diff --git a/inc/hf/std.h b/inc/hf/std.h
index be3b168..1c4458c 100644
--- a/inc/hf/std.h
+++ b/inc/hf/std.h
@@ -31,7 +31,7 @@
  * Only the safer versions of these functions are exposed to reduce the chance
  * of misusing the versions without bounds checking or null pointer checks.
  *
- * These functions don't return errno_t as per the specification and implicity
+ * These functions don't return errno_t as per the specification and implicitly
  * have a constraint handler that panics.
  */
 void memset_s(void *dest, rsize_t destsz, int ch, rsize_t count);
diff --git a/src/std.c b/src/std.c
index 9f829e8..a467384 100644
--- a/src/std.c
+++ b/src/std.c
@@ -23,25 +23,33 @@
 void *memcpy(void *dst, const void *src, size_t n);
 void *memmove(void *dst, const void *src, size_t n);
 
+/*
+ * As per the C11 specification, mem*_s() operations fill the destination buffer
+ * if runtime constraint validation fails, assuming that `dest` and `destsz`
+ * are both valid.
+ */
+#define CHECK_OR_FILL(cond, dest, destsz, ch)                               \
+	do {                                                                \
+		if (!(cond)) {                                              \
+			if ((dest) != NULL && (destsz) <= RSIZE_MAX) {      \
+				memset_s((dest), (destsz), (ch), (destsz)); \
+			}                                                   \
+			panic("%s failed: " #cond, __func__);               \
+		}                                                           \
+	} while (0)
+
+#define CHECK_OR_ZERO_FILL(cond, dest, destsz) \
+	CHECK_OR_FILL(cond, dest, destsz, '\0')
+
 void memset_s(void *dest, rsize_t destsz, int ch, rsize_t count)
 {
-	if (dest == NULL) {
-		goto fail;
-	}
+	CHECK_OR_FILL(dest != NULL, dest, destsz, ch);
 
-	if (destsz > RSIZE_MAX || count > RSIZE_MAX) {
-		goto fail;
-	}
-
-	if (count > destsz) {
-		goto fail;
-	}
+	/* Check count <= destsz <= RSIZE_MAX. */
+	CHECK_OR_FILL(destsz <= RSIZE_MAX, dest, destsz, ch);
+	CHECK_OR_FILL(count <= destsz, dest, destsz, ch);
 
 	memset(dest, ch, count);
-	return;
-
-fail:
-	panic("memset_s failure");
 }
 
 void memcpy_s(void *dest, rsize_t destsz, const void *src, rsize_t count)
@@ -49,69 +57,56 @@
 	uintptr_t d = (uintptr_t)dest;
 	uintptr_t s = (uintptr_t)src;
 
-	if (dest == NULL || src == NULL) {
-		goto fail;
-	}
+	CHECK_OR_ZERO_FILL(dest != NULL, dest, destsz);
+	CHECK_OR_ZERO_FILL(src != NULL, dest, destsz);
 
-	if (destsz > RSIZE_MAX || count > RSIZE_MAX) {
-		goto fail;
-	}
+	/* Check count <= destsz <= RSIZE_MAX. */
+	CHECK_OR_ZERO_FILL(destsz <= RSIZE_MAX, dest, destsz);
+	CHECK_OR_ZERO_FILL(count <= destsz, dest, destsz);
 
-	if (count > destsz) {
-		goto fail;
-	}
-
-	/* Destination overlaps the end of source. */
-	if (d > s && d < (s + count)) {
-		goto fail;
-	}
-
-	/* Source overlaps the end of destination. */
-	if (s > d && s < (d + destsz)) {
-		goto fail;
-	}
-
-	/* TODO: consider wrapping? */
+	/*
+	 * Buffer overlap test.
+	 * case a) `d < s` implies `s >= d+count`
+	 * case b) `d > s` implies `d >= s+count`
+	 */
+	CHECK_OR_ZERO_FILL(d != s, dest, destsz);
+	CHECK_OR_ZERO_FILL(d < s || d >= (s + count), dest, destsz);
+	CHECK_OR_ZERO_FILL(d > s || s >= (d + count), dest, destsz);
 
 	memcpy(dest, src, count);
-	return;
-
-fail:
-	panic("memcpy_s failure");
 }
 
 void memmove_s(void *dest, rsize_t destsz, const void *src, rsize_t count)
 {
-	if (dest == NULL || src == NULL) {
-		goto fail;
-	}
+	CHECK_OR_ZERO_FILL(dest != NULL, dest, destsz);
+	CHECK_OR_ZERO_FILL(src != NULL, dest, destsz);
 
-	if (destsz > RSIZE_MAX || count > RSIZE_MAX) {
-		goto fail;
-	}
-
-	if (count > destsz) {
-		goto fail;
-	}
+	/* Check count <= destsz <= RSIZE_MAX. */
+	CHECK_OR_ZERO_FILL(destsz <= RSIZE_MAX, dest, destsz);
+	CHECK_OR_ZERO_FILL(count <= destsz, dest, destsz);
 
 	memmove(dest, src, count);
-	return;
-
-fail:
-	panic("memmove_s failure");
 }
 
+/**
+ * Returns the length of the null-terminated byte string `str`, examining at
+ * most `strsz` bytes.
+ *
+ * If `str` is a NULL pointer, it returns zero.
+ * If a NULL character is not found, it returns `strsz`.
+ */
 size_t strnlen_s(const char *str, size_t strsz)
 {
-	const char *p = str;
-
 	if (str == NULL) {
 		return 0;
 	}
 
-	while (*p && strsz--) {
-		p++;
+	for (size_t i = 0; i < strsz; ++i) {
+		if (str[i] == '\0') {
+			return i;
+		}
 	}
 
-	return p - str;
+	/* NULL character not found. */
+	return strsz;
 }