diff --git a/src/internal.c b/src/internal.c
index 371a67008..25313c8f8 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -3353,7 +3353,8 @@ int wolfSSH_ProcessBuffer(WOLFSSH_CTX* ctx,
             derSz = inSz;
         }
     }
-    else if (format == WOLFSSH_FORMAT_PEM) {
+    /* WOLFSSH_FORMAT_PEM; the format check above admits no other value. */
+    else {
     #ifdef WOLFSSH_CERTS
         if (type == BUFTYPE_CA) {
             /* A CA buffer may hold a bundle, so every block is loaded. */
@@ -3401,9 +3402,6 @@ int wolfSSH_ProcessBuffer(WOLFSSH_CTX* ctx,
         }
         derSz = (word32)ret;
     }
-    else {
-        return WS_UNIMPLEMENTED_E;
-    }
 
     /* Maybe decrypt */
 
diff --git a/tests/unit.c b/tests/unit.c
index dc07c65d2..daf45b546 100644
--- a/tests/unit.c
+++ b/tests/unit.c
@@ -11227,14 +11227,15 @@ static int test_SendChannelTerminalRequestNoTty(void)
     }
 
 done:
+    /* Only reached with a descriptor still open on an already-failed path, so
+     * restore it but keep the original error code. Unlike the TERM block
+     * below, a result check here would never be true. */
     if (stdinCopy >= 0) {
-        if (dup2(stdinCopy, STDIN_FILENO) < 0 && result == 0)
-            result = -1494;
+        (void)dup2(stdinCopy, STDIN_FILENO);
         close(stdinCopy);
     }
     if (stdoutCopy >= 0) {
-        if (dup2(stdoutCopy, STDOUT_FILENO) < 0 && result == 0)
-            result = -1495;
+        (void)dup2(stdoutCopy, STDOUT_FILENO);
         close(stdoutCopy);
     }
     if (termPinned) {