diff --git a/usr.sbin/eeprom/eehandlers.c b/usr.sbin/eeprom/eehandlers.c
index 2db604d2410f..7e1f21bc2050 100644
--- a/usr.sbin/eeprom/eehandlers.c
+++ b/usr.sbin/eeprom/eehandlers.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: eehandlers.c,v 1.2 1996/02/28 01:13:22 thorpej Exp $	*/
+/*	$NetBSD: eehandlers.c,v 1.3 1997/04/13 13:36:46 mrg Exp $	*/
 
 /*-
  * Copyright (c) 1996 The NetBSD Foundation, Inc.
@@ -411,7 +411,7 @@ ee_diagpath(ktent, arg)
 	if (arg) {
 		if (strlen(arg) > sizeof(path))
 			BARF(ktent);
-		sprintf(path, arg);
+		memcpy(path, arg, sizeof path);
 		if (doio(ktent, (u_char *)&path[0], sizeof(path), IO_WRITE))
 			FAILEDWRITE(ktent);
 	} else
@@ -434,13 +434,13 @@ ee_banner(ktent, arg)
 	kt.kt_offset = EE_BANNER_ENABLE_LOC;
 	kt.kt_handler = ee_notsupp;
 
-	bzero(string, sizeof(string));
+	memset(string, '\0', sizeof(string));
 	if (arg) {
 		if (strlen(arg) > sizeof(string))
 			BARF(ktent);
 		if (*arg != '\0') {
 			enable = EE_TRUE;
-			sprintf(string, arg);
+			memcpy(string, arg, sizeof string);
 			if (doio(ktent, (u_char *)string,
 			    sizeof(string), IO_WRITE))
 				FAILEDWRITE(ktent);
@@ -495,28 +495,28 @@ doio(ktent, buf, len, wr)
 
 	buf2 = (u_char *)calloc(1, len);
 	if (buf2 == NULL) {
-		sprintf(err_str, "memory allocation failed");
+		memcpy(err_str, "memory allocation failed", sizeof err_str);
 		return (1);
 	}
 
 	fd = open(path_eeprom, wr == IO_WRITE ? O_RDWR : O_RDONLY, 0640);
 	if (fd < 0) {
-		sprintf(err_str, "open: %s: %s", path_eeprom,
+		(void)snprintf(err_str, sizeof err_str, "open: %s: %s", path_eeprom,
 		    strerror(errno));
 		free(buf2);
 		return (1);
 	}
 
 	if (lseek(fd, (off_t)ktent->kt_offset, SEEK_SET) < (off_t)0) {
-		sprintf(err_str, "lseek: %s:", path_eeprom,
-		    strerror(errno));
+		(void)snprintf(err_str, sizeof err_str, "lseek: %s:",
+		    path_eeprom, strerror(errno));
 		rval = 1;
 		goto done;
 	}
 
 	if (read(fd, buf2, len) != len) {
-		sprintf(err_str, "read: %s: %s", path_eeprom,
-		     strerror(errno));
+		(void)snprintf(err_str, sizeof err_str, "read: %s: %s",
+		    path_eeprom, strerror(errno));
 		return (1);
 	}
 
@@ -525,16 +525,16 @@ doio(ktent, buf, len, wr)
 			goto done;
 
 		if (lseek(fd, (off_t)ktent->kt_offset, SEEK_SET) < (off_t)0) {
-			sprintf(err_str, "lseek: %s: %s", path_eeprom,
-			     strerror(errno));
+			(void)snprintf(err_str, sizeof err_str, "lseek: %s: %s",
+			    path_eeprom, strerror(errno));
 			rval = 1;
 			goto done;
 		}
 
 		++update_checksums;
 		if (write(fd, buf, len) < 0) {
-			sprintf(err_str, "write: %s: %s", path_eeprom,
-			     strerror(errno));
+			(void)snprintf(err_str, sizeof err_str, "write: %s: %s",
+			    path_eeprom, strerror(errno));
 			rval = 1;
 			goto done;
 		}
diff --git a/usr.sbin/eeprom/ophandlers.c b/usr.sbin/eeprom/ophandlers.c
index 628033bcc5b0..49a38c69f16c 100644
--- a/usr.sbin/eeprom/ophandlers.c
+++ b/usr.sbin/eeprom/ophandlers.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ophandlers.c,v 1.2 1996/02/28 01:13:30 thorpej Exp $	*/
+/*	$NetBSD: ophandlers.c,v 1.3 1997/04/13 13:36:49 mrg Exp $	*/
 
 /*-
  * Copyright (c) 1996 The NetBSD Foundation, Inc.
@@ -70,7 +70,7 @@ static	struct extabent opextab[] = {
 };
 
 #define BARF(str1, str2) {						\
-	sprintf(err_str, "%s: %s", (str1), (str2));			\
+	snprintf(err_str, sizeof err_str, "%s: %s", (str1), (str2));	\
 	++eval;								\
 	return (err_str);						\
 };
@@ -145,8 +145,8 @@ op_handler(keyword, arg)
 			BARF("OPIOCGET", strerror(errno));
 
 		if (opio.op_buflen <= 0) {
-			sprintf(err_str, "nothing available for %s",
-			    keyword);
+			(void)snprintf(err_str, sizeof err_str,
+			    "nothing available for %s", keyword);
 			return (err_str);
 		}
 
@@ -227,7 +227,7 @@ op_dump()
 		 * of opio1.  If the length of the name is 0, there
 		 * are no more properties left.
 		 */
-		sprintf(opio2.op_name, opio1.op_buf);
+		strcpy(opio2.op_name, opio1.op_buf);	/* XXX strcpy is safe */
 		opio2.op_namelen = strlen(opio2.op_name);
 
 		if (opio2.op_namelen == 0) {
@@ -256,7 +256,7 @@ op_dump()
 		 */
 		bzero(opio1.op_name, sizeof(buf1));
 		bzero(opio1.op_buf, sizeof(buf2));
-		sprintf(opio1.op_name, opio2.op_name);
+		strcpy(opio1.op_name, opio2.op_name);	/* XXX strcpy is safe */
 	}
 	/* NOTREACHED */
 }
diff --git a/usr.sbin/mtrace/mtrace.c b/usr.sbin/mtrace/mtrace.c
index 81f4c0943719..b27c141854ef 100644
--- a/usr.sbin/mtrace/mtrace.c
+++ b/usr.sbin/mtrace/mtrace.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: mtrace.c,v 1.6 1995/12/16 20:11:45 thorpej Exp $	*/
+/*	$NetBSD: mtrace.c,v 1.7 1997/04/13 13:42:05 mrg Exp $	*/
 
 /*
  * mtrace.c
@@ -52,7 +52,7 @@
 
 #ifndef lint
 static char rcsid[] =
-    "@(#) $NetBSD: mtrace.c,v 1.6 1995/12/16 20:11:45 thorpej Exp $";
+    "@(#) $NetBSD: mtrace.c,v 1.7 1997/04/13 13:42:05 mrg Exp $";
 #endif
 
 #include <netdb.h>
@@ -238,7 +238,7 @@ proto_type(type)
       case PROTO_CBT:
 	return ("CBT");
       default:
-	(void) sprintf(buf, "Unknown protocol code %d", type);
+	(void)snprintf(buf, sizeof buf, "Unknown protocol code %d", type);
 	return (buf);
     }
 }
@@ -270,7 +270,7 @@ flag_type(type)
       case TR_NO_SPACE:
 	return ("No space in packet");
       default:
-	(void) sprintf(buf, "Unknown error code %d", type);
+	(void)snprintf(buf, sizeof buf, "Unknown error code %d", type);
 	return (buf);
     }
 }    
@@ -916,14 +916,14 @@ stat_line(r, s, have_next, rst)
 	if (v_out) v_pct = (v_lost * 100 + (v_out >> 1)) / v_out;
 	else v_pct = 0;
 	if (-100 < v_pct && v_pct < 101 && v_out > 10)
-	  sprintf(v_str, "%3d", v_pct);
+	  (void)snprintf(v_str, sizeof v_str, "%3d", v_pct);
 	else memcpy(v_str, " --", 4);
 
 	g_lost = g_out - (ntohl(s->tr_pktcnt) - ntohl(r->tr_pktcnt));
 	if (g_out) g_pct = (g_lost * 100 + (g_out >> 1))/ g_out;
 	else g_pct = 0;
 	if (-100 < g_pct && g_pct < 101 && g_out > 10)
-	  sprintf(g_str, "%3d", g_pct);
+	  (void)snprintf(g_str, sizeof g_str, "%3d", g_pct);
 	else memcpy(g_str, " --", 4);
 
 	printf("%6d/%-5d=%s%%%4d pps",
diff --git a/usr.sbin/sliplogin/sliplogin.c b/usr.sbin/sliplogin/sliplogin.c
index 25fa9e02e413..bfd1a7538077 100644
--- a/usr.sbin/sliplogin/sliplogin.c
+++ b/usr.sbin/sliplogin/sliplogin.c
@@ -39,7 +39,7 @@ char copyright[] =
 
 #ifndef lint
 /*static char sccsid[] = "from: @(#)sliplogin.c	5.6 (Berkeley) 3/2/91";*/
-static char rcsid[] = "$Id: sliplogin.c,v 1.11 1995/06/19 22:52:25 jtc Exp $";
+static char rcsid[] = "$Id: sliplogin.c,v 1.12 1997/04/13 13:42:16 mrg Exp $";
 #endif /* not lint */
 
 /*
@@ -114,7 +114,7 @@ findid(name)
 	char user[16];
 	int i, j, n;
 
-	(void)strcpy(loginname, name);
+	(void)strncpy(loginname, name, sizeof(loginname) - 1);
 	if ((fp = fopen(_PATH_ACCESS, "r")) == NULL) {
 		syslog(LOG_ERR, "%s: %m\n", _PATH_ACCESS);
 		err(1, "%s", _PATH_ACCESS);
@@ -136,9 +136,10 @@ findid(name)
 		 * one specific to this host.  If none found, try for
 		 * a generic one.
 		 */
-		(void)sprintf(loginfile, "%s.%s", _PATH_LOGIN, name);
+		(void)snprintf(loginfile, sizeof loginfile, "%s.%s",
+		    _PATH_LOGIN, name);
 		if (access(loginfile, R_OK|X_OK) != 0) {
-			(void)strcpy(loginfile, _PATH_LOGIN);
+			(void)strncpy(loginfile, _PATH_LOGIN, sizeof(loginfile) - 1);
 			if (access(loginfile, R_OK|X_OK)) {
 				fputs("access denied - no login file\n",
 				      stderr);
@@ -165,7 +166,8 @@ sigstr(s)
 		return(sys_signame[s]);
 	else {
 		static char buf[32];
-		(void)sprintf(buf, "sig %d", s);
+
+		(void)snprintf(buf, sizeof buf, "sig %d", s);
 		return(buf);
 	}
 }
@@ -176,14 +178,15 @@ hup_handler(s)
 {
 	char logoutfile[MAXPATHLEN];
 
-	(void)sprintf(logoutfile, "%s.%s", _PATH_LOGOUT, loginname);
+	(void)snprintf(logoutfile, sizeof logoutfile, "%s.%s", _PATH_LOGOUT,
+	    loginname);
 	if (access(logoutfile, R_OK|X_OK) != 0)
-		(void)strcpy(logoutfile, _PATH_LOGOUT);
+		(void)strncpy(logoutfile, _PATH_LOGOUT, sizeof(logoutfile) - 1);
 	if (access(logoutfile, R_OK|X_OK) == 0) {
 		char logincmd[2*MAXPATHLEN+32];
 
-		(void) sprintf(logincmd, "%s %d %d %s", logoutfile, unit, speed,
-			      loginargs);
+		(void)snprintf(logincmd, sizeof logincmd, "%s %d %d %s",
+		    logoutfile, unit, speed, loginargs);
 		(void) system(logincmd);
 	}
 	(void) close(0);
@@ -315,8 +318,8 @@ main(argc, argv)
 	(void) signal(SIGTERM, hup_handler);
 
 	syslog(LOG_INFO, "attaching slip unit %d for %s\n", unit, loginname);
-	(void)sprintf(logincmd, "%s %d %d %s", loginfile, unit, speed,
-		      loginargs);
+	(void)snprintf(logincmd, sizeof logincmd, "%s %d %d %s", loginfile,
+	    unit, speed, loginargs);
 	/*
 	 * aim stdout and errout at /dev/null so logincmd output won't
 	 * babble into the slip tty line.