diff --git a/libr/cons/grep.c b/libr/cons/grep.c
index ec68c2d09c7b9..f6d1fad30e116 100644
--- a/libr/cons/grep.c
+++ b/libr/cons/grep.c
@@ -102,6 +102,9 @@ R_API void r_cons_grep_expression(RCons *cons, const char *str) {
 	}
 	RConsContext *ctx = cons->context;
 	RConsGrep *grep = &ctx->grep;
+	// reset dynamic tokens from previous grep expression
+	R_FREE (grep->tokens);
+	grep->tokens_count = 0;
 
 	size_t str_len = strlen (str);
 	size_t buf_len = str_len;
@@ -121,7 +124,14 @@ R_API void r_cons_grep_expression(RCons *cons, const char *str) {
 	memcpy (buf, str, buf_len);
 	buf[buf_len] = '\0';
 
-	char *ptrs[R_CONS_GREP_COUNT];
+	// split expression into sub-expressions separated by '~'
+	size_t ptrs_capacity = buf_len + 1;
+	char **ptrs = malloc (ptrs_capacity * sizeof (char *));
+	if (!ptrs) {
+		R_LOG_ERROR ("r_cons_grep: cannot allocate ptrs");
+		free (buf);
+		return;
+	}
 	size_t ptrs_length = 1;
 	ptrs[0] = buf;
 	char *ptr = buf;
@@ -131,10 +141,7 @@ R_API void r_cons_grep_expression(RCons *cons, const char *str) {
 		ptrs[ptrs_length]++;
 		ptr = ptrs[ptrs_length];
 		ptrs_length++;
-		if (ptrs_length >= R_CONS_GREP_COUNT) {
-			R_LOG_ERROR ("too many nested greps");
-			goto cleanup;
-		}
+		// no static limit: ptrs_capacity is sufficient for buf_len+1 splits
 	}
 
 	R_FREE (grep->str);
@@ -297,8 +304,9 @@ R_API void r_cons_grep_expression(RCons *cons, const char *str) {
 			ptr2++;
 			for (; ptr2 <= ptr3; ptr2++) {
 				if (fail) {
-					ZERO_FILL(grep->tokens);
-					grep->tokens_used = 0;
+					// reset dynamic tokens list on failure
+					R_FREE (grep->tokens);
+					grep->tokens_count = 0;
 					break;
 				}
 				switch (*ptr2) {
@@ -309,13 +317,16 @@ R_API void r_cons_grep_expression(RCons *cons, const char *str) {
 					break;
 				case ']': // fallthrough to handle ']' like ','
 				case ',':
+					// add range of token indices dynamically
 					for (; range_begin <= range_end; range_begin++) {
-						if (range_begin >= R_CONS_GREP_TOKENS) {
-							fail = true;
-							break;
+						int idx = (int)range_begin;
+						int *tmp = realloc (grep->tokens, (grep->tokens_count + 1) * sizeof (int));
+						if (!tmp) {
+							R_LOG_ERROR ("r_cons_grep: cannot allocate tokens");
+							goto cleanup;
 						}
-						grep->tokens[range_begin] = 1;
-						grep->tokens_used = 1;
+						grep->tokens = tmp;
+						grep->tokens[grep->tokens_count++] = idx;
 					}
 					if (*ptr2 == ']' && is_range && !num_is_parsed) {
 						num_is_parsed = true;
@@ -405,8 +416,9 @@ R_API void r_cons_grep_expression(RCons *cons, const char *str) {
 		r_list_append (grep->strings, gw);
 	}
 cleanup:
+	free (ptrs);
 	free (buf);
-}
+	}
 
 // Finds and returns next intgrep expression, unescapes escaped twiddles
 static char *find_next_intgrep(char *cmd, const char *quotes) {
@@ -1120,11 +1132,9 @@ R_API int r_cons_grep_line(char *buf, int len) {
 	RConsGrep *grep = &cons->context->grep;
 	const char *delims = " |,;=\t";
 	char *tok = NULL;
-	char *save_ptr = NULL;
 	bool hit = true;
 	int outlen = 0;
 	bool use_tok = false;
-	size_t i;
 
 	char *in = calloc (1, len + 1);
 	if (!in) {
@@ -1189,11 +1199,13 @@ R_API int r_cons_grep_line(char *buf, int len) {
 		} else {
 			use_tok = true;
 		}
-		if (use_tok && grep->tokens_used) {
-			for (i = 0; i < R_CONS_GREP_TOKENS; i++) {
-				tok = r_str_tok_r (i? NULL: in, delims, &save_ptr);
-				if (tok) {
-					if (grep->tokens[i]) {
+		if (use_tok && grep->tokens_count > 0) {
+			// dynamic tokens selection: pick only specified columns
+			char *save_ptr2 = NULL;
+			size_t k, tok_idx = 0;
+			while ((tok = r_str_tok_r (tok_idx? NULL: in, delims, &save_ptr2))) {
+				for (k = 0; k < grep->tokens_count; k++) {
+					if ((size_t)grep->tokens[k] == tok_idx) {
 						const size_t toklen = strlen (tok);
 						memcpy (out + outlen, tok, toklen);
 						memcpy (out + outlen + toklen, " ", 2);
@@ -1203,19 +1215,13 @@ R_API int r_cons_grep_line(char *buf, int len) {
 							free (out);
 							return -1;
 						}
-					}
-				} else {
-					if (*out) {
 						break;
 					}
-					free (in);
-					free (out);
-					return 0;
 				}
+				tok_idx++;
 			}
-			outlen = outlen > 0? outlen - 1: 0;
-			if (outlen > len) { // should never happen
-				R_LOG_ERROR ("r_cons_grep_line: wtf, how you reach this?");
+			outlen = outlen > 0 ? outlen - 1 : 0;
+			if (outlen > len) {
 				free (in);
 				free (out);
 				return -1;
diff --git a/libr/cons/kons.inc.c b/libr/cons/kons.inc.c
index 367f2f2e38487..651c9ee68b355 100644
--- a/libr/cons/kons.inc.c
+++ b/libr/cons/kons.inc.c
@@ -427,7 +427,7 @@ static bool lastMatters(RConsContext *C) {
 	}
 	return (C->buffer_len > 0 &&
 		(C->lastEnabled && !C->filter && r_list_empty (C->grep.strings)) \
-		&& !C->grep.tokens_used && !C->grep.less \
+		&& (C->grep.tokens_count == 0) && !C->grep.less \
 		&& !C->grep.json && !C->is_html);
 }
 
@@ -947,7 +947,7 @@ R_API const char *r_kons_get_buffer(RCons *cons, size_t *buffer_len) {
 R_API void r_kons_filter(RCons *cons) {
 	RConsContext *ctx = cons->context;
 	/* grep */
-	if (ctx->filter || ctx->grep.tokens_used \
+	if (ctx->filter || (ctx->grep.tokens_count > 0) \
 			|| (ctx->grep.strings && r_list_length (ctx->grep.strings) > 0) \
 			|| ctx->grep.less || ctx->grep.json) {
 		(void)r_kons_grepbuf (cons);
diff --git a/libr/include/r_anal.h b/libr/include/r_anal.h
index 3f9625dd33a37..3ffffd1b3a05f 100644
--- a/libr/include/r_anal.h
+++ b/libr/include/r_anal.h
@@ -275,12 +275,15 @@ typedef struct r_anal_function_meta_t {
 } RAnalFcnMeta;
 
 typedef struct r_anal_function_t {
-	// TODO R2_600 Use RBinName here
+#if R2_600
+	RBinName name;
+#else
 	char *name;
-	char *realname; // R2_590: add realname for the mangled one
+	char *realname;
+#endif
+        const char *callconv; // calling convention, should come from RAnal.constpool
 	int bits; // ((> bits 0) (set-bits bits))
 	int type;
-	const char *callconv; // calling convention, should come from RAnal.constpool
 	ut64 addr;
 	HtUP/*<ut64, char *>*/ *labels;
 	HtPP/*<char *, ut64 *>*/ *label_addrs;
diff --git a/libr/include/r_cons.h b/libr/include/r_cons.h
index 08c416c4bbe93..6f8c6f89ed41b 100644
--- a/libr/include/r_cons.h
+++ b/libr/include/r_cons.h
@@ -58,9 +58,9 @@ extern "C" {
 #define CONS_PALETTE_SIZE 22
 #define CONS_COLORS_SIZE 21
 
-// R2_600 - remove more limits
-#define R_CONS_GREP_TOKENS 64
-#define R_CONS_GREP_COUNT 10
+// Grep token and count limits removed: dynamic allocation used
+#undef R_CONS_GREP_TOKENS
+#undef R_CONS_GREP_COUNT
 
 R_LIB_VERSION_HEADER(r_cons);
 
@@ -121,8 +121,9 @@ typedef struct r_cons_grep_t {
 	bool sort_invert;
 	int f_line; //first line
 	int l_line; //last line
-	int tokens[R_CONS_GREP_TOKENS];
-	int tokens_used;
+	// dynamic list of token indices for column selection
+	int *tokens;           // allocated array of token indices
+	size_t tokens_count;    // number of tokens in array
 	int amp;
 	int zoom;
 	int zoomy; // if set then its scaled unproportionally
diff --git a/libr/util/sys.c b/libr/util/sys.c
index 17e4c3a923e41..385b45ef09f8b 100644
--- a/libr/util/sys.c
+++ b/libr/util/sys.c
@@ -1339,7 +1339,7 @@ R_API void r_sys_set_environ(char **e) {
 	env = e;
 }
 
-R_API char *r_sys_whoami(void) {
+R_API char * R_NONNULL r_sys_whoami(void) {
 #if R2__WINDOWS__
 	char buf[256];
 	DWORD buf_sz = sizeof (buf);
@@ -1395,7 +1395,7 @@ R_API int r_sys_getpid(void) {
 #endif
 }
 
-R_API bool r_sys_tts(const char *txt, bool bg) {
+R_API bool r_sys_tts(const char * R_NONNULL txt, bool bg) {
 	int i;
 	R_RETURN_VAL_IF_FAIL (txt, false);
 	const char *says[] = {
@@ -1442,7 +1442,7 @@ R_API const char *r_sys_prefix(const char *pfx) {
 	return prefix;
 }
 
-R_API RSysInfo *r_sys_info(void) {
+R_API RSysInfo * R_NULLABLE r_sys_info(void) {
 #if R2__UNIX__
 	struct utsname un = {{0}};
 	if (uname (&un) != -1) {
@@ -1512,7 +1512,7 @@ R_API RSysInfo *r_sys_info(void) {
 	return NULL;
 }
 
-R_API void r_sys_info_free(RSysInfo *si) {
+R_API void r_sys_info_free(RSysInfo * R_NULLABLE si) {
 	if (si) {
 		free (si->sysname);
 		free (si->nodename);
@@ -1525,35 +1525,23 @@ R_API void r_sys_info_free(RSysInfo *si) {
 
 // R2_590 r_sys_endian_tostring() // endian == R_SYS_ENDIAN_BIG "big" .. R_ARCH_CONFIG_IS_BIG_ENDIAN (core->rasm->config)? "big": "little"
 
-R_API R_MUSTUSE char *r_file_home(const char *str) {
-	char *dst, *home = r_sys_getenv (R_SYS_HOME);
-	size_t length;
+R_API R_MUSTUSE char * R_NULLABLE r_file_home(const char * R_NULLABLE str) {
+	char *home = r_sys_getenv (R_SYS_HOME);
 	if (!home) {
 		home = r_file_tmpdir ();
 		if (!home) {
 			return NULL;
 		}
 	}
-	length = strlen (home) + 1;
-	if (R_STR_ISNOTEMPTY (str)) {
-		length += strlen (R_SYS_DIR) + strlen (str);
+	if (R_STR_ISEMPTY (str)) {
+		return home;
 	}
-	dst = (char *)calloc (1, length);
-	if (!dst) {
-		goto fail;
-	}
-	int home_len = strlen (home);
-	memcpy (dst, home, home_len + 1);
-	if (R_STR_ISNOTEMPTY (str)) {
-		dst[home_len] = R_SYS_DIR[0];
-		strcpy (dst + home_len + 1, str);
-	}
-fail:
+	char *homepath = r_str_newf ("%s%s%s", home, R_SYS_DIR, str);
 	free (home);
-	return dst;
+	return homepath;
 }
 
-R_API R_MUSTUSE char *r_file_homef(const char *fmt, ...) {
+R_API R_MUSTUSE char * R_NULLABLE r_file_homef(const char * R_NONNULL fmt, ...) {
 	va_list ap;
 	va_start (ap, fmt);
 	char *r = r_str_newvf (fmt, ap);