diff --git a/src/compat/arc4random.c b/src/compat/arc4random.c
index bd5f6e3a..7c9570b9 100644
--- a/src/compat/arc4random.c
+++ b/src/compat/arc4random.c
@@ -117,6 +117,9 @@ _rs_stir(void)
 #ifdef SIGKILL
 		raise(SIGKILL);
 #else
+#ifdef GETDNS_ON_WINDOWS
+		DebugBreak();
+#endif
 		exit(9); /* windows */
 #endif
 	}
@@ -128,6 +131,9 @@ _rs_stir(void)
 	explicit_bzero(rnd, sizeof(rnd));	/* discard source seed */
 
 	/* invalidate rs_buf */
+#ifdef GETDNS_ON_WINDOWS
+	_Analysis_assume_(rs != NULL);
+#endif
 	rs->rs_have = 0;
 	memset(rsx->rs_buf, 0, sizeof(rsx->rs_buf));
 
@@ -158,6 +164,9 @@ _rs_stir_if_needed(size_t len)
 #endif
 	if (!rs || rs->rs_count <= len)
 		_rs_stir();
+#ifdef GETDNS_ON_WINDOWS
+	_Analysis_assume_(rs != NULL);
+#endif
 	if (rs->rs_count <= len)
 		rs->rs_count = 0;
 	else
diff --git a/src/dnssec.c b/src/dnssec.c
index 51d566f2..87e2943b 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -1323,7 +1323,7 @@ static int _rr_iter_rdata_cmp(const void *a, const void *b)
  * When the rrset was a wildcard expansion (rrsig labels < labels owner name),
  * nc_name will be set to the next closer (within rrset->name).
  */
-#define VAL_RRSET_SPC_SZ 1024
+#define VAL_RRSET_SPC_SZ 256
 static int _getdns_verify_rrsig(struct mem_funcs *mf,
     _getdns_rrset *rrset, _getdns_rrsig_iter *rrsig, _getdns_rrtype_iter *key, const uint8_t **nc_name)
 {