diff --git a/examples/all-clusters-app/linux/AllClustersCommandDelegate.cpp b/examples/all-clusters-app/linux/AllClustersCommandDelegate.cpp
index 1dd6a389abbba8..503bab4f001066 100644
--- a/examples/all-clusters-app/linux/AllClustersCommandDelegate.cpp
+++ b/examples/all-clusters-app/linux/AllClustersCommandDelegate.cpp
@@ -245,8 +245,12 @@ void AllClustersAppCommandHandler::OnSoftwareFaultEventHandler(uint32_t eventId)
     softwareFault.name.SetValue(CharSpan::fromCharString(threadName));
 
     std::time_t result = std::time(nullptr);
-    char * asctime     = std::asctime(std::localtime(&result));
-    softwareFault.faultRecording.SetValue(ByteSpan(Uint8::from_const_char(asctime), strlen(asctime)));
+    // Using size of 50 as it is double the expected 25 characters "Www Mmm dd hh:mm:ss yyyy\n".
+    char timeChar[50];
+    if (std::strftime(timeChar, sizeof(timeChar), "%c", std::localtime(&result)))
+    {
+        softwareFault.faultRecording.SetValue(ByteSpan(Uint8::from_const_char(timeChar), strlen(timeChar)));
+    }
 
     Clusters::SoftwareDiagnosticsServer::Instance().OnSoftwareFaultDetect(softwareFault);
 }
diff --git a/examples/chip-tool/commands/common/Command.cpp b/examples/chip-tool/commands/common/Command.cpp
index c1d62793024ef7..64bea6faf81486 100644
--- a/examples/chip-tool/commands/common/Command.cpp
+++ b/examples/chip-tool/commands/common/Command.cpp
@@ -321,7 +321,8 @@ bool Command::InitArgument(size_t argIndex, char * argValue)
             // (e.g a struct argument with multiple fields). In case one needs to use ";" it can be overriden with the following
             // environment variable.
             constexpr const char * kSeparatorVariable = "CHIPTOOL_CUSTOM_ARGUMENTS_SEPARATOR";
-            getline(ss, valueAsString, getenv(kSeparatorVariable) ? getenv(kSeparatorVariable)[0] : ';');
+            char * getenvSeparatorVariableResult      = getenv(kSeparatorVariable);
+            getline(ss, valueAsString, getenvSeparatorVariableResult ? getenvSeparatorVariableResult[0] : ';');
 
             CustomArgument * customArgument = new CustomArgument();
             vectorArgument->push_back(customArgument);
diff --git a/examples/common/websocket-server/WebSocketServer.cpp b/examples/common/websocket-server/WebSocketServer.cpp
index f5bbd973d407c9..46f9a63c9a7034 100644
--- a/examples/common/websocket-server/WebSocketServer.cpp
+++ b/examples/common/websocket-server/WebSocketServer.cpp
@@ -110,20 +110,21 @@ static int OnWebSocketCallback(lws * wsi, lws_callback_reasons reason, void * us
 {
     LogWebSocketCallbackReason(reason);
 
-    WebSocketServer * server = nullptr;
-    auto protocol            = lws_get_protocol(wsi);
-    if (protocol)
+    if (LWS_CALLBACK_RECEIVE == reason)
     {
+        WebSocketServer * server = nullptr;
+        auto protocol            = lws_get_protocol(wsi);
+        if (!protocol)
+        {
+            ChipLogError(chipTool, "Failed to retrieve the protocol.");
+            return -1;
+        }
         server = static_cast<WebSocketServer *>(protocol->user);
         if (nullptr == server)
         {
             ChipLogError(chipTool, "Failed to retrieve the server interactive context.");
             return -1;
         }
-    }
-
-    if (LWS_CALLBACK_RECEIVE == reason)
-    {
         char msg[kMaxMessageBufferLen + 1 /* for null byte */] = {};
         VerifyOrDie(sizeof(msg) > len);
         memcpy(msg, in, len);
diff --git a/examples/platform/linux/AppMain.cpp b/examples/platform/linux/AppMain.cpp
index bdfa8eba2f428e..00463f4f970c69 100644
--- a/examples/platform/linux/AppMain.cpp
+++ b/examples/platform/linux/AppMain.cpp
@@ -413,8 +413,10 @@ void ChipLinuxAppMainLoop(AppMainLoopImplementation * impl)
     ApplicationInit();
 
 #if !defined(ENABLE_CHIP_SHELL)
+    // NOLINTBEGIN(bugprone-signal-handler)
     signal(SIGINT, StopSignalHandler);
     signal(SIGTERM, StopSignalHandler);
+    // NOLINTEND(bugprone-signal-handler)
 #endif // !defined(ENABLE_CHIP_SHELL)
 
     if (impl != nullptr)
diff --git a/scripts/setup/clang.json b/scripts/setup/clang.json
index a1f1e6d449e5b6..5c09ee6798672f 100644
--- a/scripts/setup/clang.json
+++ b/scripts/setup/clang.json
@@ -2,8 +2,12 @@
     "packages": [
         {
             "path": "fuchsia/third_party/clang/mac-arm64",
-            "platforms": ["mac-arm64"],
-            "tags": ["git_revision:3a20597776a5d2920e511d81653b4d2b6ca0c855"]
+            "platforms": [
+                "mac-arm64"
+            ],
+            "tags": [
+                "git_revision:6d667d4b261e81f325756fdfd5bb43b3b3d2451d"
+            ]
         }
     ]
 }
diff --git a/src/access/AccessControl.h b/src/access/AccessControl.h
index 7ed2d5809f007c..5c8dc929bd64a2 100644
--- a/src/access/AccessControl.h
+++ b/src/access/AccessControl.h
@@ -78,36 +78,28 @@ class AccessControl
             virtual void Release() {}
 
             // Simple getters
-            virtual CHIP_ERROR GetAuthMode(AuthMode & authMode) const { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR GetFabricIndex(FabricIndex & fabricIndex) const { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR GetPrivilege(Privilege & privilege) const { return CHIP_NO_ERROR; }
+            virtual CHIP_ERROR GetAuthMode(AuthMode & authMode) const { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR GetFabricIndex(FabricIndex & fabricIndex) const { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR GetPrivilege(Privilege & privilege) const { return CHIP_ERROR_NOT_IMPLEMENTED; }
 
             // Simple setters
-            virtual CHIP_ERROR SetAuthMode(AuthMode authMode) { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR SetFabricIndex(FabricIndex fabricIndex) { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR SetPrivilege(Privilege privilege) { return CHIP_NO_ERROR; }
+            virtual CHIP_ERROR SetAuthMode(AuthMode authMode) { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR SetFabricIndex(FabricIndex fabricIndex) { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR SetPrivilege(Privilege privilege) { return CHIP_ERROR_NOT_IMPLEMENTED; }
 
             // Subjects
-            virtual CHIP_ERROR GetSubjectCount(size_t & count) const
-            {
-                count = 0;
-                return CHIP_NO_ERROR;
-            }
-            virtual CHIP_ERROR GetSubject(size_t index, NodeId & subject) const { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR SetSubject(size_t index, NodeId subject) { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR AddSubject(size_t * index, NodeId subject) { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR RemoveSubject(size_t index) { return CHIP_NO_ERROR; }
+            virtual CHIP_ERROR GetSubjectCount(size_t & count) const { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR GetSubject(size_t index, NodeId & subject) const { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR SetSubject(size_t index, NodeId subject) { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR AddSubject(size_t * index, NodeId subject) { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR RemoveSubject(size_t index) { return CHIP_ERROR_NOT_IMPLEMENTED; }
 
             // Targets
-            virtual CHIP_ERROR GetTargetCount(size_t & count) const
-            {
-                count = 0;
-                return CHIP_NO_ERROR;
-            }
-            virtual CHIP_ERROR GetTarget(size_t index, Target & target) const { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR SetTarget(size_t index, const Target & target) { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR AddTarget(size_t * index, const Target & target) { return CHIP_NO_ERROR; }
-            virtual CHIP_ERROR RemoveTarget(size_t index) { return CHIP_NO_ERROR; }
+            virtual CHIP_ERROR GetTargetCount(size_t & count) const { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR GetTarget(size_t index, Target & target) const { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR SetTarget(size_t index, const Target & target) { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR AddTarget(size_t * index, const Target & target) { return CHIP_ERROR_NOT_IMPLEMENTED; }
+            virtual CHIP_ERROR RemoveTarget(size_t index) { return CHIP_ERROR_NOT_IMPLEMENTED; }
         };
 
         Entry() = default;
diff --git a/src/access/tests/TestAccessControl.cpp b/src/access/tests/TestAccessControl.cpp
index 9691c7296257b1..a7a62fa3a8894c 100644
--- a/src/access/tests/TestAccessControl.cpp
+++ b/src/access/tests/TestAccessControl.cpp
@@ -1906,8 +1906,8 @@ void TestPrepareEntry(nlTestSuite * inSuite, void * inContext)
             {
                 NL_TEST_ASSERT(inSuite, accessControl.PrepareEntry(entry) == CHIP_NO_ERROR);
 
-                size_t subjectCount;
-                size_t targetCount;
+                size_t subjectCount = 0;
+                size_t targetCount  = 0;
 
                 NL_TEST_ASSERT(inSuite, entry.GetSubjectCount(subjectCount) == CHIP_NO_ERROR);
                 NL_TEST_ASSERT(inSuite, entry.GetTargetCount(targetCount) == CHIP_NO_ERROR);
diff --git a/src/app/EventManagement.cpp b/src/app/EventManagement.cpp
index e6abcc8b5721ad..ccc7e89e3953b2 100644
--- a/src/app/EventManagement.cpp
+++ b/src/app/EventManagement.cpp
@@ -185,6 +185,8 @@ CHIP_ERROR EventManagement::EnsureSpaceInCircularBuffer(size_t aRequiredSpace, P
         }
     }
 
+    VerifyOrExit(eventBuffer != nullptr, err = CHIP_ERROR_INCORRECT_STATE);
+
     // check whether we actually need to do anything, exit if we don't
     VerifyOrExit(requiredSpace > eventBuffer->AvailableDataLength(), err = CHIP_NO_ERROR);
 
diff --git a/src/controller/CHIPDeviceController.cpp b/src/controller/CHIPDeviceController.cpp
index 5b27cc358429ce..968decbeb9849a 100644
--- a/src/controller/CHIPDeviceController.cpp
+++ b/src/controller/CHIPDeviceController.cpp
@@ -868,7 +868,12 @@ DeviceCommissioner::ContinueCommissioningAfterDeviceAttestation(DeviceProxy * de
         return CHIP_ERROR_INCORRECT_STATE;
     }
     CommissioneeDeviceProxy * commissioneeDevice = FindCommissioneeDevice(device->GetDeviceId());
-    if (commissioneeDevice == nullptr || !commissioneeDevice->IsSecureConnected() || commissioneeDevice != mDeviceBeingCommissioned)
+    if (commissioneeDevice == nullptr)
+    {
+        ChipLogError(Controller, "Couldn't find commissionee device");
+        return CHIP_ERROR_INCORRECT_STATE;
+    }
+    if (!commissioneeDevice->IsSecureConnected() || commissioneeDevice != mDeviceBeingCommissioned)
     {
         ChipLogError(Controller, "Invalid device for commissioning after attestation failure: 0x" ChipLogFormatX64,
                      ChipLogValueX64(commissioneeDevice->GetDeviceId()));
diff --git a/src/controller/python/chip/native/CommonStackInit.cpp b/src/controller/python/chip/native/CommonStackInit.cpp
index 8a149412a73944..eb62dd90c0131b 100644
--- a/src/controller/python/chip/native/CommonStackInit.cpp
+++ b/src/controller/python/chip/native/CommonStackInit.cpp
@@ -56,6 +56,7 @@ struct __attribute__((packed)) PyCommonStackInitParams
 void pychip_CauseCrash()
 {
     uint8_t * ptr = nullptr;
+    // NOLINTNEXTLINE(clang-analyzer-core.NullDereference): Intentionally trying to cause crash.
     *ptr          = 0;
 }
 
diff --git a/src/credentials/tests/TestGroupDataProvider.cpp b/src/credentials/tests/TestGroupDataProvider.cpp
index 17b71ff7a5c788..1a56e7bf3f8b94 100644
--- a/src/credentials/tests/TestGroupDataProvider.cpp
+++ b/src/credentials/tests/TestGroupDataProvider.cpp
@@ -1174,6 +1174,12 @@ void TestGroupDecryption(nlTestSuite * apSuite, void * apContext)
             std::pair<FabricIndex, GroupId> found(session.fabric_index, session.group_id);
             NL_TEST_ASSERT(apSuite, expected.count(found) > 0);
             NL_TEST_ASSERT(apSuite, session.keyContext != nullptr);
+            // Assert aboves doesn't actually exit, we call continue so that we can call it->Release() outside of
+            // loop.
+            if (session.keyContext == nullptr)
+            {
+                continue;
+            }
 
             // Decrypt the ciphertext
             NL_TEST_ASSERT(apSuite,
diff --git a/src/inet/tests/TestInetEndPoint.cpp b/src/inet/tests/TestInetEndPoint.cpp
index 09aeba6bf3ae13..4f5eba1a84bd36 100644
--- a/src/inet/tests/TestInetEndPoint.cpp
+++ b/src/inet/tests/TestInetEndPoint.cpp
@@ -41,6 +41,7 @@
 #include <lib/support/CHIPArgParser.hpp>
 #include <lib/support/CHIPMem.h>
 #include <lib/support/CodeUtils.h>
+#include <lib/support/UnitTestContext.h>
 #include <lib/support/UnitTestRegistration.h>
 
 #include <system/SystemError.h>
@@ -256,12 +257,12 @@ static void TestInetEndPointInternal(nlTestSuite * inSuite, void * inContext)
     // init all the EndPoints
     SYSTEM_STATS_RESET(System::Stats::kInetLayer_NumUDPEps);
     err = gUDP.NewEndPoint(&testUDPEP);
-    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, err == CHIP_NO_ERROR);
     NL_TEST_ASSERT(inSuite, SYSTEM_STATS_TEST_IN_USE(System::Stats::kInetLayer_NumUDPEps, 1));
 
     SYSTEM_STATS_RESET(System::Stats::kInetLayer_NumTCPEps);
     err = gTCP.NewEndPoint(&testTCPEP1);
-    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, err == CHIP_NO_ERROR);
     NL_TEST_ASSERT(inSuite, SYSTEM_STATS_TEST_IN_USE(System::Stats::kInetLayer_NumUDPEps, 1));
 
     err = InterfaceId::Null().GetLinkLocalAddr(&addr);
@@ -308,7 +309,7 @@ static void TestInetEndPointInternal(nlTestSuite * inSuite, void * inContext)
     NL_TEST_ASSERT(inSuite, SYSTEM_STATS_TEST_HIGH_WATER_MARK(System::Stats::kInetLayer_NumUDPEps, 1));
 
     err = gUDP.NewEndPoint(&testUDPEP);
-    NL_TEST_ASSERT(inSuite, err == CHIP_NO_ERROR);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, err == CHIP_NO_ERROR);
     NL_TEST_ASSERT(inSuite, SYSTEM_STATS_TEST_IN_USE(System::Stats::kInetLayer_NumUDPEps, 1));
 #if INET_CONFIG_ENABLE_IPV4
     err = testUDPEP->Bind(IPAddressType::kIPv4, addr_v4, 3000, intId);
diff --git a/src/lib/core/TLVReader.cpp b/src/lib/core/TLVReader.cpp
index 3c5e3e9c2a8f69..f03fc1b3cdac27 100644
--- a/src/lib/core/TLVReader.cpp
+++ b/src/lib/core/TLVReader.cpp
@@ -313,6 +313,11 @@ CHIP_ERROR TLVReader::Get(CharSpan & v)
 
     const uint8_t * bytes;
     ReturnErrorOnFailure(GetDataPtr(bytes)); // Does length sanity checks
+    if (bytes == nullptr)
+    {
+        // Calling memchr further down with bytes == nullptr would have undefined behaviour, exiting early.
+        return CHIP_NO_ERROR;
+    }
 
     uint32_t len = GetLength();
 
@@ -335,6 +340,11 @@ CHIP_ERROR TLVReader::Get(Optional<LocalizedStringIdentifier> & lsid)
 
     const uint8_t * bytes;
     ReturnErrorOnFailure(GetDataPtr(bytes)); // Does length sanity checks
+    if (bytes == nullptr)
+    {
+        // Calling memchr further down with bytes == nullptr would have undefined behaviour, exiting early.
+        return CHIP_NO_ERROR;
+    }
 
     uint32_t len = GetLength();
 
diff --git a/src/lib/core/tests/TestCHIPErrorStr.cpp b/src/lib/core/tests/TestCHIPErrorStr.cpp
index 87c0967e385c47..6686f8f1bfcf34 100644
--- a/src/lib/core/tests/TestCHIPErrorStr.cpp
+++ b/src/lib/core/tests/TestCHIPErrorStr.cpp
@@ -38,6 +38,7 @@
 
 #include <lib/core/CHIPError.h>
 #include <lib/support/ErrorStr.h>
+#include <lib/support/UnitTestContext.h>
 #include <lib/support/UnitTestRegistration.h>
 
 #include <nlunit-test.h>
@@ -199,7 +200,7 @@ static void CheckCoreErrorStr(nlTestSuite * inSuite, void * inContext)
 #if CHIP_CONFIG_ERROR_SOURCE
         // GetFile() should be relative to ${chip_root}
         char const * const file = err.GetFile();
-        NL_TEST_ASSERT(inSuite, file != nullptr);
+        NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, file != nullptr);
         NL_TEST_ASSERT(inSuite, strstr(file, "src/lib/core/") == file);
 #endif // CHIP_CONFIG_ERROR_SOURCE
     }
diff --git a/src/lib/support/ReferenceCountedHandle.h b/src/lib/support/ReferenceCountedHandle.h
index 2a54e17b3c9ba2..726e780e2c698d 100644
--- a/src/lib/support/ReferenceCountedHandle.h
+++ b/src/lib/support/ReferenceCountedHandle.h
@@ -26,6 +26,12 @@ class ReferenceCountedHandle
 {
 public:
     explicit ReferenceCountedHandle(Target & target) : mTarget(target) { mTarget.Retain(); }
+
+    // Ideally we would suppress this from within Optional.h, where this false positive is coming from. That said suppressing
+    // here is okay since no other cases could create instance of ReferenceCountedHandle without going through explicit
+    // contstructor.
+    //
+    // NOLINTNEXTLINE(clang-analyzer-core.CallAndMessage): Only in a false positive is mTarget uninitialized.
     ~ReferenceCountedHandle() { mTarget.Release(); }
 
     ReferenceCountedHandle(const ReferenceCountedHandle & that) : mTarget(that.mTarget) { mTarget.Retain(); }
diff --git a/src/lib/support/UnitTestContext.h b/src/lib/support/UnitTestContext.h
index d1a22e4885d2a2..01ad5d29d71cb6 100644
--- a/src/lib/support/UnitTestContext.h
+++ b/src/lib/support/UnitTestContext.h
@@ -23,6 +23,31 @@
 #include <lib/support/CHIPMem.h>
 #include <lib/support/CodeUtils.h>
 
+/**
+ *  @def NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, inCondition)
+ *
+ *  @brief
+ *    This is used to assert the results of a conditional check
+ *    through out a test in a test suite.
+ *
+ *  @param[in]    inSuite      A pointer to the test suite the assertion
+ *                             should be accounted against.
+ *  @param[in]    inCondition  Code for the logical predicate to be checked
+ *                             for truth. If the condition fails, the
+ *                             assertion fails.
+ *
+ */
+#define NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, inCondition)                                                                        \
+    do                                                                                                                             \
+    {                                                                                                                              \
+        NL_TEST_ASSERT(inSuite, inCondition);                                                                                      \
+                                                                                                                                   \
+        if (!(inCondition))                                                                                                        \
+        {                                                                                                                          \
+            return;                                                                                                                \
+        }                                                                                                                          \
+    } while (0)
+
 namespace chip {
 
 /// Performs a memory Init/Shutdown in a controlled manner
diff --git a/src/lib/support/Variant.h b/src/lib/support/Variant.h
index 1752c21780fbaa..a95e8dca06237a 100644
--- a/src/lib/support/Variant.h
+++ b/src/lib/support/Variant.h
@@ -225,6 +225,10 @@ struct Variant
         return *reinterpret_cast<const T *>(&mData);
     }
 
+    // Ideally we would suppress this from within Optional.h, where this false positive is coming from. That said suppressing
+    // here is okay since mTypeId would seemingly only be uninitialized when Variant is in a union.
+    //
+    // NOLINTNEXTLINE(clang-analyzer-core.CallAndMessage): Only in a false positive is mTypeId uninitialized.
     ~Variant() { Curry::Destroy(mTypeId, &mData); }
 };
 
diff --git a/src/lib/support/tests/TestCHIPMem.cpp b/src/lib/support/tests/TestCHIPMem.cpp
index 2473a211e2f0ff..fdc203ce3c92a3 100644
--- a/src/lib/support/tests/TestCHIPMem.cpp
+++ b/src/lib/support/tests/TestCHIPMem.cpp
@@ -31,6 +31,7 @@
 
 #include <lib/support/CHIPMem.h>
 #include <lib/support/CodeUtils.h>
+#include <lib/support/UnitTestContext.h>
 #include <lib/support/UnitTestRegistration.h>
 #include <nlunit-test.h>
 
@@ -76,7 +77,7 @@ static void TestMemAlloc_Malloc(nlTestSuite * inSuite, void * inContext)
 static void TestMemAlloc_Calloc(nlTestSuite * inSuite, void * inContext)
 {
     char * p = static_cast<char *>(MemoryCalloc(128, true));
-    NL_TEST_ASSERT(inSuite, p != nullptr);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, p != nullptr);
 
     for (int i = 0; i < 128; i++)
         NL_TEST_ASSERT(inSuite, p[i] == 0);
diff --git a/src/lib/support/tests/TestFixedBufferAllocator.cpp b/src/lib/support/tests/TestFixedBufferAllocator.cpp
index 94426f84d1acc1..be494536819af6 100644
--- a/src/lib/support/tests/TestFixedBufferAllocator.cpp
+++ b/src/lib/support/tests/TestFixedBufferAllocator.cpp
@@ -17,6 +17,7 @@
  */
 
 #include <lib/support/FixedBufferAllocator.h>
+#include <lib/support/UnitTestContext.h>
 #include <lib/support/UnitTestRegistration.h>
 
 #include <cstring>
@@ -34,7 +35,7 @@ void TestClone(nlTestSuite * inSuite, void * inContext)
     const char * kTestString     = "Test string";
     const char * allocatedString = alloc.Clone(kTestString);
 
-    NL_TEST_ASSERT(inSuite, allocatedString != nullptr);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, allocatedString != nullptr);
     NL_TEST_ASSERT(inSuite, allocatedString != kTestString);
 
     // NOLINTNEXTLINE(clang-analyzer-unix.cstring.NullArg): null check for allocated string already done
@@ -43,7 +44,7 @@ void TestClone(nlTestSuite * inSuite, void * inContext)
     const uint8_t kTestData[]     = { 0xDE, 0xAD, 0xBE, 0xEF };
     const uint8_t * allocatedData = alloc.Clone(kTestData, sizeof(kTestData));
 
-    NL_TEST_ASSERT(inSuite, allocatedData != nullptr);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, allocatedData != nullptr);
     NL_TEST_ASSERT(inSuite, allocatedData != kTestData);
 
     // NOLINTNEXTLINE(clang-analyzer-unix.cstring.NullArg): null check for allocated data already done
diff --git a/src/lib/support/tests/TestPool.cpp b/src/lib/support/tests/TestPool.cpp
index befeef1a51397a..9234d0bdb9d3c0 100644
--- a/src/lib/support/tests/TestPool.cpp
+++ b/src/lib/support/tests/TestPool.cpp
@@ -239,6 +239,11 @@ void TestForEachActiveObject(nlTestSuite * inSuite, void * inContext)
     size_t sum   = 0;
     pool.ForEachActiveObject([&](S * object) {
         NL_TEST_ASSERT(inSuite, object != nullptr);
+        if (object == nullptr)
+        {
+            // NL_TEST_ASSERT doesn't stop running the test and we want to avoid nullptr dereference.
+            return Loop::Continue;
+        }
         NL_TEST_ASSERT(inSuite, objIds.count(object->mId) == 1);
         objIds.erase(object->mId);
         ++count;
diff --git a/src/messaging/tests/TestExchangeMgr.cpp b/src/messaging/tests/TestExchangeMgr.cpp
index 38aec126549fe6..bb4be03d05fc0c 100644
--- a/src/messaging/tests/TestExchangeMgr.cpp
+++ b/src/messaging/tests/TestExchangeMgr.cpp
@@ -105,14 +105,14 @@ void CheckNewContextTest(nlTestSuite * inSuite, void * inContext)
 
     MockAppDelegate mockAppDelegate;
     ExchangeContext * ec1 = ctx.NewExchangeToBob(&mockAppDelegate);
-    NL_TEST_ASSERT(inSuite, ec1 != nullptr);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, ec1 != nullptr);
     NL_TEST_ASSERT(inSuite, ec1->IsInitiator() == true);
     NL_TEST_ASSERT(inSuite, ec1->GetExchangeId() != 0);
     NL_TEST_ASSERT(inSuite, ec1->GetSessionHandle() == ctx.GetSessionAliceToBob());
     NL_TEST_ASSERT(inSuite, ec1->GetDelegate() == &mockAppDelegate);
 
     ExchangeContext * ec2 = ctx.NewExchangeToAlice(&mockAppDelegate);
-    NL_TEST_ASSERT(inSuite, ec2 != nullptr);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, ec2 != nullptr);
     NL_TEST_ASSERT(inSuite, ec2->GetExchangeId() > ec1->GetExchangeId());
     NL_TEST_ASSERT(inSuite, ec2->GetSessionHandle() == ctx.GetSessionBobToAlice());
 
diff --git a/src/platform/Darwin/ConfigurationManagerImpl.cpp b/src/platform/Darwin/ConfigurationManagerImpl.cpp
index 45957a5c37ee32..aeb02e63655708 100644
--- a/src/platform/Darwin/ConfigurationManagerImpl.cpp
+++ b/src/platform/Darwin/ConfigurationManagerImpl.cpp
@@ -96,7 +96,7 @@ CHIP_ERROR GetMACAddressFromInterfaces(io_iterator_t primaryInterfaceIterator, u
 
     kern_return_t kernResult;
     io_object_t interfaceService;
-    io_object_t controllerService;
+    io_object_t controllerService = 0;
 
     while ((interfaceService = IOIteratorNext(primaryInterfaceIterator)))
     {
diff --git a/src/platform/Linux/ConnectivityManagerImpl.cpp b/src/platform/Linux/ConnectivityManagerImpl.cpp
index 1cb9cd1d85166c..d393008102bbb4 100644
--- a/src/platform/Linux/ConnectivityManagerImpl.cpp
+++ b/src/platform/Linux/ConnectivityManagerImpl.cpp
@@ -444,7 +444,10 @@ void ConnectivityManagerImpl::_OnWpaPropertiesChanged(WpaFiW1Wpa_supplicant1Inte
                             }
                         });
 
-                        delegate->OnAssociationFailureDetected(associationFailureCause, status);
+                        if (delegate)
+                        {
+                            delegate->OnAssociationFailureDetected(associationFailureCause, status);
+                        }
                     }
 
                     DeviceLayer::SystemLayer().ScheduleLambda([]() { ConnectivityMgrImpl().UpdateNetworkStatus(); });
diff --git a/src/platform/tests/TestDnssd.cpp b/src/platform/tests/TestDnssd.cpp
index 21f46388ff5730..09929068731bf7 100644
--- a/src/platform/tests/TestDnssd.cpp
+++ b/src/platform/tests/TestDnssd.cpp
@@ -34,6 +34,7 @@
 #include <lib/dnssd/minimal_mdns/responders/Srv.h>
 #include <lib/dnssd/minimal_mdns/responders/Txt.h>
 #include <lib/support/CHIPMem.h>
+#include <lib/support/UnitTestContext.h>
 #include <lib/support/UnitTestRegistration.h>
 
 using chip::Dnssd::DnssdService;
@@ -101,7 +102,7 @@ static void HandleResolve(void * context, DnssdService * result, const chip::Spa
     auto * suite = ctx->mTestSuite;
     char addrBuf[100];
 
-    NL_TEST_ASSERT(suite, result != nullptr);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(suite, result != nullptr);
     NL_TEST_ASSERT(suite, error == CHIP_NO_ERROR);
 
     // The NL_TEST_ASSERT above will not abort the test, so we need to
diff --git a/src/protocols/bdx/tests/TestBdxTransferSession.cpp b/src/protocols/bdx/tests/TestBdxTransferSession.cpp
index e86f079aa0c285..b246f459392752 100644
--- a/src/protocols/bdx/tests/TestBdxTransferSession.cpp
+++ b/src/protocols/bdx/tests/TestBdxTransferSession.cpp
@@ -183,10 +183,16 @@ void SendAndVerifyTransferInit(nlTestSuite * inSuite, void * inContext, Transfer
         NL_TEST_ASSERT(inSuite, outEvent.transferInitData.MetadataLength == initData.MetadataLength);
         if (outEvent.transferInitData.MetadataLength == initData.MetadataLength)
         {
-            // Only check that metadata buffers match. The OutputEvent can still be inspected when this function returns to parse
-            // the metadata and verify that it matches.
-            NL_TEST_ASSERT(
-                inSuite, !memcmp(initData.Metadata, outEvent.transferInitData.Metadata, outEvent.transferInitData.MetadataLength));
+            // Even if initData.MetadataLength is 0, it is still technically undefined behaviour to call memcmp with a null
+            bool isNullAndLengthZero = initData.Metadata == nullptr && initData.MetadataLength == 0;
+            if (!isNullAndLengthZero)
+            {
+                // Only check that metadata buffers match. The OutputEvent can still be inspected when this function returns to
+                // parse the metadata and verify that it matches.
+                NL_TEST_ASSERT(
+                    inSuite,
+                    !memcmp(initData.Metadata, outEvent.transferInitData.Metadata, outEvent.transferInitData.MetadataLength));
+            }
         }
         else
         {
@@ -239,11 +245,16 @@ void SendAndVerifyAcceptMsg(nlTestSuite * inSuite, void * inContext, TransferSes
         NL_TEST_ASSERT(inSuite, outEvent.transferAcceptData.MetadataLength == acceptData.MetadataLength);
         if (outEvent.transferAcceptData.MetadataLength == acceptData.MetadataLength)
         {
-            // Only check that metadata buffers match. The OutputEvent can still be inspected when this function returns to parse
-            // the metadata and verify that it matches.
-            NL_TEST_ASSERT(
-                inSuite,
-                !memcmp(acceptData.Metadata, outEvent.transferAcceptData.Metadata, outEvent.transferAcceptData.MetadataLength));
+            // Even if acceptData.MetadataLength is 0, it is still technically undefined behaviour to call memcmp with a null
+            bool isNullAndLengthZero = acceptData.Metadata == nullptr && acceptData.MetadataLength == 0;
+            if (!isNullAndLengthZero)
+            {
+                // Only check that metadata buffers match. The OutputEvent can still be inspected when this function returns to
+                // parse the metadata and verify that it matches.
+                NL_TEST_ASSERT(
+                    inSuite,
+                    !memcmp(acceptData.Metadata, outEvent.transferAcceptData.Metadata, outEvent.transferAcceptData.MetadataLength));
+            }
         }
         else
         {
diff --git a/src/protocols/user_directed_commissioning/tests/TestUdcMessages.cpp b/src/protocols/user_directed_commissioning/tests/TestUdcMessages.cpp
index c7941ba027aa5e..8e9684f461abf3 100644
--- a/src/protocols/user_directed_commissioning/tests/TestUdcMessages.cpp
+++ b/src/protocols/user_directed_commissioning/tests/TestUdcMessages.cpp
@@ -8,6 +8,7 @@
 #include <lib/support/CHIPMem.h>
 #include <lib/support/CHIPMemString.h>
 #include <lib/support/CodeUtils.h>
+#include <lib/support/UnitTestContext.h>
 #include <lib/support/UnitTestRegistration.h>
 #include <transport/TransportMgr.h>
 #include <transport/raw/MessageHeader.h>
@@ -61,7 +62,7 @@ void TestUDCServerClients(nlTestSuite * inSuite, void * inContext)
     NL_TEST_ASSERT(inSuite, nullptr == udcServer.GetUDCClients().FindUDCClientState(instanceName1));
     udcServer.SetUDCClientProcessingState((char *) instanceName1, UDCClientProcessingState::kUserDeclined);
     UDCClientState * state = udcServer.GetUDCClients().FindUDCClientState(instanceName1);
-    NL_TEST_ASSERT(inSuite, nullptr != state);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, nullptr != state);
     NL_TEST_ASSERT(inSuite, UDCClientProcessingState::kUserDeclined == state->GetUDCClientProcessingState());
 }
 
@@ -99,7 +100,7 @@ void TestUDCServerUserConfirmationProvider(nlTestSuite * inSuite, void * inConte
     udcServer.OnCommissionableNodeFound(nodeData2);
     udcServer.OnCommissionableNodeFound(nodeData1);
     state = udcServer.GetUDCClients().FindUDCClientState(instanceName1);
-    NL_TEST_ASSERT(inSuite, nullptr != state);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, nullptr != state);
     NL_TEST_ASSERT(inSuite, UDCClientProcessingState::kUserDeclined == state->GetUDCClientProcessingState());
     // test other fields on UDCClientState
     NL_TEST_ASSERT(inSuite, 0 == strcmp(state->GetInstanceName(), instanceName1));
@@ -113,10 +114,10 @@ void TestUDCServerUserConfirmationProvider(nlTestSuite * inSuite, void * inConte
     udcServer.OnCommissionableNodeFound(nodeData2);
     udcServer.OnCommissionableNodeFound(nodeData1);
     state = udcServer.GetUDCClients().FindUDCClientState(instanceName1);
-    NL_TEST_ASSERT(inSuite, nullptr != state);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, nullptr != state);
     NL_TEST_ASSERT(inSuite, UDCClientProcessingState::kUserDeclined == state->GetUDCClientProcessingState());
     state = udcServer.GetUDCClients().FindUDCClientState(instanceName2);
-    NL_TEST_ASSERT(inSuite, nullptr != state);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, nullptr != state);
     NL_TEST_ASSERT(inSuite, UDCClientProcessingState::kPromptingUser == state->GetUDCClientProcessingState());
     // test other fields on UDCClientState
     NL_TEST_ASSERT(inSuite, 0 == strcmp(state->GetInstanceName(), instanceName2));
@@ -166,7 +167,7 @@ void TestUDCServerInstanceNameResolver(nlTestSuite * inSuite, void * inContext)
 
     // check if the state is set for the instance name sent
     state = udcServer.GetUDCClients().FindUDCClientState(nameBuffer);
-    NL_TEST_ASSERT(inSuite, nullptr != state);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, nullptr != state);
     NL_TEST_ASSERT(inSuite, UDCClientProcessingState::kDiscoveringNode == state->GetUDCClientProcessingState());
 
     // check if a callback happened
@@ -320,7 +321,7 @@ void TestUDCClientState(nlTestSuite * inSuite, void * inContext)
 
     // get the state
     state = mUdcClients.FindUDCClientState(instanceName1);
-    NL_TEST_ASSERT(inSuite, nullptr != state);
+    NL_TEST_EXIT_ON_FAILED_ASSERT(inSuite, nullptr != state);
     NL_TEST_ASSERT(inSuite, strcmp(state->GetInstanceName(), instanceName1) == 0);
 
     state->SetPeerAddress(chip::Transport::PeerAddress::UDP(address, port));
diff --git a/third_party/pigweed/repo b/third_party/pigweed/repo
index e72f0d5a6f9315..da76d1317f4730 160000
--- a/third_party/pigweed/repo
+++ b/third_party/pigweed/repo
@@ -1 +1 @@
-Subproject commit e72f0d5a6f9315b995b9002b2af6c41190f91144
+Subproject commit da76d1317f4730d582f4fab346ebacf0d0935263