diff --git a/lib/private.h b/lib/private.h
index e3d97b32..b89df8b2 100644
--- a/lib/private.h
+++ b/lib/private.h
@@ -61,6 +61,12 @@
                              sizeof(struct vfio_user_header) + \
                              sizeof(struct vfio_user_region_access))
 
+/*
+ * Maximum value we are prepared to accept in hdr->error_no. Somewhat arbitrary
+ * value low enough to avoid any signed conversion issues.
+ */
+#define SERVER_MAX_ERROR_NO (4096)
+
 /*
  * Structure used to hold an in-flight request+reply.
  *
diff --git a/lib/tran_pipe.c b/lib/tran_pipe.c
index 4c3dc9c1..48d8ea4e 100644
--- a/lib/tran_pipe.c
+++ b/lib/tran_pipe.c
@@ -137,7 +137,7 @@ tran_pipe_recv(int fd, struct vfio_user_header *hdr, bool is_reply,
         }
 
         if (hdr->flags & VFIO_USER_F_ERROR) {
-            if (hdr->error_no <= 0) {
+            if (hdr->error_no <= 0 || hdr->error_no > SERVER_MAX_ERROR_NO) {
                 hdr->error_no = EINVAL;
             }
             return ERROR_INT(hdr->error_no);
diff --git a/lib/tran_sock.c b/lib/tran_sock.c
index 024e5b01..5f144b29 100644
--- a/lib/tran_sock.c
+++ b/lib/tran_sock.c
@@ -217,7 +217,7 @@ tran_sock_recv_fds(int sock, struct vfio_user_header *hdr, bool is_reply,
         }
 
         if (hdr->flags & VFIO_USER_F_ERROR) {
-            if (hdr->error_no <= 0) {
+            if (hdr->error_no <= 0 || hdr->error_no > SERVER_MAX_ERROR_NO) {
                 hdr->error_no = EINVAL;
             }
             return ERROR_INT(hdr->error_no);
diff --git a/samples/client.c b/samples/client.c
index e8b737f4..7e6721f8 100644
--- a/samples/client.c
+++ b/samples/client.c
@@ -821,7 +821,8 @@ get_dirty_bitmap(int sock, struct client_dma_region *dma_region,
     uint64_t bitmap_size = get_bitmap_size(dma_region->map.size,
                                            sysconf(_SC_PAGESIZE));
 
-    size_t size = sizeof(*res) + sizeof(*report) + bitmap_size;
+    /* Saturating add to keep coverity happy. */
+    size_t size = satadd_u64(sizeof(*res) + sizeof(*report), bitmap_size);
 
     void *data = calloc(1, size);
     assert(data != NULL);