #ifdef CONTROLSEND_ENABLE
-	/*@ -compdef @*/
 	if (control) {
 	    bool write_enable = context.readonly;
 	    context.readonly = false;
@@ -855,14 +831,10 @@ int main(int argc, char **argv)
 	    }
 	    context.readonly = write_enable;
 	}
-	/*@ +compdef @*/
 #endif /* CONTROLSEND_ENABLE */
 
 	exit(status);
-	/*@ +nullderef @*/
-	/*@ +mustfreeonly +immediatetrans @*/
     }
 }
-/*@+mustfreeonly +observertrans +statictrans@*/
 
 /* end */
diff --git a/gpsd.c b/gpsd.c
index 2e767366..243c19c3 100644
--- a/gpsd.c
+++ b/gpsd.c
@@ -22,15 +22,11 @@
 #include <syslog.h>
 #include <errno.h>
 #include <signal.h>
-#ifdef S_SPLINT_S
-extern int pthread_mutex_lock (pthread_mutex_t *__mutex);
-extern int pthread_mutex_unlock (pthread_mutex_t *__mutex);
-#else
-#include <ctype.h>         /* raspbian splint hates this */
-#include <pwd.h>           /* raspbian splint hates this */
-#include <grp.h>           /* raspbian splint hates this */
-#include <fcntl.h>         /* raspbian splint hates this */
-#include <pthread.h>       /* raspbian splint hates this */
+#include <ctype.h>
+#include <pwd.h>
+#include <grp.h>
+#include <fcntl.h>
+#include <pthread.h>
 #include <netdb.h>
 #ifndef AF_UNSPEC
 #include <sys/socket.h>
@@ -41,7 +37,6 @@ extern int pthread_mutex_unlock (pthread_mutex_t *__mutex);
 #include <sys/un.h>
 #include <arpa/inet.h>     /* for htons() and friends */
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd_config.h"
 
@@ -252,7 +247,6 @@ static socket_t filesock(char *filename)
     struct sockaddr_un addr;
     socket_t sock;
 
-    /*@ -mayaliasunique -usedef @*/
     if (BAD_SOCKET(sock = socket(AF_UNIX, SOCK_STREAM, 0))) {
 	gpsd_log(&context.errout, LOG_ERROR,
 		 "Can't create device-control socket\n");
@@ -272,7 +266,6 @@ static socket_t filesock(char *filename)
 	(void)close(sock);
 	return -1;
     }
-    /*@ +mayaliasunique +usedef @*/
 
     /* coverity[leaked_handle] This is an intentional allocation */
     return sock;
@@ -324,7 +317,7 @@ static socket_t passivesock_af(int af, char *service, char *tcp_or_udp, int qlen
      * qlen = maximum wait-queue length for connections
      */
     struct servent *pse;
-    struct protoent *ppe;	/* splint has a bug here */
+    struct protoent *ppe;
     sockaddr_t sat;
     int sin_len = 0;
     int type, proto, one = 1;
@@ -343,20 +336,18 @@ static socket_t passivesock_af(int af, char *service, char *tcp_or_udp, int qlen
     ppe = getprotobyname(tcp_or_udp);
     if (strcmp(tcp_or_udp, "udp") == 0) {
 	type = SOCK_DGRAM;
-	/*@i@*/ proto = (ppe) ? ppe->p_proto : IPPROTO_UDP;
+	proto = (ppe) ? ppe->p_proto : IPPROTO_UDP;
     } else {
 	type = SOCK_STREAM;
-	/*@i@*/ proto = (ppe) ? ppe->p_proto : IPPROTO_TCP;
+	proto = (ppe) ? ppe->p_proto : IPPROTO_TCP;
     }
 
-    /*@ -mustfreefresh +matchanyintegral @*/
     switch (af) {
     case AF_INET:
 	sin_len = sizeof(sat.sa_in);
 
 	memset((char *)&sat.sa_in, 0, sin_len);
 	sat.sa_in.sin_family = (sa_family_t) AF_INET;
-#ifndef S_SPLINT_S
 #ifndef FORCE_GLOBAL_ENABLE
 	if (!listen_global)
 	    sat.sa_in.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
@@ -364,24 +355,20 @@ static socket_t passivesock_af(int af, char *service, char *tcp_or_udp, int qlen
 #endif /* FORCE_GLOBAL_ENABLE */
 	    sat.sa_in.sin_addr.s_addr = htonl(INADDR_ANY);
 	sat.sa_in.sin_port = htons(port);
-#endif /* S_SPLINT_S */
 
 	af_str = "IPv4";
 	/* see PF_INET6 case below */
 	s = socket(PF_INET, type, proto);
 	if (s > -1 ) {
-	/*@-unrecog@*/
 	/* Set packet priority */
 	if (setsockopt(s, IPPROTO_IP, IP_TOS, &dscp, sizeof(dscp)) == -1)
 	    gpsd_log(&context.errout, LOG_WARN,
 		     "Warning: SETSOCKOPT TOS failed\n");
 	}
-	/*@+unrecog@*/
 
 	break;
 #ifdef IPV6_ENABLE
     case AF_INET6:
-#ifndef S_SPLINT_S
 	sin_len = sizeof(sat.sa_in6);
 
 	memset((char *)&sat.sa_in6, 0, sin_len);
@@ -424,7 +411,6 @@ static socket_t passivesock_af(int af, char *service, char *tcp_or_udp, int qlen
 		gpsd_log(&context.errout, LOG_WARN,
 			 "Warning: SETSOCKOPT TOS failed\n");
 	}
-#endif /* S_SPLINT_S */
 	break;
 #endif  /* IPV6_ENABLE */
     default:
@@ -467,12 +453,11 @@ static socket_t passivesock_af(int af, char *service, char *tcp_or_udp, int qlen
 
     gpsd_log(&context.errout, LOG_SPIN, "passivesock_af() -> %d\n", s);
     return s;
-    /*@ +mustfreefresh -matchanyintegral @*/
 }
 
 /* *INDENT-OFF* */
 static int passivesocks(char *service, char *tcp_or_udp,
-			int qlen, /*@out@*/socket_t socks[])
+			int qlen, socket_t socks[])
 {
     int numsocks = AFCOUNT;
     int i;
@@ -527,7 +512,7 @@ static void unlock_subscriber(struct subscriber_t *sub)
     (void)pthread_mutex_unlock(&sub->mutex);
 }
 
-static /*@null@*//*@observer@ */ struct subscriber_t *allocate_client(void)
+static struct subscriber_t *allocate_client(void)
 /* return the address of a subscriber structure allocated for a new session */
 {
     int si;
@@ -575,7 +560,6 @@ static void detach_client(struct subscriber_t *sub)
     sub->policy.devpath[0] = '\0';
     sub->fd = UNALLOCATED_FD;
     unlock_subscriber(sub);
-    /*@+mustfreeonly@*/
 }
 
 static ssize_t throttled_write(struct subscriber_t *sub, char *buf,
@@ -673,7 +657,7 @@ static void deactivate_device(struct gps_device_t *device)
 
 #if defined(SOCKET_EXPORT_ENABLE) || defined(CONTROL_SOCKET_ENABLE)
 /* *INDENT-OFF* */
-/*@null@*//*@observer@*/ static struct gps_device_t *find_device(/*@null@*/const char
+static struct gps_device_t *find_device(const char
 								 *device_name)
 /* find the device block for an existing device name */
 {
@@ -690,7 +674,7 @@ static void deactivate_device(struct gps_device_t *device)
 /* *INDENT-ON* */
 #endif /* defined(SOCKET_EXPORT_ENABLE) || defined(CONTROL_SOCKET_ENABLE) */
 
-static bool open_device( /*@null@*/struct gps_device_t *device)
+static bool open_device( struct gps_device_t *device)
 {
     if (NULL == device || gpsd_activate(device, O_OPTIMIZE) < 0) {
 	return false;
@@ -755,21 +739,19 @@ bool gpsd_add_device(const char *device_name, bool flag_nowait)
 }
 
 #ifdef CONTROL_SOCKET_ENABLE
-/*@ observer @*/ static char *snarfline(char *p, /*@out@*/ char **out)
+static char *snarfline(char *p, char **out)
 /* copy the rest of the command line, before CR-LF */
 {
     char *q;
     static char stash[BUFSIZ];
 
-    /*@ -temptrans -mayaliasunique @*/
-    for (q = p; isprint((unsigned char) *p) && !isspace((unsigned char) *p) && /*@i@*/ (p - q < (ssize_t) sizeof(stash) - 1);
+    for (q = p; isprint((unsigned char) *p) && !isspace((unsigned char) *p) && (p - q < (ssize_t) sizeof(stash) - 1);
 	 p++)
 	continue;
     (void)memcpy(stash, q, (size_t) (p - q));
     stash[p - q] = '\0';
     *out = stash;
     return p;
-    /*@ +temptrans +mayaliasunique @*/
 }
 
 static void handle_control(int sfd, char *buf)
@@ -784,7 +766,6 @@ static void handle_control(int sfd, char *buf)
       * gpsdctl.c.  Be careful about keeping them in sync, or
       * hotplugging will have mysterious failures.
       */
-    /*@ -sefparams @*/
     if (buf[0] == '-') {
 	/* remove device named after - */
 	(void)snarfline(buf + 1, &stash);
@@ -916,7 +897,6 @@ static void handle_control(int sfd, char *buf)
 	/* unknown command */
 	ignore_return(write(sfd, "ERROR\n", 6));
     }
-    /*@ +sefparams @*/
 }
 #endif /* CONTROL_SOCKET_ENABLE */
 
@@ -1074,18 +1054,6 @@ static void handle_request(struct subscriber_t *sub,
     struct gps_device_t *devp;
     const char *end = NULL;
 
-    /*
-     * There's a splint limitation that parameters can be declared
-     * @out@ or @null@ but not, apparently, both.  This collides with
-     * the (admittedly tricky) way we use endptr. The workaround is to
-     * declare it @null@ and use -compdef around the JSON reader calls.
-     */
-    /*@-compdef@*/
-    /*
-     * See above...
-     */
-    /*@-nullderef -nullpass@*/
-
     if (buf[0] == '?')
 	++buf;
     if (str_starts_with(buf, "DEVICES;")) {
@@ -1098,9 +1066,7 @@ static void handle_request(struct subscriber_t *sub,
 	if (*buf == ';') {
 	    ++buf;
 	} else {
-	    /*@-nullstate@*/
 	    int status = json_watch_read(buf + 1, &sub->policy, &end);
-	    /*@+nullstate@*/
 #ifndef TIMING_ENABLE
 	    sub->policy.timing = false;
 #endif /* TIMING_ENABLE */
@@ -1166,10 +1132,8 @@ static void handle_request(struct subscriber_t *sub,
 	} else {
 #ifdef RECONFIGURE_ENABLE
 	    struct gps_device_t *device;
-	    /*@-nullstate@*/
 	    /* first, select a device to operate on */
 	    int status = json_device_read(buf + 1, &devconf, &end);
-	    /*@+nullstate@*/
 	    if (end == NULL)
 		buf += strlen(buf);
 	    else {
@@ -1178,7 +1142,6 @@ static void handle_request(struct subscriber_t *sub,
 		buf = end;
 	    }
 	    device = NULL;
-	    /*@-branchstate@*/
 	    if (status != 0) {
 		(void)snprintf(reply, replylen,
 			       "{\"class\":\"ERROR\",\"message\":\"Invalid DEVICE: \"%s\"}\r\n",
@@ -1268,7 +1231,6 @@ static void handle_request(struct subscriber_t *sub,
 			    device->gpsdata.dev.cycle = devconf.cycle;
 		}
 	    }
-	    /*@+branchstate@*/
 #else /* RECONFIGURE_ENABLE */
 	    str_appendf(reply, replylen,
 			   "{\"class\":\"ERROR\",\"message\":\"Device configuration support not compiled.\"}\r\n");
@@ -1352,8 +1314,6 @@ static void handle_request(struct subscriber_t *sub,
     }
   bailout:
     *after = buf;
-    /*@+nullderef +nullpass@*/
-    /*@+compdef@*/
 }
 
 static void raw_report(struct subscriber_t *sub, struct gps_device_t *device)
@@ -1527,7 +1487,7 @@ static void all_reports(struct gps_device_t *device, gps_mask_t changed)
 	//gpsd_log(&context.errout, LOG_PROG, "NTP: No time this packet\n");
     } else if (isnan(device->newdata.time)) {
 	//gpsd_log(&context.errout, LOG_PROG, "NTP: bad new time\n");
-#if defined(PPS_ENABLE) && !defined(S_SPLINT_S)
+#if defined(PPS_ENABLE)
     } else if (device->newdata.time <= device->pps_thread.fixin.real.tv_sec) {
 	//gpsd_log(&context.errout, LOG_PROG, "NTP: Not a new time\n");
 #endif /* PPS_ENABLE */
@@ -1538,20 +1498,16 @@ static void all_reports(struct gps_device_t *device, gps_mask_t changed)
 	ntp_latch(device, &td);
 #ifdef NTPSHM_ENABLE
 	if (device->shm_clock != NULL) {
-	    /*@-compdef@*/
 	    (void)ntpshm_put(device, device->shm_clock, &td);
-	    /*@+compdef@*/
 	}
 #endif /* NTPSHM_ENABLE */
 
 #ifdef SOCKET_EXPORT_ENABLE
-	/*@-type@*//* splint is confused about struct timespec */
 	notify_watchers(device, false, true,
 			"{\"class\":\"TOFF\",\"device\":\"%s\",\"real_sec\":%ld, \"real_nsec\":%ld,\"clock_sec\":%ld,\"clock_nsec\":%ld}\r\n",
 			device->gpsdata.dev.path,
 			td.real.tv_sec, td.real.tv_nsec,
 			td.clock.tv_sec, td.clock.tv_nsec);
-	/*@+type@*/
 #endif /* SOCKET_EXPORT_ENABLE */
 
     }
@@ -1580,10 +1536,10 @@ static void all_reports(struct gps_device_t *device, gps_mask_t changed)
 		    netgnss_report(&context, device, dgnss);
 	}
 #endif /* NETFEED_ENABLE */
-#if defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S)
+#if defined(DBUS_EXPORT_ENABLE)
 	if (device->gpsdata.fix.mode > MODE_NO_FIX)
 	    send_dbus_fix(device);
-#endif /* defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S) */
+#endif /* defined(DBUS_EXPORT_ENABLE) */
     }
 
 #ifdef SHM_EXPORT_ENABLE
@@ -1595,7 +1551,6 @@ static void all_reports(struct gps_device_t *device, gps_mask_t changed)
 #ifdef SOCKET_EXPORT_ENABLE
     /* update all subscribers associated with this device */
     for (sub = subscribers; sub < subscribers + MAX_CLIENTS; sub++) {
-	/*@-nullderef@*/
 	if (sub == NULL || sub->active == 0 || !subscribed(sub, device))
 	    continue;
 
@@ -1650,7 +1605,6 @@ static void all_reports(struct gps_device_t *device, gps_mask_t changed)
 		}
 	    }
 	}
-	/*@+nullderef@*/
     } /* subscribers */
 #endif /* SOCKET_EXPORT_ENABLE */
 }
@@ -1709,22 +1663,18 @@ static void ship_pps_message(struct gps_device_t *session,
 	     * This read access should be safe - PPS threads
 	     * read fixin locations asynchronously but don't write them.
 	     */
-	    /*@-type@*//* splint is confused about struct timespec */
 	    tc = recent->pps_thread.fixin;
 	    tc.real.tv_sec += recent->gpsdata.dev.cycle;
 	    td = (struct timedelta_t *)&tc;	/* cast discards volatile */
-	    /*@-type@*/
 	} else
 	    return;
     }
 
-    /*@-type@*//* splint is confused about struct timespec */
     notify_watchers(session, true, true,
 		    "{\"class\":\"PPS\",\"device\":\"%s\",\"real_sec\":%ld, \"real_nsec\":%ld,\"clock_sec\":%ld,\"clock_nsec\":%ld}\r\n",
 		    session->gpsdata.dev.path,
 		    td->real.tv_sec, td->real.tv_nsec,
 		    td->clock.tv_sec, td->clock.tv_nsec);
-    /*@+type@*/
 
     /*
      * PPS receipt resets the device's timeout.  This keeps PPS-only
@@ -1768,7 +1718,6 @@ static void netgnss_autoconnect(struct gps_context_t *context,
 	sp->dist = DGPS_THRESHOLD;
 	sp->server[0] = '\0';
     }
-    /*@ -usedef @*/
     while (fgets(buf, (int)sizeof(buf), sfp)) {
 	char *cp = strchr(buf, '#');
 	if (cp != NULL)
@@ -1799,7 +1748,6 @@ static void netgnss_autoconnect(struct gps_context_t *context,
 		 (int)(DGPS_THRESHOLD / 1000));
 	return;
     }
-    /*@ +usedef @*/
 
     /* sort them and try the closest first */
     qsort((void *)keep, SERVER_SAMPLE, sizeof(struct dgps_server_t), srvcmp);
@@ -1835,12 +1783,11 @@ static void gpsd_terminate(struct gps_context_t *context CONDITIONALLY_UNUSED)
 #endif /* PPS_ENABLE */
 }
 
-/*@ -mustfreefresh @*/
 int main(int argc, char *argv[])
 {
     /* some of these statics suppress -W warnings due to longjmp() */
 #ifdef SOCKET_EXPORT_ENABLE
-    static char *gpsd_service = NULL;	/* this static pacifies splint */
+    static char *gpsd_service = NULL;
     struct subscriber_t *sub;
 #endif /* SOCKET_EXPORT_ENABLE */
     fd_set rfds;
@@ -1996,14 +1943,12 @@ int main(int argc, char *argv[])
 
 
     /* might be time to daemonize */
-    /*@-unrecog@*/
     if (go_background) {
 	/* not SuS/POSIX portable, but we have our own fallback version */
 	if (daemon(0, 0) != 0)
 	    gpsd_log(&context.errout, LOG_ERROR,
 		     "demonization failed: %s\n",strerror(errno));
     }
-    /*@+unrecog@*/
 
     if (pid_file != NULL) {
 	FILE *fp;
@@ -2021,11 +1966,9 @@ int main(int argc, char *argv[])
     gpsd_log(&context.errout, LOG_INF, "launching (Version %s)\n", VERSION);
 
 #ifdef SOCKET_EXPORT_ENABLE
-    /*@ -observertrans @*/
     if (!gpsd_service)
 	gpsd_service =
 	    getservbyname("gpsd", "tcp") ? "gpsd" : DEFAULT_GPSD_PORT;
-    /*@ +observertrans @*/
     if (passivesocks(gpsd_service, "tcp", QLEN, msocks) < 1) {
 	gpsd_log(&context.errout, LOG_ERR,
 		 "command sockets creation failed, netlib errors %d, %d\n",
@@ -2054,7 +1997,7 @@ int main(int argc, char *argv[])
     (void)ntpshm_context_init(&context);
 #endif /* NTPSHM_ENABLE */
 
-#if defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S)
+#if defined(DBUS_EXPORT_ENABLE)
     /* we need to connect to dbus as root */
     if (initialize_dbus_connection()) {
 	/* the connection could not be started */
@@ -2063,7 +2006,7 @@ int main(int argc, char *argv[])
     } else
 	gpsd_log(&context.errout, LOG_PROG,
 		 "successfully connected to the DBUS system bus\n");
-#endif /* defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S) */
+#endif /* defined(DBUS_EXPORT_ENABLE) */
 
 #ifdef SHM_EXPORT_ENABLE
     /* create the shared segment as root so readers can't mess with it */
@@ -2102,13 +2045,10 @@ int main(int argc, char *argv[])
 	 * of any compromises in the code.  It requires that all GPS
 	 * devices have their group read/write permissions set.
 	 */
-	/*@-nullpass@*/
 	if (setgroups(0, NULL) != 0)
 	    gpsd_log(&context.errout, LOG_ERROR,
 		     "setgroups() failed, errno %s\n",
 		     strerror(errno));
-	/*@+nullpass@*/
-	/*@-type@*/
 #ifdef GPSD_GROUP
 	{
 	    struct group *grp = getgrnam(GPSD_GROUP);
@@ -2135,7 +2075,6 @@ int main(int argc, char *argv[])
 		gpsd_log(&context.errout, LOG_ERROR,
 			    "setuid() failed, errno %s\n",
 			    strerror(errno));
-	/*@+type@*/
     }
     gpsd_log(&context.errout, LOG_INF,
 	     "running with effective group ID %d\n", getegid());
@@ -2145,13 +2084,10 @@ int main(int argc, char *argv[])
 #ifdef SOCKET_EXPORT_ENABLE
     for (i = 0; i < NITEMS(subscribers); i++) {
 	subscribers[i].fd = UNALLOCATED_FD;
-#ifndef S_SPLINT_S
 	(void)pthread_mutex_init(&subscribers[i].mutex, NULL);
-#endif /* S_SPLINT_S */
     }
 #endif /* SOCKET_EXPORT_ENABLE*/
 
-    /*@-compdef -compdestroy@*/
     {
 	struct sigaction sa;
 
@@ -2172,7 +2108,6 @@ int main(int argc, char *argv[])
 	(void)sigaction(SIGQUIT, &sa, NULL);
 	(void)signal(SIGPIPE, SIG_IGN);
     }
-    /*@+compdef +compdestroy@*/
 
     /* daemon got termination or interrupt signal */
     if (setjmp(restartbuf) > 0) {
@@ -2232,10 +2167,8 @@ int main(int argc, char *argv[])
 	for (i = 0; i < AFCOUNT; i++) {
 	    if (msocks[i] >= 0 && FD_ISSET(msocks[i], &rfds)) {
 		socklen_t alen = (socklen_t) sizeof(fsin);
-		/*@+matchanyintegral@*/
 		socket_t ssock =
 		    accept(msocks[i], (struct sockaddr *)&fsin, &alen);
-		/*@+matchanyintegral@*/
 
 		if (BAD_SOCKET(ssock))
 		    gpsd_log(&context.errout, LOG_ERROR,
@@ -2287,9 +2220,7 @@ int main(int argc, char *argv[])
 	/* also be open to new control-socket connections */
 	if (csock > -1 && FD_ISSET(csock, &rfds)) {
 	    socklen_t alen = (socklen_t) sizeof(fsin);
-	    /*@+matchanyintegral@*/
 	    socket_t ssock = accept(csock, (struct sockaddr *)&fsin, &alen);
-	    /*@-matchanyintegral@*/
 
 	    if (BAD_SOCKET(ssock))
 		gpsd_log(&context.errout, LOG_ERROR,
@@ -2534,4 +2465,3 @@ shutdown:
     return 0;
 }
 
-/*@ +mustfreefresh @*/
diff --git a/gpsd.h-tail b/gpsd.h-tail
index cedcb7ab..a6685196 100644
--- a/gpsd.h-tail
+++ b/gpsd.h-tail
@@ -5,11 +5,10 @@
  */
 #endif /* GPSD_CONFIG_H */
 
-#ifndef S_SPLINT_S
-#include <termios.h>     /* raspbian splint hates this */
-#endif /* S_SPLINT_S */
 #include <stdint.h>
 #include <stdarg.h>
+#include <termios.h>
+
 #include "gps.h"
 #include "compiler.h"
 
@@ -150,7 +149,7 @@ struct gps_lexer_t {
     size_t length;
     unsigned char inbuffer[MAX_PACKET_LENGTH*2+1];
     size_t inbuflen;
-    unsigned /*@observer@*/char *inbufptr;
+    unsigned char *inbufptr;
     /* outbuffer needs to be able to hold 4 GPGSV records at once */
     unsigned char outbuffer[MAX_PACKET_LENGTH*2+1];
     size_t outbuflen;
@@ -187,8 +186,8 @@ struct gps_lexer_t {
 #endif /* PASSTHROUGH_ENABLE */
 };
 
-extern void lexer_init(/*@out@*/struct gps_lexer_t *);
-extern void packet_reset(/*@out@*/struct gps_lexer_t *);
+extern void lexer_init(struct gps_lexer_t *);
+extern void packet_reset(struct gps_lexer_t *);
 extern void packet_pushback(struct gps_lexer_t *);
 extern void packet_parse(struct gps_lexer_t *);
 extern ssize_t packet_get(int, struct gps_lexer_t *);
@@ -237,16 +236,16 @@ struct gps_context_t {
 #ifdef NTPSHM_ENABLE
     /* we need the volatile here to tell the C compiler not to
      * 'optimize' as 'dead code' the writes to SHM */
-    /*@reldef@*/volatile struct shmTime *shmTime[NTPSHMSEGS];
+    volatile struct shmTime *shmTime[NTPSHMSEGS];
     bool shmTimeInuse[NTPSHMSEGS];
 #endif /* NTPSHM_ENABLE */
 #ifdef PPS_ENABLE
-    /*@null@*/ void (*pps_hook)(struct gps_device_t *, struct timedelta_t *);
+    void (*pps_hook)(struct gps_device_t *, struct timedelta_t *);
 #endif /* PPS_ENABLE */
 #ifdef SHM_EXPORT_ENABLE
     /* we don't want the compiler to treat writes to shmexport as dead code,
      * and we don't want them reordered either */
-    /*@reldef@*/volatile void *shmexport;
+    volatile void *shmexport;
 #endif
     ssize_t (*serial_write)(struct gps_device_t *,
 			    const char *buf, const size_t len);
@@ -306,7 +305,7 @@ typedef enum {
 #define EOF_IS		INTERNAL_SET(10)	/* synthetic EOF */
 #define DATA_IS	~(ONLINE_SET|PACKET_SET|CLEAR_IS|REPORT_IS)
 
-typedef /*@unsignedintegraltype@*/ unsigned int driver_mask_t;
+typedef unsigned int driver_mask_t;
 #define DRIVER_NOFLAGS	0x00000000u
 #define DRIVER_STICKY	0x00000001u
 
@@ -325,29 +324,29 @@ typedef /*@unsignedintegraltype@*/ unsigned int driver_mask_t;
 
 struct gps_type_t {
 /* GPS method table, describes how to talk to a particular GPS type */
-    /*@observer@*/char *type_name;
+    char *type_name;
     int packet_type;
     driver_mask_t flags;	/* reserved for expansion */
-    /*@observer@*//*@null@*/char *trigger;
+    char *trigger;
     int channels;
-    /*@null@*/bool (*probe_detect)(struct gps_device_t *session);
-    /*@null@*/ssize_t (*get_packet)(struct gps_device_t *session);
-    /*@null@*/gps_mask_t (*parse_packet)(struct gps_device_t *session);
-    /*@null@*/ssize_t (*rtcm_writer)(struct gps_device_t *session, const char *rtcmbuf, size_t rtcmbytes);
-    /*@null@*/void (*init_query)(struct gps_device_t *session);
-    /*@null@*/void (*event_hook)(struct gps_device_t *session, event_t event);
+    bool (*probe_detect)(struct gps_device_t *session);
+    ssize_t (*get_packet)(struct gps_device_t *session);
+    gps_mask_t (*parse_packet)(struct gps_device_t *session);
+    ssize_t (*rtcm_writer)(struct gps_device_t *session, const char *rtcmbuf, size_t rtcmbytes);
+    void (*init_query)(struct gps_device_t *session);
+    void (*event_hook)(struct gps_device_t *session, event_t event);
 #ifdef RECONFIGURE_ENABLE
-    /*@null@*/bool (*speed_switcher)(struct gps_device_t *session,
+    bool (*speed_switcher)(struct gps_device_t *session,
 				     speed_t speed, char parity, int stopbits);
-    /*@null@*/void (*mode_switcher)(struct gps_device_t *session, int mode);
-    /*@null@*/bool (*rate_switcher)(struct gps_device_t *session, double rate);
+    void (*mode_switcher)(struct gps_device_t *session, int mode);
+    bool (*rate_switcher)(struct gps_device_t *session, double rate);
     double min_cycle;
 #endif /* RECONFIGURE_ENABLE */
 #ifdef CONTROLSEND_ENABLE
-    /*@null@*/ssize_t (*control_send)(struct gps_device_t *session, char *buf, size_t buflen);
+    ssize_t (*control_send)(struct gps_device_t *session, char *buf, size_t buflen);
 #endif /* CONTROLSEND_ENABLE */
 #ifdef TIMEHINT_ENABLE
-    /*@null@*/double (*time_offset)(struct gps_device_t *session);
+    double (*time_offset)(struct gps_device_t *session);
 #endif /* TIMEHINT_ENABLE */
 };
 
@@ -435,11 +434,11 @@ struct ntrip_stream_t
 struct gps_device_t {
 /* session object, encapsulates all global state */
     struct gps_data_t gpsdata;
-    /*@relnull@*/const struct gps_type_t *device_type;
+    const struct gps_type_t *device_type;
     unsigned int driver_index;		/* numeric index of current driver */
     unsigned int drivers_identified;	/* bitmask; what drivers have we seen? */
 #ifdef RECONFIGURE_ENABLE
-    /*@relnull@*/const struct gps_type_t *last_controller;
+    const struct gps_type_t *last_controller;
 #endif /* RECONFIGURE_ENABLE */
     struct gps_context_t	*context;
     sourcetype_t sourcetype;
@@ -465,10 +464,10 @@ struct gps_device_t {
 #ifdef NTP_ENABLE
     bool ship_to_ntpd;
 #ifdef NTPSHM_ENABLE
-    volatile /*@null@*/ struct shmTime *shm_clock;
+    volatile struct shmTime *shm_clock;
 #endif /* NTPSHM_ENABLE */
 # ifdef PPS_ENABLE
-    volatile /*@null@*/ struct shmTime *shm_pps;
+    volatile struct shmTime *shm_pps;
     int chronyfd;			/* for talking to chrony */
 # endif /* PPS_ENABLE */
 #endif /* NTP_ENABLE */
@@ -725,7 +724,7 @@ struct gps_device_t {
 #define IS_HIGHEST_BIT(v,m)	(v & ~((m<<1)-1))==0
 
 /* driver helper functions */
-extern void isgps_init(/*@out@*/struct gps_lexer_t *);
+extern void isgps_init(struct gps_lexer_t *);
 enum isgpsstat_t isgps_decode(struct gps_lexer_t *,
 			      bool (*preamble_match)(isgps30bits_t *),
 			      bool (*length_check)(struct gps_lexer_t *),
@@ -736,12 +735,12 @@ extern void isgps_output_magnavox(const isgps30bits_t *, unsigned int, FILE *);
 
 extern enum isgpsstat_t rtcm2_decode(struct gps_lexer_t *, unsigned int);
 extern void json_rtcm2_dump(const struct rtcm2_t *,
-			    /*@null@*/const char *, /*@out@*/char[], size_t);
-extern void rtcm2_unpack(/*@out@*/struct rtcm2_t *, char *);
+			    const char *, char[], size_t);
+extern void rtcm2_unpack(struct rtcm2_t *, char *);
 extern void json_rtcm3_dump(const struct rtcm3_t *,
-			    /*@null@*/const char *, /*@out@*/char[], size_t);
+			    const char *, char[], size_t);
 extern void rtcm3_unpack(const struct gps_context_t *, 
-			 /*@out@*/struct rtcm3_t *, char *);
+			 struct rtcm3_t *, char *);
 
 /* here are the available GPS drivers */
 extern const struct gps_type_t **gpsd_drivers;
@@ -799,45 +798,43 @@ extern ssize_t gpsd_write(struct gps_device_t *, const char *, const size_t);
 
 extern void gpsd_time_init(struct gps_context_t *, time_t);
 extern void gpsd_set_century(struct gps_device_t *);
-extern timestamp_t gpsd_gpstime_resolve(/*@in@ */ struct gps_device_t *,
+extern timestamp_t gpsd_gpstime_resolve(struct gps_device_t *,
 			      const unsigned short, const double);
-extern timestamp_t gpsd_utc_resolve(/*@in@*/struct gps_device_t *);
-extern void gpsd_century_update(/*@in@*/struct gps_device_t *, int);
+extern timestamp_t gpsd_utc_resolve(struct gps_device_t *);
+extern void gpsd_century_update(struct gps_device_t *, int);
 
-extern void gpsd_zero_satellites(/*@out@*/struct gps_data_t *sp);
+extern void gpsd_zero_satellites(struct gps_data_t *sp);
 extern gps_mask_t gpsd_interpret_subframe(struct gps_device_t *, unsigned int,
 				uint32_t[]);
 extern gps_mask_t gpsd_interpret_subframe_raw(struct gps_device_t *,
 				unsigned int, uint32_t[]);
-extern /*@ observer @*/ const char *gpsd_hexdump(/*@out@*/char *, size_t,
-						 /*@null@*/char *, size_t);
-extern /*@ observer @*/ const char *gpsd_packetdump(/*@out@*/char *, size_t,
-						    /*@null@*/char *, size_t);
-extern /*@ observer @*/ const char *gpsd_prettydump(struct gps_device_t *);
+extern const char *gpsd_hexdump(char *, size_t, char *, size_t);
+extern const char *gpsd_packetdump(char *, size_t, char *, size_t);
+extern const char *gpsd_prettydump(struct gps_device_t *);
 # ifdef __cplusplus
 extern "C" {
 # endif
-extern int gpsd_hexpack(/*@in@*/const char *, /*@out@*/char *, size_t);
+extern int gpsd_hexpack(const char *, char *, size_t);
 # ifdef __cplusplus
 }
 # endif
-extern ssize_t hex_escapes(/*@out@*/char *, const char *);
+extern ssize_t hex_escapes(char *, const char *);
 extern void gpsd_position_fix_dump(struct gps_device_t *,
-				   /*@out@*/char[], size_t);
+				   char[], size_t);
 extern void gpsd_clear_data(struct gps_device_t *);
 extern socket_t netlib_connectsock(int, const char *, const char *, const char *);
 extern socket_t netlib_localsocket(const char *, int);
-extern const char /*@observer@*/ *netlib_errstr(const int);
-extern char /*@observer@*/ *netlib_sock2ip(socket_t);
+extern const char *netlib_errstr(const int);
+extern char *netlib_sock2ip(socket_t);
 
-extern void nmea_tpv_dump(struct gps_device_t *, /*@out@*/char[], size_t);
-extern void nmea_sky_dump(struct gps_device_t *, /*@out@*/char[], size_t);
-extern void nmea_subframe_dump(struct gps_device_t *, /*@out@*/char[], size_t);
-extern void nmea_ais_dump(struct gps_device_t *, /*@out@*/char[], size_t);
-extern unsigned int ais_binary_encode(struct ais_t *ais, /*@out@*/unsigned char *bits, int flag);
+extern void nmea_tpv_dump(struct gps_device_t *, char[], size_t);
+extern void nmea_sky_dump(struct gps_device_t *, char[], size_t);
+extern void nmea_subframe_dump(struct gps_device_t *, char[], size_t);
+extern void nmea_ais_dump(struct gps_device_t *, char[], size_t);
+extern unsigned int ais_binary_encode(struct ais_t *ais, unsigned char *bits, int flag);
 
 #ifdef NTP_ENABLE
-extern void ntp_latch(struct gps_device_t *device,  /*@out@*/struct timedelta_t *td);
+extern void ntp_latch(struct gps_device_t *device,  struct timedelta_t *td);
 #ifdef NTPSHM_ENABLE
 extern void ntpshm_context_init(struct gps_context_t *);
 extern void ntpshm_session_init(struct gps_device_t *);
@@ -857,8 +854,7 @@ extern void ntpshm_link_activate(struct gps_device_t *);
  * this only handles the case where two normalized timespecs
  * are added or subracted.  (e.g. only a one needs to be borrowed/carried
  */
-/*@-type -noeffect@*/ /* splint is confused about struct timespec */
-/*@unused@*/static inline void TS_NORM( struct timespec *ts)
+static inline void TS_NORM( struct timespec *ts)
 {
     if ( (  1 <= ts->tv_sec ) ||
          ( (0 == ts->tv_sec ) && (0 <= ts->tv_nsec ) ) ) {
@@ -885,7 +881,6 @@ extern void ntpshm_link_activate(struct gps_device_t *);
 	}
     }
 }
-/*@+type +noeffect@*/
 
 /* normalize a timeval */
 #define TV_NORM(tv)  \
@@ -932,11 +927,11 @@ extern void errout_reset(struct gpsd_errout_t *errout);
 extern void gpsd_acquire_reporting_lock(void);
 extern void gpsd_release_reporting_lock(void);
 
-extern void ecef_to_wgs84fix(/*@out@*/struct gps_fix_t *,
-			     /*@out@*/double *,
+extern void ecef_to_wgs84fix(struct gps_fix_t *,
+			     double *,
 			     double, double, double,
 			     double, double, double);
-extern void clear_dop(/*@out@*/struct dop_t *);
+extern void clear_dop(struct dop_t *);
 
 /* shmexport.c */
 #define GPSD_SHM_KEY	0x47505344	/* "GPSD" */
@@ -951,10 +946,10 @@ extern void shm_release(struct gps_context_t *);
 extern void shm_update(struct gps_context_t *, struct gps_data_t *);
 
 /* dbusexport.c */
-#if defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S)
+#if defined(DBUS_EXPORT_ENABLE)
 int initialize_dbus_connection (void);
 void send_dbus_fix (struct gps_device_t* channel);
-#endif /* defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S) */
+#endif /* defined(DBUS_EXPORT_ENABLE) */
 
 /* srecord.c */
 extern void hexdump(size_t, unsigned char *, unsigned char *);
@@ -970,10 +965,10 @@ int b64_ntop(unsigned char const *src, size_t srclength, char *target,
 
 /* application interface */
 extern void gps_context_init(struct gps_context_t *context, 
-			     /*@observer@*/const char *label);
+			     const char *label);
 extern void gpsd_init(struct gps_device_t *,
 		      struct gps_context_t *,
-		      /*@null@*/const char *);
+		      const char *);
 extern void gpsd_clear(struct gps_device_t *);
 extern int gpsd_open(struct gps_device_t *);
 #define O_CONTINUE	0
@@ -985,10 +980,10 @@ extern void gpsd_deactivate(struct gps_device_t *);
 #define AWAIT_GOT_INPUT	1
 #define AWAIT_NOT_READY	0
 #define AWAIT_FAILED	-1
-extern int gpsd_await_data(/*@out@*/fd_set *,
-			   /*@out@*/fd_set *,
+extern int gpsd_await_data(fd_set *,
+			   fd_set *,
 			    const int, 
-			    /*@in@*/fd_set *,
+			    fd_set *,
 			    struct gpsd_errout_t *errout);
 extern gps_mask_t gpsd_poll(struct gps_device_t *);
 #define DEVICE_EOF	-3
@@ -1002,15 +997,15 @@ extern int gpsd_multipoll(const bool,
 			  float reawake_time);
 extern void gpsd_wrap(struct gps_device_t *);
 extern bool gpsd_add_device(const char *device_name, bool flag_nowait);
-extern /*@observer@*/const char *gpsd_maskdump(gps_mask_t);
+extern const char *gpsd_maskdump(gps_mask_t);
 
 /* exceptional driver methods */
 extern bool ubx_write(struct gps_device_t *, unsigned int, unsigned int,
-		      /*@null@*/unsigned char *, size_t);
+		      unsigned char *, size_t);
 extern bool ais_binary_decode(const struct gpsd_errout_t *errout,
 			      struct ais_t *ais,
 			      const unsigned char *, size_t,
-			      /*@null@*/struct ais_type24_queue_t *);
+			      struct ais_type24_queue_t *);
 
 /* debugging apparatus for the client library */
 #ifdef CLIENTDEBUG_ENABLE
@@ -1023,7 +1018,7 @@ extern bool ais_binary_decode(const struct gpsd_errout_t *errout,
 extern int libgps_debuglevel;
 extern void libgps_dump_state(struct gps_data_t *);
 #else
-# define libgps_debug_trace(args) /*@i1@*/do { } while (0)
+# define libgps_debug_trace(args) do { } while (0)
 #endif /* LIBGPS_DEBUG */
 
 void gpsd_labeled_report(const int, const int,
@@ -1032,13 +1027,6 @@ void gpsd_vlog(const struct gpsd_errout_t *,
 	       const int, char *, size_t, const char *, va_list ap);
 PRINTF_FUNC(3, 4) void gpsd_log(const struct gpsd_errout_t *, const int, const char *, ...);
 
-#ifdef S_SPLINT_S
-extern struct protoent *getprotobyname(const char *);
-extern /*@observer@*/char *strptime(const char *,const char *tp,/*@out@*/struct tm *)/*@modifies tp@*/;
-extern struct tm *gmtime_r(const time_t *,/*@out@*/struct tm *tp)/*@modifies tp@*/;
-extern struct tm *localtime_r(const time_t *,/*@out@*/struct tm *tp)/*@modifies tp@*/;
-#endif /* S_SPLINT_S */
-
 /*
  * How to mix together epx and epy to get a horizontal circular error
  * eph when reporting requires it. Most devices don't report these;
diff --git a/gpsd_json.c b/gpsd_json.c
index 9d51b12d..f27d29c9 100644
--- a/gpsd_json.c
+++ b/gpsd_json.c
@@ -54,12 +54,11 @@ struct classmap_t classmap[CLASSMAP_NITEMS] = {
 };
 /* *INDENT-ON* */
 
-char *json_stringify( /*@out@*/ char *to,
+char *json_stringify( char *to,
 		     size_t len,
-		     /*@in@*/ const char *from)
+		     const char *from)
 /* escape double quotes and control characters inside a JSON string */
 {
-    /*@-temptrans@*/
     const char *sp;
     char *tp;
 
@@ -105,10 +104,9 @@ char *json_stringify( /*@out@*/ char *to,
     *tp = '\0';
 
     return to;
-    /*@+temptrans@*/
 }
 
-void json_version_dump( /*@out@*/ char *reply, size_t replylen)
+void json_version_dump( char *reply, size_t replylen)
 {
     (void)snprintf(reply, replylen,
 		   "{\"class\":\"VERSION\",\"release\":\"%s\",\"rev\":\"%s\",\"proto_major\":%d,\"proto_minor\":%d}\r\n",
@@ -125,7 +123,7 @@ void json_version_dump( /*@out@*/ char *reply, size_t replylen)
 
 void json_tpv_dump(const struct gps_device_t *session,
 		   const struct policy_t *policy CONDITIONALLY_UNUSED,
-		   /*@out@*/ char *reply, size_t replylen)
+		   char *reply, size_t replylen)
 {
     const struct gps_data_t *gpsdata = &session->gpsdata;
 
@@ -182,12 +180,10 @@ void json_tpv_dump(const struct gps_device_t *session,
 	    str_appendf(reply, replylen, "\"epc\":%.2f,", gpsdata->fix.epc);
 #ifdef TIMING_ENABLE
 	if (policy->timing) {
-	    /*@-type -formattype@*/ /* splint is confused about struct timespec */
 	    char rtime_str[TIMESPEC_LEN];
 	    struct timespec rtime_tmp;
-	    /*@i@*/(int)clock_gettime(CLOCK_REALTIME, &rtime_tmp);
-	    /*@i1@*/timespec_str(&rtime_tmp, rtime_str, sizeof(rtime_str));
-	    /*@-formattype@*/
+	    (int)clock_gettime(CLOCK_REALTIME, &rtime_tmp);
+	    timespec_str(&rtime_tmp, rtime_str, sizeof(rtime_str));
 	    str_appendf(reply, replylen, "\"rtime\":%s,", rtime_str);
 #ifdef PPS_ENABLE
 	    if (session->pps_thread.ppsout_count) {
@@ -197,7 +193,6 @@ void json_tpv_dump(const struct gps_device_t *session,
 		str_appendf(reply, replylen, "\"pps\":%s,", ts_str);
                 /* TODO: add PPS precision to JSON output */
 	    }
-	    /*@+type +formattype@*/
 #endif /* PPS_ENABLE */
 	    str_appendf(reply, replylen,
 			"\"sor\":%.9f,\"chars\":%lu,\"sats\":%2d,"
@@ -216,7 +211,7 @@ void json_tpv_dump(const struct gps_device_t *session,
 }
 
 void json_noise_dump(const struct gps_data_t *gpsdata,
-		   /*@out@*/ char *reply, size_t replylen)
+		   char *reply, size_t replylen)
 {
     char tbuf[JSON_DATE_MAX+1];
 
@@ -247,7 +242,7 @@ void json_noise_dump(const struct gps_data_t *gpsdata,
 }
 
 void json_sky_dump(const struct gps_data_t *datap,
-		   /*@out@*/ char *reply, size_t replylen)
+		   char *reply, size_t replylen)
 {
     int i, reported = 0;
 
@@ -300,7 +295,7 @@ void json_sky_dump(const struct gps_data_t *datap,
 }
 
 void json_device_dump(const struct gps_device_t *device,
-		      /*@out@*/ char *reply, size_t replylen)
+		      char *reply, size_t replylen)
 {
     struct classmap_t *cmp;
     char buf1[JSON_VAL_MAX * 2 + 1];
@@ -313,7 +308,6 @@ void json_device_dump(const struct gps_device_t *device,
 	(void)strlcat(reply, device->device_type->type_name, replylen);
 	(void)strlcat(reply, "\",", replylen);
     }
-    /*@-mustfreefresh@*/
     if (device->subtype[0] != '\0') {
 	(void)strlcat(reply, "\"subtype\":\"", replylen);
 	(void)strlcat(reply,
@@ -321,7 +315,6 @@ void json_device_dump(const struct gps_device_t *device,
 		      replylen);
 	(void)strlcat(reply, "\",", replylen);
     }
-    /*@+mustfreefresh@*/
     /*
      * There's an assumption here: Anything that we type service_sensor is
      * a serial device with the usual control parameters.
@@ -363,9 +356,8 @@ void json_device_dump(const struct gps_device_t *device,
 }
 
 void json_watch_dump(const struct policy_t *ccp,
-		     /*@out@*/ char *reply, size_t replylen)
+		     char *reply, size_t replylen)
 {
-    /*@-compdef@*/
     (void)snprintf(reply, replylen,
 		   "{\"class\":\"WATCH\",\"enable\":%s,\"json\":%s,\"nmea\":%s,\"raw\":%d,\"scaled\":%s,\"timing\":%s,\"split24\":%s,\"pps\":%s,",
 		   ccp->watcher ? "true" : "false",
@@ -380,11 +372,10 @@ void json_watch_dump(const struct policy_t *ccp,
 	str_appendf(reply, replylen, "\"device\":\"%s\",", ccp->devpath);
     str_rstrip_char(reply, ',');
     (void)strlcat(reply, "}\r\n", replylen);
-    /*@+compdef@*/
 }
 
 void json_subframe_dump(const struct gps_data_t *datap,
-			/*@out@*/ char buf[], size_t buflen)
+			char buf[], size_t buflen)
 {
     const struct subframe_t *subframe = &datap->subframe;
     const bool scaled = datap->policy.scaled;
@@ -397,7 +388,6 @@ void json_subframe_dump(const struct gps_data_t *datap,
 		   (unsigned int)subframe->subframe_num,
 		   JSON_BOOL(scaled));
 
-    /*@-type@*/
     if ( 1 == subframe->subframe_num ) {
 	if (scaled) {
 	    str_appendf(buf, buflen,
@@ -498,7 +488,6 @@ void json_subframe_dump(const struct gps_data_t *datap,
 	}
     } else if ( subframe->is_almanac ) {
 	if (scaled) {
-	    /*@-compdef@*/
 	    str_appendf(buf, buflen,
 			",\"ALMANAC\":{\"ID\":%d,\"Health\":%u,"
 			"\"e\":%g,\"toa\":%lu,"
@@ -546,7 +535,6 @@ void json_subframe_dump(const struct gps_data_t *datap,
 	case 52:
 	{
 		int i;
-	    /*@+charint@*/
 		/* decoding of ERD to SV is non trivial and not done yet */
 		str_appendf(buf, buflen,
 		    ",\"ERD\":{\"ai\":%u,", subframe->sub4_13.ai);
@@ -559,7 +547,6 @@ void json_subframe_dump(const struct gps_data_t *datap,
 		str_rstrip_char(buf, ',');
 		str_appendf(buf, buflen, "}");
 		break;
-	    /*@-charint@*/
 	}
 	case 55:
 	    /* JSON is UTF-8. double quote, backslash and
@@ -654,7 +641,6 @@ void json_subframe_dump(const struct gps_data_t *datap,
 		       (unsigned int)subframe->pageid);
 	if ( 51 == subframe->pageid ) {
 	    int i;
-	    /*@+matchanyintegral@*/
 	    /* subframe5, page 25 */
 	    str_appendf(buf, buflen,
 		",\"HEALTH2\":{\"toa\":%lu,\"WNa\":%u,",
@@ -668,21 +654,17 @@ void json_subframe_dump(const struct gps_data_t *datap,
 		str_rstrip_char(buf, ',');
 		str_appendf(buf, buflen, "}");
 
-	    /*@-matchanyintegral@*/
 	}
     }
-    /*@+type@*/
     (void)strlcat(buf, "}\r\n", buflen);
-    /*@+compdef@*/
 }
 
 #if defined(RTCM104V2_ENABLE)
 void json_rtcm2_dump(const struct rtcm2_t *rtcm,
-		     /*@null@*/const char *device,
-		     /*@out@*/char buf[], size_t buflen)
+		     const char *device,
+		     char buf[], size_t buflen)
 /* dump the contents of a parsed RTCM104 message as JSON */
 {
-    /*@-mustfreefresh@*/
     char buf1[JSON_VAL_MAX * 2 + 1];
     unsigned int n;
 
@@ -828,17 +810,15 @@ void json_rtcm2_dump(const struct rtcm2_t *rtcm,
 
     str_rstrip_char(buf, ',');
     (void)strlcat(buf, "}\r\n", buflen);
-    /*@+mustfreefresh@*/
 }
 #endif /* defined(RTCM104V2_ENABLE) */
 
 #if defined(RTCM104V3_ENABLE)
 void json_rtcm3_dump(const struct rtcm3_t *rtcm,
-		     /*@null@*/const char *device,
-		     /*@out@*/char buf[], size_t buflen)
+		     const char *device,
+		     char buf[], size_t buflen)
 /* dump the contents of a parsed RTCM104v3 message as JSON */
 {
-    /*@-mustfreefresh@*/
     char buf1[JSON_VAL_MAX * 2 + 1];
     unsigned short i;
     unsigned int n;
@@ -1227,7 +1207,6 @@ void json_rtcm3_dump(const struct rtcm3_t *rtcm,
 	break;
 
     case 1029:
-	/*@-formatcode@*//* splint has a bug */
 	str_appendf(buf, buflen,
 		       "\"station_id\":%u,\"mjd\":%u,\"sec\":%u,"
 		       "\"len\":%zd,\"units\":%zd,\"msg\":\"%s\",",
@@ -1238,7 +1217,6 @@ void json_rtcm3_dump(const struct rtcm3_t *rtcm,
 		       rtcm->rtcmtypes.rtcm3_1029.unicode_units,
 		       json_stringify(buf1, sizeof(buf1),
 				      (char *)rtcm->rtcmtypes.rtcm3_1029.text));
-	/*@+formatcode@*/
 	break;
 
     case 1033:
@@ -1266,7 +1244,6 @@ void json_rtcm3_dump(const struct rtcm3_t *rtcm,
 
     str_rstrip_char(buf, ',');
     (void)strlcat(buf, "}\r\n", buflen);
-    /*@+mustfreefresh@*/
 #undef CODE
 #undef INT
 }
@@ -1274,8 +1251,8 @@ void json_rtcm3_dump(const struct rtcm3_t *rtcm,
 
 #if defined(AIVDM_ENABLE)
 void json_aivdm_dump(const struct ais_t *ais,
-		     /*@null@*/const char *device, bool scaled,
-		     /*@out@*/char *buf, size_t buflen)
+		     const char *device, bool scaled,
+		     char *buf, size_t buflen)
 {
     char buf1[JSON_VAL_MAX * 2 + 1];
     char buf2[JSON_VAL_MAX * 2 + 1];
@@ -1585,7 +1562,6 @@ void json_aivdm_dump(const struct ais_t *ais,
     str_appendf(buf, buflen,
 		   "\"type\":%u,\"repeat\":%u,\"mmsi\":%u,\"scaled\":%s,",
 		   ais->type, ais->repeat, ais->mmsi, JSON_BOOL(scaled));
-    /*@ -formatcode -mustfreefresh @*/
     switch (ais->type) {
     case 1:			/* Position Report */
     case 2:
@@ -3293,13 +3269,12 @@ void json_aivdm_dump(const struct ais_t *ais,
 	(void)strlcat(buf, "}\r\n", buflen);
 	break;
     }
-    /*@ +formatcode +mustfreefresh @*/
 }
 #endif /* defined(AIVDM_ENABLE) */
 
 #ifdef COMPASS_ENABLE
 void json_att_dump(const struct gps_data_t *gpsdata,
-		   /*@out@*/ char *reply, size_t replylen)
+		   char *reply, size_t replylen)
 /* dump the contents of an attitude_t structure as JSON */
 {
     assert(replylen > sizeof(char *));
@@ -3391,7 +3366,7 @@ void json_att_dump(const struct gps_data_t *gpsdata,
 void json_data_report(const gps_mask_t changed,
 		 const struct gps_device_t *session,
 		 const struct policy_t *policy,
-		 /*@out@*/char *buf, size_t buflen)
+		 char *buf, size_t buflen)
 /* report a session state in JSON */
 {
     const struct gps_data_t *datap = &session->gpsdata;
diff --git a/gpsdclient.c b/gpsdclient.c
index cd4f58c3..c3b24451 100644
--- a/gpsdclient.c
+++ b/gpsdclient.c
@@ -17,9 +17,9 @@
 #include "gpsdclient.h"
 
 static struct exportmethod_t exportmethods[] = {
-#if defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S)
+#if defined(DBUS_EXPORT_ENABLE)
     {"dbus", GPSD_DBUS_EXPORT, "DBUS broadcast"},
-#endif /* defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S) */
+#endif /* defined(DBUS_EXPORT_ENABLE) */
 #ifdef SHM_EXPORT_ENABLE
     {"shm", GPSD_SHARED_MEMORY, "shared memory"},
 #endif /* SOCKET_EXPORT_ENABLE */
@@ -36,7 +36,7 @@ static struct exportmethod_t exportmethods[] = {
  *      deg_ddmmss : return DD MM' SS.sss"
  *
  */
-/*@observer@*/ char *deg_to_str(enum deg_str_type type, double f)
+char *deg_to_str(enum deg_str_type type, double f)
 {
     static char str[40];
     int dsec, sec, deg, min;
@@ -134,7 +134,6 @@ enum unit gpsd_units(void)
     return unspecified;
 }
 
-/*@ -observertrans -statictrans -mustfreeonly -branchstate -kepttrans @*/
 void gpsd_source_spec(const char *arg, struct fixsource_t *source)
 /* standard parsing of a GPS data source spec */
 {
@@ -143,7 +142,6 @@ void gpsd_source_spec(const char *arg, struct fixsource_t *source)
     source->port = (char *)DEFAULT_GPSD_PORT;
     source->device = NULL;
 
-    /*@-usedef@ Sigh, splint is buggy */
     if (arg != NULL) {
 	char *colon1, *skipto, *rbrk;
 	source->spec = strdup(arg);
@@ -174,18 +172,14 @@ void gpsd_source_spec(const char *arg, struct fixsource_t *source)
 	}
     }
 
-    /*@-modobserver@*/
     if (*source->server == '[') {
 	char *rbrk = strchr(source->server, ']');
 	++source->server;
 	if (rbrk != NULL)
 	    *rbrk = '\0';
     }
-    /*@+modobserver@*/
-    /*@+usedef@*/
 }
 
-/*@ +observertrans -statictrans +mustfreeonly +branchstate +kepttrans @*/
 
 char *maidenhead(double n, double e)
 /* lat/lon to Maidenhead */
@@ -234,10 +228,9 @@ char *maidenhead(double n, double e)
 
 #define NITEMS(x) (int)(sizeof(x)/sizeof(x[0])) /* from gpsd.h-tail */
 
-/*@null observer@*/struct exportmethod_t *export_lookup(const char *name)
+struct exportmethod_t *export_lookup(const char *name)
 /* Look up an available export method by name */
 {
-    /*@-globstate@*/
     struct exportmethod_t *mp, *method = NULL;
 
     for (mp = exportmethods;
@@ -246,7 +239,6 @@ char *maidenhead(double n, double e)
 	if (strcmp(mp->name, name) == 0)
 	    method = mp;
     return method;
-    /*@+globstate@*/
 }
 
 void export_list(FILE *fp)
@@ -260,7 +252,7 @@ void export_list(FILE *fp)
 	(void)fprintf(fp, "%s: %s\n", method->name, method->description);
 }
 
-/*@null observer@*/struct exportmethod_t *export_default(void)
+struct exportmethod_t *export_default(void)
 {
     return (NITEMS(exportmethods) > 0) ? &exportmethods[0] : NULL;
 }
@@ -285,7 +277,6 @@ void export_list(FILE *fp)
 float true2magnetic(double lat, double lon, double heading)
 {
     /* Western Europe */
-    /*@ -evalorder +relaxtypes @*/
     if ((lat > 36.0) && (lat < 68.0) && (lon > -10.0) && (lon < 28.0)) {
 	heading =
 	    (10.4768771667158 - (0.507385322418858 * lon) +
@@ -330,7 +321,6 @@ float true2magnetic(double lat, double lon, double heading)
 	heading += 360.0;
 
     return (heading);
-    /*@ +evalorder -relaxtypes @*/
 }
 
 /* gpsclient.c ends here */
diff --git a/gpsdclient.h b/gpsdclient.h
index 2363f5a5..ba1aabfb 100644
--- a/gpsdclient.h
+++ b/gpsdclient.h
@@ -13,7 +13,7 @@ struct exportmethod_t
 /* describe an export method */
 {
     const char *name;
-    /*@null@*/const char *magic;
+    const char *magic;
     const char *description;
 };
 
@@ -23,21 +23,21 @@ struct fixsource_t
     char *spec;		/* pointer to actual storage */
     char *server;
     char *port;
-    /*@null@*/char *device;
+    char *device;
 };
 
-/*@null observer@*/struct exportmethod_t *export_lookup(const char *);
-/*@null observer@*/struct exportmethod_t *export_default(void);
+struct exportmethod_t *export_lookup(const char *);
+struct exportmethod_t *export_default(void);
 void export_list(FILE *);
 enum unit {unspecified, imperial, nautical, metric};
 enum unit gpsd_units(void);
 enum deg_str_type { deg_dd, deg_ddmm, deg_ddmmss };
 float true2magnetic(double, double, double);
 
-extern /*@observer@*/ char *deg_to_str( enum deg_str_type type,  double f);
+extern char *deg_to_str( enum deg_str_type type,  double f);
 
-extern void gpsd_source_spec(/*@null@*/const char *fromstring,
-			     /*@out@*/struct fixsource_t *source);
+extern void gpsd_source_spec(const char *fromstring,
+			     struct fixsource_t *source);
 
 char *maidenhead(double n,double e);
 
diff --git a/gpsdctl.c b/gpsdctl.c
index 017dd1c9..21d27e44 100644
--- a/gpsdctl.c
+++ b/gpsdctl.c
@@ -7,17 +7,13 @@
 #include <string.h>
 #include <fcntl.h>
 #include <sys/stat.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 #include <syslog.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <assert.h>
-#ifndef S_SPLINT_S
 #include <sys/socket.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 
@@ -62,7 +58,6 @@ static int gpsd_control(char *action, char *argument)
      * gpsd.c. Be careful about keeping them in sync, or hotplugging
      * will have mysterious failures.
      */
-    /*@ -sefparams @*/
     if (strcmp(action, "add") == 0) {
 	/*
 	 * Force the group-read & group-write bits on, so gpsd will still be
@@ -84,7 +79,6 @@ static int gpsd_control(char *action, char *argument)
 	(void)syslog(LOG_ERR, "unknown action \"%s\"", action);
 	status = -1;
     }
-    /*@ +sefparams @*/
     (void)close(connect);
     //syslog(LOG_DEBUG, "gpsd_control ends");
     return status;
@@ -97,7 +91,6 @@ int main(int argc, char *argv[])
 	(void)syslog(LOG_ERR, "requires action and argument (%d)", argc);
 	exit(EXIT_FAILURE);
     } else {
-	/*@-observertrans@*/
 	char *sockenv = getenv("GPSD_SOCKET");
 	char *optenv = getenv("GPSD_OPTIONS");
 
@@ -113,6 +106,5 @@ int main(int argc, char *argv[])
 	    exit(EXIT_FAILURE);
 	else
 	    exit(EXIT_SUCCESS);
-	/*@+observertrans@*/
     }
 }
diff --git a/gpsdecode.c b/gpsdecode.c
index b5eda7c4..17114c59 100644
--- a/gpsdecode.c
+++ b/gpsdecode.c
@@ -7,9 +7,7 @@
 #include <stdbool.h>
 #include <string.h>
 #include <stdarg.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "bits.h"
@@ -40,7 +38,6 @@ static void aivdm_csv_dump(struct ais_t *ais, char *buf, size_t buflen)
 
     (void)snprintf(buf, buflen, "%u|%u|%09u|", ais->type, ais->repeat,
 		   ais->mmsi);
-    /*@ -formatcode @*/
     switch (ais->type) {
     case 1:			/* Position Report */
     case 2:
@@ -471,7 +468,6 @@ static void aivdm_csv_dump(struct ais_t *ais, char *buf, size_t buflen)
 	str_appendf(buf, buflen, "unknown AIVDM message content.");
 	break;
     }
-    /*@ +formatcode @*/
     (void)strlcat(buf, "\r\n", buflen);
 }
 #endif
@@ -529,7 +525,6 @@ static void pseudonmea_report(gps_mask_t changed, struct gps_device_t *device)
     }
 }
 
-/*@ -mustfreeonly -compdestroy -compdef -usedef -uniondef -immediatetrans -observertrans -statictrans @*/
 static void decode(FILE *fpin, FILE*fpout)
 /* sensor data on fpin to dump format on fpout */
 {
@@ -669,7 +664,6 @@ static void encode(FILE *fpin, FILE *fpout)
 	(void)fputs(inbuf, fpout);
     }
 }
-/*@ +mustfreeonly +compdestroy +compdef +usedef +immediatetrans +observertrans @ +statictrans*/
 #endif /* SOCKET_EXPORT_ENABLE */
 
 int main(int argc, char **argv)
@@ -711,7 +705,6 @@ int main(int argc, char **argv)
 	    break;
 
 	case 't':
-	    /*@-nullpass@*/
 	    typelist[ntypes++] = (unsigned int)atoi(strtok(optarg, ","));
 	    for(;;) {
 		char *next = strtok(NULL, ",");
@@ -719,7 +712,6 @@ int main(int argc, char **argv)
 		    break;
 		typelist[ntypes++] = (unsigned int)atoi(next);
 	    }
-	    /*@+nullpass@*/
 	    break;
 
 	case 'u':
diff --git a/gpsmon.c b/gpsmon.c
index 221a49de..9f16df9a 100644
--- a/gpsmon.c
+++ b/gpsmon.c
@@ -21,9 +21,7 @@
 #include <sys/stat.h>
 #include <sys/select.h>
 #include <fcntl.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "gps_json.h"
@@ -54,8 +52,8 @@ bool serial;
 static struct gps_context_t context;
 static bool curses_active;
 static WINDOW *statwin, *cmdwin;
-/*@null@*/ static WINDOW *packetwin;
-/*@null@*/ static FILE *logfile;
+static WINDOW *packetwin;
+static FILE *logfile;
 static char *type_name;
 static size_t promptlen = 0;
 struct termios cooked, rare;
@@ -77,7 +75,6 @@ const struct monitor_object_t json_mmt = {
 };
 #endif /* PASSTHROUGH_ENABLE */
 
-/*@ -nullassign @*/
 static const struct monitor_object_t *monitor_objects[] = {
 #ifdef NMEA_ENABLE
     &nmea_mmt,
@@ -129,7 +126,6 @@ static const struct monitor_object_t *monitor_objects[] = {
 
 static const struct monitor_object_t **active;
 static const struct gps_type_t *fallback;
-/*@ +nullassign @*/
 
 static jmp_buf terminate;
 
@@ -170,7 +166,7 @@ static inline void report_unlock(void) { }
  ******************************************************************************/
 
 #ifdef PPS_ENABLE
-static void visibilize(/*@out@*/char *buf2, size_t len2, const char *buf)
+static void visibilize(char *buf2, size_t len2, const char *buf)
 /* string is mostly printable, dress up the nonprintables a bit */
 {
     const char *sp;
@@ -186,8 +182,7 @@ static void visibilize(/*@out@*/char *buf2, size_t len2, const char *buf)
 }
 #endif /* PPS_ENABLE */
 
-/*@-compdef -mustdefine@*/
-static void cond_hexdump(/*@out@*/char *buf2, size_t len2, 
+static void cond_hexdump(char *buf2, size_t len2, 
 			 const char *buf, size_t len)
 /* pass through visibilized if all printable, hexdump otherwise */
 {
@@ -219,11 +214,8 @@ static void cond_hexdump(/*@out@*/char *buf2, size_t len2,
 	    str_appendf(buf2, len2, "%02x", (unsigned int)(buf[i] & 0xff));
     }
 }
-/*@+compdef +mustdefine@*/
 
 #ifdef NTP_ENABLE
-/*@-compdef@*/
-/*@-type -noeffect@*/ /* splint is confused about struct timespec */
 void toff_update(WINDOW *win, int y, int x)
 {
     assert(win != NULL);
@@ -254,15 +246,11 @@ void toff_update(WINDOW *win, int y, int x)
 	}
     }
 }
-/*@+type +noeffect@*/
-/*@+compdef@*/
 #endif /* NTP_ENABLE */
 
 #ifdef PPS_ENABLE
 void pps_update(WINDOW *win, int y, int x)
 {
-    /*@-compdef@*/
-    /*@-type -noeffect@*/ /* splint is confused about struct timespec */
     struct timedelta_t ppstimes;
 
     assert(win != NULL);
@@ -288,8 +276,6 @@ void pps_update(WINDOW *win, int y, int x)
         }
 	(void)wnoutrefresh(win);
     }
-    /*@+type +noeffect@*/
-    /*@+compdef@*/
 }
 #endif /* PPS_ENABLE */
 
@@ -321,7 +307,7 @@ static void packet_dump(const char *buf, size_t buflen)
     }
 }
 
-static void monitor_dump_send(/*@in@*/ const char *buf, size_t len)
+static void monitor_dump_send(const char *buf, size_t len)
 {
     if (packetwin != NULL) {
 	report_lock();
@@ -334,7 +320,6 @@ static void monitor_dump_send(/*@in@*/ const char *buf, size_t len)
 }
 #endif /* defined(CONTROLSEND_ENABLE) || defined(RECONFIGURE_ENABLE) */
 
-/*@-compdef@*/
 static void gpsmon_report(const char *buf)
 /* log to the packet window if curses is up, otherwise stdout */
 {
@@ -346,10 +331,8 @@ static void gpsmon_report(const char *buf)
     if (logfile != NULL)
 	(void)fputs(buf, logfile);
 }
-/*@+compdef@*/
 
 #ifdef PPS_ENABLE
-/*@-compdef@*/
 static void packet_vlog(char *buf, size_t len, const char *fmt, va_list ap)
 {
     char buf2[BUFSIZ];
@@ -361,11 +344,10 @@ static void packet_vlog(char *buf, size_t len, const char *fmt, va_list ap)
     gpsmon_report(buf2);
     report_unlock();
 }
-/*@+compdef@*/
 #endif
 
 #ifdef RECONFIGURE_ENABLE
-static void announce_log(/*@in@*/ const char *fmt, ...)
+static void announce_log(const char *fmt, ...)
 {
     char buf[BUFSIZ];
     va_list ap;
@@ -427,7 +409,7 @@ void monitor_log(const char *fmt, ...)
     }
 }
 
-static /*@observer@*/ const char *promptgen(void)
+static const char *promptgen(void)
 {
     static char buf[sizeof(session.gpsdata.dev.path)];
 
@@ -449,7 +431,6 @@ static /*@observer@*/ const char *promptgen(void)
     return buf;
 }
 
- /*@-observertrans -nullpass -globstate@*/
 static void refresh_statwin(void)
 /* refresh the device-identification window */
 {
@@ -482,7 +463,6 @@ static void refresh_cmdwin(void)
     (void)wclrtoeol(cmdwin);
     (void)wnoutrefresh(cmdwin);
 }
-/*@+observertrans +nullpass +globstate@*/
 
 static bool curses_init(void)
 {
@@ -497,7 +477,6 @@ static bool curses_init(void)
 
 #define CMDWINHEIGHT	1
 
-    /*@ -onlytrans @*/
     statwin = newwin(CMDWINHEIGHT, 30, 0, 0);
     cmdwin = newwin(CMDWINHEIGHT, 0, 0, 30);
     packetwin = newwin(0, 0, CMDWINHEIGHT, 0);
@@ -505,7 +484,6 @@ static bool curses_init(void)
 	return false;
     (void)scrollok(packetwin, true);
     (void)wsetscrreg(packetwin, 0, LINES - CMDWINHEIGHT);
-    /*@ +onlytrans @*/
 
     (void)wmove(packetwin, 0, 0);
 
@@ -548,7 +526,6 @@ static bool switch_type(const struct gps_type_t *devtype)
 		return false;
 	    }
 
-	    /*@ -onlytrans @*/
 	    leftover = LINES - 1 - (*active)->min_y;
 	    report_lock();
 	    if (leftover <= 0) {
@@ -565,7 +542,6 @@ static bool switch_type(const struct gps_type_t *devtype)
 		(void)wsetscrreg(packetwin, 0, leftover - 1);
 	    }
 	    report_unlock();
-	    /*@ +onlytrans @*/
 	}
 	return true;
     }
@@ -574,7 +550,6 @@ static bool switch_type(const struct gps_type_t *devtype)
     return false;
 }
 
-/*@-globstate@*/
 static void select_packet_monitor(struct gps_device_t *device)
 {
     static int last_type = BAD_PACKET;
@@ -607,10 +582,8 @@ static void select_packet_monitor(struct gps_device_t *device)
     if (devicewin != NULL)
 	(void)wnoutrefresh(devicewin);
 }
-/*@+globstate@*/
 
-/*@-statictrans -globstate -unrecog@*/
-static /*@null@*/ char *curses_get_command(void)
+static char *curses_get_command(void)
 /* char-by-char nonblocking input, return accumulated command line on \n */
 {
     static char input[80];
@@ -663,7 +636,6 @@ static /*@null@*/ char *curses_get_command(void)
 
     return line;
 }
-/*@+statictrans +globstate +unrecog@*/
 
 /******************************************************************************
  *
@@ -699,7 +671,7 @@ static ssize_t gpsmon_serial_write(struct gps_device_t *session,
 }
 
 #ifdef CONTROLSEND_ENABLE
-bool monitor_control_send( /*@in@*/ unsigned char *buf, size_t len)
+bool monitor_control_send( unsigned char *buf, size_t len)
 {
     if (!serial)
 	return false;
@@ -713,7 +685,7 @@ bool monitor_control_send( /*@in@*/ unsigned char *buf, size_t len)
     }
 }
 
-static bool monitor_raw_send( /*@in@*/ unsigned char *buf, size_t len)
+static bool monitor_raw_send( unsigned char *buf, size_t len)
 {
     ssize_t st = gpsd_write(&session, (char *)buf, len);
     return (st > 0 && (size_t) st == len);
@@ -741,7 +713,6 @@ static void complain(const char *fmt, ...)
  *
  *****************************************************************************/
 
-/*@-observertrans -nullpass -globstate -compdef -uniondef@*/
 static void gpsmon_hook(struct gps_device_t *device, gps_mask_t changed UNUSED)
 /* per-packet hook */
 {
@@ -758,7 +729,6 @@ static void gpsmon_hook(struct gps_device_t *device, gps_mask_t changed UNUSED)
 	    complain("Ill-formed TOFF packet: %d", status);
 	    return;
 	} else {
-	    /*@-type -noeffect@*/ /* splint is confused about struct timespec */
 	    if (!curses_active)
 		(void)fprintf(stderr,
 			      "TOFF=%ld.%09ld real=%ld.%09ld\n",
@@ -766,7 +736,6 @@ static void gpsmon_hook(struct gps_device_t *device, gps_mask_t changed UNUSED)
 			      (long)session.gpsdata.toff.clock.tv_nsec,
 			      (long)session.gpsdata.toff.real.tv_sec,
 			      (long)session.gpsdata.toff.real.tv_nsec);
-	    /*@+type +noeffect@*/
 #ifdef NTP_ENABLE
 	    time_offset = session.gpsdata.toff;
 #endif /* NTP_ENABLE */
@@ -783,7 +752,6 @@ static void gpsmon_hook(struct gps_device_t *device, gps_mask_t changed UNUSED)
 	    complain("Ill-formed PPS packet: %d", status);
 	    return;
 	} else {
-	    /*@-type -noeffect@*/ /* splint is confused about struct timespec */
 	    struct timespec timedelta;
 	    char timedelta_str[TIMESPEC_LEN];
 
@@ -805,7 +773,6 @@ static void gpsmon_hook(struct gps_device_t *device, gps_mask_t changed UNUSED)
 			      pps_real_str,
                               timedelta_str);
 	    }
-	    /*@+type +noeffect@*/
 
 	    (void)snprintf(buf, sizeof(buf), 
 			"------------------- PPS offset: %.20s ------\n ",
@@ -853,12 +820,10 @@ static void gpsmon_hook(struct gps_device_t *device, gps_mask_t changed UNUSED)
     }
 
     if (logfile != NULL && device->lexer.outbuflen > 0) {
-        /*@ -shiftimplementation -sefparams +charint @*/
         UNUSED size_t written_count = fwrite
                (device->lexer.outbuffer, sizeof(char),
                 device->lexer.outbuflen, logfile);
         assert(written_count >= 1);
-        /*@ +shiftimplementation +sefparams -charint @*/
     }
 
     report_unlock();
@@ -868,7 +833,7 @@ static void gpsmon_hook(struct gps_device_t *device, gps_mask_t changed UNUSED)
      * and it is a new second. */
     if ( 0 != isnan(device->newdata.time)) {
 	// "NTP: bad new time
-#if defined(PPS_ENABLE) && !defined(S_SPLINT_S)
+#if defined(PPS_ENABLE)
     } else if (device->newdata.time <= device->pps_thread.fixin.real.tv_sec) {
 	// "NTP: Not a new time
 #endif /* PPS_ENABLE */
@@ -876,9 +841,7 @@ static void gpsmon_hook(struct gps_device_t *device, gps_mask_t changed UNUSED)
 	ntp_latch(device, &time_offset);
 #endif /* NTP_ENABLE */
 }
-/*@+observertrans +nullpass +globstate +compdef +uniondef@*/
 
-/*@-globstate -usedef -compdef@*/
 static bool do_command(const char *line)
 {
 #ifdef RECONFIGURE_ENABLE
@@ -991,10 +954,8 @@ static bool do_command(const char *line)
 		 * gpsmon resyncs.  So stash the current type to
 		 * be restored if we do 'n' from NMEA mode.
 		 */
-		/*@-onlytrans@*/
 		if (v == 0)
 		    fallback = switcher;
-		/*@+onlytrans@*/
 	    } else
 		complain
 		    ("Device type %s has no mode switcher", 
@@ -1023,7 +984,6 @@ static bool do_command(const char *line)
 	    if (fallback != NULL && fallback->speed_switcher != NULL)
 		switcher = fallback;
 	    modespec = strchr(arg, ':');
-	    /*@ +charint @*/
 	    if (modespec != NULL) {
 		if (strchr("78", *++modespec) == NULL) {
 		    complain
@@ -1043,7 +1003,6 @@ static bool do_command(const char *line)
 		}
 		stopbits = (unsigned int)(stopbits - '0');
 	    }
-	    /*@ -charint @*/
 	    speed = (unsigned)atoi(arg);
 	    /* *INDENT-OFF* */
 	    if (switcher->speed_switcher) {
@@ -1115,7 +1074,6 @@ static bool do_command(const char *line)
 	else if (!serial)
 	    complain("Only available in low-level mode.");
 	else {
-	    /*@ -compdef @*/
 	    int st = gpsd_hexpack(arg, (char *)buf, strlen(arg));
 	    if (st < 0)
 		complain("Invalid hex string (error %d)", st);
@@ -1124,7 +1082,6 @@ static bool do_command(const char *line)
 			 session.device_type->type_name);
 	    else if (!monitor_control_send(buf, (size_t) st))
 		complain("Control send failed.");
-	    /*@ +compdef @*/
 	}
 	break;
 
@@ -1132,13 +1089,11 @@ static bool do_command(const char *line)
 	if (!serial)
 	    complain("Only available in low-level mode.");
 	else {
-	    /*@ -compdef @*/
 	    ssize_t len = (ssize_t) gpsd_hexpack(arg, (char *)buf, strlen(arg));
 	    if (len < 0)
 		complain("Invalid hex string (error %d)", len);
 	    else if (!monitor_raw_send(buf, (size_t) len))
 		complain("Raw send failed.");
-	    /*@ +compdef @*/
 	}
 	break;
 #endif /* CONTROLSEND_ENABLE */
@@ -1151,10 +1106,9 @@ static bool do_command(const char *line)
     /* continue accepting commands */
     return true;
 }
-/*@+globstate +usedef +compdef@*/
 
 #ifdef PPS_ENABLE
-static /*@observer@*/ char *pps_report(volatile struct pps_thread_t *pps_thread UNUSED,
+static char *pps_report(volatile struct pps_thread_t *pps_thread UNUSED,
 			struct timedelta_t *td UNUSED) {
     packet_log(PPSBAR);
     return "gpsmon";
@@ -1179,7 +1133,6 @@ static void onsig(int sig UNUSED)
 /* this placement avoids a compiler warning */
 static const char *cmdline;
 
-/*@-onlytrans -branchstate@*/
 int main(int argc, char **argv)
 {
     int option;
@@ -1192,9 +1145,7 @@ int main(int argc, char **argv)
     char inbuf[80];
     volatile bool nocurses = false;
 
-    /*@ -observertrans @*/
     (void)putenv("TZ=UTC");	// for ctime()
-    /*@ +observertrans @*/
     gps_context_init(&context, "gsmon");	// initialize the report mutex
     context.serial_write = gpsmon_serial_write;
     context.errout.report = gpsmon_report;
@@ -1308,12 +1259,10 @@ int main(int argc, char **argv)
     }
 
     if (serial) {
-	assert(source.device != NULL);	/* clue to splint */
 	(void) strlcpy(session.gpsdata.dev.path, 
 		       source.device, 
 		       sizeof(session.gpsdata.dev.path));
     } else {
-	assert(source.server != NULL);	/* clue to splint */
 	if (strstr(source.server, "//") == 0)
 	    (void) strlcpy(session.gpsdata.dev.path, 
 			   "tcp://",
@@ -1385,7 +1334,7 @@ int main(int argc, char **argv)
 	    (void)tcgetattr(0, &cooked);
 	    (void)tcgetattr(0, &rare);
 	    rare.c_lflag &=~ (ICANON | ECHO);
-	    /*@i2@*/rare.c_cc[VMIN] = (cc_t)1;
+	    rare.c_cc[VMIN] = (cc_t)1;
 	    (void)tcflush(0, TCIFLUSH);
 	    (void)tcsetattr(0, TCSANOW, &rare);
 	} else if (!curses_init())
@@ -1506,6 +1455,5 @@ int main(int argc, char **argv)
 	(void)fputs(explanation, stderr);
     exit(EXIT_SUCCESS);
 }
-/*@+onlytrans +branchstate@*/
 
 /* gpsmon.c ends here */
diff --git a/gpspipe.c b/gpspipe.c
index 8ceea716..978b8216 100644
--- a/gpspipe.c
+++ b/gpspipe.c
@@ -38,9 +38,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/select.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 
@@ -79,14 +77,12 @@ static void open_serial(char *device)
     }
 
     /* Clear struct for new port settings. */
-    /*@i@*/ bzero(&newtio, sizeof(newtio));
+    bzero(&newtio, sizeof(newtio));
 
-#ifndef S_SPLINT_S
     /* make it raw */
     (void)cfmakeraw(&newtio);
-#endif /* S_SPLINT_S */
     /* set speed */
-    /*@i@*/ (void)cfsetospeed(&newtio, BAUDRATE);
+    (void)cfsetospeed(&newtio, BAUDRATE);
 
     /* Clear the modem line and activate the settings for the port. */
     (void)tcflush(fd_out, TCIFLUSH);
@@ -122,7 +118,6 @@ static void usage(void)
 		  "You must use -o if you use -d.\n");
 }
 
-/*@ -compdestroy @*/
 int main(int argc, char **argv)
 {
     char buf[4096];
@@ -148,7 +143,6 @@ int main(int argc, char **argv)
     char *serialport = NULL;
     char *outfile = NULL;
 
-    /*@-branchstate@*/
     flags = WATCH_ENABLE;
     while ((option = getopt(argc, argv, "?dD:lhrRwStT:vVn:s:o:pPu2")) != -1) {
 	switch (option) {
@@ -226,7 +220,6 @@ int main(int argc, char **argv)
 	    exit(EXIT_FAILURE);
 	}
     }
-    /*@+branchstate@*/
 
     /* Grok the server, port, and device. */
     if (optind < argc) {
@@ -251,13 +244,11 @@ int main(int argc, char **argv)
     }
 
     /* Daemonize if the user requested it. */
-    /*@ -unrecog @*/
     if (daemonize)
 	if (daemon(0, 0) != 0)
 	    (void)fprintf(stderr,
 			  "gpspipe: demonization failed: %s\n",
 			  strerror(errno));
-    /*@ +unrecog @*/
 
     /* Sleep for ten seconds if the user requested it. */
     if (sleepy)
@@ -286,14 +277,12 @@ int main(int argc, char **argv)
     if (serialport)
 	open_serial(serialport);
 
-    /*@ -nullpass -onlytrans @*/
     if (gps_open(source.server, source.port, &gpsdata) != 0) {
 	(void)fprintf(stderr,
 		      "gpspipe: could not connect to gpsd %s:%s, %s(%d)\n",
 		      source.server, source.port, gps_errstr(errno), errno);
 	exit(EXIT_FAILURE);
     }
-    /*@ +nullpass +onlytrans @*/
 
     if (profile)
 	flags |= WATCH_TIMING;
@@ -340,8 +329,7 @@ int main(int argc, char **argv)
 		    struct timespec now;
 		    struct tm *tmp_now;
 
-		    /*@-type@*//* splint is confused about struct timespec */
-		    /*@i2@*/(void)clock_gettime(CLOCK_REALTIME, &now);
+		    (void)clock_gettime(CLOCK_REALTIME, &now);
 		    tmp_now = localtime((time_t *)&(now.tv_sec));
 		    (void)strftime(tmstr, sizeof(tmstr), format, tmp_now);
 		    new_line = 0;
@@ -369,7 +357,6 @@ int main(int argc, char **argv)
 			exit(EXIT_FAILURE);
 		    }
 		}
-		/*@+type@*/
 		if (fputc(c, fp) == EOF) {
 		    fprintf(stderr, "gpspipe: write error, %s(%d)\n",
 			    strerror(errno), errno);
@@ -430,7 +417,6 @@ int main(int argc, char **argv)
     exit(EXIT_SUCCESS);
 }
 
-/*@ +compdestroy @*/
 
 static void spinner(unsigned int v, unsigned int num)
 {
diff --git a/gpsutils.c b/gpsutils.c
index 8f51e622..9b263a82 100644
--- a/gpsutils.c
+++ b/gpsutils.c
@@ -19,7 +19,7 @@
 #include <errno.h>
 #include <ctype.h>
 
-#include "gpsd.h"  /* could be gps.h if we didn't need splint decorations */
+#include "gps.h"
 #include "libgps.h"
 
 #ifdef USE_QT
@@ -27,21 +27,11 @@
 #include <QStringList>
 #endif
 
-#ifdef S_SPLINT_S
-/*@-matchfields@*/
-struct timespec
-  {
-    time_t tv_sec;	/* Seconds.  */
-    long tv_nsec;	/* Nanoseconds.  */
-  };
-/*@+matchfields@*/
-#endif /* S_SPLINT_S */
 /*
  * Berkeley implementation of strtod(), inlined to avoid locale problems
  * with the decimal point and stripped down to an atof()-equivalent.
  */
 
-/*@-shiftimplementation +charint@*/
 double safe_atof(const char *string)
 /* Takes a decimal ASCII floating-point number, optionally
  * preceded by white space.  Must have form "-I.FE-X",
@@ -240,11 +230,10 @@ done:
     }
     return fraction;
 }
-/*@+shiftimplementation -charint@*/
 
 #define MONTHSPERYEAR	12	/* months per calendar year */
 
-void gps_clear_fix( /*@out@*/ struct gps_fix_t *fixp)
+void gps_clear_fix(struct gps_fix_t *fixp)
 /* stuff a fix structure with recognizable out-of-band values */
 {
     fixp->time = NAN;
@@ -263,15 +252,15 @@ void gps_clear_fix( /*@out@*/ struct gps_fix_t *fixp)
     fixp->epc = NAN;
 }
 
-void gps_clear_dop( /*@out@*/ struct dop_t *dop)
+void gps_clear_dop( struct dop_t *dop)
 {
     dop->xdop = dop->ydop = dop->vdop = dop->tdop = dop->hdop = dop->pdop =
         dop->gdop = NAN;
 }
 
-void gps_merge_fix( /*@ out @*/ struct gps_fix_t *to,
+void gps_merge_fix(struct gps_fix_t *to,
 		   gps_mask_t transfer,
-		   /*@ in @*/ struct gps_fix_t *from)
+		   struct gps_fix_t *from)
 /* merge new data into an old fix */
 {
     if ((NULL == to) || (NULL == from))
@@ -309,8 +298,8 @@ void gps_merge_fix( /*@ out @*/ struct gps_fix_t *to,
 timestamp_t timestamp(void)
 {
      struct timespec ts;
-     /*@i2@*/(void)clock_gettime(CLOCK_REALTIME, &ts);
-     /*@i2@*/return (timestamp_t)(ts.tv_sec + ts.tv_nsec * 1e-9);
+     (void)clock_gettime(CLOCK_REALTIME, &ts);
+     return (timestamp_t)(ts.tv_sec + ts.tv_nsec * 1e-9);
 }
 
 time_t mkgmtime(register struct tm * t)
@@ -321,7 +310,6 @@ time_t mkgmtime(register struct tm * t)
     static const int cumdays[MONTHSPERYEAR] =
 	{ 0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334 };
 
-    /*@ +matchanyintegral @*/
     year = 1900 + t->tm_year + t->tm_mon / MONTHSPERYEAR;
     result = (year - 1970) * 365 + cumdays[t->tm_mon % MONTHSPERYEAR];
     result += (year - 1968) / 4;
@@ -339,11 +327,10 @@ time_t mkgmtime(register struct tm * t)
     result += t->tm_sec;
     if (t->tm_isdst == 1)
 	result -= 3600;
-    /*@ -matchanyintegral @*/
     return (result);
 }
 
-timestamp_t iso8601_to_unix( /*@in@*/ char *isotime)
+timestamp_t iso8601_to_unix(char *isotime)
 /* ISO8601 UTC to Unix UTC, no leapsecond correction. */
 {
 #ifndef USE_QT
@@ -352,7 +339,7 @@ timestamp_t iso8601_to_unix( /*@in@*/ char *isotime)
     struct tm tm;
     memset(&tm,0,sizeof(tm));
 
-    /*@i1@*/ dp = strptime(isotime, "%Y-%m-%dT%H:%M:%S", &tm);
+    dp = strptime(isotime, "%Y-%m-%dT%H:%M:%S", &tm);
     if (dp != NULL && *dp == '.')
 	usec = strtod(dp, NULL);
     else
@@ -378,7 +365,7 @@ timestamp_t iso8601_to_unix( /*@in@*/ char *isotime)
 }
 
 /* *INDENT-OFF* */
-/*@observer@*/char *unix_to_iso8601(timestamp_t fixtime, /*@ out @*/
+char *unix_to_iso8601(timestamp_t fixtime, /*@ out @*/
 				     char isotime[], size_t len)
 /* Unix UTC time to ISO8601, no timezone adjustment */
 /* example: 2007-12-11T23:38:51.033Z */
@@ -401,7 +388,7 @@ timestamp_t iso8601_to_unix( /*@in@*/ char *isotime)
      */
     (void)snprintf(fractstr, sizeof(fractstr), "%.3f", fractional);
     /* add fractional part, ignore leading 0; "0.2" -> ".2" */
-    /*@i2@*/(void)snprintf(isotime, len, "%s%sZ",timestr, strchr(fractstr,'.'));
+    (void)snprintf(isotime, len, "%s%sZ",timestr, strchr(fractstr,'.'));
     return isotime;
 }
 /* *INDENT-ON* */
@@ -410,7 +397,6 @@ timestamp_t iso8601_to_unix( /*@in@*/ char *isotime)
 
 /* Distance in meters between two points specified in degrees, optionally
 with initial and final bearings. */
-/*@-mustdefine@*/
 double earth_distance_and_bearings(double lat1, double lon1, double lat2, double lon2, double *ib, double *fb)
 {
     /*
@@ -480,7 +466,6 @@ double earth_distance_and_bearings(double lat1, double lon1, double lat2, double
 
     return (WGS84B * A * (S - d_S));
 }
-/*@+mustdefine@*/
 
 /* Distance in meters between two points specified in degrees. */
 double earth_distance(double lat1, double lon1, double lat2, double lon2)
diff --git a/gpxlogger.c b/gpxlogger.c
index b149729d..96037319 100644
--- a/gpxlogger.c
+++ b/gpxlogger.c
@@ -13,9 +13,7 @@
 #include <libgen.h>
 #include <signal.h>
 #include <assert.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gps.h"
 #include "gpsd_config.h"
@@ -141,12 +139,10 @@ static void conditionally_log_fix(struct gps_data_t *gpsdata)
      * backward when gpsd is submitting junk on the
      * dbus.
      */
-    /*@-type@*/
     if (fabs(int_time - old_int_time) > timeout && !first) {
 	print_gpx_trk_end();
 	intrack = false;
     }
-    /*@+type@*/
 
     if (!intrack) {
 	print_gpx_trk_start();
@@ -181,17 +177,14 @@ static void quit_handler(int signum)
 
 static void usage(void)
 {
-    /*@-nullderef@*/
     fprintf(stderr,
 	    "Usage: %s [-V] [-h] [-d] [-i timeout] [-f filename] [-m minmove]\n"
 	    "\t[-e exportmethod] [server[:port:[device]]]\n\n"
 	    "defaults to '%s -i 5 -e %s localhost:2947'\n",
 	    progname, progname, export_default()->name);
-    /*@-nullderef@*/
     exit(EXIT_FAILURE);
 }
 
-/*@-mustfreefresh -mustfreeonly -branchstate -globstate@*/
 int main(int argc, char **argv)
 {
     int ch;
@@ -231,7 +224,6 @@ int main(int argc, char **argv)
 	    break;
        case 'f':       /* Output file name. */
             {
-		/*@-usedef@*/
                 char   *fname = NULL;
                 time_t  t;
                 size_t  s = 0;
@@ -249,7 +241,6 @@ int main(int argc, char **argv)
 		    }
 		    s = strftime(fname, fnamesize-1, optarg, localtime(&t));
                 }
-		assert(fname != NULL); /* pacify splint */
                 fname[s] = '\0';;
                 logfile = fopen(fname, "w");
                 if (logfile == NULL)
@@ -259,7 +250,6 @@ int main(int argc, char **argv)
 	    bailout:
                 free(fname);
                 break;
-		/*@+usedef@*/
             }
 	case 'i':		/* set polling interfal */
 	    timeout = (time_t) atoi(optarg);
@@ -295,11 +285,9 @@ int main(int argc, char **argv)
 	source.port = NULL;
 	source.device = NULL;
     } else {
-	/*@-statictrans -observertrans@*/
 	source.server = (char *)"localhost";
 	source.port = (char *)DEFAULT_GPSD_PORT;
 	source.device = NULL;
-	/*@+statictrans +observertrans@*/
     }
 
     if (optind < argc) {
@@ -316,14 +304,12 @@ int main(int argc, char **argv)
     (void)signal(SIGQUIT, quit_handler);
     (void)signal(SIGINT, quit_handler);
 
-    /*@-unrecog@*/
     /* might be time to daemonize */
     if (daemonize) {
 	/* not SuS/POSIX portable, but we have our own fallback version */
 	if (daemon(0, 0) != 0)
 	    (void) fprintf(stderr,"demonization failed: %s\n", strerror(errno));
     }
-    /*@+unrecog@*/
 
     //syslog (LOG_INFO, "---------- STARTED ----------");
 
@@ -345,4 +331,3 @@ int main(int argc, char **argv)
 
     exit(EXIT_SUCCESS);
 }
-/*@+mustfreefresh +mustfreeonly +branchstate +globstate@*/
diff --git a/hex.c b/hex.c
index 513cf558..606356af 100644
--- a/hex.c
+++ b/hex.c
@@ -8,9 +8,8 @@
 
 #include "gpsd.h"
 
-/*@-mustdefine@*/
-const char /*@ observer @*/ *gpsd_packetdump(char *scbuf, size_t scbuflen,
-					     char *binbuf, size_t binbuflen)
+const char *gpsd_packetdump(char *scbuf, size_t scbuflen,
+			    char *binbuf, size_t binbuflen)
 {
     char *cp;
     bool printable = true;
@@ -24,10 +23,8 @@ const char /*@ observer @*/ *gpsd_packetdump(char *scbuf, size_t scbuflen,
     else
 	return gpsd_hexdump(scbuf, scbuflen, binbuf, binbuflen);
 }
-/*@+mustdefine@*/
 
-/*@-mustdefine@*/
-const char /*@ observer @*/ *gpsd_hexdump(char *scbuf, size_t scbuflen,
+const char *gpsd_hexdump(char *scbuf, size_t scbuflen,
 					  char *binbuf, size_t binbuflen)
 {
 #ifndef SQUELCH_ENABLE
@@ -41,12 +38,10 @@ const char /*@ observer @*/ *gpsd_hexdump(char *scbuf, size_t scbuflen,
     if (NULL == binbuf || 0 == binbuflen)
 	return "";
 
-    /*@ -shiftimplementation @*/
     for (i = 0; i < len && i * 2 < scbuflen - 2; i++) {
 	scbuf[j++] = hexchar[(ibuf[i] & 0xf0) >> 4];
 	scbuf[j++] = hexchar[ibuf[i] & 0x0f];
     }
-    /*@ +shiftimplementation @*/
     scbuf[j] = '\0';
 #else /* SQUELCH defined */
     scbuf[0] = '\0';
@@ -56,9 +51,7 @@ const char /*@ observer @*/ *gpsd_hexdump(char *scbuf, size_t scbuflen,
 #endif /* SQUELCH_ENABLE */
     return scbuf;
 }
-/*@+mustdefine@*/
 
-/*@ +charint -shiftimplementation @*/
 static int hex2bin(const char *s)
 {
     int a, b;
@@ -87,12 +80,11 @@ static int hex2bin(const char *s)
     return ((a << 4) + b);
 }
 
-int gpsd_hexpack( /*@in@*/ const char *src, /*@out@ */ char *dst, size_t len)
+int gpsd_hexpack(const char *src, char *dst, size_t len)
 /* hex2bin source string to destination - destination can be same as source */
 {
     int i, j;
 
-    /*@ -mustdefine @*/
     j = (int)(strlen(src) / 2);
     if ((j < 1) || ((size_t) j > len))
 	return -2;
@@ -106,17 +98,14 @@ int gpsd_hexpack( /*@in@*/ const char *src, /*@out@ */ char *dst, size_t len)
     }
     (void)memset(dst + i, '\0', (size_t) (len - i));
     return j;
-    /*@ +mustdefine @*/
 }
 
-/*@ -charint +shiftimplementation @*/
 
-ssize_t hex_escapes( /*@out@*/ char *cooked, const char *raw)
+ssize_t hex_escapes(char *cooked, const char *raw)
 /* interpret C-style hex escapes */
 {
     char c, *cookend;
 
-    /*@ +charint -mustdefine -compdef @*/
     for (cookend = cooked; *raw != '\0'; raw++)
 	if (*raw != '\\')
 	    *cookend++ = *raw;
@@ -270,5 +259,4 @@ ssize_t hex_escapes( /*@out@*/ char *cooked, const char *raw)
 	    }
 	}
     return (ssize_t) (cookend - cooked);
-    /*@ +charint +mustdefine +compdef @*/
 }
diff --git a/isgps.c b/isgps.c
index 2d9438b7..30b4d107 100644
--- a/isgps.c
+++ b/isgps.c
@@ -67,7 +67,6 @@ BSD terms apply: see the file COPYING in the distribution root for details.
 
 #define W_DATA_MASK	0x3fffffc0u
 
-/*@ +charint @*/
 static unsigned char parity_array[] = {
     0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
     1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
@@ -94,7 +93,6 @@ static unsigned int reverse_bits[] = {
     3, 35, 19, 51, 11, 43, 27, 59, 7, 39, 23, 55, 15, 47, 31, 63
 };
 
-/*@ -charint @*/
 
 unsigned int isgps_parity(isgps30bits_t th)
 {
@@ -114,7 +112,6 @@ unsigned int isgps_parity(isgps30bits_t th)
      * th ^= W_DATA_MASK;
      */
 
-    /*@ +charint @*/
     t = th & PARITY_25;
     p = parity_array[t & 0xff] ^ parity_array[(t >> 8) & 0xff] ^
 	parity_array[(t >> 16) & 0xff] ^ parity_array[(t >> 24) & 0xff];
@@ -138,7 +135,6 @@ unsigned int isgps_parity(isgps30bits_t th)
     p = (p << 1) | (parity_array[t & 0xff] ^ parity_array[(t >> 8) & 0xff] ^
 		    parity_array[(t >> 16) & 0xff] ^ parity_array[(t >> 24) &
 								  0xff]);
-    /*@ -charint @*/
 
 #ifdef __UNUSED__
     gpsd_log(errout, ISGPS_ERRLEVEL_BASE + 2, "ISGPS parity %u\n", p);
@@ -167,7 +163,7 @@ unsigned int isgps_parity(isgps30bits_t th)
  */
 #define isgps_parityok(w)	(isgps_parity(w) == ((w) & 0x3f))
 
-void isgps_init( /*@out@*/ struct gps_lexer_t *lexer)
+void isgps_init(struct gps_lexer_t *lexer)
 {
     lexer->isgps.curr_word = 0;
     lexer->isgps.curr_offset = 24;	/* first word */
@@ -176,7 +172,6 @@ void isgps_init( /*@out@*/ struct gps_lexer_t *lexer)
     lexer->isgps.buflen = 0;
 }
 
-/*@ -usereleased -compdef @*/
 // This works around cppcheck not looking into enough config branches
 // cppcheck-suppress unusedFunction
 enum isgpsstat_t isgps_decode(struct gps_lexer_t *lexer,
@@ -193,7 +188,6 @@ enum isgpsstat_t isgps_decode(struct gps_lexer_t *lexer,
 
     c = reverse_bits[c & 0x3f];
 
-    /*@ -shiftnegative @*/
     if (!lexer->isgps.locked) {
 	lexer->isgps.curr_offset = -5;
 	lexer->isgps.bufindex = 0;
@@ -309,7 +303,6 @@ enum isgpsstat_t isgps_decode(struct gps_lexer_t *lexer,
 		 lexer->isgps.curr_offset);
 	return res;
     }
-    /*@ +shiftnegative @*/
 
     /* never achieved lock */
     gpsd_log(&lexer->errout, ISGPS_ERRLEVEL_BASE + 1,
@@ -317,4 +310,3 @@ enum isgpsstat_t isgps_decode(struct gps_lexer_t *lexer,
     return ISGPS_NO_SYNC;
 }
 
-/*@ +usereleased +compdef @*/
diff --git a/json.c b/json.c
index 229f3d1a..979709ad 100644
--- a/json.c
+++ b/json.c
@@ -108,12 +108,10 @@ static void json_trace(int errlevel, const char *fmt, ...)
 
 # define json_debug_trace(args) (void) json_trace args
 #else
-# define json_debug_trace(args) /*@i1@*/do { } while (0)
+# define json_debug_trace(args) do { } while (0)
 #endif /* CLIENTDEBUG_ENABLE */
 
-/*@-immediatetrans -dependenttrans -usereleased -compdef@*/
-static /*@null@*/ char *json_target_address(const struct json_attr_t *cursor,
-					     /*@null@*/
+static char *json_target_address(const struct json_attr_t *cursor,
 					     const struct json_array_t
 					     *parent, int offset)
 {
@@ -157,16 +155,13 @@ static /*@null@*/ char *json_target_address(const struct json_attr_t *cursor,
     return targetaddr;
 }
 
-/*@-immediatetrans -dependenttrans +usereleased +compdef@*/
 
 static int json_internal_read_object(const char *cp,
 				     const struct json_attr_t *attrs,
-				     /*@null@*/
 				     const struct json_array_t *parent,
 				     int offset,
-				     /*@null@*/ const char **end)
+				     const char **end)
 {
-    /*@ -nullstate -nullderef -mustfreefresh -nullpass -usedef @*/
     enum
     { init, await_attr, in_attr, await_value, in_val_string,
 	in_escape, in_val_token, post_val, post_array
@@ -187,12 +182,6 @@ static int json_internal_read_object(const char *cp,
     const struct json_enum_t *mp;
     char *lptr;
 
-#ifdef S_SPLINT_S
-    /* prevents gripes about buffers not being completely defined */
-    memset(valbuf, '\0', sizeof(valbuf));
-    memset(attrbuf, '\0', sizeof(attrbuf));
-#endif /* S_SPLINT_S */
-
     if (end != NULL)
 	*end = NULL;		/* give it a well-defined value on parse failure */
 
@@ -536,7 +525,6 @@ static int json_internal_read_object(const char *cp,
 		    }
 		    break;
 		}
-	    /*@fallthrough@*/
 	case post_array:
 	    if (isspace((unsigned char) *cp))
 		continue;
@@ -565,13 +553,11 @@ static int json_internal_read_object(const char *cp,
 	*end = cp;
     json_debug_trace((1, "JSON parse ends.\n"));
     return 0;
-    /*@ +nullstate +nullderef +mustfreefresh +nullpass +usedef @*/
 }
 
 int json_read_array(const char *cp, const struct json_array_t *arr,
 		    const char **end)
 {
-    /*@-nullstate -onlytrans@*/
     int substatus, offset, arrcount;
     char *tp;
 
@@ -728,16 +714,13 @@ int json_read_array(const char *cp, const struct json_array_t *arr,
 	*(arr->count) = arrcount;
     if (end != NULL)
 	*end = cp;
-    /*@ -nullderef @*/
     json_debug_trace((1, "leaving json_read_array() with %d elements\n",
 		      arrcount));
-    /*@ +nullderef @*/
     return 0;
-    /*@+nullstate +onlytrans@*/
 }
 
 int json_read_object(const char *cp, const struct json_attr_t *attrs,
-		     /*@null@*/ const char **end)
+		     const char **end)
 {
     int st;
 
@@ -746,7 +729,7 @@ int json_read_object(const char *cp, const struct json_attr_t *attrs,
     return st;
 }
 
-const /*@observer@*/ char *json_error_string(int err)
+const char *json_error_string(int err)
 {
     const char *errors[] = {
 	"unknown error while parsing JSON",
diff --git a/json.h b/json.h
index 3ebf1ce4..cd555628 100644
--- a/json.h
+++ b/json.h
@@ -5,9 +5,7 @@
  */
 
 #include <stdbool.h>
-#ifndef S_SPLINT_S
-#include <ctype.h>       /* raspbian splint hates this */
-#endif /* S_SPLINT_S */
+#include <ctype.h>
 
 typedef enum {t_integer, t_uinteger, t_real,
 	      t_string, t_boolean, t_character,
@@ -83,10 +81,10 @@ struct json_attr_t {
 extern "C" {
 #endif
 int json_read_object(const char *, const struct json_attr_t *,
-		     /*@null@*/const char **);
+		     const char **);
 int json_read_array(const char *, const struct json_array_t *,
-		    /*@null@*/const char **);
-const /*@observer@*/char *json_error_string(int);
+		    const char **);
+const char *json_error_string(int);
 
 void json_enable_debug(int, FILE *);
 #ifdef __cplusplus
diff --git a/jsongen.py.in b/jsongen.py.in
index 40b42159..8155e43e 100644
--- a/jsongen.py.in
+++ b/jsongen.py.in
@@ -946,10 +946,8 @@ def generate(spec):
     # to make a separate parse control initializer for each one.  The
     # attribute name is the name of the array; substructure and length
     # fieldnames must be given in the defaults part.
-    pacify_splint = False
     for (attr, itype, arrayparts) in spec["fieldmap"]:
         if itype == 'array':
-            pacify_splint = True
             (innerstruct, lengthfield, elements) = arrayparts
             report += "    const struct json_attr_t %s_%s_subtype[] = {\n" % (initname, attr)
             for (subattr, subitype, default) in elements:
@@ -968,8 +966,6 @@ def generate(spec):
 """
     # Generate the main structure definition describing this parse.
     # It may have object subarrays.
-    if pacify_splint:
-        report += "/*@-type@*//* STRUCTARRAY confuses splint */\n"
     report += "    const struct json_attr_t %s[] = {\n" % initname
     if "headers" in spec:
         for header in spec["headers"]:
@@ -1003,8 +999,6 @@ def generate(spec):
         {NULL}
     };
 """
-    if pacify_splint:
-        report += "/*@+type@*/\n"
     print report
 
 if __name__ == '__main__':
diff --git a/lcdgps.c b/lcdgps.c
index e3fa0040..b346951f 100644
--- a/lcdgps.c
+++ b/lcdgps.c
@@ -33,21 +33,17 @@
 
 #define CLIMB 3
 
-#ifndef S_SPLINT_S
 #include <netdb.h>
 #ifndef AF_UNSPEC
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/socket.h>
 #endif /* AF_UNSPEC */
-#endif /* S_SPLINT_S */
 #ifndef INADDR_ANY
 #include <netinet/in.h>
 #endif /* INADDR_ANY */
-#ifndef S_SPLINT_S
 #include <arpa/inet.h>
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 #include <stdlib.h>
 #include <string.h>
 #include <math.h>
@@ -259,7 +255,6 @@ int main(int argc, char *argv[])
     int n;
     for(n=0;n<CLIMB;n++) climb[n]=0.0;
 
-    /*@ -observertrans @*/
     switch (gpsd_units())
     {
     case imperial:
@@ -284,7 +279,6 @@ int main(int argc, char *argv[])
 	/* leave the default alone */
 	break;
     }
-    /*@ +observertrans @*/
 
     /* Process the options.  Print help if requested. */
     while ((option = getopt(argc, argv, "Vhl:su:")) != -1) {
@@ -309,7 +303,6 @@ int main(int argc, char *argv[])
 		continue;
 	    default:
 		(void)fprintf(stderr, "Unknown -l argument: %s\n", optarg);
-		/*@ -casebreak @*/
 	    }
 	case 's':
 	    sleep(10);
@@ -336,7 +329,6 @@ int main(int argc, char *argv[])
 		continue;
 	    default:
 		(void)fprintf(stderr, "Unknown -u argument: %s\n", optarg);
-		/*@ -casebreak @*/
 	    }
 	}
     }
diff --git a/libgps.h b/libgps.h
index 9ef0ae37..92649130 100644
--- a/libgps.h
+++ b/libgps.h
@@ -15,17 +15,17 @@
 #ifdef __cplusplus
 extern "C" {
 #endif
-extern int gps_sock_open(/*@null@*/const char *, /*@null@*/const char *,
-		      /*@out@*/struct gps_data_t *);
+extern int gps_sock_open(const char *, const char *,
+		      struct gps_data_t *);
 extern int gps_sock_close(struct gps_data_t *);
 extern int gps_sock_send(struct gps_data_t *, const char *);
-extern int gps_sock_read(/*@out@*/struct gps_data_t *);
+extern int gps_sock_read(struct gps_data_t *);
 extern bool gps_sock_waiting(const struct gps_data_t *, int);
-extern int gps_sock_stream(struct gps_data_t *, unsigned int, /*@null@*/void *);
-extern const char /*@observer@*/ *gps_sock_data(const struct gps_data_t *);
+extern int gps_sock_stream(struct gps_data_t *, unsigned int, void *);
+extern const char *gps_sock_data(const struct gps_data_t *);
 extern int gps_sock_mainloop(struct gps_data_t *, int,
 			      void (*)(struct gps_data_t *));
-extern int gps_shm_open(/*@out@*/struct gps_data_t *);
+extern int gps_shm_open(struct gps_data_t *);
 extern void gps_shm_close(struct gps_data_t *);
 extern bool gps_shm_waiting(const struct gps_data_t *, int);
 extern int gps_shm_read(struct gps_data_t *);
@@ -37,7 +37,7 @@ extern int gps_dbus_mainloop(struct gps_data_t *, int,
 			      void (*)(struct gps_data_t *));
 
 extern int json_ais_read(const char *, char *, size_t, struct ais_t *,
-		  /*@null@*/const char **);
+			 const char **);
 #ifdef __cplusplus
 }
 #endif
diff --git a/libgps_core.c b/libgps_core.c
index 9a26124d..b26e6ff1 100644
--- a/libgps_core.c
+++ b/libgps_core.c
@@ -57,13 +57,12 @@ void libgps_trace(int errlevel, const char *fmt, ...)
 #define CONDITIONALLY_UNUSED UNUSED
 #endif /* SOCKET_EXPORT_ENABLE */
 
-int gps_open(/*@null@*/const char *host,
-	     /*@null@*/const char *port CONDITIONALLY_UNUSED,
-	     /*@out@*/ struct gps_data_t *gpsdata)
+int gps_open(const char *host,
+	     const char *port CONDITIONALLY_UNUSED,
+	     struct gps_data_t *gpsdata)
 {
     int status = -1;
 
-    /*@ -branchstate -compdef @*/
     if (!gpsdata)
 	return -1;
 
@@ -80,7 +79,7 @@ int gps_open(/*@null@*/const char *host,
 
 #ifdef DBUS_EXPORT_ENABLE
     if (host != NULL && strcmp(host, GPSD_DBUS_EXPORT) == 0) {
-	/*@i@*/status = gps_dbus_open(gpsdata);
+	status = gps_dbus_open(gpsdata);
 	if (status != 0)
 	    status = DBUS_FAILURE;
     }
@@ -106,7 +105,6 @@ int gps_open(/*@null@*/const char *host,
     gps_clear_dop(&(gpsdata->dop));
 
     return status;
-    /*@ +branchstate +compdef @*/
 }
 
 #if defined(SHM_EXPORT_ENABLE) || defined(SOCKET_EXPORT_ENABLE)
@@ -145,7 +143,6 @@ int gps_read(struct gps_data_t *gpsdata CONDITIONALLY_UNUSED)
 
     libgps_debug_trace((DEBUG_CALLS, "gps_read() begins\n"));
 
-    /*@ -usedef -compdef -uniondef @*/
 #ifdef SHM_EXPORT_ENABLE
     if (BAD_SOCKET((intptr_t)(gpsdata->gps_fd))) {
 	status = gps_shm_read(gpsdata);
@@ -157,12 +154,9 @@ int gps_read(struct gps_data_t *gpsdata CONDITIONALLY_UNUSED)
         status = gps_sock_read(gpsdata);
     }
 #endif /* SOCKET_EXPORT_ENABLE */
-    /*@ +usedef +compdef +uniondef @*/
 
-    /*@-usedef@*/
     libgps_debug_trace((DEBUG_CALLS, "gps_read() -> %d (%s)\n",
 			status, gps_maskdump(gpsdata->set)));
-    /*@+usedef@*/
 
     return status;
 }
@@ -189,7 +183,7 @@ int gps_send(struct gps_data_t *gpsdata CONDITIONALLY_UNUSED, const char *fmt CO
 
 int gps_stream(struct gps_data_t *gpsdata CONDITIONALLY_UNUSED,
 	unsigned int flags CONDITIONALLY_UNUSED,
-	/*@null@*/ void *d CONDITIONALLY_UNUSED)
+	void *d CONDITIONALLY_UNUSED)
 {
     int status = -1;
 
@@ -201,10 +195,9 @@ int gps_stream(struct gps_data_t *gpsdata CONDITIONALLY_UNUSED,
     return status;
 }
 
-const char /*@null observer@*/ *gps_data(const struct gps_data_t *gpsdata CONDITIONALLY_UNUSED)
+const char *gps_data(const struct gps_data_t *gpsdata CONDITIONALLY_UNUSED)
 /* return the contents of the client data buffer */
 {
-    /*@-dependenttrans -observertrans@*/
     const char *bufp = NULL;
 
 #ifdef SOCKET_EXPORT_ENABLE
@@ -212,7 +205,6 @@ const char /*@null observer@*/ *gps_data(const struct gps_data_t *gpsdata CONDIT
 #endif /* SOCKET_EXPORT_ENABLE */
 
     return bufp;
-    /*@+dependenttrans +observertrans@*/
 }
 
 bool gps_waiting(const struct gps_data_t *gpsdata CONDITIONALLY_UNUSED, int timeout CONDITIONALLY_UNUSED)
@@ -244,7 +236,6 @@ int gps_mainloop(struct gps_data_t *gpsdata CONDITIONALLY_UNUSED,
 
     libgps_debug_trace((DEBUG_CALLS, "gps_mainloop() begins\n"));
 
-    /*@ -usedef -compdef -uniondef @*/
 #ifdef SHM_EXPORT_ENABLE
     if ((intptr_t)(gpsdata->gps_fd) == SHM_PSEUDO_FD)
 	status = gps_shm_mainloop(gpsdata, timeout, hook);
@@ -257,7 +248,6 @@ int gps_mainloop(struct gps_data_t *gpsdata CONDITIONALLY_UNUSED,
     if ((intptr_t)(gpsdata->gps_fd) >= 0)
 	status = gps_sock_mainloop(gpsdata, timeout, hook);
 #endif /* SOCKET_EXPORT_ENABLE */
-    /*@ +usedef +compdef +uniondef @*/
 
     libgps_debug_trace((DEBUG_CALLS, "gps_mainloop() -> %d (%s)\n",
 			status, gps_maskdump(gpsdata->set)));
@@ -265,7 +255,7 @@ int gps_mainloop(struct gps_data_t *gpsdata CONDITIONALLY_UNUSED,
     return status;
 }
 
-extern const char /*@observer@*/ *gps_errstr(const int err)
+extern const char *gps_errstr(const int err)
 {
     /*
      * We might add our own error codes in the future, e.g for
diff --git a/libgps_dbus.c b/libgps_dbus.c
index 826f12d4..e179330e 100644
--- a/libgps_dbus.c
+++ b/libgps_dbus.c
@@ -8,15 +8,13 @@
 #include <errno.h>
 #include <libgen.h>
 #include <signal.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gps.h"
 #include "gpsd_config.h"
 #include "libgps.h"
 
-#if defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S)
+#if defined(DBUS_EXPORT_ENABLE)
 
 struct privdata_t
 {
@@ -137,4 +135,4 @@ int gps_dbus_mainloop(struct gps_data_t *gpsdata,
     return 0;
 }
 
-#endif /* defined(DBUS_EXPORT_ENABLE) && !defined(S_SPLINT_S) */
+#endif /* defined(DBUS_EXPORT_ENABLE) */
diff --git a/libgps_json.c b/libgps_json.c
index ba967ca8..8f97c274 100644
--- a/libgps_json.c
+++ b/libgps_json.c
@@ -24,18 +24,9 @@ PERMISSIONS
 #ifdef SOCKET_EXPORT_ENABLE
 #include "gps_json.h"
 
-/*
- * There's a splint limitation that parameters can be declared
- * @out@ or @null@ but not, apparently, both.  This collides with
- * the (admittedly tricky) way we use endptr. The workaround is to
- * declare it @null@ and use -compdef around the JSON reader calls.
- */
-/*@-compdef@*/
-
 static int json_tpv_read(const char *buf, struct gps_data_t *gpsdata,
-			 /*@null@*/ const char **endptr)
+			 const char **endptr)
 {
-    /*@ -fullinitblock @*/
     const struct json_attr_t json_attrs_1[] = {
 	/* *INDENT-OFF* */
 	{"class",  t_check,   .dflt.check = "TPV"},
@@ -76,15 +67,13 @@ static int json_tpv_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@ +fullinitblock @*/
 
     return json_read_object(buf, json_attrs_1, endptr);
 }
 
 static int json_noise_read(const char *buf, struct gps_data_t *gpsdata,
-                           /*@null@*/ const char **endptr)
+                           const char **endptr)
 {
-    /*@ -fullinitblock @*/
     const struct json_attr_t json_attrs_1[] = {
 	/* *INDENT-OFF* */
 	{"class",  t_check,   .dflt.check = "GST"},
@@ -111,16 +100,13 @@ static int json_noise_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@ +fullinitblock @*/
 
     return json_read_object(buf, json_attrs_1, endptr);
 }
 
 static int json_sky_read(const char *buf, struct gps_data_t *gpsdata,
-			 /*@null@*/ const char **endptr)
+			 const char **endptr)
 {
-    /*@ -fullinitblock @*/
-    /*@-type@*//* STRUCTARRAY confuses splint */
     const struct json_attr_t json_attrs_satellites[] = {
 	/* *INDENT-OFF* */
 	{"PRN",	   t_integer, STRUCTOBJECT(struct satellite_t, PRN)},
@@ -161,7 +147,6 @@ static int json_sky_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@ +fullinitblock @*/
     int status, i, j;
 
     for (i = 0; i < MAXCHANNELS; i++) {
@@ -187,9 +172,8 @@ static int json_sky_read(const char *buf, struct gps_data_t *gpsdata,
 }
 
 static int json_att_read(const char *buf, struct gps_data_t *gpsdata,
-			 /*@null@*/ const char **endptr)
+			 const char **endptr)
 {
-    /*@ -fullinitblock @*/
     const struct json_attr_t json_attrs_1[] = {
 	/* *INDENT-OFF* */
 	{"class",    t_check,     .dflt.check = "ATT"},
@@ -238,15 +222,13 @@ static int json_att_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@ +fullinitblock @*/
 
     return json_read_object(buf, json_attrs_1, endptr);
 }
 
 static int json_devicelist_read(const char *buf, struct gps_data_t *gpsdata,
-				/*@null@*/ const char **endptr)
+				const char **endptr)
 {
-    /*@ -fullinitblock @*/
     const struct json_attr_t json_attrs_subdevices[] = {
 	/* *INDENT-OFF* */
 	{"class",      t_check,      .dflt.check = "DEVICE"},
@@ -274,7 +256,6 @@ static int json_devicelist_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@-type@*//* STRUCTARRAY confuses splint */
     const struct json_attr_t json_attrs_devices[] = {
 	{"class", t_check,.dflt.check = "DEVICES"},
 	{"devices", t_array, STRUCTARRAY(gpsdata->devices.list,
@@ -282,8 +263,6 @@ static int json_devicelist_read(const char *buf, struct gps_data_t *gpsdata,
 					 &gpsdata->devices.ndevices)},
 	{NULL},
     };
-    /*@+type@*/
-    /*@ +fullinitblock @*/
     int status;
 
     memset(&gpsdata->devices, '\0', sizeof(gpsdata->devices));
@@ -297,9 +276,8 @@ static int json_devicelist_read(const char *buf, struct gps_data_t *gpsdata,
 }
 
 static int json_version_read(const char *buf, struct gps_data_t *gpsdata,
-			     /*@null@*/ const char **endptr)
+			     const char **endptr)
 {
-    /*@ -fullinitblock @*/
     const struct json_attr_t json_attrs_version[] = {
 	/* *INDENT-OFF* */
         {"class",     t_check,   .dflt.check = "VERSION"},
@@ -314,7 +292,6 @@ static int json_version_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@ +fullinitblock @*/
     int status;
 
     memset(&gpsdata->version, '\0', sizeof(gpsdata->version));
@@ -324,9 +301,8 @@ static int json_version_read(const char *buf, struct gps_data_t *gpsdata,
 }
 
 static int json_error_read(const char *buf, struct gps_data_t *gpsdata,
-			   /*@null@*/ const char **endptr)
+			   const char **endptr)
 {
-    /*@ -fullinitblock @*/
     const struct json_attr_t json_attrs_error[] = {
 	/* *INDENT-OFF* */
         {"class",     t_check,   .dflt.check = "ERROR"},
@@ -335,7 +311,6 @@ static int json_error_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@ +fullinitblock @*/
     int status;
 
     memset(&gpsdata->error, '\0', sizeof(gpsdata->error));
@@ -347,10 +322,9 @@ static int json_error_read(const char *buf, struct gps_data_t *gpsdata,
 }
 
 int json_toff_read(const char *buf, struct gps_data_t *gpsdata,
-			   /*@null@*/ const char **endptr)
+			   const char **endptr)
 {
     int real_sec = 0, real_nsec = 0, clock_sec = 0, clock_nsec = 0;
-    /*@ -fullinitblock @*/
     const struct json_attr_t json_attrs_toff[] = {
 	/* *INDENT-OFF* */
         {"class",     t_check,   .dflt.check = "TOFF"},
@@ -367,19 +341,14 @@ int json_toff_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@ +fullinitblock @*/
     int status;
 
     memset(&gpsdata->toff, '\0', sizeof(gpsdata->toff));
     status = json_read_object(buf, json_attrs_toff, endptr);
-    /*@-usedef@*/
-    /*@-type@*//* splint is confused about struct timespec */
     gpsdata->toff.real.tv_sec = (time_t)real_sec;
     gpsdata->toff.real.tv_nsec = (long)real_nsec;
     gpsdata->toff.clock.tv_sec = (time_t)clock_sec;
     gpsdata->toff.clock.tv_nsec = (long)clock_nsec;
-    /*@+type@*/
-    /*@+usedef@*/
     if (status != 0)
 	return status;
 
@@ -387,10 +356,9 @@ int json_toff_read(const char *buf, struct gps_data_t *gpsdata,
 }
 
 int json_pps_read(const char *buf, struct gps_data_t *gpsdata,
-			   /*@null@*/ const char **endptr)
+		  const char **endptr)
 {
     int real_sec = 0, real_nsec = 0, clock_sec = 0, clock_nsec = 0;
-    /*@ -fullinitblock @*/
     const struct json_attr_t json_attrs_pps[] = {
 	/* *INDENT-OFF* */
         {"class",     t_check,   .dflt.check = "PPS"},
@@ -407,7 +375,6 @@ int json_pps_read(const char *buf, struct gps_data_t *gpsdata,
 	{NULL},
 	/* *INDENT-ON* */
     };
-    /*@ +fullinitblock @*/
     int status;
 
     memset(&gpsdata->pps, '\0', sizeof(gpsdata->pps));
@@ -416,14 +383,10 @@ int json_pps_read(const char *buf, struct gps_data_t *gpsdata,
      * This is theoretically dodgy, but in practice likely not
      * to break until GPSes are obsolete.
      */
-    /*@-usedef@*/
-    /*@-type@*//* splint is confused about struct timespec */
     gpsdata->pps.real.tv_sec = (time_t)real_sec;
     gpsdata->pps.real.tv_nsec = (long)real_nsec;
     gpsdata->pps.clock.tv_sec = (time_t)clock_sec;
     gpsdata->pps.clock.tv_nsec = (long)clock_nsec;
-    /*@+type@*/
-    /*@+usedef@*/
     if (status != 0)
 	return status;
 
@@ -575,7 +538,6 @@ int libgps_json_unpack(const char *buf,
 	return -1;
 }
 
-/*@+compdef@*/
 
 #endif /* SOCKET_EXPORT_ENABLE */
 
diff --git a/libgps_shm.c b/libgps_shm.c
index 8eb38041..34de8efa 100644
--- a/libgps_shm.c
+++ b/libgps_shm.c
@@ -30,23 +30,19 @@ PERMISSIONS
 #include "gpsd.h"
 #include "libgps.h"
 
-/*@-matchfields@*/
 struct privdata_t
 {
     void *shmseg;
     int tick;
 };
-/*@+matchfields@*/
 
 
-int gps_shm_open(/*@out@*/struct gps_data_t *gpsdata)
+int gps_shm_open(struct gps_data_t *gpsdata)
 /* open a shared-memory connection to the daemon */
 {
     int shmid;
 
-    /*@-nullpass@*/
     long shmkey = getenv("GPSD_SHM_KEY") ? strtol(getenv("GPSD_SHM_KEY"), NULL, 0) : GPSD_SHM_KEY;
-    /*@+nullpass@*/
 
     libgps_debug_trace((DEBUG_CALLS, "gps_shm_open()\n"));
 
@@ -101,7 +97,6 @@ bool gps_shm_waiting(const struct gps_data_t *gpsdata, int timeout)
 int gps_shm_read(struct gps_data_t *gpsdata)
 /* read an update from the shared-memory segment */
 {
-    /*@ -compdestroy */
     if (gpsdata->privdata == NULL)
 	return -1;
     else
@@ -136,7 +131,7 @@ int gps_shm_read(struct gps_data_t *gpsdata)
 	    (void)memcpy((void *)gpsdata,
 			 (void *)&noclobber,
 			 sizeof(struct gps_data_t));
-	    /*@i1@*/gpsdata->privdata = private_save;
+	    gpsdata->privdata = private_save;
 	    PRIVATE(gpsdata)->tick = after;
 	    if ((gpsdata->set & REPORT_IS)!=0) {
 		if (gpsdata->fix.mode >= 2)
@@ -148,7 +143,6 @@ int gps_shm_read(struct gps_data_t *gpsdata)
 	    return (int)sizeof(struct gps_data_t);
 	}
     }
-    /*@ +compdestroy */
 }
 
 void gps_shm_close(struct gps_data_t *gpsdata)
diff --git a/libgps_sock.c b/libgps_sock.c
index a87cd444..169a9003 100644
--- a/libgps_sock.c
+++ b/libgps_sock.c
@@ -17,15 +17,11 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/select.h>
-#ifndef S_SPLINT_S
 #include <sys/socket.h>
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #ifndef USE_QT
-#ifndef S_SPLINT_S
 #include <sys/socket.h>
-#endif /* S_SPLINT_S */
 #else
 #include <QTcpSocket>
 #endif /* USE_QT */
@@ -37,11 +33,6 @@
 #ifdef SOCKET_EXPORT_ENABLE
 #include "gps_json.h"
 
-#ifdef S_SPLINT_S
-extern char *strtok_r(char *, const char *, char **);
-#endif /* S_SPLINT_S */
-
-/*@-matchfields@*/
 struct privdata_t
 {
     bool newstyle;
@@ -52,11 +43,9 @@ struct privdata_t
     int waitcount;
 #endif /* LIBGPS_DEBUG */
 };
-/*@+matchfields@*/
 
-/*@-branchstate@*/
-int gps_sock_open(/*@null@*/const char *host, /*@null@*/const char *port,
-		  /*@out@*/ struct gps_data_t *gpsdata)
+int gps_sock_open(const char *host, const char *port,
+		  struct gps_data_t *gpsdata)
 {
     if (!host)
 	host = "localhost";
@@ -96,7 +85,6 @@ int gps_sock_open(/*@null@*/const char *host, /*@null@*/const char *port,
 #endif /* LIBGPS_DEBUG */
     return 0;
 }
-/*@+branchstate@*/
 
 bool gps_sock_waiting(const struct gps_data_t *gpsdata, int timeout)
 /* is there input waiting from the GPS? */
@@ -124,7 +112,6 @@ bool gps_sock_waiting(const struct gps_data_t *gpsdata, int timeout)
 #endif
 }
 
-/*@-usereleased -compdef@*/
 int gps_sock_close(struct gps_data_t *gpsdata)
 /* close a gpsd connection */
 {
@@ -143,10 +130,8 @@ int gps_sock_close(struct gps_data_t *gpsdata)
     return 0;
 #endif
 }
-/*@+usereleased +compdef@*/
 
-/*@-compdef -usedef -uniondef@*/
-int gps_sock_read(/*@out@*/struct gps_data_t *gpsdata)
+int gps_sock_read(struct gps_data_t *gpsdata)
 /* wait for and read data being streamed from the daemon */
 {
     char *eol;
@@ -213,18 +198,14 @@ int gps_sock_read(/*@out@*/struct gps_data_t *gpsdata)
     response_length = eol - PRIVATE(gpsdata)->buffer + 1;
     gpsdata->online = timestamp();
     status = gps_unpack(PRIVATE(gpsdata)->buffer, gpsdata);
-    /*@+matchanyintegral@*/
     memmove(PRIVATE(gpsdata)->buffer,
 	    PRIVATE(gpsdata)->buffer + response_length, PRIVATE(gpsdata)->waiting - response_length);
-    /*@-matchanyintegral@*/
     PRIVATE(gpsdata)->waiting -= response_length;
     gpsdata->set |= PACKET_SET;
 
     return (status == 0) ? (int)response_length : status;
 }
-/*@+compdef -usedef +uniondef@*/
 
-/*@ -branchstate -usereleased -mustfreefresh -nullstate -usedef @*/
 int gps_unpack(char *buf, struct gps_data_t *gpsdata)
 /* unpack a gpsd response into a status structure, buf must be writeable.
  * gps_unpack() currently returns 0 in all cases, but should it ever need to
@@ -253,9 +234,8 @@ int gps_unpack(char *buf, struct gps_data_t *gpsdata)
 #endif
     return 0;
 }
-/*@ +compdef @*/
 
-const char /*@observer@*/ *gps_sock_data(const struct gps_data_t *gpsdata)
+const char *gps_sock_data(const struct gps_data_t *gpsdata)
 /* return the contents of the client data buffer */
 {
     return PRIVATE(gpsdata)->buffer;
@@ -281,8 +261,7 @@ int gps_sock_send(struct gps_data_t *gpsdata, const char *buf)
 #endif
 }
 
-int gps_sock_stream(struct gps_data_t *gpsdata, unsigned int flags,
-	       /*@null@*/ void *d)
+int gps_sock_stream(struct gps_data_t *gpsdata, unsigned int flags, void *d)
 /* ask gpsd to stream reports at you, hiding the command details */
 {
     char buf[GPS_JSON_COMMAND_MAX];
@@ -330,10 +309,8 @@ int gps_sock_stream(struct gps_data_t *gpsdata, unsigned int flags,
 	    (void)strlcat(buf, "\"split24\":true,", sizeof(buf));
 	if (flags & WATCH_PPS)
 	    (void)strlcat(buf, "\"pps\":true,", sizeof(buf));
-	/*@-nullpass@*//* shouldn't be needed, splint has a bug */
 	if (flags & WATCH_DEVICE)
 	    str_appendf(buf, sizeof(buf), "\"device\":\"%s\",", (char *)d);
-	/*@+nullpass@*/
 	str_rstrip_char(buf, ',');
 	(void)strlcat(buf, "};", sizeof(buf));
 	libgps_debug_trace((DEBUG_CALLS, "gps_stream() enable command: %s\n", buf));
diff --git a/libgpsd_core.c b/libgpsd_core.c
index 33d2a48a..bd821a60 100644
--- a/libgpsd_core.c
+++ b/libgpsd_core.c
@@ -25,11 +25,9 @@
 #include <sys/select.h>
 #include <sys/stat.h>
 #include <assert.h>
-#ifndef S_SPLINT_S
 #include <sys/wait.h>
 #include <sys/socket.h>
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "matrix.h"
@@ -63,9 +61,7 @@ static pthread_mutex_t report_mutex;
 void gpsd_acquire_reporting_lock(void)
 {
     int err;
-    /*@ -unrecog  (splint has no pthread declarations as yet) @*/
     err = pthread_mutex_lock(&report_mutex);
-    /*@ +unrecog @*/
     if ( 0 != err ) {
         /* POSIX says pthread_mutex_lock() should only fail if the
         thread holding the lock has died.  Best for gppsd to just die
@@ -80,9 +76,7 @@ void gpsd_acquire_reporting_lock(void)
 void gpsd_release_reporting_lock(void)
 {
     int err;
-    /*@ -unrecog (splint has no pthread declarations as yet) @*/
     err = pthread_mutex_unlock(&report_mutex);
-    /*@ +unrecog @*/
     if ( 0 != err ) {
         /* POSIX says pthread_mutex_unlock() should only fail when
         trying to unlock a lock that does not exist, or is not owned by
@@ -97,7 +91,7 @@ void gpsd_release_reporting_lock(void)
 #endif /* PPS_ENABLE */
 
 #ifndef SQUELCH_ENABLE
-static void visibilize(/*@out@*/char *outbuf, size_t outlen,
+static void visibilize(char *outbuf, size_t outlen,
 		       const char *inbuf, size_t inlen)
 {
     const char *sp;
@@ -248,10 +242,8 @@ static void gpsd_run_device_hook(struct gpsd_errout_t *errout,
     }
 }
 
-/*@-kepttrans@*/
 int gpsd_switch_driver(struct gps_device_t *session, char *type_name)
 {
-    /*@-mustfreeonly@*/
     const struct gps_type_t **dp;
     bool first_sync = (session->device_type != NULL);
     unsigned int i;
@@ -261,14 +253,13 @@ int gpsd_switch_driver(struct gps_device_t *session, char *type_name)
 
     gpsd_log(&session->context->errout, LOG_PROG,
 	     "switch_driver(%s) called...\n", type_name);
-    /*@ -compmempass @*/
     for (dp = gpsd_drivers, i = 0; *dp; dp++, i++)
 	if (strcmp((*dp)->type_name, type_name) == 0) {
 	    gpsd_log(&session->context->errout, LOG_PROG,
 		     "selecting %s driver...\n",
 		     (*dp)->type_name);
 	    gpsd_assert_sync(session);
-	    /*@i@*/ session->device_type = *dp;
+	    session->device_type = *dp;
 	    session->driver_index = i;
 #ifdef RECONFIGURE_ENABLE
 	    session->gpsdata.dev.mincycle = session->device_type->min_cycle;
@@ -286,14 +277,10 @@ int gpsd_switch_driver(struct gps_device_t *session, char *type_name)
     gpsd_log(&session->context->errout, LOG_ERROR,
 	     "invalid GPS type \"%s\".\n", type_name);
     return 0;
-    /*@ +compmempass @*/
-    /*@+mustfreeonly@*/
 }
-/*@+kepttrans@*/
 
-/*@-compdestroy -mustfreeonly -observertrans -dependenttrans@*/
 void gps_context_init(struct gps_context_t *context, 
-		      /*@observer@*/const char *label)
+		      const char *label)
 {
     (void)memset(context, '\0', sizeof(struct gps_context_t));
     //context.readonly = false;
@@ -305,32 +292,23 @@ void gps_context_init(struct gps_context_t *context,
     errout_reset(&context->errout);
     context->errout.label = (char *)label;
 
-#if !defined(S_SPLINT_S) && defined(PPS_ENABLE)
-    /*@-nullpass@*/
+#if defined(PPS_ENABLE)
     (void)pthread_mutex_init(&report_mutex, NULL);
-    /*@+nullpass@*/
-#endif /* defined(S_SPLINT_S) defined(PPS_ENABLE) */
+#endif /* defined(PPS_ENABLE) */
 }
-/*@+compdestroy +mustfreeonly +observertrans +dependenttrans@*/
 
 void gpsd_init(struct gps_device_t *session, struct gps_context_t *context,
 	       const char *device)
 /* initialize GPS polling */
 {
-    /*@ -mayaliasunique @*/
     if (device != NULL)
 	(void)strlcpy(session->gpsdata.dev.path, device,
 		      sizeof(session->gpsdata.dev.path));
-    /*@ -mustfreeonly @*/
     session->device_type = NULL;	/* start by hunting packets */
     session->observed = 0;
     session->sourcetype = source_unknown;	/* gpsd_open() sets this */
     session->servicetype = service_unknown;	/* gpsd_open() sets this */
-    /*@ -temptrans @*/
     session->context = context;
-    /*@ +temptrans @*/
-    /*@ +mayaliasunique @*/
-    /*@ +mustfreeonly @*/
     memset( session->subtype, 0, sizeof( session->subtype));
     gps_clear_fix(&session->gpsdata.fix);
     gps_clear_fix(&session->newdata);
@@ -382,10 +360,8 @@ void gpsd_deactivate(struct gps_device_t *session)
 			     session->gpsdata.dev.path,
 			     "DEACTIVATE");
 #ifdef PPS_ENABLE
-    /*@-mustfreeonly@*/
     session->pps_thread.report_hook = NULL; /* tell any PPS-watcher thread to die */
 #endif /* PPS_ENABLE */
-    /*@-mustfreeonly@*/
     /* mark it inactivated */
     session->gpsdata.online = (timestamp_t)0;
 }
@@ -425,7 +401,6 @@ static void ppsthread_log(volatile struct pps_thread_t *pps_thread,
 #endif /* PPS_ENABLE */
 
 
-/*@-usereleased -compdef -compmempass@*/
 void gpsd_clear(struct gps_device_t *session)
 /* device has been opened - clear its storage for use */
 {
@@ -446,15 +421,14 @@ void gpsd_clear(struct gps_device_t *session)
     /* set up the context structure for the PPS thread monitor */
     memset((void *)&session->pps_thread, 0, sizeof(session->pps_thread));
     session->pps_thread.devicefd = session->gpsdata.gps_fd;
-    /*@i2@*/session->pps_thread.devicename = session->gpsdata.dev.path;
+    session->pps_thread.devicename = session->gpsdata.dev.path;
     session->pps_thread.pps_hook = NULL;
     session->pps_thread.log_hook = ppsthread_log;
-    /*@i4@*/session->pps_thread.context = (void *)session;
+    session->pps_thread.context = (void *)session;
 #endif /* PPS_ENABLE */
 
     session->opentime = time(NULL);
 }
-/*@+usereleased +compdef +compmempass@*/
 
 int gpsd_open(struct gps_device_t *session)
 /* open a device for access to its data */
@@ -527,7 +501,6 @@ int gpsd_open(struct gps_device_t *session)
 #endif /* NETFEED_ENABLE */
 #ifdef PASSTHROUGH_ENABLE
     if (str_starts_with(session->gpsdata.dev.path, "gpsd://")) {
-	/*@-branchstate -nullpass@*/
 	char server[strlen(session->gpsdata.dev.path)+1], *port;
 	socket_t dsock;
 	(void)strlcpy(server, session->gpsdata.dev.path + 7, sizeof(server));
@@ -547,23 +520,21 @@ int gpsd_open(struct gps_device_t *session)
 	} else
 	    gpsd_log(&session->context->errout, LOG_SPIN,
 		     "remote gpsd feed opened on fd %d\n", dsock);
-	/*@+branchstate +nullpass@*/
 	/* watch to remote is issued when WATCH is */
 	session->gpsdata.gps_fd = dsock;
 	session->sourcetype = source_gpsd;
 	return session->gpsdata.gps_fd;
     }
 #endif /* PASSTHROUGH_ENABLE */
-#if defined(NMEA2000_ENABLE) && !defined(S_SPLINT_S)
+#if defined(NMEA2000_ENABLE)
     if (str_starts_with(session->gpsdata.dev.path, "nmea2000://")) {
         return nmea2000_open(session);
     }
-#endif /* defined(NMEA2000_ENABLE) && !defined(S_SPLINT_S) */
+#endif /* defined(NMEA2000_ENABLE) */
     /* fall through to plain serial open */
     return gpsd_serial_open(session);
 }
 
-/*@ -branchstate @*/
 int gpsd_activate(struct gps_device_t *session, const int mode)
 /* acquire a connection to the GPS device */
 {
@@ -584,7 +555,6 @@ int gpsd_activate(struct gps_device_t *session, const int mode)
 	    (session->sourcetype != source_can)) {
 	    const struct gps_type_t **dp;
 
-	    /*@ -mustfreeonly @*/
 	    for (dp = gpsd_drivers; *dp; dp++) {
 		if ((*dp)->probe_detect != NULL) {
 		    gpsd_log(&session->context->errout, LOG_PROG,
@@ -605,7 +575,6 @@ int gpsd_activate(struct gps_device_t *session, const int mode)
 				 (*dp)->type_name);
 		}
 	    }
-	    /*@ +mustfreeonly @*/
 	    gpsd_log(&session->context->errout, LOG_PROG,
 		     "no probe matched...\n");
 	}
@@ -628,7 +597,6 @@ int gpsd_activate(struct gps_device_t *session, const int mode)
     return session->gpsdata.gps_fd;
 }
 
-/*@ +branchstate @*/
 
 #ifndef NOFLOATS_ENABLE
 /*****************************************************************************
@@ -828,7 +796,6 @@ static gps_mask_t fill_dop(const struct gpsd_errout_t *errout,
 	     dop->vdop, pdop, dop->pdop, tdop, dop->tdop, gdop, dop->gdop);
 #endif
 
-    /*@ -usedef @*/
     if (isnan(dop->xdop) != 0) {
 	dop->xdop = xdop;
     }
@@ -850,7 +817,6 @@ static gps_mask_t fill_dop(const struct gpsd_errout_t *errout,
     if (isnan(dop->gdop) != 0) {
 	dop->gdop = gdop;
     }
-    /*@ +usedef @*/
 
     return DOP_SET;
 }
@@ -1002,18 +968,15 @@ static void gpsd_error_model(struct gps_device_t *session,
     }
 
     /* save old fix for later error computations */
-    /*@ -mayaliasunique @*/
     if (fix->mode >= MODE_2D)
 	(void)memcpy(oldfix, fix, sizeof(struct gps_fix_t));
-    /*@ +mayaliasunique @*/
 }
 #endif /* NOFLOATS_ENABLE */
 
-/*@ -mustdefine -compdef @*/
-int gpsd_await_data(/*@out@*/fd_set *rfds,
-		    /*@out@*/fd_set *efds,
+int gpsd_await_data(fd_set *rfds,
+		    fd_set *efds,
 		     const int maxfd,
-		     /*@in@*/fd_set *all_fds, 
+		     fd_set *all_fds, 
 		     struct gpsd_errout_t *errout)
 /* await data from any socket in the all_fds set */
 {
@@ -1034,7 +997,6 @@ int gpsd_await_data(/*@out@*/fd_set *rfds,
      * the once-per-second wakeup when no sensors are attached.
      * This cuts power consumption.
      */
-    /*@ -usedef -nullpass @*/
     errno = 0;
 
     status = pselect(maxfd + 1, rfds, NULL, NULL, NULL, NULL);
@@ -1058,7 +1020,6 @@ int gpsd_await_data(/*@out@*/fd_set *rfds,
 	    return AWAIT_FAILED;
 	}
     }
-    /*@ +usedef +nullpass @*/
 
     if (errout->debug >= LOG_SPIN) {
 	int i;
@@ -1079,7 +1040,6 @@ int gpsd_await_data(/*@out@*/fd_set *rfds,
 
     return AWAIT_GOT_INPUT;
 }
-/*@ +mustdefine +compdef @*/
 
 static bool hunt_failure(struct gps_device_t *session)
 /* after a bad packet, what should cue us to go to next autobaud setting? */
@@ -1191,9 +1151,7 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 #endif /* TIMING_ENABLE */
 
     if (session->lexer.type >= COMMENT_PACKET) {
-	/*@-shiftnegative@*/
 	session->observed |= PACKET_TYPEMASK(session->lexer.type);
-	/*@+shiftnegative@*/
     }
 
     /* can we get a full packet from the device? */
@@ -1278,7 +1236,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 		 */
 		driver_change = new_packet_type && !dependent_nmea;
 	    }
-	    /*@-nullderef@*/
 	    if (driver_change) {
 		const struct gps_type_t **dp;
 
@@ -1291,7 +1248,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 			break;
 		    }
 	    }
-	    /*@+nullderef@*/
 	    session->badcount = 0;
 	    session->gpsdata.dev.driver_mode = (session->lexer.type > NMEA_PACKET) ? MODE_BINARY : MODE_NMEA;
 	    /* FALL THROUGH */
@@ -1322,7 +1278,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 		&& (session->drivers_identified & (1 << session->driver_index)) == 0) {
 	    speed_t speed = gpsd_get_speed(session);
 
-	    /*@-nullderef@*/
 	    /* coverity[var_deref_op] */
 	    gpsd_log(&session->context->errout, LOG_INF,
 		     "%s identified as type %s, %ld sec @ %ubps\n",
@@ -1330,7 +1285,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 		     session->device_type->type_name,
 		     time(NULL) - session->opentime,
 		     (unsigned int)speed);
-	    /*@+nullderef@*/
 
 	    /* fire the init_query method */
 	    if (session->device_type != NULL
@@ -1390,7 +1344,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 	 * methods or an event hook had been active before that, we
 	 * keep the information about those capabilities.
 	 */
-	/*@-mustfreeonly@*/
 	if (!STICKY(session->device_type)
 	    && session->last_controller != NULL
 	    && STICKY(session->last_controller))
@@ -1400,7 +1353,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 		     "reverted to %s driver...\n",
 		     session->device_type->type_name);
 	}
-	/*@+mustfreeonly@*/
 #endif /* RECONFIGURE_ENABLE */
 
 #ifdef TIMING_ENABLE
@@ -1429,7 +1381,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 #endif /* NOFLOATS_ENABLE */
 
 	/* copy/merge device data into staging buffers */
-	/*@-nullderef -nullpass@*/
 	if ((session->gpsdata.set & CLEAR_IS) != 0)
 	    gps_clear_fix(&session->gpsdata.fix);
 	/* don't downgrade mode if holding previous fix */
@@ -1440,10 +1391,9 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 	gps_merge_fix(&session->gpsdata.fix,
 		      session->gpsdata.set, &session->newdata);
 #ifndef NOFLOATS_ENABLE
-	/*@i1@*/gpsd_error_model(session, &session->gpsdata.fix, &session->oldfix);
+	gpsd_error_model(session, &session->gpsdata.fix, &session->oldfix);
 #endif /* NOFLOATS_ENABLE */
 
-	/*@+nullderef -nullpass@*/
 
 	/*
 	 * Count good fixes. We used to check
@@ -1471,7 +1421,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 	 * Sanity check.  This catches a surprising number of port and
 	 * driver errors, including 32-vs.-64-bit problems.
 	 */
-	/*@+relaxtypes +longunsignedintegral@*/
 	if ((session->gpsdata.set & TIME_SET) != 0) {
 	    if (session->newdata.time > time(NULL) + (60 * 60 * 24 * 365))
 		gpsd_log(&session->context->errout, LOG_WARN,
@@ -1480,7 +1429,6 @@ gps_mask_t gpsd_poll(struct gps_device_t *session)
 		gpsd_log(&session->context->errout, LOG_ERROR,
 			 "date is negative!\n");
 	}
-	/*@-relaxtypes -longunsignedintegral@*/
 
 	return session->gpsdata.set;
     }
@@ -1605,7 +1553,7 @@ int gpsd_multipoll(const bool data_ready,
 
 	    /* handle data contained in this packet */
 	    if (device->lexer.type != BAD_PACKET)
-		/*@i1@*/handler(device, changed);
+		handler(device, changed);
 
 #ifdef __future__
 	    /*
@@ -1643,7 +1591,7 @@ void gpsd_wrap(struct gps_device_t *session)
 	gpsd_deactivate(session);
 }
 
-void gpsd_zero_satellites( /*@out@*/ struct gps_data_t *out)
+void gpsd_zero_satellites( struct gps_data_t *out)
 {
     (void)memset(out->skyview, '\0', sizeof(out->skyview));
     out->satellites_visible = 0;
@@ -1659,7 +1607,7 @@ void gpsd_zero_satellites( /*@out@*/ struct gps_data_t *out)
 }
 
 #ifdef NTP_ENABLE
-void ntp_latch(struct gps_device_t *device, struct timedelta_t /*@out@*/*td)
+void ntp_latch(struct gps_device_t *device, struct timedelta_t *td)
 /* latch the fact that we've saved a fix */
 {
     double fix_time, integral, fractional;
@@ -1684,16 +1632,12 @@ void ntp_latch(struct gps_device_t *device, struct timedelta_t /*@out@*/*td)
      * fix_time is in microSec
      * OK since GPS timestamps are millSec or worse */
     fractional = modf(fix_time, &integral);
-    /*@-type@*/ /* splint is confused about struct timespec */
     td->real.tv_sec = (time_t)integral;
     td->real.tv_nsec = (long)(fractional * 1e+9);
-    /*@+type@*/
 
 #ifdef PPS_ENABLE
     /* thread-safe update */
-    /*@-compdef@*/
     pps_thread_fixin(&device->pps_thread, td);
-    /*@+compdef@*/
 #endif /* PPS_ENABLE */
 }
 #endif /* NTP_ENABLE */
diff --git a/matrix.c b/matrix.c
index 45f524e3..497946d2 100644
--- a/matrix.c
+++ b/matrix.c
@@ -8,8 +8,7 @@
 
 #include "matrix.h"
 
-/*@ -fixedformalarray -mustdefine @*/
-bool matrix_invert(double mat[4][4], /*@out@*/ double inverse[4][4])
+bool matrix_invert(double mat[4][4], double inverse[4][4])
 /* selected elements from 4x4 matrox inversion */
 {
     // Find all NECESSARY 2x2 subdeterminants
@@ -98,11 +97,10 @@ bool matrix_invert(double mat[4][4], /*@out@*/ double inverse[4][4])
 
     return true;
 }
-/*@ +fixedformalarray +mustdefine @*/
 
 #ifdef __UNUSED_
 // cppcheck-suppress unusedFunction
-void matrix_symmetrize(double mat[4][4], /*@out@*/ double prod[4][4])
+void matrix_symmetrize(double mat[4][4], double prod[4][4])
 /* symmetrize a matrix, multiply it by its transpose */
 {
     int i, j, k;
diff --git a/matrix.h b/matrix.h
index 9050e6b6..85ebbe01 100644
--- a/matrix.h
+++ b/matrix.h
@@ -5,7 +5,7 @@
  * BSD terms apply: see the file COPYING in the distribution root for details.
  */
 
-extern bool matrix_invert(double mat[4][4], /*@out@*/ double inverse[4][4]);
-extern void matrix_symmetrize(double mat[4][4], /*@out@*/ double inverse[4][4]);
+extern bool matrix_invert(double mat[4][4], double inverse[4][4]);
+extern void matrix_symmetrize(double mat[4][4], double inverse[4][4]);
 
 /* end */
diff --git a/monitor_garmin.c b/monitor_garmin.c
index 570179b7..f370cab4 100644
--- a/monitor_garmin.c
+++ b/monitor_garmin.c
@@ -97,7 +97,6 @@ static char *fixdesc[] = {
 
 static bool garmin_bin_initialize(void)
 {
-    /*@-globstate@*/
     unsigned int i;
 
 #ifndef CONTROLSEND_ENABLE
@@ -107,7 +106,6 @@ static bool garmin_bin_initialize(void)
     }
 #endif
 
-    /*@ -onlytrans @*/
     miscwin = subwin(devicewin, 1, 80, 1, 0);
     mid51win = subwin(devicewin, 12, 18, 2, 0);
     mid114win = subwin(devicewin, GARMIN_CHANNELS + 3, 23, 2, 18);
@@ -118,7 +116,6 @@ static bool garmin_bin_initialize(void)
     (void)syncok(mid51win, true);
     (void)syncok(mid114win, true);
 
-    /*@ -nullpass @*/
     (void)wattrset(miscwin, A_BOLD);
     display(miscwin, 0, 0, "Time:");
     (void)wattrset(miscwin, A_NORMAL);
@@ -155,10 +152,8 @@ static bool garmin_bin_initialize(void)
     gpsd_time_init(session.context, time(NULL));
 
     return true;
-    /*@+globstate@*/
 }
 
-/*@ -globstate -compdef */
 static void garmin_bin_update(uint16_t pkt_id, uint32_t pkt_size UNUSED, unsigned char *pkt_data)
 {
     int i;
@@ -287,7 +282,6 @@ static void garmin_bin_ser_update(void)
 	monitor_log("BAD 0x%02x=", buf[1]);
    }
 }
-/*@ +globstate +compdef */
 
 static void garmin_bin_wrap(void)
 {
diff --git a/monitor_italk.c b/monitor_italk.c
index 903a1d5b..3b547a81 100644
--- a/monitor_italk.c
+++ b/monitor_italk.c
@@ -21,7 +21,6 @@ static bool italk_initialize(void)
 {
     int i;
 
-    /*@ -onlytrans @*/
     /* "heavily inspired" by monitor_nmea.c */
     if ((satwin =
 	 derwin(devicewin, MAX_NR_VISIBLE_PRNS + 3, 27, 0, 0)) == NULL)
@@ -62,7 +61,6 @@ static bool italk_initialize(void)
     display(navfixwin, 12, 20, " NAV_FIX ");
     (void)wattrset(navfixwin, A_NORMAL);
     return true;
-    /*@ +onlytrans @*/
 }
 
 static void display_itk_navfix(unsigned char *buf, size_t len)
diff --git a/monitor_nmea0183.c b/monitor_nmea0183.c
index 5bab9efa..ff34b8f9 100644
--- a/monitor_nmea0183.c
+++ b/monitor_nmea0183.c
@@ -12,9 +12,7 @@
 #include <stdlib.h> /* for labs() */
 #include <assert.h>
 #include <stdarg.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "gpsmon.h"
@@ -41,7 +39,6 @@ static bool nmea_initialize(void)
 {
     int i;
 
-    /*@ -globstate -onlytrans @*/
     cookedwin = derwin(devicewin, 3, 80, 0, 0);
     assert(cookedwin !=NULL);
     (void)wborder(cookedwin, 0, 0, 0, 0, 0, 0, 0, 0);
@@ -142,14 +139,12 @@ static bool nmea_initialize(void)
     (void)mvwprintw(gpgstwin, 5, 12, " GST ");
     (void)wattrset(gpgstwin, A_NORMAL);
 
-    /*@ +onlytrans @*/
 
     last_tick = timestamp();
 
     sentences[0] = '\0';
 
     return (nmeawin != NULL);
-    /*@ +globstate @*/
 }
 
 static void cooked_pvt(void)
@@ -211,7 +206,6 @@ static void monitor_satlist(WINDOW *win, int y, int x)
     monitor_fixframe(win);
 }
 
-/*@ -globstate -nullpass (splint is confused) */
 static void nmea_update(void)
 {
     char **fields;
@@ -349,8 +343,6 @@ static void nmea_update(void)
 #endif /* PPS_ENABLE */
 }
 
-/*@ +globstate +nullpass */
-
 #undef SENTENCELINE
 
 static void nmea_wrap(void)
diff --git a/monitor_oncore.c b/monitor_oncore.c
index 6e08c34b..2448202e 100644
--- a/monitor_oncore.c
+++ b/monitor_oncore.c
@@ -75,10 +75,8 @@ static const char *pos_hold_mode[] = {
 
 static bool oncore_initialize(void)
 {
-    /*@-globstate@*/
     unsigned int i;
 
-    /*@ -onlytrans @*/
     Ea1win = subwin(devicewin, 5, 80, 1, 0);
     Eawin = subwin(devicewin, MAXTRACKSATS + 3, 27, 6, 0);
     Bbwin = subwin(devicewin, MAXVISSATS + 3, 22, 6, 28);
@@ -87,7 +85,6 @@ static bool oncore_initialize(void)
     Aywin = subwin(devicewin, 4, 15, 17, 12);
     Atwin = subwin(devicewin, 5, 9, 16, 51);
     Aswin = subwin(devicewin, 5, 19, 16, 61);
-    /*@ +onlytrans @*/
 
     if (Ea1win == NULL || Eawin == NULL || Bbwin == NULL || Enwin == NULL
 	|| Bowin == NULL || Aswin == NULL || Atwin == NULL || Aywin == NULL)
@@ -173,7 +170,6 @@ static bool oncore_initialize(void)
     memset(EaSVlines, 0, sizeof(EaSVlines));
 
     return true;
-    /*@+globstate@*/
 }
 
 static void oncore_update(void)
@@ -227,7 +223,6 @@ static void oncore_update(void)
 	(void)mvwprintw(Ea1win, 2, 70, "%5.1f", track);
 	(void)mvwprintw(Ea1win, 3, 68, "%8.2f m", alt);
 
-	/*@ -predboolothers @*/
 	(void)snprintf(statusbuf, sizeof(statusbuf), "%s%s%s%s%s%s%s%s%s",
 		       (status & 0x80) ? "PProp " : "",
 		       (status & 0x40) ? "PoorGeom " : "",
@@ -238,16 +233,13 @@ static void oncore_update(void)
 		       (status & 0x02) ? "Ins (<3 SV) " : "",
 		       (status & 0x01) ? "BadAlm " : "",
 		       (dopt   & 0x20) ? "survey " : "");
-	/*@ +predboolothers @*/
 
 	(void)mvwprintw(Ea1win, 3, 24, "%-37s", statusbuf);
 
 	(void)mvwprintw(Ea1win, 2, 10, "%-10s", antenna[dopt >> 6]);
 
-	/*@ -predboolothers @*/
 	(void)mvwprintw(Ea1win, 2, 27, "%s %4.1f",
 			(dopt & 1) ? "hdop" : "pdop", dop);
-	/*@ +predboolothers @*/
 
 	(void)mvwprintw(Ea1win, 3, 10, "%d/%d ", nsat, nvis);
     }
@@ -268,7 +260,6 @@ static void oncore_update(void)
 	    else
 		(void)wprintw(Eawin, "    -");
 	    (void)wprintw(Eawin, " %3d", sn);
-	    /*@ -predboolothers @*/
 	    (void)wprintw(Eawin, " %c%c%c%c%c%c%c%c", (status & 0x80) ? 'p' : ' ',	/* used for pos fix  */
 			  (status & 0x40) ? 'M' : ' ',	/* momentum alert    */
 			  (status & 0x20) ? 's' : ' ',	/* anti-spoof   */
@@ -277,7 +268,6 @@ static void oncore_update(void)
 			  (status & 0x04) ? 'S' : ' ',	/* spare             */
 			  (status & 0x02) ? 't' : ' ',	/* used for time sol */
 			  (status & 0x01) ? 'P' : ' ');	/* parity error      */
-	    /*@ +predboolothers @*/
 	}
 
 	monitor_log("Ea =");
@@ -303,13 +293,11 @@ static void oncore_update(void)
 	    unsigned int j;
 	    off = 5 + 7 * i;
 	    sv = (unsigned char)getub(buf, off);
-	    /*@ -boolops @*/
 	    for (j = 0; j < 8; j++)
 		if (EaSVlines[j] == sv && !(Bblines_mask & (1 << (j + 2)))) {
 		    Bblines[i] = j + 2;
 		    Bblines_mask |= 1 << Bblines[i];
 		}
-	    /*@ +boolops @*/
 	}
 	/* SVs not seen in Ea fill lines left over. */
 	next_line = 2;
@@ -338,12 +326,10 @@ static void oncore_update(void)
 	}
 
 	for (i = 2; i < 14; i++)
-	    /*@ -boolops @*/
 	    if (!(Bblines_mask & (1 << i))) {
 		(void)wmove(Bbwin, (int)i, 1);
 		(void)wprintw(Bbwin, "                   ");
 	    }
-	/*@ +boolops @*/
     }
 
 	monitor_log("Bb =");
@@ -363,7 +349,6 @@ static void oncore_update(void)
 	status = (unsigned char)getub(buf, 22);
 	sigma = (float)(getbeu16(buf, 23));
 
-	/*@ -predboolothers @*/
 	(void)mvwprintw(Enwin, 1, 24, "%3s", traim ? "on" : "off");
 	(void)mvwprintw(Enwin, 2, 18, "%6.1f us", alarm);
 	(void)mvwprintw(Enwin, 3, 13, "%14s", pps_ctrl[ctrl]);
@@ -372,7 +357,6 @@ static void oncore_update(void)
 	(void)mvwprintw(Enwin, 6, 20, "%7s", traim_sol[sol_stat]);
 	(void)mvwprintw(Enwin, 7, 11, "%16s", traim_status[status]);
 	(void)mvwprintw(Enwin, 8, 18, "%6.3f us", sigma * 0.001);
-	/*@ +predboolothers @*/
     }
 
 	monitor_log("En =");
diff --git a/monitor_proto.c b/monitor_proto.c
index 60c0bc4e..b73a7717 100644
--- a/monitor_proto.c
+++ b/monitor_proto.c
@@ -12,9 +12,7 @@
 #include <stdarg.h>
 #include <stdbool.h>
 #include <assert.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "bits.h"
diff --git a/monitor_sirf.c b/monitor_sirf.c
index 5efbcc65..25411f00 100644
--- a/monitor_sirf.c
+++ b/monitor_sirf.c
@@ -27,7 +27,6 @@ static WINDOW *mid19win, *mid27win;
 static bool dispmode = false, subframe_enabled = false, ppstime_enabled = false;
 static int leapseconds;
 
-/*@ -nullassign @*/
 static char *verbpat[] = {
     "#Time:",
     "@R Time:",
@@ -39,7 +38,6 @@ static char *verbpat[] = {
     NULL
 };
 
-/*@ +nullassign @*/
 
 static char *dgpsvec[] = {
     "None",
@@ -64,10 +62,8 @@ static char *dgpsvec[] = {
 
 static bool sirf_initialize(void)
 {
-    /*@-globstate@*/
     unsigned int i;
 
-    /*@ -onlytrans @*/
     mid2win = subwin(devicewin, 6, 80, 1, 0);
     mid4win = subwin(devicewin, SIRF_CHANNELS + 3, 30, 7, 0);
     mid6win = subwin(devicewin, 3, 50, 7, 30);
@@ -89,7 +85,6 @@ static bool sirf_initialize(void)
     (void)syncok(mid13win, true);
     (void)syncok(mid27win, true);
 
-    /*@ -nullpass @*/
     (void)wborder(mid2win, 0, 0, 0, 0, 0, 0, 0, 0),
 	(void)wattrset(mid2win, A_BOLD);
     (void)wmove(mid2win, 0, 1);
@@ -200,21 +195,16 @@ static bool sirf_initialize(void)
     display(mid27win, 0, 1, " DGPS Status ");
     display(mid27win, 2, 8, " Packet type 27 (0x1B) ");
     (void)wattrset(mid27win, A_NORMAL);
-    /*@ +nullpass @*/
-    /*@ -onlytrans @*/
 
 #ifdef CONTROLSEND_ENABLE
     /* probe for version */
-    /*@ -compdef @*/
     (void)monitor_control_send((unsigned char *)"\x84\x00", 2);
-    /*@ +compdef @*/
 #endif /* CONTROLSEND_ENABLE */
 
     /* initialize the GPS context's time fields */
     gpsd_time_init(session.context, time(NULL));
 
     return true;
-    /*@+globstate@*/
 }
 
 static void decode_ecef(double x, double y, double z,
@@ -226,11 +216,7 @@ static void decode_ecef(double x, double y, double z,
     const double e_2 = (a * a - b * b) / (b * b);
     double lambda, p, theta, phi, n, h, vnorth, veast, vup, speed, heading;
 
-    /* splint pacification */
-    assert(mid2win!=NULL);
-
     lambda = atan2(y, x);
-    /*@ -evalorder @*/
     p = sqrt(pow(x, 2) + pow(y, 2));
     theta = atan2(z * a, p * b);
     phi =
@@ -249,7 +235,6 @@ static void decode_ecef(double x, double y, double z,
 	vz * sin(phi);
     speed = sqrt(pow(vnorth, 2) + pow(veast, 2));
     heading = atan2(veast, vnorth);
-    /*@ +evalorder @*/
     if (heading < 0)
 	heading += 2 * GPS_PI;
 
@@ -274,7 +259,6 @@ static void decode_ecef(double x, double y, double z,
     (void)wattrset(mid2win, A_NORMAL);
 }
 
-/*@ -globstate */
 static void sirf_update(void)
 {
     int i, j, ch, sv;
@@ -283,9 +267,6 @@ static void sirf_update(void)
     uint8_t dgps;
     char tbuf[JSON_DATE_MAX+1];
 
-    /* splint pacification */
-    assert(mid2win!=NULL && mid27win != NULL);
-
     buf = session.lexer.outbuffer + 4;
     len = session.lexer.outbuflen - 8;
     switch (buf[0]) {
@@ -507,14 +488,12 @@ static void sirf_update(void)
 	total               3 x 12 = 36 bytes
 	******************************************************************/
 	dgps = getub(buf, 1);
-	/*@ -type @*/
 	display(mid27win, 1, 1, "%8s =                                      ",
 		(CHECK_RANGE(dgpsvec, dgps) ? dgpsvec[dgps] : "???"));
 	(void)wmove(mid27win, 1, 11);
 	for (ch = 0; ch < SIRF_CHANNELS; ch++)
 	    if (getub(buf, 16 + 3 * ch) != '\0')
 		(void)wprintw(mid27win, " %d", getub(buf, 16 + 3 * ch));
-	/*@ +type @*/
 	monitor_log("DST 0x1b=");
 	break;
 
@@ -541,12 +520,10 @@ static void sirf_update(void)
 	break;
 
     case 0xff:			/* Development Data */
-	/*@ +ignoresigns @*/
 	while (len > 0 && buf[len - 1] == '\n')
 	    len--;
 	while (len > 0 && buf[len - 1] == ' ')
 	    len--;
-	/*@ -ignoresigns @*/
 	buf[len] = '\0';
 	j = 1;
 	for (i = 0; verbpat[i] != NULL; i++)
@@ -577,20 +554,16 @@ static void sirf_update(void)
 	   display(mid4win, ch + 2, 27, "  ");
     }
 
-    /*@ -nullpass -nullderef @*/
     if (dispmode) {
 	(void)touchwin(mid19win);
 	(void)wnoutrefresh(mid19win);
     }
-    /*@ +nullpass -nullderef @*/
 
 #ifdef PPS_ENABLE
     pps_update(mid7win, 2, 32);
 #endif /* PPS_ENABLE */
 }
 
-/*@ +globstate */
-
 #ifdef CONTROLSEND_ENABLE
 static int sirf_command(char line[])
 {
diff --git a/monitor_superstar2.c b/monitor_superstar2.c
index f4aa08d7..489c7a8f 100644
--- a/monitor_superstar2.c
+++ b/monitor_superstar2.c
@@ -15,7 +15,6 @@ static bool superstar2_initialize(void)
 {
     int i;
 
-    /*@ -onlytrans @*/
     /* "heavily inspired" by monitor_nmea.c */
     if ((satwin = derwin(devicewin, 15, 27, 7, 0)) == NULL)
 	return false;
@@ -26,7 +25,6 @@ static bool superstar2_initialize(void)
 	(void)mvwprintw(satwin, (int)(i + 2), 1, "%2d", i);
     (void)mvwprintw(satwin, 14, 1, " Satellite Data & Status ");
     (void)wattrset(satwin, A_NORMAL);
-    /*@ +onlytrans @*/
 
     return true;
 }
@@ -45,10 +43,8 @@ static void display_superstar2_svinfo(unsigned char *buf, size_t data_len)
 	char el;
 	unsigned short az;
 
-	/*@ +charint */
 	if ((porn = (unsigned char)getub(buf, off) & 0x1f) == 0)
 	    porn = ((unsigned char)getub(buf, off + 3) >> 1) + 87;
-	/*@ -charint */
 
 	ss = (unsigned char)getub(buf, off + 4);
 	el = (char)getsb(buf, off + 1);
@@ -56,11 +52,9 @@ static void display_superstar2_svinfo(unsigned char *buf, size_t data_len)
 			      ((getub(buf, off + 3) & 0x1) << 1));
 	fl = (unsigned char)getub(buf, off) & 0xe0;
 	(void)wmove(satwin, i + 2, 4);
-	/*@ +charint */
 	(void)wprintw(satwin, "%3u %3d %2d  %02d %02x %c",
 		      porn, az, el, ss, fl,
 		      ((fl & 0x60) == 0x60) ? 'Y' : ' ');
-	/*@ -charint */
     }
     (void)wnoutrefresh(satwin);
     return;
diff --git a/monitor_tnt.c b/monitor_tnt.c
index b9825fa6..38ae9c48 100644
--- a/monitor_tnt.c
+++ b/monitor_tnt.c
@@ -16,8 +16,6 @@ static WINDOW *thtmwin;
 
 static bool tnt_initialize(void)
 {
-    /*@-globstate@*/
-    /*@ -onlytrans @*/
     thtmwin = derwin(devicewin, 6, 80, 0, 0);
     assert(thtmwin != NULL);
     (void)wborder(thtmwin, 0, 0, 0, 0, 0, 0, 0, 0),
@@ -34,9 +32,7 @@ static bool tnt_initialize(void)
     (void)mvwaddstr(thtmwin, 3, 40, "Roll Status          ");
     (void)mvwaddstr(thtmwin, 4, 40, "Horizontal Field:    ");
     (void)wattrset(thtmwin, A_NORMAL);
-    /*@ +onlytrans @*/
     return true;
-    /*@+globstate@*/
 }
 
 static void tnt_update(void)
diff --git a/monitor_ubx.c b/monitor_ubx.c
index 7a95540e..11a290bf 100644
--- a/monitor_ubx.c
+++ b/monitor_ubx.c
@@ -21,7 +21,6 @@ static bool ubx_initialize(void)
 {
     int i;
 
-    /*@ -onlytrans @*/
     /* "heavily inspired" by monitor_nmea.c */
     if ((satwin = derwin(devicewin, 19, 28, 0, 0)) == NULL)
 	return false;
@@ -32,7 +31,6 @@ static bool ubx_initialize(void)
 	display(satwin, (int)(i + 2), 1, "%2d", i);
     display(satwin, 18, 7, " NAV_SVINFO ");
     (void)wattrset(satwin, A_NORMAL);
-    /*@ -onlytrans @*/
 
     /* "heavily inspired" by monitor_nmea.c */
     if ((navsolwin = derwin(devicewin, 13, 51, 0, 28)) == NULL)
@@ -123,7 +121,6 @@ static void display_nav_svinfo(unsigned char *buf, size_t data_len)
     return;
 }
 
-/*@ -mustfreeonly -compdestroy @*/
 static void display_nav_sol(unsigned char *buf, size_t data_len)
 {
     unsigned short gw = 0;
@@ -136,10 +133,6 @@ static void display_nav_sol(unsigned char *buf, size_t data_len)
     if (data_len != 52)
 	return;
 
-#ifdef S_SPLINT_S
-    assert(navsolwin != NULL);
-#endif /* S_SPLINT_S */
-
     navmode = (unsigned char)getub(buf, 10);
     flags = (unsigned int)getub(buf, 11);
 
@@ -178,7 +171,6 @@ static void display_nav_sol(unsigned char *buf, size_t data_len)
     (void)wattrset(navsolwin, A_NORMAL);
 
     (void)wmove(navsolwin, 7, 7);
-    /*@ -compdef @*/
     {
 	unsigned int day = tow / 8640000;
 	unsigned int tod = tow % 8640000;
@@ -192,7 +184,6 @@ static void display_nav_sol(unsigned char *buf, size_t data_len)
 	(void)wprintw(navsolwin, "%u %02u:%02u:%05.2f", day, h, m, (double)s / 100);
 	(void)wattrset(navsolwin, A_NORMAL);
     }
-    /*@ +compdef @*/
     (void)wmove(navsolwin, 8, 11);
     if ((flags & (UBX_SOL_VALID_WEEK | UBX_SOL_VALID_TIME)) != 0) {
 	(void)wprintw(navsolwin, "%d+%10.3lf", gw, (double)(tow / 1000.0));
@@ -216,7 +207,6 @@ static void display_nav_sol(unsigned char *buf, size_t data_len)
     (void)wnoutrefresh(navsolwin);
 }
 
-/*@ +mustfreeonly +compdestroy @*/
 
 static void display_nav_dop(unsigned char *buf, size_t data_len)
 {
diff --git a/net_dgpsip.c b/net_dgpsip.c
index 3574125b..900e911a 100644
--- a/net_dgpsip.c
+++ b/net_dgpsip.c
@@ -9,15 +9,12 @@
 #include <stdlib.h>
 #include <string.h>
 #include <fcntl.h>
-#ifndef S_SPLINT_S
 #include <netdb.h>
 #include <sys/socket.h>
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 
-/*@ -branchstate */
 int dgpsip_open(struct gps_device_t *device, const char *dgpsserver)
 /* open a connection to a DGPSIP server */
 {
@@ -60,8 +57,6 @@ int dgpsip_open(struct gps_device_t *device, const char *dgpsserver)
     return device->gpsdata.gps_fd;
 }
 
-/*@ +branchstate */
-
 void dgpsip_report(struct gps_context_t *context,
 		   struct gps_device_t *gps,
 		   struct gps_device_t *dgpsip)
diff --git a/net_gnss_dispatch.c b/net_gnss_dispatch.c
index a8f6fd13..b7a15b20 100644
--- a/net_gnss_dispatch.c
+++ b/net_gnss_dispatch.c
@@ -8,10 +8,8 @@
 #include <errno.h>
 #include <sys/types.h>
 #include <sys/stat.h>
-#ifndef S_SPLINT_S
 #include <sys/socket.h>
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "strfuncs.h"
@@ -28,7 +26,6 @@ bool netgnss_uri_check(char *name)
 }
 
 
-/*@ -branchstate */
 int netgnss_uri_open(struct gps_device_t *dev, char *netgnss_service)
 /* open a connection to a DGNSS service */
 {
@@ -51,7 +48,6 @@ int netgnss_uri_open(struct gps_device_t *dev, char *netgnss_service)
     return -1;
 #endif
 }
-/*@ +branchstate */
 
 void netgnss_report(struct gps_context_t *context,
 		    struct gps_device_t *gps, struct gps_device_t *dgnss)
diff --git a/net_ntrip.c b/net_ntrip.c
index 75ef0d88..8fc3b676 100644
--- a/net_ntrip.c
+++ b/net_ntrip.c
@@ -11,13 +11,11 @@
 #include <fcntl.h>
 #include <math.h>
 #include <strings.h>
-#ifndef S_SPLINT_S
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <netdb.h>
 #include <sys/socket.h>
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "strfuncs.h"
@@ -32,11 +30,10 @@
 #define NTRIP_ICY		"ICY 200 OK"
 #define NTRIP_UNAUTH		"401 Unauthorized"
 
-/*@ -temptrans -mustfreefresh @*/
-static /*@null@*/ char *ntrip_field_iterate( /*@null@ */ char *start,
-					     /*@null@*/ char *prev,
-					     const char *eol,
-					     const struct gpsd_errout_t *errout)
+static char *ntrip_field_iterate(char *start,
+				 char *prev,
+				 const char *eol,
+				 const struct gpsd_errout_t *errout)
 {
     char *s, *t, *u;
 
@@ -63,11 +60,9 @@ static /*@null@*/ char *ntrip_field_iterate( /*@null@ */ char *start,
     return s;
 }
 
-/*@ +temptrans +mustfreefresh @*/
 
-/*@ -mustfreefresh @*/
 static void ntrip_str_parse(char *str, size_t len,
-			    /*@out@*/ struct ntrip_stream_t *hold,
+			    struct ntrip_stream_t *hold,
 			    const struct gpsd_errout_t *errout)
 {
     char *s, *eol = str + len;
@@ -337,9 +332,9 @@ static int ntrip_stream_req_probe(const struct ntrip_stream_t *stream,
 }
 
 static int ntrip_auth_encode(const struct ntrip_stream_t *stream,
-	const char *auth,
-	/*@out@*/ char buf[],
-	size_t size)
+			     const char *auth,
+			     char buf[],
+			     size_t size)
 {
     memset(buf, 0, size);
     if (stream->authentication == auth_none)
@@ -401,7 +396,6 @@ static int ntrip_stream_get_parse(const struct ntrip_stream_t *stream,
 				  const int dsock, 
 				  const struct gpsd_errout_t *errout)
 {
-/*@-nullpass@*/
     char buf[BUFSIZ];
     int opts;
     memset(buf, 0, sizeof(buf));
@@ -445,10 +439,8 @@ static int ntrip_stream_get_parse(const struct ntrip_stream_t *stream,
 close:
     (void)close(dsock);
     return -1;
-/*@+nullpass@*/
 }
 
-/*@ -branchstate -nullpass @*/
 int ntrip_open(struct gps_device_t *device, char *caster)
     /* open a connection to a Ntrip broadcaster */
 {
@@ -470,7 +462,6 @@ int ntrip_open(struct gps_device_t *device, char *caster)
 	    device->ntrip.stream.set = false;
 	    (void)strlcpy(tmp, caster, sizeof(t));
 
-	    /*@ -boolops @*/
 	    if ((amp = strchr(tmp, '@')) != NULL) {
 		if (((colon = strchr(tmp, ':')) != NULL) && colon < amp) {
 		    auth = tmp;
@@ -485,7 +476,6 @@ int ntrip_open(struct gps_device_t *device, char *caster)
 		    return -1;
 		}
 	    }
-	    /*@ +boolops @*/
 	    if ((slash = strchr(tmp, '/')) != NULL) {
 		*slash = '\0';
 		stream = slash + 1;
@@ -576,7 +566,6 @@ int ntrip_open(struct gps_device_t *device, char *caster)
     }
     return ret;
 }
-/*@ +branchstate +nullpass @*/
 
 void ntrip_report(struct gps_context_t *context,
 		  struct gps_device_t *gps,
diff --git a/netlib.c b/netlib.c
index 8718fc3d..2652835f 100644
--- a/netlib.c
+++ b/netlib.c
@@ -4,7 +4,6 @@
  */
 #include <string.h>
 #include <fcntl.h>
-#ifndef S_SPLINT_S
 #include <netdb.h>
 #ifndef AF_UNSPEC
 #include <sys/types.h>
@@ -18,12 +17,10 @@
 #include <arpa/inet.h>     /* for htons() and friends */
 #include <unistd.h>
 #include <netinet/ip.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 #include "sockaddr.h"
 
-/*@-mustfreefresh -usedef@*/
 socket_t netlib_connectsock(int af, const char *host, const char *service,
 			    const char *protocol)
 {
@@ -35,7 +32,6 @@ socket_t netlib_connectsock(int af, const char *host, const char *service,
     bool bind_me;
 
     INVALIDATE_SOCKET(s);
-    /*@-type@*/
     ppe = getprotobyname(protocol);
     if (strcmp(protocol, "udp") == 0) {
 	type = SOCK_DGRAM;
@@ -44,7 +40,6 @@ socket_t netlib_connectsock(int af, const char *host, const char *service,
 	type = SOCK_STREAM;
 	proto = (ppe) ? ppe->p_proto : IPPROTO_TCP;
     }
-    /*@+type@*/
 
     /* we probably ought to pass this in as an explicit flag argument */
     bind_me = (type == SOCK_DGRAM);
@@ -53,13 +48,11 @@ socket_t netlib_connectsock(int af, const char *host, const char *service,
     hints.ai_family = af;
     hints.ai_socktype = type;
     hints.ai_protocol = proto;
-#ifndef S_SPLINT_S
     if (bind_me)
 	hints.ai_flags = AI_PASSIVE;
     if ((ret = getaddrinfo(host, service, &hints, &result))) {
 	return NL_NOHOST;
     }
-#endif /* S_SPLINT_S */
 
     /*
      * From getaddrinfo(3):
@@ -71,7 +64,6 @@ socket_t netlib_connectsock(int af, const char *host, const char *service,
      *     IPv4 addresses.
      * Thus, with the default parameters, we get IPv6 addresses first.
      */
-    /*@-type@*/
     for (rp = result; rp != NULL; rp = rp->ai_next) {
 	ret = NL_NOCONNECT;
 	if ((s = socket(rp->ai_family, rp->ai_socktype, rp->ai_protocol)) < 0)
@@ -98,22 +90,17 @@ socket_t netlib_connectsock(int af, const char *host, const char *service,
 	    (void)close(s);
 	}
     }
-    /*@+type@*/
-#ifndef S_SPLINT_S
     freeaddrinfo(result);
-#endif /* S_SPLINT_S */
     if (ret != 0 || BAD_SOCKET(s))
 	return ret;
 
 #ifdef IPTOS_LOWDELAY
     {
 	int opt = IPTOS_LOWDELAY;
-	/*@ -unrecog @*/
 	(void)setsockopt(s, IPPROTO_IP, IP_TOS, &opt, sizeof(opt));
 #ifdef IPV6_TCLASS
 	(void)setsockopt(s, IPPROTO_IPV6, IPV6_TCLASS, &opt, sizeof(opt));
 #endif
-	/*@ +unrecog @*/
     }
 #endif
 #ifdef TCP_NODELAY
@@ -132,12 +119,10 @@ socket_t netlib_connectsock(int af, const char *host, const char *service,
     (void)fcntl(s, F_SETFL, fcntl(s, F_GETFL) | O_NONBLOCK);
 
     return s;
-    /*@ +type +mustfreefresh @*/
 }
 
-/*@+mustfreefresh +usedef@*/
 
-const char /*@observer@*/ *netlib_errstr(const int err)
+const char *netlib_errstr(const int err)
 {
     switch (err) {
     case NL_NOSERVICE:
@@ -173,12 +158,10 @@ socket_t netlib_localsocket(const char *sockfile, int socktype)
 		      sockfile,
 		      sizeof(saddr.sun_path));
 
-	/*@-unrecog@*/
 	if (connect(sock, (struct sockaddr *)&saddr, SUN_LEN(&saddr)) < 0) {
 	    (void)close(sock);
 	    return -2;
 	}
-	/*@+unrecog@*/
 
 	return sock;
     }
@@ -193,7 +176,6 @@ char *netlib_sock2ip(socket_t fd)
     int r;
 
     r = getpeername(fd, &(fsin.sa), &alen);
-    /*@ -branchstate -unrecog +boolint @*/
     if (r == 0) {
 	switch (fsin.sa.sa_family) {
 	case AF_INET:
@@ -214,6 +196,5 @@ char *netlib_sock2ip(socket_t fd)
     if (r != 0) {
 	(void)strlcpy(ip, "<unknown>", sizeof(ip));
     }
-    /*@ +branchstate +unrecog -boolint @*/
     return ip;
 }
diff --git a/ntpshm.h b/ntpshm.h
index bf36f879..f3e9945b 100644
--- a/ntpshm.h
+++ b/ntpshm.h
@@ -75,11 +75,9 @@ struct timedelta_t {
 #define TIMEDELTA_DEFINED
 #endif /* TIMEDELTA_DEFINED */
 
-struct shmTime /*@null@*/ *shm_get(int, bool, bool);
+struct shmTime *shm_get(int, bool, bool);
 extern char *ntp_name(const int);
-enum segstat_t ntp_read(/*@null@*/struct shmTime *, 
-			 /*@out@*/struct shm_stat_t *,
-			 const bool);
+enum segstat_t ntp_read(struct shmTime *, struct shm_stat_t *, const bool);
 void ntp_write(volatile struct shmTime *, struct timedelta_t *, int, int);
 
 #endif /* GPSD_NTPSHM_H */
diff --git a/ntpshmmon.c b/ntpshmmon.c
index 0e545169..16f5dc2b 100644
--- a/ntpshmmon.c
+++ b/ntpshmmon.c
@@ -8,9 +8,7 @@
 #include <stdlib.h>
 #include <getopt.h>
 #include <limits.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd_config.h"
 #include "ntpshm.h"
@@ -93,8 +91,6 @@ int main(int argc, char **argv)
 	    switch(status)
 	    {
 	    case OK:
-		/*@-mustfreefresh -formattype@*/
-		/*@-type@*//* splint is confused about struct timespec */
 		if (timespec_diff_ns(shm_stat.tvc, tick[i]) >= cycle * 1000000000) {
 		    printf("sample %s %ld.%09ld %ld.%09ld %ld.%09ld %d %3d\n",
 			   ntp_name(i),
@@ -105,8 +101,6 @@ int main(int argc, char **argv)
 		    tick[i] = shm_stat.tvc;
 		    --nsamples;
 		}
-		/*@+type@*/
-		/*@+mustfreefresh +formattype@*/
 		break;
 	    case NO_SEGMENT:
 		break;
@@ -114,19 +108,15 @@ int main(int argc, char **argv)
 		/* do nothing, data not ready, wait another cycle */
 		break;
 	    case BAD_MODE:
-		/*@-mustfreefresh@*/
 		fprintf(stderr, "ntpshmmon: unknown mode %d on segment %s\n",
 			shm_stat.status, ntp_name(i));
-		/*@+mustfreefresh@*/
 		break;
 	    case CLASH:
 		/* do nothing, data is corrupt, wait another cycle */
 		break;
 	    default:
-		/*@-mustfreefresh@*/
 		fprintf(stderr, "ntpshmmon: unknown status %d on segment %s\n",
 			status, ntp_name(i));
-		/*@+mustfreefresh@*/
 		break;
 	    }
 	}
diff --git a/ntpshmread.c b/ntpshmread.c
index c8ebec00..c75410be 100644
--- a/ntpshmread.c
+++ b/ntpshmread.c
@@ -15,17 +15,14 @@
 #include <assert.h>
 #include <stdio.h>
 #include <stdint.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S*/
 
 #include "ntpshm.h"
 #include "compiler.h"
 
-struct shmTime /*@null@*/ *shm_get(const int unit, const bool create, const bool forall)
+struct shmTime *shm_get(const int unit, const bool create, const bool forall)
 /* initialize a SHM segment */
 {
-    /*@-mustfreefresh@*/
     struct shmTime *p = NULL;
     int shmid;
 
@@ -43,10 +40,8 @@ struct shmTime /*@null@*/ *shm_get(const int unit, const bool create, const bool
 	return NULL;
     }
     return p;
-    /*@+mustfreefresh@*/
 }
 
-/*@-statictrans@*/
 char *ntp_name(const int unit)
 /* return the name of a specified segment */
 {
@@ -56,9 +51,8 @@ char *ntp_name(const int unit)
 
     return name;
 }
-/*@+statictrans@*/
 
-enum segstat_t ntp_read(/*@null@*/struct shmTime *shm_in, /*@out@*/struct shm_stat_t *shm_stat, const bool consume)
+enum segstat_t ntp_read(struct shmTime *shm_in, struct shm_stat_t *shm_stat, const bool consume)
 /* try to grab a sample from the specified SHM segment */
 {
     volatile struct shmTime shmcopy, *shm = shm_in;
@@ -71,7 +65,6 @@ enum segstat_t ntp_read(/*@null@*/struct shmTime *shm_in, /*@out@*/struct shm_st
 	return NO_SEGMENT;
     }
 
-    /*@-type@*//* splint is confused about struct timespec */
     shm_stat->tvc.tv_sec = shm_stat->tvc.tv_nsec = 0;
 
     clock_gettime(CLOCK_REALTIME, &shm_stat->tvc);
@@ -172,7 +165,6 @@ enum segstat_t ntp_read(/*@null@*/struct shmTime *shm_in, /*@out@*/struct shm_st
 	shm_stat->status = BAD_MODE;
 	break;
     }
-    /*@-type@*/
 
     /*
      * leap field is not a leap offset but a leap notification code.
diff --git a/ntpshmwrite.c b/ntpshmwrite.c
index 217f9514..563102be 100644
--- a/ntpshmwrite.c
+++ b/ntpshmwrite.c
@@ -12,11 +12,9 @@
 #include <errno.h>
 #include <sys/types.h>
 #include <sys/stat.h>
-#ifndef S_SPLINT_S
 #include <sys/wait.h>
 #include <sys/socket.h>
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "ntpshm.h"
 #include "compiler.h"
@@ -33,13 +31,11 @@ void ntp_write(volatile struct shmTime *shmseg,
      * GPS emits leap pending for 3 months prior to insertion
      * NTP expects leap pending for only 1 month prior to insertion 
      * Per http://bugs.ntp.org/1090 */
-    /*@-type@*//* splint is confused about struct timespec */ 
     (void)gmtime_r( &(td->real.tv_sec), &tm);
     if ( 5 != tm.tm_mon && 11 != tm.tm_mon ) {
         /* Not june, not December, no way */
         leap_notify = LEAP_NOWARNING;
     }
-    /*@-type@*/
 
     /* we use the shmTime mode 1 protocol
      *
@@ -61,14 +57,12 @@ void ntp_write(volatile struct shmTime *shmseg,
     /* We need a memory barrier here to prevent write reordering by
      * the compiler or CPU cache */
     memory_barrier();
-    /*@-type@*/ /* splint is confused about struct timespec */
     shmseg->clockTimeStampSec = (time_t)td->real.tv_sec;
     shmseg->clockTimeStampUSec = (int)(td->real.tv_nsec/1000);
     shmseg->clockTimeStampNSec = (unsigned)td->real.tv_nsec;
     shmseg->receiveTimeStampSec = (time_t)td->clock.tv_sec;
     shmseg->receiveTimeStampUSec = (int)(td->clock.tv_nsec/1000);
     shmseg->receiveTimeStampNSec = (unsigned)td->clock.tv_nsec;
-    /*@+type@*/
     shmseg->leap = leap_notify;
     shmseg->precision = precision;
     memory_barrier();
diff --git a/packet.c b/packet.c
index 8c6bacde..ec4fd5ae 100644
--- a/packet.c
+++ b/packet.c
@@ -33,11 +33,9 @@ PERMISSIONS
 #include <ctype.h>
 #include <string.h>
 #include <errno.h>
-#ifndef S_SPLINT_S
 #include <netinet/in.h>
 #include <arpa/inet.h>		/* for htons() */
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "bits.h"
 #include "gpsd.h"
@@ -194,9 +192,7 @@ static size_t oncore_payload_cksum_length(unsigned char id1, unsigned char id2)
 static bool character_pushback(struct gps_lexer_t *lexer, unsigned int newstate)
 /* push back the last character grabbed, setting a specified state */
 {
-    /*@-modobserver@*//* looks like a splint bug */
     --lexer->inbufptr;
-    /*@+modobserver@*/
     --lexer->char_counter;
     lexer->state = newstate;
     if (lexer->errout.debug >= LOG_RAW + 2)
@@ -221,7 +217,6 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
 #ifdef SUPERSTAR2_ENABLE
     static unsigned char ctmp;
 #endif /* SUPERSTAR2_ENABLE */
-/*@ +charint -casebreak @*/
     n++;
     switch (lexer->state) {
     case GROUND_STATE:
@@ -1427,7 +1422,6 @@ static bool nextstate(struct gps_lexer_t *lexer, unsigned char c)
 	break;
 #endif /* PASSTHROUGH_ENABLE */
     }
-/*@ -charint +casebreak @*/
 
     return true;	/* no pushback */
 }
@@ -1495,7 +1489,7 @@ static void character_discard(struct gps_lexer_t *lexer)
 
 /* entry points begin here */
 
-void lexer_init( /*@out@*/ struct gps_lexer_t *lexer)
+void lexer_init(struct gps_lexer_t *lexer)
 {
     lexer->char_counter = 0;
     lexer->retry_counter = 0;
@@ -1514,9 +1508,7 @@ void packet_parse(struct gps_lexer_t *lexer)
 {
     lexer->outbuflen = 0;
     while (packet_buffered_input(lexer) > 0) {
-	/*@ -modobserver @*/
 	unsigned char c = *lexer->inbufptr++;
-	/*@ +modobserver @*/
 	unsigned int oldstate = lexer->state;
 	if (!nextstate(lexer, c))
 	    continue;
@@ -1685,7 +1677,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 		size_t n;
 		unsigned int ch, chksum;
 		n = 0;
-		/*@ +charint */
 #ifdef TSIP_ENABLE
 		/* shortcut garmin */
 		if (TSIP_PACKET == lexer->type)
@@ -1719,7 +1710,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 		/* we used to say n++ here, but scan-build complains */
 		if (lexer->inbuffer[n] != ETX)
 		    goto not_garmin;
-		/*@ +charint */
 		chksum &= 0xff;
 		if (chksum) {
 		    gpsd_log(&lexer->errout, LOG_IO,
@@ -1772,7 +1762,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 		 * specification, nor does it cover every packet type we
 		 * may see on the wire.
 		 */
-		/*@ +charint @*/
 		pkt_id = lexer->inbuffer[1];	/* packet ID */
                 /* *INDENT-OFF* */
 		if (!((0x13 == pkt_id) || 
@@ -1787,7 +1776,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 		    goto not_tsip;
 		}
                 /* *INDENT-ON* */
-		/*@ -ifempty */
 #define TSIP_ID_AND_LENGTH(id, len)	((id == pkt_id) && (len == packetlen-4))
 		if ((0x13 == pkt_id) && (1 <= packetlen))
 		    /* pass */ ;
@@ -1875,7 +1863,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 		gpsd_log(&lexer->errout, LOG_RAW,
 			 "TSIP pkt_id = %#02x, packetlen= %zu\n",
 			 pkt_id, packetlen);
-		/*@ -charint +ifempty @*/
 		packet_accept(lexer, TSIP_PACKET);
 		packet_discard(lexer);
 		break;
@@ -1969,7 +1956,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 	else if (lexer->state == EVERMORE_RECOGNIZED) {
 	    unsigned int n, crc, checksum, len;
 	    n = 0;
-	    /*@ +charint */
 	    if (lexer->inbuffer[n++] != DLE)
 		goto not_evermore;
 	    if (lexer->inbuffer[n++] != STX)
@@ -2005,7 +1991,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 			 crc, checksum);
 		goto not_evermore;
 	    }
-	    /*@ +charint */
 	    packet_accept(lexer, EVERMORE_PACKET);
 	    packet_discard(lexer);
 	    break;
@@ -2027,7 +2012,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 	    /* number of words */
 	    len = (uint16_t) (lexer->inbuffer[6] & 0xff);
 
-	    /*@ -type @*/
 	    /* expected checksum */
 	    xsum = getiw(7 + 2 * len);
 
@@ -2038,7 +2022,6 @@ void packet_parse(struct gps_lexer_t *lexer)
 		volatile uint32_t tmpdw  = (csum + 1) * (tmpw + n);
 		csum ^= (tmpdw & 0xffff) ^ ((tmpdw >> 16) & 0xffff);
 	    }
-	    /*@ +type @*/
 	    if (len == 0 || csum == xsum)
 		packet_accept(lexer, ITALK_PACKET);
 	    else {
@@ -2136,11 +2119,9 @@ ssize_t packet_get(int fd, struct gps_lexer_t *lexer)
 {
     ssize_t recvd;
 
-    /*@ -modobserver @*/
     errno = 0;
     recvd = read(fd, lexer->inbuffer + lexer->inbuflen,
 		 sizeof(lexer->inbuffer) - (lexer->inbuflen));
-    /*@ +modobserver @*/
     if (recvd == -1) {
 	if ((errno == EAGAIN) || (errno == EINTR)) {
 	    gpsd_log(&lexer->errout, LOG_RAW + 2, "no bytes ready\n");
@@ -2214,7 +2195,7 @@ ssize_t packet_get(int fd, struct gps_lexer_t *lexer)
 	return recvd;
 }
 
-void packet_reset( /*@out@*/ struct gps_lexer_t *lexer)
+void packet_reset(struct gps_lexer_t *lexer)
 /* return the packet machine to the ground state */
 {
     lexer->type = BAD_PACKET;
diff --git a/ppsthread.h b/ppsthread.h
index 656be6cd..726f88b2 100644
--- a/ppsthread.h
+++ b/ppsthread.h
@@ -40,13 +40,13 @@ struct pps_thread_t {
     void *context;
     int devicefd;		/* device file descriptor */
     char *devicename;
-    /*@null@*/ char *(*report_hook)(volatile struct pps_thread_t *,
-				    struct timedelta_t *);
-    /*@null@*/ void (*pps_hook)(volatile struct pps_thread_t *,
-				struct timedelta_t *);
-    /*@null@*/ void (*log_hook)(volatile struct pps_thread_t *,
-				int errlevel, const char *fmt, ...);
-    /*@null@*/ void (*wrap_hook)(volatile struct pps_thread_t *);
+    char *(*report_hook)(volatile struct pps_thread_t *,
+			 struct timedelta_t *);
+    void (*pps_hook)(volatile struct pps_thread_t *,
+		     struct timedelta_t *);
+    void (*log_hook)(volatile struct pps_thread_t *,
+		     int errlevel, const char *fmt, ...);
+    void (*wrap_hook)(volatile struct pps_thread_t *);
     struct timedelta_t fixin;	/* real & clock time when in-band fix received */
 #if defined(HAVE_SYS_TIMEPPS_H)
     pps_handle_t kernelpps_handle;
diff --git a/pseudoais.c b/pseudoais.c
index d079e467..5c40e91b 100644
--- a/pseudoais.c
+++ b/pseudoais.c
@@ -21,7 +21,6 @@
 #define AIS_MSG_PART2_FLAG 0x100
 
 static unsigned char convtab[] = {"0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVW`abcdefghijklmnopqrstuvw"};
-/*@+charint */
 static unsigned char contab1[] = {0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
 				  0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
 				  0x20,0x21,0x22,0x23,0x24,0x25,0x26,0x27,0x28,0x29,0x2a,0x2b,0x2c,0x2d,0x2e,0x2f,
@@ -30,7 +29,6 @@ static unsigned char contab1[] = {0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0
 				  0x10,0x11,0x12,0x13,0x14,0x15,0x16,0x17,0x18,0x19,0x1a,0x1b,0x1c,0x1d,0x1e,0x1f,
 				  0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
 				  0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff};
-/*@ -charint */
 
 static void ais_addbits(unsigned char *bits,
 			unsigned int   start,
@@ -122,7 +120,6 @@ static void ais_binary_to_ascii(unsigned char *bits, unsigned int len)
 }
 
 
-/*@-compdef -mustdefine@*/
 unsigned int ais_binary_encode(struct ais_t *ais,
 			       unsigned char *bits,
                                int flag)
@@ -319,5 +316,4 @@ unsigned int ais_binary_encode(struct ais_t *ais,
     ais_binary_to_ascii(bits, len);
     return len;
 }
-/*@+compdef +mustdefine@*/
 #endif /* AIVDM_ENABLE */
diff --git a/pseudonmea.c b/pseudonmea.c
index 96c80b79..5239069d 100644
--- a/pseudonmea.c
+++ b/pseudonmea.c
@@ -29,9 +29,8 @@ static double degtodm(double angle)
     return floor(angle) * 100 + fraction * 60;
 }
 
-/*@ -mustdefine @*/
 void gpsd_position_fix_dump(struct gps_device_t *session,
-			    /*@out@*/ char bufp[], size_t len)
+			    char bufp[], size_t len)
 {
     struct tm tm;
     time_t intfixtime;
@@ -72,7 +71,6 @@ void gpsd_position_fix_dump(struct gps_device_t *session,
     }
 }
 
-/*@ +mustdefine @*/
 
 static void gpsd_transit_fix_dump(struct gps_device_t *session,
 				  char bufp[], size_t len)
@@ -89,7 +87,6 @@ static void gpsd_transit_fix_dump(struct gps_device_t *session,
 	tm.tm_year %= 100;
     }
 #define ZEROIZE(x)	(isnan(x)!=0 ? 0.0 : x)
-    /*@ -usedef @*/
     (void)snprintf(bufp, len,
 		   "$GPRMC,%02d%02d%02d,%c,%09.4f,%c,%010.4f,%c,%.4f,%.3f,%02d%02d%02d,,",
 		   tm.tm_hour,
@@ -103,7 +100,6 @@ static void gpsd_transit_fix_dump(struct gps_device_t *session,
 		   ZEROIZE(session->gpsdata.fix.speed * MPS_TO_KNOTS),
 		   ZEROIZE(session->gpsdata.fix.track),
 		   tm.tm_mday, tm.tm_mon, tm.tm_year);
-    /*@ +usedef @*/
 #undef ZEROIZE
     nmea_add_checksum(bufp);
 }
@@ -295,9 +291,7 @@ static void gpsd_binary_ais_dump(struct gps_device_t *session,
 	if ((datalen % (6*60)) != 0) {
 	    msg1 += 1;
 	}
-	/*@ +charint */
 	numc[0] = '0' + (char)(number1 & 0x0f);
-	/*@ -charint */
 	numc[1] = '\0';
 	number1 += 1;
 	if (number1 > 9) {
@@ -377,10 +371,9 @@ static void gpsd_binary_ais_dump(struct gps_device_t *session,
 }
 #endif /* AIVDM_ENABLE */
 
-/*@-compdef -mustdefine@*/
 /* *INDENT-OFF* */
 void nmea_tpv_dump(struct gps_device_t *session,
-		   /*@out@*/ char bufp[], size_t len)
+		   char bufp[], size_t len)
 {
     bufp[0] = '\0';
     if ((session->gpsdata.set & TIME_SET) != 0)
@@ -400,7 +393,7 @@ void nmea_tpv_dump(struct gps_device_t *session,
 /* *INDENT-ON* */
 
 void nmea_sky_dump(struct gps_device_t *session,
-		   /*@out@*/ char bufp[], size_t len)
+		   char bufp[], size_t len)
 {
     bufp[0] = '\0';
     if ((session->gpsdata.set & SATELLITE_SET) != 0)
@@ -409,7 +402,7 @@ void nmea_sky_dump(struct gps_device_t *session,
 }
 
 void nmea_subframe_dump(struct gps_device_t *session,
-		   /*@out@*/ char bufp[], size_t len)
+		   char bufp[], size_t len)
 {
     bufp[0] = '\0';
     if ((session->gpsdata.set & SUBFRAME_SET) != 0)
@@ -419,7 +412,7 @@ void nmea_subframe_dump(struct gps_device_t *session,
 
 #ifdef AIVDM_ENABLE
 void nmea_ais_dump(struct gps_device_t *session,
-		   /*@out@*/ char bufp[], size_t len)
+		   char bufp[], size_t len)
 {
     bufp[0] = '\0';
     if ((session->gpsdata.set & AIS_SET) != 0)
@@ -428,6 +421,5 @@ void nmea_ais_dump(struct gps_device_t *session,
 }
 #endif /* AIVDM_ENABLE */
 
-/*@+compdef +mustdefine@*/
 
 /* pseudonmea.c ends here */
diff --git a/rtcm2_json.c b/rtcm2_json.c
index 4d310d8d..d094e94b 100644
--- a/rtcm2_json.c
+++ b/rtcm2_json.c
@@ -27,7 +27,7 @@ PERMISSIONS
 
 int json_rtcm2_read(const char *buf,
 		    char *path, size_t pathlen, struct rtcm2_t *rtcm2,
-		    /*@null@*/ const char **endptr)
+		    const char **endptr)
 {
 
     static char *stringptrs[NITEMS(rtcm2->words)];
@@ -49,7 +49,6 @@ int json_rtcm2_read(const char *buf,
 
     int status = 0, satcount = 0;
 
-    /*@ -fullinitblock @*/
     const struct json_attr_t rtcm1_satellite[] = {
 	{"ident",     t_uinteger, STRUCTOBJECT(struct gps_rangesat_t, ident)},
 	{"udre",      t_uinteger, STRUCTOBJECT(struct gps_rangesat_t, udre)},
@@ -58,14 +57,12 @@ int json_rtcm2_read(const char *buf,
 	{"rrc",       t_real,     STRUCTOBJECT(struct gps_rangesat_t, rrc)},
 	{NULL},
     };
-    /*@-type@*//* STRUCTARRAY confuses splint */
     const struct json_attr_t json_rtcm1[] = {
 	RTCM2_HEADER
         {"satellites", t_array,	STRUCTARRAY(rtcm2->gps_ranges.sat,
 					    rtcm1_satellite, &satcount)},
 	{NULL},
     };
-    /*@+type@*/
 
     const struct json_attr_t json_rtcm3[] = {
 	RTCM2_HEADER
@@ -115,14 +112,12 @@ int json_rtcm2_read(const char *buf,
 	{"tou",         t_uinteger, STRUCTOBJECT(struct consat_t, tou)},
 	{NULL},
     };
-    /*@-type@*//* STRUCTARRAY confuses splint */
     const struct json_attr_t json_rtcm5[] = {
 	RTCM2_HEADER
         {"satellites", t_array,	STRUCTARRAY(rtcm2->conhealth.sat,
 					    rtcm5_satellite, &satcount)},
 	{NULL},
     };
-    /*@+type@*/
 
     const struct json_attr_t json_rtcm6[] = {
 	RTCM2_HEADER
@@ -140,14 +135,12 @@ int json_rtcm2_read(const char *buf,
 	{"bitrate",     t_uinteger, STRUCTOBJECT(struct station_t, bitrate)},
 	{NULL},
     };
-    /*@-type@*//* STRUCTARRAY confuses splint */
     const struct json_attr_t json_rtcm7[] = {
 	RTCM2_HEADER
         {"satellites", t_array,	STRUCTARRAY(rtcm2->almanac.station,
 					    rtcm7_satellite, &satcount)},
 	{NULL},
     };
-    /*@+type@*/
 
     const struct json_attr_t json_rtcm13[] = {
 	RTCM2_HEADER
@@ -185,16 +178,13 @@ int json_rtcm2_read(const char *buf,
 	{"rrc",       t_real,     STRUCTOBJECT(struct glonass_rangesat_t, rrc)},
 	{NULL},
     };
-    /*@-type@*//* STRUCTARRAY confuses splint */
     const struct json_attr_t json_rtcm31[] = {
 	RTCM2_HEADER
         {"satellites", t_array,	STRUCTARRAY(rtcm2->glonass_ranges.sat,
 					    rtcm31_satellite, &satcount)},
 	{NULL},
     };
-    /*@+type@*/
 
-    /*@-type@*//* complex union array initislizations confuses splint */
     const struct json_attr_t json_rtcm2_fallback[] = {
 	RTCM2_HEADER
 	{"data",         t_array, .addr.array.element_type = t_string,
@@ -205,8 +195,6 @@ int json_rtcm2_read(const char *buf,
 	                             .addr.array.maxlen = NITEMS(stringptrs)},
 	{NULL},
     };
-    /*@+type@*/
-    /*@ +fullinitblock @*/
 
 #undef RTCM2_HEADER
 /* *INDENT-ON* */
diff --git a/rtcm3_json.c b/rtcm3_json.c
index 3e91ca20..75f66786 100644
--- a/rtcm3_json.c
+++ b/rtcm3_json.c
@@ -25,7 +25,7 @@ PERMISSIONS
 
 int json_rtcm3_read(const char *buf,
 		    char *path, size_t pathlen, struct rtcm3_t *rtcm3,
-		    /*@null@*/ const char **endptr)
+		    const char **endptr)
 {
     static char *stringptrs[NITEMS(rtcm3->rtcmtypes.data)];
     static char stringstore[sizeof(rtcm3->rtcmtypes.data) * 2];
@@ -41,7 +41,6 @@ int json_rtcm3_read(const char *buf,
     int status = 0, satcount = 0;
 
 #define RTCM3FIELD(type, fld)	STRUCTOBJECT(struct rtcm3_ ## type ## _t, fld)
-    /*@ -fullinitblock @*/
     const struct json_attr_t rtcm1001_satellite[] = {
 	{"ident",     t_uinteger, RTCM3FIELD(1001, ident)},
 	{"ind",       t_uinteger, RTCM3FIELD(1001, L1.indicator)},
@@ -85,7 +84,6 @@ int json_rtcm3_read(const char *buf,
     };
 #undef RTCM3FIELD
 
-    /*@-type@*//* STRUCTARRAY confuses splint */
 #define R1001	&rtcm3->rtcmtypes.rtcm3_1001.header
     const struct json_attr_t json_rtcm1001[] = {
 	RTCM3_HEADER
@@ -99,9 +97,7 @@ int json_rtcm3_read(const char *buf,
 	{NULL},
     };
 #undef R1001
-    /*@+type@*/
 
-    /*@-type@*//* STRUCTARRAY confuses splint */
 #define R1002	&rtcm3->rtcmtypes.rtcm3_1002.header
     const struct json_attr_t json_rtcm1002[] = {
 	RTCM3_HEADER
@@ -115,9 +111,7 @@ int json_rtcm3_read(const char *buf,
 	{NULL},
     };
 #undef R1002
-    /*@+type@*/
 
-    /*@-type@*//* STRUCTARRAY confuses splint */
 #define R1007	rtcm3->rtcmtypes.rtcm3_1007
     const struct json_attr_t json_rtcm1007[] = {
 	RTCM3_HEADER
@@ -128,9 +122,7 @@ int json_rtcm3_read(const char *buf,
 	{NULL},
     };
 #undef R1002
-    /*@+type@*/
 
-    /*@-type@*//* STRUCTARRAY confuses splint */
 #define R1008	rtcm3->rtcmtypes.rtcm3_1008
     const struct json_attr_t json_rtcm1008[] = {
 	RTCM3_HEADER
@@ -143,9 +135,7 @@ int json_rtcm3_read(const char *buf,
 	{NULL},
     };
 #undef R1008
-    /*@+type@*/
 
-    /*@-type@*//* STRUCTARRAY confuses splint */
 #define R1009	&rtcm3->rtcmtypes.rtcm3_1009.header
     const struct json_attr_t json_rtcm1009[] = {
 	RTCM3_HEADER
@@ -159,9 +149,7 @@ int json_rtcm3_read(const char *buf,
 	{NULL},
     };
 #undef R1010
-    /*@+type@*/
 
-    /*@-type@*//* STRUCTARRAY confuses splint */
 #define R1010	&rtcm3->rtcmtypes.rtcm3_1010.header
     const struct json_attr_t json_rtcm1010[] = {
 	RTCM3_HEADER
@@ -175,9 +163,7 @@ int json_rtcm3_read(const char *buf,
 	{NULL},
     };
 #undef R1010
-    /*@+type@*/
 
-    /*@-type@*//* STRUCTARRAY confuses splint */
 #define R1014	&rtcm3->rtcmtypes.rtcm3_1014
     const struct json_attr_t json_rtcm1014[] = {
 	RTCM3_HEADER
@@ -192,9 +178,7 @@ int json_rtcm3_read(const char *buf,
 	{NULL},
     };
 #undef R1014
-    /*@+type@*/
 
-    /*@-type@*//* STRUCTARRAY confuses splint */
 #define R1033	rtcm3->rtcmtypes.rtcm3_1033
     const struct json_attr_t json_rtcm1033[] = {
 	RTCM3_HEADER
@@ -211,9 +195,7 @@ int json_rtcm3_read(const char *buf,
 	{NULL},
     };
 #undef R1033
-    /*@+type@*/
 
-    /*@-type@*//* complex union array initislizations confuses splint */
     const struct json_attr_t json_rtcm3_fallback[] = {
 	RTCM3_HEADER
 	{"data",     t_array, .addr.array.element_type = t_string,
@@ -224,8 +206,6 @@ int json_rtcm3_read(const char *buf,
 	                             .addr.array.maxlen = NITEMS(stringptrs)},
 	{NULL},
     };
-    /*@+type@*/
-    /*@ +fullinitblock @*/
 
 #undef RTCM3_HEADER
 /* *INDENT-ON* */
diff --git a/sd_socket.c b/sd_socket.c
index 8d5b7d8a..8c8c7719 100644
--- a/sd_socket.c
+++ b/sd_socket.c
@@ -5,9 +5,7 @@
 
 #include <limits.h>
 #include <stdlib.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif
 
 #include "sd_socket.h"
 
diff --git a/serial.c b/serial.c
index 7dc5fb99..a85a4ffb 100644
--- a/serial.c
+++ b/serial.c
@@ -11,16 +11,11 @@
 #include <string.h>
 #include <fcntl.h>
 #include <errno.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
 #include <sys/socket.h>
-#endif /* S_SPLINT_S */
 #include <sys/param.h>	/* defines BSD */
 
 #include "gpsd_config.h"
-#ifdef S_SPLINT_S
-#undef ENABLE_BLUEZ
-#endif /* S_SPLINT_S */
 #ifdef ENABLE_BLUEZ
 #include <bluetooth/bluetooth.h>
 #include <bluetooth/hci.h>
@@ -244,9 +239,7 @@ int gpsd_get_stopbits(const struct gps_device_t *dev)
 
 bool gpsd_set_raw(struct gps_device_t * session)
 {
-#ifndef S_SPLINT_S
     (void)cfmakeraw(&session->ttyset);
-#endif /* S_SPLINT_S */
     if (tcsetattr(session->gpsdata.gps_fd, TCIOFLUSH, &session->ttyset) == -1) {
 	gpsd_log(&session->context->errout, LOG_ERROR,
 		 "error changing port attributes: %s\n", strerror(errno));
@@ -303,12 +296,10 @@ void gpsd_set_speed(struct gps_device_t *session,
 	 * get packet lock within 1.5 seconds.  Alas, the BSDs and OS X
 	 * aren't so nice.
 	 */
-	/*@ignore@*/
 	if (rate != B0) {
 	    (void)cfsetispeed(&session->ttyset, rate);
 	    (void)cfsetospeed(&session->ttyset, rate);
 	}
-	/*@end@*/
 	session->ttyset.c_iflag &= ~(PARMRK | INPCK);
 	session->ttyset.c_cflag &= ~(CSIZE | CSTOPB | PARENB | PARODD);
 	session->ttyset.c_cflag |= (stopbits == 2 ? CS7 | CSTOPB : CS8);
@@ -428,7 +419,6 @@ int gpsd_serial_open(struct gps_device_t *session)
 	return PLACEHOLDING_FD;
     }
 
-    /*@ -boolops -type @*/
     if (session->context->readonly
 	|| (session->sourcetype <= source_blockdev)) {
 	mode = (mode_t) O_RDONLY;
@@ -440,7 +430,6 @@ int gpsd_serial_open(struct gps_device_t *session)
 		 "opening GPS data source type %d at '%s'\n",
 		 (int)session->sourcetype, session->gpsdata.dev.path);
     }
-    /*@ +boolops +type @*/
 #ifdef ENABLE_BLUEZ
     if (bachk(session->gpsdata.dev.path) == 0) {
         struct sockaddr_rc addr = { 0, *BDADDR_ANY, 0};
@@ -536,8 +525,8 @@ int gpsd_serial_open(struct gps_device_t *session)
 #endif
 
     if (session->saved_baud != -1) {
-	/*@i@*/(void)cfsetispeed(&session->ttyset, (speed_t)session->saved_baud);
-	/*@i@*/(void)cfsetospeed(&session->ttyset, (speed_t)session->saved_baud);
+	(void)cfsetispeed(&session->ttyset, (speed_t)session->saved_baud);
+	(void)cfsetospeed(&session->ttyset, (speed_t)session->saved_baud);
 	(void)tcsetattr(session->gpsdata.gps_fd, TCSANOW, &session->ttyset);
 	(void)tcflush(session->gpsdata.gps_fd, TCIOFLUSH);
     }
@@ -549,10 +538,8 @@ int gpsd_serial_open(struct gps_device_t *session)
 	    return UNALLOCATED_FD;
 	(void)memcpy(&session->ttyset,
 		     &session->ttyset_old, sizeof(session->ttyset));
-	/*@ ignore @*/
 	memset(session->ttyset.c_cc, 0, sizeof(session->ttyset.c_cc));
 	//session->ttyset.c_cc[VTIME] = 1;
-	/*@ end @*/
 	/*
 	 * Tip from Chris Kuethe: the FIDI chip used in the Trip-Nav
 	 * 200 (and possibly other USB GPSes) gets completely hosed
@@ -709,10 +696,8 @@ void gpsd_close(struct gps_device_t *session)
 	(void)tcdrain(session->gpsdata.gps_fd);
 	if (isatty(session->gpsdata.gps_fd) != 0) {
 	    /* force hangup on close on systems that don't do HUPCL properly */
-	    /*@ ignore @*/
 	    (void)cfsetispeed(&session->ttyset, (speed_t) B0);
 	    (void)cfsetospeed(&session->ttyset, (speed_t) B0);
-	    /*@ end @*/
 	    (void)tcsetattr(session->gpsdata.gps_fd, TCSANOW,
 			    &session->ttyset);
 	}
@@ -729,12 +714,10 @@ void gpsd_close(struct gps_device_t *session)
 	     * If we revert, keep the most recent baud rate.
 	     * Cuts down on autobaud overhead the next time.
 	     */
-	    /*@ ignore @*/
 	    (void)cfsetispeed(&session->ttyset_old,
 			      (speed_t) session->gpsdata.dev.baudrate);
 	    (void)cfsetospeed(&session->ttyset_old,
 			      (speed_t) session->gpsdata.dev.baudrate);
-	    /*@ end @*/
 	    (void)tcsetattr(session->gpsdata.gps_fd, TCSANOW,
 			    &session->ttyset_old);
 	}
diff --git a/shared_json.c b/shared_json.c
index 5605e319..a1589421 100644
--- a/shared_json.c
+++ b/shared_json.c
@@ -24,11 +24,10 @@ PERMISSIONS
 #include "gps_json.h"
 
 int json_device_read(const char *buf,
-		     /*@out@*/ struct devconfig_t *dev,
-		     /*@null@*/ const char **endptr)
+		     struct devconfig_t *dev,
+		     const char **endptr)
 {
     char tbuf[JSON_DATE_MAX+1];
-    /*@ -fullinitblock @*/
     /* *INDENT-OFF* */
     const struct json_attr_t json_attrs_device[] = {
 	{"class",      t_check,      .dflt.check = "DEVICE"},
@@ -58,7 +57,6 @@ int json_device_read(const char *buf,
 	{NULL},
     };
     /* *INDENT-ON* */
-    /*@ +fullinitblock @*/
     int status;
 
     tbuf[0] = '\0';
@@ -66,24 +64,21 @@ int json_device_read(const char *buf,
     if (status != 0)
 	return status;
 
-    /*@-usedef@*/
     if (isnan(dev->activated)!=0) {
 	if (tbuf[0] == '\0')
 	    dev->activated = NAN;
 	else
 	    dev->activated = iso8601_to_unix(tbuf);
     }
-    /*@+usedef@*/
 
     return 0;
 }
 
 int json_watch_read(const char *buf,
-		    /*@out@*/ struct policy_t *ccp,
-		    /*@null@*/ const char **endptr)
+		    struct policy_t *ccp,
+		    const char **endptr)
 {
     bool dummy_pps_flag;
-    /*@ -fullinitblock @*/
     /* *INDENT-OFF* */
     struct json_attr_t chanconfig_attrs[] = {
 	{"class",          t_check,    .dflt.check = "WATCH"},
@@ -109,7 +104,6 @@ int json_watch_read(const char *buf,
 	{NULL},
     };
     /* *INDENT-ON* */
-    /*@ +fullinitblock @*/
     int status;
 
     status = json_read_object(buf, chanconfig_attrs, endptr);
diff --git a/shmexport.c b/shmexport.c
index b4283671..6e7dc274 100644
--- a/shmexport.c
+++ b/shmexport.c
@@ -30,14 +30,11 @@ PERMISSIONS
 #include "gpsd.h"
 #include "libgps.h" /* for SHM_PSEUDO_FD */
 
-/*@ -mustfreeonly -nullstate -mayaliasunique @*/
 
 bool shm_acquire(struct gps_context_t *context)
 /* initialize the shared-memory segment to be used for export */
 {
-    /*@-nullpass@*/
     long shmkey = getenv("GPSD_SHM_KEY") ? strtol(getenv("GPSD_SHM_KEY"), NULL, 0) : GPSD_SHM_KEY;
-    /*@+nullpass@*/
 
     int shmid = shmget((key_t)shmkey, sizeof(struct gps_data_t), (int)(IPC_CREAT|0666));
     if (shmid == -1) {
@@ -107,7 +104,6 @@ void shm_update(struct gps_context_t *context, struct gps_data_t *gpsdata)
     }
 }
 
-/*@ +mustfreeonly +nullstate +mayaliasunique @*/
 
 #endif /* SHM_EXPORT_ENABLE */
 
diff --git a/srecord.c b/srecord.c
index afbbefa5..49aba590 100644
--- a/srecord.c
+++ b/srecord.c
@@ -89,7 +89,6 @@ void hexdump(size_t len, unsigned char *bbuf, unsigned char *abuf)
     }
 }
 
-/*@ -type @*/
 unsigned char hc(unsigned char x)
 {
     switch (x) {
@@ -117,7 +116,6 @@ unsigned char hc(unsigned char x)
     }
 }
 
-/*@ -type @*/
 
 unsigned char
 sr_sum(unsigned int count, unsigned int addr, unsigned char *bbuf)
diff --git a/strfuncs.h b/strfuncs.h
index e38305b6..7ea136fb 100644
--- a/strfuncs.h
+++ b/strfuncs.h
@@ -14,14 +14,14 @@
 #include "compiler.h"
 
 
-static /*@unused@*/ inline bool str_starts_with(const char *str, const char *prefix)
+static inline bool str_starts_with(const char *str, const char *prefix)
 {
     return strncmp(str, prefix, strlen(prefix)) == 0;
 }
 
 
 PRINTF_FUNC(3, 4)
-static /*@unused@*/ inline void str_appendf(char *str, size_t alloc_size, const char *format, ...)
+static inline void str_appendf(char *str, size_t alloc_size, const char *format, ...)
 {
     va_list ap;
     va_start(ap, format);
@@ -30,13 +30,13 @@ static /*@unused@*/ inline void str_appendf(char *str, size_t alloc_size, const
 }
 
 
-static /*@unused@*/ inline void str_vappendf(char *str, size_t alloc_size, const char *format, va_list ap)
+static inline void str_vappendf(char *str, size_t alloc_size, const char *format, va_list ap)
 {
     (void) vsnprintf(str + strlen(str), alloc_size - strlen(str), format, ap);
 }
 
 
-static /*@unused@*/ inline void str_rstrip_char(char *str, char ch)
+static inline void str_rstrip_char(char *str, char ch)
 {
     if (strlen(str) != 0 && str[strlen(str) - 1] == ch) {
         str[strlen(str) - 1] = '\0';
diff --git a/strl.c b/strl.c
index d5a81415..49d0a0fe 100644
--- a/strl.c
+++ b/strl.c
@@ -20,7 +20,6 @@
  * Returns strlen(src) + MIN(siz, strlen(initial dst)).
  * If retval >= siz, truncation occurred.
  */
-/*@ -compdef -mayaliasunique -mustdefine @*/
 size_t strlcat(char *dst, const char *src, size_t siz)
 {
     size_t slen = strlen(src);
@@ -35,7 +34,6 @@ size_t strlcat(char *dst, const char *src, size_t siz)
     }
     return dlen + slen;
 }
-/*@ +compdef +mayaliasunique +mustdefine @*/
 
 #ifdef __UNUSED__
 /*	$OpenBSD: strlcat.c,v 1.13 2005/08/08 08:05:37 espie Exp $	*/
@@ -56,7 +54,6 @@ size_t strlcat(char *dst, const char *src, size_t siz)
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/*@ -usedef -mustdefine @*/
 size_t strlcat(char *dst, const char *src, size_t siz)
 {
     char *d = dst;
@@ -84,7 +81,6 @@ size_t strlcat(char *dst, const char *src, size_t siz)
     return (dlen + (s - src));	/* count does not include NUL */
 }
 #endif /* __UNUSED__ */
-/*@ +usedef +mustdefine @*/
 #endif /* HAVE_STRLCAT */
 
 #ifndef HAVE_STRLCPY
@@ -93,7 +89,6 @@ size_t strlcat(char *dst, const char *src, size_t siz)
  * will be copied.  Always NUL terminates (unless siz == 0).
  * Returns strlen(src); if retval >= siz, truncation occurred.
  */
-/*@ -mayaliasunique -mustdefine @*/
 size_t strlcpy(char *dst, const char *src, size_t siz)
 {
     size_t len = strlen(src);
@@ -106,7 +101,6 @@ size_t strlcpy(char *dst, const char *src, size_t siz)
     }
     return len;
 }
-/*@ -mayaliasunique -mustdefine @*/
 
 #ifdef __UNUSED__
 /*	$OpenBSD: strlcpy.c,v 1.11 2006/05/05 15:27:38 millert Exp $	*/
diff --git a/subframe.c b/subframe.c
index df5fa7e8..58afa53d 100644
--- a/subframe.c
+++ b/subframe.c
@@ -10,7 +10,6 @@
 /* convert unsigned to signed */
 #define uint2int( u, bit) ( (u & (1<<(bit-1))) ? u - (1<<bit) : u)
 
-/*@ -usedef @*/
 gps_mask_t gpsd_interpret_subframe_raw(struct gps_device_t *session,
 				unsigned int tSVID, uint32_t words[])
 {
@@ -90,9 +89,8 @@ static void subframe_almanac(const struct gpsd_errout_t *errout,
 			     uint8_t tSVID, uint32_t words[],
 			     uint8_t subframe, uint8_t sv,
 			     uint8_t data_id,
-			     /*@out@*/struct almanac_t *almp)
+			     struct almanac_t *almp)
 {
-    /*@+matchanyintegral -shiftimplementation@*/
     almp->sv     = sv; /* ignore the 0 sv problem for now */
     almp->e      = ( words[2] & 0x00FFFF);
     almp->d_eccentricity  = pow(2.0,-21) * almp->e;
@@ -142,7 +140,6 @@ static void subframe_almanac(const struct gpsd_errout_t *errout,
 	     almp->d_M0,
 	     almp->d_af0,
 	     almp->d_af1);
-    /*@-matchanyintegral -shiftimplementation@*/
 }
 
 gps_mask_t gpsd_interpret_subframe(struct gps_device_t *session,
@@ -419,7 +416,6 @@ gps_mask_t gpsd_interpret_subframe(struct gps_device_t *session,
 		/* NMCT */
 		sv = -1;
 		subp->sub4_13.ai      = (unsigned char)((words[2] >> 22) & 0x000003);
-		/*@+charint@*/
 		subp->sub4_13.ERD[1]  = (char)((words[2] >>  8) & 0x00003F);
 		subp->sub4_13.ERD[2]  = (char)((words[2] >>  2) & 0x00003F);
 		subp->sub4_13.ERD[3]  = (char)((words[2] >>  0) & 0x000003);
@@ -475,7 +471,6 @@ gps_mask_t gpsd_interpret_subframe(struct gps_device_t *session,
 		for ( i = 1; i < 31; i++ ) {
 		    subp->sub4_13.ERD[i]  = uint2int(subp->sub4_13.ERD[i], 6);
 		}
-		/*@-charint@*/
 
 		gpsd_log(&session->context->errout, LOG_PROG,
 			 "50B: SF:4-13 data_id %d ai:%u "
@@ -630,7 +625,6 @@ gps_mask_t gpsd_interpret_subframe(struct gps_device_t *session,
 		 * and shifted the data to a byte boundary, we can just
 		 * copy it out. */
 
-		/*@ -type @*/
 		i = 0;
 		subp->sub4_17.str[i++] = (words[2] >> 8) & 0xff;
 		subp->sub4_17.str[i++] = (words[2]) & 0xff;
@@ -662,7 +656,6 @@ gps_mask_t gpsd_interpret_subframe(struct gps_device_t *session,
 		subp->sub4_17.str[i++] = (words[9] >> 16) & 0xff;
 		subp->sub4_17.str[i++] = (words[9] >> 8) & 0xff;
 		subp->sub4_17.str[i] = '\0';
-		/*@ +type @*/
 		gpsd_log(&session->context->errout, LOG_PROG,
 			 "50B: SF:4-17 system message: %.24s\n",
 			 subp->sub4_17.str);
@@ -846,4 +839,3 @@ gps_mask_t gpsd_interpret_subframe(struct gps_device_t *session,
     return SUBFRAME_SET;
 }
 
-/*@ +usedef @*/
diff --git a/test_bits.c b/test_bits.c
index 7977e027..a1a04ba4 100644
--- a/test_bits.c
+++ b/test_bits.c
@@ -12,7 +12,6 @@
 #include <stdbool.h>
 #include "bits.h"
 
-/*@ -duplicatequals -formattype */
 static unsigned char buf[80];
 static signed char sb1, sb2;
 static unsigned char ub1, ub2;
@@ -25,19 +24,17 @@ static uint64_t uL1, uL2;
 static float f1;
 static double d1;
 
-static char /*@ observer @*/ *hexdump(const void *binbuf, size_t len)
+static char *hexdump(const void *binbuf, size_t len)
 {
     static char hexbuf[BUFSIZ];
     size_t i, j = 0;
     const char *ibuf = (const char *)binbuf;
     const char *hexchar = "0123456789abcdef";
 
-    /*@ -shiftimplementation @*/
     for (i = 0; i < len; i++) {
 	hexbuf[j++] = hexchar[(ibuf[i] & 0xf0) >> 4];
 	hexbuf[j++] = hexchar[ibuf[i] & 0x0f];
     }
-    /*@ +shiftimplementation @*/
     hexbuf[j] = '\0';
     return hexbuf;
 }
@@ -111,13 +108,11 @@ struct unsigned_test
     char *description;
 };
 
-/*@ -duplicatequals +ignorequals @*/
 int main(int argc, char *argv[])
 {
     bool failures = false;
     bool quiet = (argc > 1) && (strcmp(argv[1], "--quiet") == 0);
 
-    /*@ -observertrans -usereleased @*/
     struct unsigned_test *up, unsigned_tests[] = {
 	/* tests using the big buffer */
 	{buf, 0,  1,  0,    false, "first bit of first byte"},
@@ -139,17 +134,14 @@ int main(int argc, char *argv[])
     memcpy(buf + 8, "\xff\xfe\xfd\xfc\xfb\xfa\xf9\xf8", 8);
     memcpy(buf + 16, "\x40\x09\x21\xfb\x54\x44\x2d\x18", 8);
     memcpy(buf + 24, "\x40\x49\x0f\xdb", 4);
-    /*@ +observertrans +usereleased @*/
 
     if (!quiet)
 	(void)printf("Testing bitfield extraction\n");
 
-    /*@-type@*/
     sb1 = getsb(buf, 0);
     sb2 = getsb(buf, 8);
     ub1 = getub(buf, 0);
     ub2 = getub(buf, 8);
-    /*@+type@*/
 
     if (!quiet) {
 	unsigned char *sp;
@@ -161,7 +153,6 @@ int main(int argc, char *argv[])
 
 	/* big-endian test */
 	printf("Big-endian:\n");
-	/*@-type@*/
 	sw1 = getbes16(buf, 0);
 	sw2 = getbes16(buf, 8);
 	uw1 = getbeu16(buf, 0);
@@ -176,12 +167,10 @@ int main(int argc, char *argv[])
 	uL2 = getbeu64(buf, 8);
 	f1 = getbef32((const char *)buf, 24);
 	d1 = getbed64((const char *)buf, 16);
-	/*@+type@*/
 	bedumpall();
 
 	/* little-endian test */
 	printf("Little-endian:\n");
-	/*@-type@*/
 	sw1 = getles16(buf, 0);
 	sw2 = getles16(buf, 8);
 	uw1 = getleu16(buf, 0);
@@ -196,7 +185,6 @@ int main(int argc, char *argv[])
 	uL2 = getleu64(buf, 8);
 	f1 = getlef32((const char *)buf, 24);
 	d1 = getled64((const char *)buf, 16);
-	/*@+type@*/
 	ledumpall();
     }
 
diff --git a/test_json.c b/test_json.c
index 0891df9d..d054e273 100644
--- a/test_json.c
+++ b/test_json.c
@@ -57,14 +57,12 @@ static void assert_uinteger(char *attr, uint fld, uint val)
 
 static void assert_boolean(char *attr, bool fld, bool val)
 {
-    /*@-boolcompare@*/
     if (fld != val) {
 	(void)fprintf(stderr,
 		      "'%s' boolean attribute eval failed, value = %s.\n",
 		      attr, fld ? "true" : "false");
 	exit(EXIT_FAILURE);
     }
-    /*@+boolcompare@*/
 }
 
 /*
@@ -81,7 +79,6 @@ static void assert_real(char *attr, double fld, double val)
     }
 }
 
-/*@ -fullinitblock @*/
 
 static struct gps_data_t gpsdata;
 
@@ -114,7 +111,6 @@ static char *stringptrs[3];
 static char stringstore[256];
 static int stringcount;
 
-/*@-type@*/
 static const struct json_array_t json_array_3 = {
     .element_type = t_string,
     .arr.strings.ptrs = stringptrs,
@@ -123,7 +119,6 @@ static const struct json_array_t json_array_3 = {
     .count = &stringcount,
     .maxlen = sizeof(stringptrs)/sizeof(stringptrs[0]),
 };
-/*@+type@*/
 
 /* Case 4: test defaulting of unspecified attributes */
 
@@ -167,7 +162,6 @@ struct dumbstruct_t {
 static struct dumbstruct_t dumbstruck[5];
 static int dumbcount;
 
-/*@-type@*/
 static const struct json_attr_t json_attrs_6_subtype[] = {
     {"name",  t_string,  .addr.offset = offsetof(struct dumbstruct_t, name),
                          .len = 64},
@@ -185,7 +179,6 @@ static const struct json_attr_t json_attrs_6[] = {
                        .addr.array.maxlen = sizeof(dumbstruck)/sizeof(dumbstruck[0])},
     {NULL},
 };
-/*@+type@*/
 
 /* Case 7: test parsing of version response */
 
@@ -218,14 +211,12 @@ static const char *json_str9 = "{\"parts\":[]}";
 static const char *json_str10 = "[23,-17,5]";
 static int intstore[4], intcount;
 
-/*@-type@*/
 static const struct json_array_t json_array_10 = {
     .element_type = t_integer,
     .arr.integers.store = intstore,
     .count = &intcount,
     .maxlen = sizeof(intstore)/sizeof(intstore[0]),
 };
-/*@+type@*/
 
 /* Case 11: Read array of booleans */
 
@@ -233,14 +224,12 @@ static const char *json_str11 = "[true,false,true]";
 static bool boolstore[4];
 static int boolcount;
 
-/*@-type@*/
 static const struct json_array_t json_array_11 = {
     .element_type = t_boolean,
     .arr.booleans.store = boolstore,
     .count = &boolcount,
     .maxlen = sizeof(boolstore)/sizeof(boolstore[0]),
 };
-/*@+type@*/
 
 /* Case 12: Read array of reals */
 
@@ -248,17 +237,14 @@ static const char *json_str12 = "[23.1,-17.2,5.3]";
 static double realstore[4]; 
 static int realcount;
 
-/*@-type@*/
 static const struct json_array_t json_array_12 = {
     .element_type = t_real,
     .arr.reals.store = realstore,
     .count = &realcount,
     .maxlen = sizeof(realstore)/sizeof(realstore[0]),
 };
-/*@+type@*/
 #endif /* JSON_MINIMAL */
 
-/*@ +fullinitblock @*/
 /* *INDENT-ON* */
 
 static void jsontest(int i)
diff --git a/test_libgps.c b/test_libgps.c
index 1d4bcc4e..e0958745 100644
--- a/test_libgps.c
+++ b/test_libgps.c
@@ -14,9 +14,7 @@
 
 #include "gpsd.h"
 
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 #include <getopt.h>
 #include <signal.h>
 
@@ -123,4 +121,3 @@ int main(int argc, char *argv[])
     return 0;
 }
 
-/*@-nullderef@*/
diff --git a/test_mktime.c b/test_mktime.c
index 0c3244c6..878812d8 100644
--- a/test_mktime.c
+++ b/test_mktime.c
@@ -10,7 +10,6 @@
 #include "gps.h"
 #include "compiler.h"
 
-/*@-type@*/
 static struct
 {
     struct tm t;
@@ -82,9 +81,7 @@ static struct
 	/* *INDENT-ON* */
 };
 
-/*@-type@*/
 
-/*@+longunsignedintegral*/
 int main(int argc UNUSED, char *argv[] UNUSED)
 {
     int i;
@@ -108,4 +105,5 @@ int main(int argc UNUSED, char *argv[] UNUSED)
     return (int)failed;
 }
 
-/*@-longunsignedintegral*/
+/* end */
+
diff --git a/test_packet.c b/test_packet.c
index e8f6e34e..3c27025c 100644
--- a/test_packet.c
+++ b/test_packet.c
@@ -9,9 +9,7 @@
 #include <ctype.h>
 #include <sys/types.h>
 #include <fcntl.h>
-#ifndef S_SPLINT_S
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "gpsd.h"
 
@@ -27,7 +25,6 @@ struct map
 };
 
 /* *INDENT-OFF* */
-/*@ -initallelements +charint -usedef @*/
 static struct map singletests[] = {
     /* NMEA tests */
     {
@@ -235,11 +232,9 @@ static struct map singletests[] = {
 	.type = RTCM3_PACKET,
     },
 };
-/*@ +initallelements -charint +usedef @*/
 /* *INDENT-ON* */
 
 /* *INDENT-OFF* */
-/*@ -initallelements +charint -usedef @*/
 static struct map runontests[] = {
     /* NMEA tests */
     {
@@ -250,20 +245,17 @@ static struct map runontests[] = {
 	NMEA_PACKET,
     },
 };
-/*@ +initallelements -charint +usedef @*/
 /* *INDENT-ON* */
 
 static int packet_test(struct map *mp)
 {
-    /*@-compdestroy@*/
     struct gps_lexer_t lexer;
     int failure = 0;
 
     lexer_init(&lexer);
     lexer.errout.debug = verbose;
-    /*@i@*/ memcpy(lexer.inbufptr = lexer.inbuffer, mp->test, mp->testlen);
+    memcpy(lexer.inbufptr = lexer.inbuffer, mp->test, mp->testlen);
     lexer.inbuflen = mp->testlen;
-    /*@ -compdef -uniondef -usedef -formatcode @*/
     packet_parse(&lexer);
     if (lexer.type != mp->type)
 	printf("%2zi: %s test FAILED (packet type %d wrong).\n",
@@ -276,13 +268,11 @@ static int packet_test(struct map *mp)
 	++failure;
     } else
 	printf("%2zi: %s test succeeded.\n", mp - singletests + 1,
-	       mp->legend);    /*@ +compdef +uniondef +usedef +formatcode @*/
+	       mp->legend);
 
     return failure;
-    /*@+compdestroy@*/
 }
 
-/*@ -compdef -uniondef -usedef -formatcode -compdestroy @*/
 static void runon_test(struct map *mp)
 {
     struct gps_lexer_t lexer;
@@ -291,7 +281,7 @@ static void runon_test(struct map *mp)
 
     lexer_init(&lexer);
     lexer.errout.debug = verbose;
-    /*@i@*/ memcpy(lexer.inbufptr = lexer.inbuffer, mp->test, mp->testlen);
+    memcpy(lexer.inbufptr = lexer.inbuffer, mp->test, mp->testlen);
     lexer.inbuflen = mp->testlen;
      (void)fputs(mp->test, stdout);
     do {
@@ -299,7 +289,6 @@ static void runon_test(struct map *mp)
 	//printf("packet_parse() returned %zd\n", st);
     } while (st > 0);
 }
-/*@ +compdef +uniondef +usedef +formatcode +compdestroy@*/
 
 static int property_check(void)
 {
diff --git a/timebase.c b/timebase.c
index c44ed372..cddd5915 100644
--- a/timebase.c
+++ b/timebase.c
@@ -205,9 +205,7 @@ void gpsd_time_init(struct gps_context_t *context, time_t starttime)
      * the timezone offset).  Avoid this and all manner of other local
      * time issues by telling the system we want times returned in UTC.
      */
-    /*@-observertrans@*/
     (void)putenv("TZ=UTC");
-    /*@+observertrans@*/
 
     /*
      * Provides a start time for getting the century.  Do this, just
@@ -262,7 +260,7 @@ void gpsd_set_century(struct gps_device_t *session)
 }
 
 #ifdef NMEA_ENABLE
-timestamp_t gpsd_utc_resolve(/*@in@*/struct gps_device_t *session)
+timestamp_t gpsd_utc_resolve(struct gps_device_t *session)
 /* resolve a UTC date, checking for rollovers */
 {
     /*
@@ -299,7 +297,7 @@ timestamp_t gpsd_utc_resolve(/*@in@*/struct gps_device_t *session)
     return t;
 }
 
-void gpsd_century_update(/*@in@*/struct gps_device_t *session, int century)
+void gpsd_century_update(struct gps_device_t *session, int century)
 {
     session->context->valid |= CENTURY_VALID;
     if (century > session->context->century) {
@@ -325,7 +323,7 @@ void gpsd_century_update(/*@in@*/struct gps_device_t *session, int century)
 }
 #endif /* NMEA_ENABLE */
 
-timestamp_t gpsd_gpstime_resolve(/*@in@*/struct gps_device_t *session,
+timestamp_t gpsd_gpstime_resolve(struct gps_device_t *session,
 			 unsigned short week, double tow)
 {
     timestamp_t t;
diff --git a/timehint.c b/timehint.c
index 154eb448..33d9f8b3 100644
--- a/timehint.c
+++ b/timehint.c
@@ -15,19 +15,9 @@
 #include <errno.h>
 #include <sys/types.h>
 #include <sys/stat.h>
-#ifdef S_SPLINT_S
-/*@-matchfields@*/
-struct timespec
-{
-  time_t tv_sec;
-  long tv_nsec;
-};
-/*@+matchfields@*/
-#else
 #include <sys/wait.h>
 #include <sys/socket.h>
 #include <unistd.h>
-#endif /* S_SPLINT_S */
 
 #include "timespec_str.h"
 #include "gpsd.h"
@@ -117,7 +107,7 @@ struct timespec
 
 #define PPS_MIN_FIXES	3	/* # fixes to wait for before shipping PPS */
 
-static /*@null@*/ volatile struct shmTime *getShmTime(struct gps_context_t *context, int unit)
+static volatile struct shmTime *getShmTime(struct gps_context_t *context, int unit)
 {
     int shmid;
     unsigned int perms;
@@ -146,7 +136,6 @@ static /*@null@*/ volatile struct shmTime *getShmTime(struct gps_context_t *cont
 	return NULL;
     }
     p = (struct shmTime *)shmat(shmid, 0, 0);
-    /*@ -mustfreefresh */
     if ((int)(long)p == -1) {
 	gpsd_log(&context->errout, LOG_ERROR,
 		 "NTPD shmat failed: %s\n",
@@ -157,7 +146,6 @@ static /*@null@*/ volatile struct shmTime *getShmTime(struct gps_context_t *cont
 	     "NTPD shmat(%d,0,0) succeeded, segment %d\n",
 	     shmid, unit);
     return p;
-    /*@ +mustfreefresh */
 }
 
 void ntpshm_context_init(struct gps_context_t *context)
@@ -174,8 +162,7 @@ void ntpshm_context_init(struct gps_context_t *context)
     memset(context->shmTimeInuse, 0, sizeof(context->shmTimeInuse));
 }
 
-/*@-unqualifiedtrans@*/
-static /*@null@*/ volatile struct shmTime *ntpshm_alloc(struct gps_context_t *context)
+static volatile struct shmTime *ntpshm_alloc(struct gps_context_t *context)
 /* allocate NTP SHM segment.  return its segment number, or -1 */
 {
     int i;
@@ -203,7 +190,6 @@ static /*@null@*/ volatile struct shmTime *ntpshm_alloc(struct gps_context_t *co
 
     return NULL;
 }
-/*@+unqualifiedtrans@*/
 
 static bool ntpshm_free(struct gps_context_t * context, volatile struct shmTime *s)
 /* free NTP SHM segment */
@@ -221,7 +207,6 @@ static bool ntpshm_free(struct gps_context_t * context, volatile struct shmTime
 
 void ntpshm_session_init(struct gps_device_t *session)
 {
-    /*@-mustfreeonly@*/
 #ifdef NTPSHM_ENABLE
     /* mark NTPD shared memory segments as unused */
     session->shm_clock = NULL;
@@ -229,7 +214,6 @@ void ntpshm_session_init(struct gps_device_t *session)
 #ifdef PPS_ENABLE
     session->shm_pps = NULL;
 #endif	/* PPS_ENABLE */
-    /*@+mustfreeonly@*/
 }
 
 int ntpshm_put(struct gps_device_t *session, volatile struct shmTime *shmseg, struct timedelta_t *td)
@@ -255,7 +239,6 @@ int ntpshm_put(struct gps_device_t *session, volatile struct shmTime *shmseg, st
 
     ntp_write(shmseg, td, precision, session->context->leap_notify);
 
-    /*@-type@*/ /* splint is confused about struct timespec */
     timespec_str( &td->real, real_str, sizeof(real_str) );
     timespec_str( &td->clock, clock_str, sizeof(clock_str) );
     gpsd_log(&session->context->errout, LOG_RAW,
@@ -263,7 +246,6 @@ int ntpshm_put(struct gps_device_t *session, volatile struct shmTime *shmseg, st
 	     session->gpsdata.dev.path,
 	     (precision == -20) ? "pps" : "clock", 
 	     real_str, clock_str);
-    /*@+type@*/
 
     return 1;
 }
@@ -280,7 +262,6 @@ struct sock_sample {
     int magic;      /* must be SOCK_MAGIC */
 };
 
-/*@-mustfreefresh@*/
 static void init_hook(struct gps_device_t *session)
 /* for chrony SOCK interface, which allows nSec timekeeping */
 {
@@ -317,7 +298,6 @@ static void init_hook(struct gps_device_t *session)
 		     session->gpsdata.dev.path, chrony_path);
     }
 }
-/*@+mustfreefresh@*/
 
 
 /* td is the real time and clock time of the edge */
@@ -346,8 +326,6 @@ static void chrony_send(struct gps_device_t *session, struct timedelta_t *td)
     sample.pulse = 0;
     sample.leap = leap_notify;
     sample.magic = SOCK_MAGIC;
-    /*@-compdef@*/
-    /*@-type@*//* splint is confused about struct timespec */
     /* chronyd wants a timeval, not a timspec, not to worry, it is
      * just the top of the second */
     TSTOTV(&sample.tv, &td->clock);
@@ -356,17 +334,13 @@ static void chrony_send(struct gps_device_t *session, struct timedelta_t *td)
     /* if tv_sec greater than 2 then tv_nsec loses precision, but
      * not a big deal as slewing will bbe required */
     sample.offset = TSTONS( &offset );
-    /*@+compdef@*/
     sample._pad = 0;
-    /*@+type@*/
 
-    /*@-type@*/ /* splint is confused about struct timespec */
     timespec_str( &td->real, real_str, sizeof(real_str) );
     timespec_str( &td->clock, clock_str, sizeof(clock_str) );
     gpsd_log(&session->context->errout, LOG_RAW,
 	     "PPS chrony_send %s @ %s Offset: %0.9f\n",
 	     real_str, clock_str, sample.offset);
-    /*@+type@*/
     (void)send(session->chronyfd, &sample, sizeof (sample), 0);
 }
 
@@ -377,7 +351,7 @@ static void wrap_hook(volatile struct pps_thread_t *pps_thread)
 	(void)close(session->chronyfd);
 }
 
-static /*@observer@*/ char *report_hook(volatile struct pps_thread_t *pps_thread,
+static char *report_hook(volatile struct pps_thread_t *pps_thread,
 					struct timedelta_t *td)
 /* ship the time of a PPS event to ntpd and/or chrony */
 {
@@ -411,7 +385,6 @@ static /*@observer@*/ char *report_hook(volatile struct pps_thread_t *pps_thread
 }
 #endif	/* PPS_ENABLE */
 
-/*@-mustfreeonly@*/
 void ntpshm_link_deactivate(struct gps_device_t *session)
 /* release ntpshm storage for a session */
 {
@@ -427,9 +400,7 @@ void ntpshm_link_deactivate(struct gps_device_t *session)
     }
 #endif	/* PPS_ENABLE */
 }
-/*@+mustfreeonly@*/
 
-/*@-mustfreeonly@*/
 void ntpshm_link_activate(struct gps_device_t *session)
 /* set up ntpshm storage for a session */
 {
@@ -461,7 +432,6 @@ void ntpshm_link_activate(struct gps_device_t *session)
 #endif /* PPS_ENABLE */
     }
 }
-/*@+mustfreeonly@*/
 
 #endif /* NTPSHM_ENABLE */
 /* end */
diff --git a/timespec_str.c b/timespec_str.c
index 6adadd7d..5af8a825 100644
--- a/timespec_str.c
+++ b/timespec_str.c
@@ -36,11 +36,10 @@
  * So 21 digits like this: "-2147483647.123456789"
  *
 */
-void timespec_str(const struct timespec *ts, /*@out@*/char *buf, size_t buf_size)
+void timespec_str(const struct timespec *ts, char *buf, size_t buf_size)
 {
     char sign = ' ';
 
-    /*@-type@*//* splint is confused about timespec*/
     if ( (0 > ts->tv_nsec ) || ( 0 > ts->tv_sec ) ) {
 	sign = '-';
     }
@@ -48,7 +47,6 @@ void timespec_str(const struct timespec *ts, /*@out@*/char *buf, size_t buf_size
 			  sign,
 			  (long)labs(ts->tv_sec),
 			  (long)labs(ts->tv_nsec));
-    /*@+type@*/
 }
 
 /* end */
diff --git a/timespec_str.h b/timespec_str.h
index 50651509..501c01f8 100644
--- a/timespec_str.h
+++ b/timespec_str.h
@@ -8,7 +8,7 @@
 
 #define TIMESPEC_LEN	22	/* required length of a timespec buffer */
 
-extern void timespec_str(const struct timespec *, /*@out@*/char *, size_t);
+extern void timespec_str(const struct timespec *, char *, size_t);
 
 #endif /* GPSD_TIMESPEC_H */
 
diff --git a/www/excellence.html b/www/excellence.html
index 890bcee7..bd793387 100644
--- a/www/excellence.html
+++ b/www/excellence.html
@@ -156,14 +156,17 @@ of test logs.  Almost every time a user fills out one of these, the
 number of devices for which we can guarantee good performance in the
 future goes up. Currently it's 87 devices from 39 vendors.</p>
 
-<p>We also routinely audit our code with <a
-href="http://www.splint.org/">splint</a>. Not many people do this,
-because splint is very finicky and a pain in the ass to use and
-requires you to litter your code with cryptic annotations. But I
-believe accepting that discipline is the main reason the Coverity scan
-went so well. After hacking through the underbrush of false positives,
-I generally find that splint heads off about two potentially serious
-bugs per release cycle, averaging out to about one every 17 weeks.</p>
+<!-- splint was dropped in March 2015 --> <p>We also used to routinely
+audit our code with <a href="http://www.splint.org/">splint</a>. Not
+many people do this, because splint is very finicky and a pain in the
+ass to use and requires you to litter your code with cryptic
+annotations. We stopped doing this because splint gave us randomly
+variable warnings across different Linux distributions, and has been
+obsolesced by newer static analyzers. But I believe accepting that
+discipline was the main reason the Coverity scan went so well. After
+hacking through the underbrush of false positives, I generally find
+that splint heads off about two potentially serious bugs per release
+cycle, averaging out to about one every 17 weeks.</p>
 
 <p>We have a policy of not using C where a scripting language will do.
 Python is what we mostly use, but not the actual point here (though I
diff --git a/www/hacking.html.in b/www/hacking.html.in
index 3e0bebb7..5c580b03 100644
--- a/www/hacking.html.in
+++ b/www/hacking.html.in
@@ -351,12 +351,6 @@ go through the following checklist:</p>
     include the test changes in your patch, and (c) <b>explain
     in detail why the regression broke</b> in your change comment.</li>
 
-<li>Check that the patched code displays no warnings when you run '<code>scons
-    splint</code>' (see <a href="http://www.splint.org">the Splint
-    website</a> for further description of this tool if you don't
-    already know about it). Yes, tweaking your code to be splint-clean is
-    a pain in the ass.  Experience shows it's worth it.</li>
-
 <li>After code changes that do anything to the storage handling, run
     valgrind-audit and look out for reports of memory leaks and other
     dynamic-allocation problems (see <a href="http://valgrind.org">the
@@ -369,11 +363,6 @@ on these to catch damaging side-effects of seemingly innocent but
 ill-thought-out changes, and to nail problems before they become
 user-visible.</p>
 
-<p>The reason we use splint is twofold: (1) it's good at catching
-static buffer overruns, and (2) <code>gpsd</code> does a lot of
-low-level bit-bashing that can be sensitive to 32-vs.-64-bit
-problems. Getting the code splint-clean tends to prevent these.</p>
-
 <p>If you are contributing a driver for a new GPS, please also do the
 following things:</p>
 
@@ -489,8 +478,7 @@ that type specifiers will default to int.</p>
 <p>You are allowed, but not required, to use C99 // comments.</p>
 
 <p>Though C99 allows it, do not intermix declarations with executable
-statements within a block, because that gives one of our code checkers
-the screaming fantods (splint dies with an internal error).  Do,
+statements within a block, that's too hard to read.  Do,
 however, declare variables at the front of the <em>smallest</em> enclosing
 block.</p>
 
@@ -545,8 +533,8 @@ is easier.<p>
 <ol>
 <li><p>Use asserts sparingly.</p></li>
 
-<li><p>One valid use is to pass hints to splint and other analyzers. This
-sort of assert should be guarded with #ifdef S_SPLINT_S or #ifdef
+<li><p>One valid use is to pass hints to sratic analyzers. This
+sort of assert should be guarded with, e.g., #ifdef
 __COVERITY_ so we get the benefit of asserting the invariant without
 the risk of the assertion failing in production.</p></li>
 
@@ -1119,7 +1107,7 @@ done.</p>
 
 <h2 id="newstyle">Points for style</h2>
 
-<p>Audit your code with splint and cppcheck (there are productions in
+<p>Audit your code with cppcheck and scan-build (there are productions in
 the SConstruct file).  Patches that are not just clean but properly
 annotated for static checking will give the maintainers warm
 fuzzy feelings and go right to the front of the queue.</p>
diff --git a/www/reliability.html b/www/reliability.html
index 420af53b..19e381e0 100644
--- a/www/reliability.html
+++ b/www/reliability.html
@@ -111,28 +111,27 @@ off hugely.</p>
 <h2>We use every fault scanner we can lay our hands on.</h2>
 
 <p>We regulary apply Coverity, <a
-href='http://www.splint.org'>splint</a>, <a
 href='http://sourceforge.net/apps/mediawiki/cppcheck/'>cppcheck</a>,
 and <a
 href="http://clang-analyzer.llvm.org/scan-build.html">scan-build</a>.
 We've as yet been unable to eliminate all scan-build warnings, but we
 require the code to audit clean under all the other tools on each
-release.</p>
+release. </p>
 
-<p>Of these, splint is (a) the oldest, (b) the second most effective
-after Coverity at turning up bugs, and (c) far and away the biggest
+<p>We used to use <a href='http://www.splint.org'>splint</a>, until 
+we found that we couldn't replicate the results of splint runs
+reliably in different Linux distributions. Also, far and away the biggest
 pain in the ass to use. You have to drop cryptic, cluttery magic
 comments all over your source to pass hints to splint and suppress its
-extremely voluminous and picky output. The thing is, splint checking
-turns up real bugs at a low but consistent rate - one or two each
-release cycle.</p>
+extremely voluminous and picky output. We have retired in favor of more
+modern analyzers.</p>
 
 <p>cppcheck is much newer and much less prone to false
 positives. Likewise scan-build. But here's what experience tells us:
-each of these four tools finds overlapping but different sets of
+each of these tools finds overlapping but different sets of
 bugs. Coverity is, by reputation at least, capable enough that it
 might dominate one or more of them - but why take chances? Best to use
-all four and constrain the population of undiscovered bugs into as
+all and constrain the population of undiscovered bugs into as
 small a fraction of the state space as we can.</p>
 
 <p>We also use <a href='http://valgrind.org/'>valgrind</a> to check