log_errx() never returns, so str can't be NULL here. Same below.

Here and in the other two places you check if str is not null, but I think it would read clearer if you added the cur_port->pp = 0; to the existing conditional expression and, after an else, the cur_port->pp = strtoul(str, NULL, 0);.

great I will drop these patches

I don't think serial_num or device_id is expected to be NULL terminated, i.e., they are not C strings, so the change looks wrong since it might truncate the last byte by inserting a nul terminator.

When can l_backend be NULL? Why don't kernel_lun_add() or kernel_lun_remove() need similar treatment?

If log_err* aren't marked as __dead2, then adding that might help Coverity to avoid adding false positives. Hmm, both log_err() and log_errx() are marked as __dead2, so not sure why Coverity didn't grok that?

Confirmed by digging around in the ctl code that the destination are fixed-length buffers that do not necessarily hold C strings. We need to avoid overflowing the source as the source is a C string (hence using strncpy and not memcpy), but the target does not need a nul.

It is never NULL. In other places in ctld we always give it a value, e.g. in conf_verify_lun in ctld.c:

	if (lun->l_backend == NULL)
		lun_set_backend(lun, "block");

strncpy is the right thing here because it's a fixed length string. That's what it was written for. Same for model, etc.

also a fixed length string, so strncpy is right.