diff --git a/h_malloc.c b/h_malloc.c
index fc95bd4..88ea764 100644
--- a/h_malloc.c
+++ b/h_malloc.c
@@ -429,7 +429,10 @@ static size_t get_free_slot(struct random_state *rng, size_t slots, const struct
             }
 
             i = i == (slots - 1) / U64_WIDTH ? 0 : i + 1;
-            masked = metadata->bitmap[i];
+            // false positive: i is bounded by the bitmap length since slots is limited to
+            // MAX_SLAB_SLOT_COUNT (256) and random_index is bounded by slots, but the
+            // analyzer can't see either bound across translation units
+            masked = metadata->bitmap[i]; // NOLINT(clang-analyzer-security.ArrayBound)
         }
     } else {
         for (size_t i = 0; i <= (slots - 1) / U64_WIDTH; i++) {
diff --git a/util.h b/util.h
index 72c28d8..7d5f648 100644
--- a/util.h
+++ b/util.h
@@ -48,7 +48,7 @@ typedef unsigned __int128 u128;
 #define U64_WIDTH 64
 
 static inline int ffz64(u64 x) {
-    return __builtin_ffsll(~x);
+    return __builtin_ffsll((int64_t) ~x);
 }
 
 // parameter must not be 0