diff --git a/src/klib/kvec.h b/src/klib/kvec.h
index fe1ae6a04d..dc8b08c6ef 100644
--- a/src/klib/kvec.h
+++ b/src/klib/kvec.h
@@ -108,6 +108,8 @@
   if (len > 0) { \
     kv_ensure_space(v, len); \
     assert((v).items); \
+    /* kv_roundup32() only ORs bits in, so kv_ensure_space() leaves capacity >= size+len. */ \
+    /* coverity[overrun-buffer-arg] */ \
     memcpy((v).items + (v).size, data, sizeof((v).items[0]) * len); \
     (v).size = (v).size + len; \
   }
diff --git a/src/nvim/input.c b/src/nvim/input.c
index b6d53499bf..9db26f6d97 100644
--- a/src/nvim/input.c
+++ b/src/nvim/input.c
@@ -293,6 +293,7 @@ static String redo_compose(RedoBuf *r)
   if (buf.size == 0) {
     return (String)STRING_INIT;
   }
+  assert(buf.items != NULL);  // Coverity false-positive (already checked `size` above).
   kv_push(buf, NUL);
   return cbuf_as_string(buf.items, buf.size - 1);
 }
@@ -865,6 +866,7 @@ int start_redo(int count, bool old_redo)
   }
   StringBuilder prefix = KV_INITIAL_VALUE;
   redo_prefix(&spec, &prefix, true);
+  // coverity[var_deref_model] `items` is NULL only when size=0, which add_buff() ignores.
   add_buff(&readbuf2, prefix.items, (ptrdiff_t)prefix.size);
   kv_destroy(prefix);
   if (spec.regname == '=') {
diff --git a/src/nvim/input_cmdatom.c b/src/nvim/input_cmdatom.c
index 42e0817339..f0974403cb 100644
--- a/src/nvim/input_cmdatom.c
+++ b/src/nvim/input_cmdatom.c
@@ -170,6 +170,7 @@ static char *atom_compose_keys(CmdSpec spec)
   if (sb.size == 0) {
     return NULL;
   }
+  assert(sb.items != NULL);  // Coverity false-positive (already checked `size` above).
   kv_push(sb, NUL);
   return sb.items;
 }