diff --git a/modules/spl/spl-proc.c b/modules/spl/spl-proc.c
index 017c69d47..bf185c60e 100644
--- a/modules/spl/spl-proc.c
+++ b/modules/spl/spl-proc.c
@@ -446,7 +446,7 @@ proc_dohostid(struct ctl_table *table, int write, struct file *filp,
 			RETURN(-EINVAL);
 
 		spl_hostid = (long)val;
-                sprintf(hw_serial, "%u", (val >= 0) ? val : -val);
+                (void)snprintf(hw_serial, 11, "%u", (val >= 0) ? val : -val);
                 *ppos += *lenp;
         } else {
                 len = snprintf(str, sizeof(str), "%lx", spl_hostid);
diff --git a/modules/spl/spl-vnode.c b/modules/spl/spl-vnode.c
index 17336a1a2..fef74f3c7 100644
--- a/modules/spl/spl-vnode.c
+++ b/modules/spl/spl-vnode.c
@@ -161,18 +161,18 @@ vn_openat(const char *path, uio_seg_t seg, int flags, int mode,
 	  vnode_t **vpp, int x1, void *x2, vnode_t *vp, int fd)
 {
 	char *realpath;
-	int rc;
+	int len, rc;
 	ENTRY;
 
 	ASSERT(vp == rootdir);
 
-	realpath = kmalloc(strlen(path) + 2, GFP_KERNEL);
+	len = strlen(path) + 2;
+	realpath = kmalloc(len, GFP_KERNEL);
 	if (!realpath)
 		RETURN(ENOMEM);
 
-	sprintf(realpath, "/%s", path);
+	(void)snprintf(realpath, len, "/%s", path);
 	rc = vn_open(realpath, seg, flags, mode, vpp, x1, x2);
-
 	kfree(realpath);
 
 	RETURN(rc);
diff --git a/modules/splat/splat-kmem.c b/modules/splat/splat-kmem.c
index bc15bc64a..7e95b4af8 100644
--- a/modules/splat/splat-kmem.c
+++ b/modules/splat/splat-kmem.c
@@ -601,7 +601,8 @@ splat_kmem_test8_sc(struct file *file, void *arg, int size, int count)
 	        spin_lock_init(&kcp.kcp_lock);
 	        init_waitqueue_head(&kcp.kcp_waitq);
 
-		sprintf(cache_name, "%s-%d-%d", SPLAT_KMEM_CACHE_NAME, size, i);
+		(void)snprintf(cache_name, 32, "%s-%d-%d",
+			       SPLAT_KMEM_CACHE_NAME, size, i);
 		kcp.kcp_cache = kmem_cache_create(cache_name, kcp.kcp_size, 0,
 	                                  splat_kmem_cache_test_constructor,
 	                                  splat_kmem_cache_test_destructor,