diff --git a/Makefile b/Makefile
index 676a3aa..264f65d 100644
--- a/Makefile
+++ b/Makefile
@@ -338,6 +338,7 @@
 	utility/dump_kernel_config_lib.c \
 	firmware/lib/cgptlib/crc32.c \
 	firmware/lib/cgptlib/cgptlib_internal.c \
+	firmware/lib/utility_string.c \
 	firmware/stub/utility_stub.c
 
 TINYHOSTLIB_OBJS = ${TINYHOSTLIB_SRCS:%.c=${BUILD}/%.o}
diff --git a/cgpt/cgpt_add.c b/cgpt/cgpt_add.c
index ada323e..9a966ba 100644
--- a/cgpt/cgpt_add.c
+++ b/cgpt/cgpt_add.c
@@ -8,7 +8,8 @@
 
 #include "cgptlib_internal.h"
 #include "cgpt_params.h"
-
+#define _STUB_IMPLEMENTATION_
+#include "utility.h"
 
 static const char* DumpCgptAddParams(const CgptAddParams *params) {
   static char buf[256];
@@ -16,49 +17,49 @@
 
   buf[0] = 0;
   snprintf(tmp, sizeof(tmp), "-i %d ", params->partition);
-  strncat(buf, tmp, sizeof(buf));
+  StrnAppend(buf, tmp, sizeof(buf));
   if (params->label) {
     snprintf(tmp, sizeof(tmp), "-l %s ", params->label);
-    strncat(buf, tmp, sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
   }
   if (params->set_begin) {
     snprintf(tmp, sizeof(tmp), "-b %llu ", (unsigned long long)params->begin);
-    strncat(buf, tmp, sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
   }
   if (params->set_size) {
     snprintf(tmp, sizeof(tmp), "-s %llu ", (unsigned long long)params->size);
-    strncat(buf, tmp, sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
   }
   if (params->set_type) {
     GuidToStr(&params->type_guid, tmp, sizeof(tmp));
-    strncat(buf, "-t ", sizeof(buf));
-    strncat(buf, tmp, sizeof(buf));
-    strncat(buf, " ", sizeof(buf));
+    StrnAppend(buf, "-t ", sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
+    StrnAppend(buf, " ", sizeof(buf));
   }
   if (params->set_unique) {
     GuidToStr(&params->unique_guid, tmp, sizeof(tmp));
-    strncat(buf, "-u ", sizeof(buf));
-    strncat(buf, tmp, sizeof(buf));
-    strncat(buf, " ", sizeof(buf));
+    StrnAppend(buf, "-u ", sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
+    StrnAppend(buf, " ", sizeof(buf));
   }
   if (params->set_successful) {
     snprintf(tmp, sizeof(tmp), "-S %d ", params->successful);
-    strncat(buf, tmp, sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
   }
   if (params->set_tries) {
     snprintf(tmp, sizeof(tmp), "-T %d ", params->tries);
-    strncat(buf, tmp, sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
   }
   if (params->set_priority) {
     snprintf(tmp, sizeof(tmp), "-P %d ", params->priority);
-    strncat(buf, tmp, sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
   }
   if (params->set_raw) {
     snprintf(tmp, sizeof(tmp), "-A 0x%x ", params->raw_value);
-    strncat(buf, tmp, sizeof(buf));
+    StrnAppend(buf, tmp, sizeof(buf));
   }
 
-  strncat(buf, "\n", sizeof(buf));
+  StrnAppend(buf, "\n", sizeof(buf));
   return buf;
 }
 
diff --git a/firmware/include/utility.h b/firmware/include/utility.h
index ead2351..8fe8277 100644
--- a/firmware/include/utility.h
+++ b/firmware/include/utility.h
@@ -118,7 +118,7 @@
  * null-terminated if <destlen> > 0.  Returns the number of characters used in
  * <dest>, not counting the terminating null.
  */
-uint32_t Strncat(char *dest, const char *src, uint32_t destlen);
+uint32_t StrnAppend(char *dest, const char *src, uint32_t destlen);
 
 /* Ensure that only our stub implementations are used, not standard C */
 #ifndef _STUB_IMPLEMENTATION_
diff --git a/firmware/lib/rollback_index.c b/firmware/lib/rollback_index.c
index 0c6e02a..11bc12d 100644
--- a/firmware/lib/rollback_index.c
+++ b/firmware/lib/rollback_index.c
@@ -352,6 +352,7 @@
 	uint8_t disable;
 	uint8_t deactivated;
 	uint32_t result;
+	uint32_t versions;
 
 	VBDEBUG(("TPM: SetupTPM(r%d, d%d)\n", recovery_mode, developer_mode));
 
@@ -434,8 +435,9 @@
 		VBDEBUG(("TPM: Firmware space in a bad state; giving up.\n"));
 		return TPM_E_CORRUPTED_STATE;
 	}
+	Memcpy(&versions, &rsf->fw_versions, sizeof(versions));
 	VBDEBUG(("TPM: Firmware space sv%d f%x v%x\n",
-		 rsf->struct_version, rsf->flags, rsf->fw_versions));
+		 rsf->struct_version, rsf->flags, versions));
 	in_flags = rsf->flags;
 
 	/* If we've been asked to clear the virtual dev-mode flag, do so now */
@@ -577,20 +579,22 @@
 	RETURN_ON_FAILURE(SetupTPM(recovery_mode, is_hw_dev,
 				   disable_dev_request,
 				   clear_tpm_owner_request, &rsf));
-	*version = rsf.fw_versions;
+	Memcpy(version, &rsf.fw_versions, sizeof(*version));
 	*is_virt_dev = (rsf.flags & FLAG_VIRTUAL_DEV_MODE_ON) ? 1 : 0;
-	VBDEBUG(("TPM: RollbackFirmwareSetup %x\n", (int)rsf.fw_versions));
+	VBDEBUG(("TPM: RollbackFirmwareSetup %x\n", (int)*version));
 	return TPM_SUCCESS;
 }
 
 uint32_t RollbackFirmwareWrite(uint32_t version)
 {
 	RollbackSpaceFirmware rsf;
+	uint32_t old_version;
 
 	RETURN_ON_FAILURE(ReadSpaceFirmware(&rsf));
-	VBDEBUG(("TPM: RollbackFirmwareWrite %x --> %x\n", (int)rsf.fw_versions,
+	Memcpy(&old_version, &rsf.fw_versions, sizeof(old_version));
+	VBDEBUG(("TPM: RollbackFirmwareWrite %x --> %x\n", (int)old_version,
 		 (int)version));
-	rsf.fw_versions = version;
+	Memcpy(&rsf.fw_versions, &version, sizeof(version));
 	return WriteSpaceFirmware(&rsf);
 }
 
@@ -602,7 +606,7 @@
 uint32_t RollbackKernelRead(uint32_t* version)
 {
 	RollbackSpaceKernel rsk;
-	uint32_t perms;
+	uint32_t perms, uid;
 
 	/*
 	 * Read the kernel space and verify its permissions.  If the kernel
@@ -614,21 +618,24 @@
 	 */
 	RETURN_ON_FAILURE(ReadSpaceKernel(&rsk));
 	RETURN_ON_FAILURE(TlclGetPermissions(KERNEL_NV_INDEX, &perms));
-	if (TPM_NV_PER_PPWRITE != perms || ROLLBACK_SPACE_KERNEL_UID != rsk.uid)
+	Memcpy(&uid, &rsk.uid, sizeof(uid));
+	if (TPM_NV_PER_PPWRITE != perms || ROLLBACK_SPACE_KERNEL_UID != uid)
 		return TPM_E_CORRUPTED_STATE;
 
-	*version = rsk.kernel_versions;
-	VBDEBUG(("TPM: RollbackKernelRead %x\n", (int)rsk.kernel_versions));
+	Memcpy(version, &rsk.kernel_versions, sizeof(*version));
+	VBDEBUG(("TPM: RollbackKernelRead %x\n", (int)*version));
 	return TPM_SUCCESS;
 }
 
 uint32_t RollbackKernelWrite(uint32_t version)
 {
 	RollbackSpaceKernel rsk;
+	uint32_t old_version;
 	RETURN_ON_FAILURE(ReadSpaceKernel(&rsk));
+	Memcpy(&old_version, &rsk.kernel_versions, sizeof(old_version));
 	VBDEBUG(("TPM: RollbackKernelWrite %x --> %x\n",
-		 (int)rsk.kernel_versions, (int)version));
-	rsk.kernel_versions = version;
+		 (int)old_version, (int)version));
+	Memcpy(&rsk.kernel_versions, &version, sizeof(version));
 	return WriteSpaceKernel(&rsk);
 }
 
diff --git a/firmware/lib/utility_string.c b/firmware/lib/utility_string.c
index b1b1a39..4a7e3e3 100644
--- a/firmware/lib/utility_string.c
+++ b/firmware/lib/utility_string.c
@@ -52,11 +52,11 @@
 	return usedsize - 1;
 }
 
-uint32_t Strncat(char *dest, const char *src, uint32_t destlen)
+uint32_t StrnAppend(char *dest, const char *src, uint32_t destlen)
 {
 	uint32_t used = 0;
 
-	if (!dest || !src)
+	if (!dest || !src || !destlen)
 		return 0;
 
 	/* Skip past existing string in destination.*/
diff --git a/firmware/lib/vboot_display.c b/firmware/lib/vboot_display.c
index 9abc51d..adf4a3f 100644
--- a/firmware/lib/vboot_display.c
+++ b/firmware/lib/vboot_display.c
@@ -66,7 +66,6 @@
  * in-memory font structure distinct from the in-flash version.  We'll do that
  * Real Soon Now. Until then, we just repeat the same linear search every time.
  */
-typedef FontArrayHeader VbFont_t;
 
 VbFont_t *VbInternalizeFontData(FontArrayHeader *fonthdr)
 {
@@ -366,11 +365,11 @@
 	 */
 	if (gbb->major_version == GBB_MAJOR_VER && gbb->minor_version >= 1 &&
 	    (gbb->flags != 0)) {
-		used += Strncat(outbuf + used, "gbb.flags is nonzero: 0x",
+		used += StrnAppend(outbuf + used, "gbb.flags is nonzero: 0x",
 				OUTBUF_LEN - used);
 		used += Uint64ToString(outbuf + used, OUTBUF_LEN - used,
 				       gbb->flags, 16, 8);
-		used += Strncat(outbuf + used, "\n", OUTBUF_LEN - used);
+		used += StrnAppend(outbuf + used, "\n", OUTBUF_LEN - used);
 		(void)VbExDisplayDebugInfo(outbuf);
 	}
 
@@ -581,98 +580,98 @@
 	VbDisplayScreen(cparams, disp_current_screen, 1, vncptr);
 
 	/* Add hardware ID */
-	used += Strncat(buf + used, "HWID: ", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, "HWID: ", DEBUG_INFO_SIZE - used);
 	if (0 == gbb->hwid_size ||
 	    gbb->hwid_offset > cparams->gbb_size ||
 	    gbb->hwid_offset + gbb->hwid_size > cparams->gbb_size) {
 		VBDEBUG(("VbDisplayDebugInfo(): invalid hwid offset/size\n"));
-		used += Strncat(buf + used,
+		used += StrnAppend(buf + used,
 				"(INVALID)", DEBUG_INFO_SIZE - used);
   } else {
-		used += Strncat(buf + used,
+		used += StrnAppend(buf + used,
 				(char *)((uint8_t *)gbb + gbb->hwid_offset),
 				DEBUG_INFO_SIZE - used);
   }
 
 	/* Add recovery reason */
-	used += Strncat(buf + used,
+	used += StrnAppend(buf + used,
 			"\nrecovery_reason: 0x", DEBUG_INFO_SIZE - used);
 	used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used,
 			       shared->recovery_reason, 16, 2);
-	used += Strncat(buf + used, "  ", DEBUG_INFO_SIZE - used);
-	used += Strncat(buf + used,
+	used += StrnAppend(buf + used, "  ", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used,
 			RecoveryReasonString(shared->recovery_reason),
 			DEBUG_INFO_SIZE - used);
 
 	/* Add VbSharedData flags */
-	used += Strncat(buf + used, "\nVbSD.flags: 0x", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, "\nVbSD.flags: 0x", DEBUG_INFO_SIZE - used);
 	used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used,
 			       shared->flags, 16, 8);
 
 	/* Add raw contents of VbNvStorage */
-	used += Strncat(buf + used, "\nVbNv.raw:", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, "\nVbNv.raw:", DEBUG_INFO_SIZE - used);
 	for (i = 0; i < VBNV_BLOCK_SIZE; i++) {
-		used += Strncat(buf + used, " ", DEBUG_INFO_SIZE - used);
+		used += StrnAppend(buf + used, " ", DEBUG_INFO_SIZE - used);
 		used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used,
 				       vncptr->raw[i], 16, 2);
 	}
 
 	/* Add dev_boot_usb flag */
 	VbNvGet(vncptr, VBNV_DEV_BOOT_USB, &i);
-	used += Strncat(buf + used, "\ndev_boot_usb: ", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, "\ndev_boot_usb: ", DEBUG_INFO_SIZE - used);
 	used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used, i, 10, 0);
 
 	/* Add dev_boot_legacy flag */
 	VbNvGet(vncptr, VBNV_DEV_BOOT_LEGACY, &i);
-	used += Strncat(buf + used,
+	used += StrnAppend(buf + used,
 			"\ndev_boot_legacy: ", DEBUG_INFO_SIZE - used);
 	used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used, i, 10, 0);
 
 	/* Add dev_boot_signed_only flag */
 	VbNvGet(vncptr, VBNV_DEV_BOOT_SIGNED_ONLY, &i);
-	used += Strncat(buf + used, "\ndev_boot_signed_only: ",
+	used += StrnAppend(buf + used, "\ndev_boot_signed_only: ",
 			DEBUG_INFO_SIZE - used);
 	used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used, i, 10, 0);
 
 	/* Add TPM versions */
-	used += Strncat(buf + used, "\nTPM: fwver=0x", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, "\nTPM: fwver=0x", DEBUG_INFO_SIZE - used);
 	used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used,
 			       shared->fw_version_tpm, 16, 8);
-	used += Strncat(buf + used, " kernver=0x", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, " kernver=0x", DEBUG_INFO_SIZE - used);
 	used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used,
 			       shared->kernel_version_tpm, 16, 8);
 
 	/* Add GBB flags */
-	used += Strncat(buf + used, "\ngbb.flags: 0x", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, "\ngbb.flags: 0x", DEBUG_INFO_SIZE - used);
 	if (gbb->major_version == GBB_MAJOR_VER && gbb->minor_version >= 1) {
 		used += Uint64ToString(buf + used, DEBUG_INFO_SIZE - used,
 				       gbb->flags, 16, 8);
 	} else {
-		used += Strncat(buf + used,
+		used += StrnAppend(buf + used,
 				"0 (default)", DEBUG_INFO_SIZE - used);
 	}
 
 	/* Add sha1sum for Root & Recovery keys */
 	FillInSha1Sum(sha1sum,
 		(VbPublicKey *)((uint8_t *)gbb + gbb->rootkey_offset));
-	used += Strncat(buf + used, "\ngbb.rootkey: ", DEBUG_INFO_SIZE - used);
-	used += Strncat(buf + used, sha1sum, DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, "\ngbb.rootkey: ", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, sha1sum, DEBUG_INFO_SIZE - used);
 	FillInSha1Sum(sha1sum,
 		(VbPublicKey *)((uint8_t *)gbb + gbb->recovery_key_offset));
-	used += Strncat(buf + used,
+	used += StrnAppend(buf + used,
 			"\ngbb.recovery_key: ", DEBUG_INFO_SIZE - used);
-	used += Strncat(buf + used, sha1sum, DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, sha1sum, DEBUG_INFO_SIZE - used);
 
 	/* If we're in dev-mode, show the kernel subkey that we expect, too. */
 	if (0 == shared->recovery_reason) {
 		FillInSha1Sum(sha1sum, &shared->kernel_subkey);
-		used += Strncat(buf + used,
+		used += StrnAppend(buf + used,
 				"\nkernel_subkey: ", DEBUG_INFO_SIZE - used);
-		used += Strncat(buf + used, sha1sum, DEBUG_INFO_SIZE - used);
+		used += StrnAppend(buf + used, sha1sum, DEBUG_INFO_SIZE - used);
 	}
 
 	/* Make sure we finish with a newline */
-	used += Strncat(buf + used, "\n", DEBUG_INFO_SIZE - used);
+	used += StrnAppend(buf + used, "\n", DEBUG_INFO_SIZE - used);
 
 	/* TODO: add more interesting data:
 	 * - Information on current disks */
diff --git a/tests/utility_string_tests.c b/tests/utility_string_tests.c
index d6b2e1c..42254a4 100644
--- a/tests/utility_string_tests.c
+++ b/tests/utility_string_tests.c
@@ -19,38 +19,38 @@
   char dest[128];
 
   /* Null inputs */
-  TEST_EQ(0, Strncat(dest, NULL, sizeof(dest)), "Strncat('', null)");
-  TEST_EQ(0, Strncat(NULL, "Hey!", sizeof(dest)), "Strncat(null, '')");
+  TEST_EQ(0, StrnAppend(dest, NULL, sizeof(dest)), "StrnAppend('', null)");
+  TEST_EQ(0, StrnAppend(NULL, "Hey!", sizeof(dest)), "StrnAppend(null, '')");
 
   /* Empty <-- empty */
   *dest = 0;
-  TEST_EQ(0, Strncat(dest, "", sizeof(dest)), "Strncat('', '')");
-  TEST_EQ(0, strcmp(dest, ""), "Strncat('', '') result");
+  TEST_EQ(0, StrnAppend(dest, "", sizeof(dest)), "StrnAppend('', '')");
+  TEST_EQ(0, strcmp(dest, ""), "StrnAppend('', '') result");
 
   /* Nonempty <-- empty */
   strcpy(dest, "Bob");
-  TEST_EQ(3, Strncat(dest, "", sizeof(dest)), "Strncat(B, '')");
-  TEST_EQ(0, strcmp(dest, "Bob"), "Strncat(B, '') result");
+  TEST_EQ(3, StrnAppend(dest, "", sizeof(dest)), "StrnAppend(B, '')");
+  TEST_EQ(0, strcmp(dest, "Bob"), "StrnAppend(B, '') result");
 
   /* Empty <-- nonempty */
   *dest = 0;
-  TEST_EQ(5, Strncat(dest, "Alice", sizeof(dest)), "Strncat('', A)");
-  TEST_EQ(0, strcmp(dest, "Alice"), "Strncat('', A) result");
+  TEST_EQ(5, StrnAppend(dest, "Alice", sizeof(dest)), "StrnAppend('', A)");
+  TEST_EQ(0, strcmp(dest, "Alice"), "StrnAppend('', A) result");
 
   /* Nonempty <-- nonempty */
   strcpy(dest, "Tigre");
-  TEST_EQ(10, Strncat(dest, "Bunny", sizeof(dest)), "Strncat(T, B)");
-  TEST_EQ(0, strcmp(dest, "TigreBunny"), "Strncat(T, B) result");
+  TEST_EQ(10, StrnAppend(dest, "Bunny", sizeof(dest)), "StrnAppend(T, B)");
+  TEST_EQ(0, strcmp(dest, "TigreBunny"), "StrnAppend(T, B) result");
 
   /* Test clipping */
   strcpy(dest, "YesI");
-  TEST_EQ(7, Strncat(dest, "Can't", 8), "Strncat(Y, over)");
-  TEST_EQ(0, strcmp(dest, "YesICan"), "Strncat(Y, over) result");
+  TEST_EQ(7, StrnAppend(dest, "Can't", 8), "StrnAppend(Y, over)");
+  TEST_EQ(0, strcmp(dest, "YesICan"), "StrnAppend(Y, over) result");
 
   /* Test clipping if dest already overflows its claimed length */
   strcpy(dest, "BudgetDeficit");
-  TEST_EQ(6, Strncat(dest, "Spending", 7), "Strncat(over, over)");
-  TEST_EQ(0, strcmp(dest, "Budget"), "Strncat(over, over) result");
+  TEST_EQ(6, StrnAppend(dest, "Spending", 7), "StrnAppend(over, over)");
+  TEST_EQ(0, strcmp(dest, "Budget"), "StrnAppend(over, over) result");
 }