diff --git a/changes/stack b/changes/stack
new file mode 100644
index 0000000000..ffdf536cb9
--- /dev/null
+++ b/changes/stack
@@ -0,0 +1,7 @@
+  o Minor bugfixes (correctness):
+    - Fix several places in our codebase where a C compiler would be likely
+      to eliminate a check, based on assuming that undefined behavior had not
+      happened elsewhere in the code.  These cases are usually a sign of
+      redundant checking, or dubious arithmetic. Found by Georg Koppen using
+      the "STACK" tool from Wang, Zeldovich, Kaashoek, and
+      Solar-Lezama. Fixes bug 24423; bugfix on various Tor versions.
diff --git a/src/common/sandbox.c b/src/common/sandbox.c
index 0fd129d22c..ba6c3efb9e 100644
--- a/src/common/sandbox.c
+++ b/src/common/sandbox.c
@@ -1393,10 +1393,6 @@ sandbox_cfg_allow_stat_filename(sandbox_cfg_t **cfg, char *file)
   sandbox_cfg_t *elem = NULL;
 
   elem = new_element(SCMP_stat, file);
-  if (!elem) {
-    log_err(LD_BUG,"(Sandbox) failed to register parameter!");
-    return -1;
-  }
 
   elem->next = *cfg;
   *cfg = elem;
@@ -1410,10 +1406,6 @@ sandbox_cfg_allow_open_filename(sandbox_cfg_t **cfg, char *file)
   sandbox_cfg_t *elem = NULL;
 
   elem = new_element(SCMP_SYS(open), file);
-  if (!elem) {
-    log_err(LD_BUG,"(Sandbox) failed to register parameter!");
-    return -1;
-  }
 
   elem->next = *cfg;
   *cfg = elem;
@@ -1427,10 +1419,6 @@ sandbox_cfg_allow_chmod_filename(sandbox_cfg_t **cfg, char *file)
   sandbox_cfg_t *elem = NULL;
 
   elem = new_element(SCMP_SYS(chmod), file);
-  if (!elem) {
-    log_err(LD_BUG,"(Sandbox) failed to register parameter!");
-    return -1;
-  }
 
   elem->next = *cfg;
   *cfg = elem;
@@ -1444,10 +1432,6 @@ sandbox_cfg_allow_chown_filename(sandbox_cfg_t **cfg, char *file)
   sandbox_cfg_t *elem = NULL;
 
   elem = new_element(SCMP_SYS(chown), file);
-  if (!elem) {
-    log_err(LD_BUG,"(Sandbox) failed to register parameter!");
-    return -1;
-  }
 
   elem->next = *cfg;
   *cfg = elem;
@@ -1462,11 +1446,6 @@ sandbox_cfg_allow_rename(sandbox_cfg_t **cfg, char *file1, char *file2)
 
   elem = new_element2(SCMP_SYS(rename), file1, file2);
 
-  if (!elem) {
-    log_err(LD_BUG,"(Sandbox) failed to register parameter!");
-    return -1;
-  }
-
   elem->next = *cfg;
   *cfg = elem;
 
@@ -1479,10 +1458,6 @@ sandbox_cfg_allow_openat_filename(sandbox_cfg_t **cfg, char *file)
   sandbox_cfg_t *elem = NULL;
 
   elem = new_element(SCMP_SYS(openat), file);
-  if (!elem) {
-    log_err(LD_BUG,"(Sandbox) failed to register parameter!");
-    return -1;
-  }
 
   elem->next = *cfg;
   *cfg = elem;
diff --git a/src/or/rephist.c b/src/or/rephist.c
index 87b5a93713..345722d8ce 100644
--- a/src/or/rephist.c
+++ b/src/or/rephist.c
@@ -1811,7 +1811,7 @@ static time_t last_prediction_add_time=0;
 int
 predicted_ports_prediction_time_remaining(time_t now)
 {
-  time_t idle_delta = now - last_prediction_add_time;
+  time_t idle_delta;
 
   /* Protect against overflow of return value. This can happen if the clock
    * jumps backwards in time. Update the last prediction time (aka last
@@ -1821,6 +1821,8 @@ predicted_ports_prediction_time_remaining(time_t now)
   if (last_prediction_add_time > now) {
     last_prediction_add_time = now;
     idle_delta = 0;
+  } else {
+    idle_delta = now - last_prediction_add_time;
   }
 
   /* Protect against underflow of the return value. This can happen for very
diff --git a/src/or/transports.c b/src/or/transports.c
index 68d1354844..5fb24e11a0 100644
--- a/src/or/transports.c
+++ b/src/or/transports.c
@@ -1094,8 +1094,6 @@ parse_smethod_line(const char *line, managed_proxy_t *mp)
 
   transport = transport_new(&tor_addr, port, method_name,
                             PROXY_NONE, args_string);
-  if (!transport)
-    goto err;
 
   smartlist_add(mp->transports, transport);
 
@@ -1186,8 +1184,6 @@ parse_cmethod_line(const char *line, managed_proxy_t *mp)
   }
 
   transport = transport_new(&tor_addr, port, method_name, socks_ver, NULL);
-  if (!transport)
-    goto err;
 
   smartlist_add(mp->transports, transport);