diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 55856ca2af..1a9959cf44 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,10 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
+        distro: [debian, fedora, tumbleweed]
         compiler: [gcc, clang]
         buildtype: [debug, release]
     container:
-      image: ghcr.io/linux-nvme/debian:latest
+      image: ghcr.io/linux-nvme/${{ matrix.distro }}:latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Mark repo as safe for git
@@ -37,10 +38,11 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        compiler: [gcc, clang]
-        buildtype: [debug, release]
+        distro: [debian]
+        compiler: [gcc]
+        buildtype: [release]
     container:
-      image: ghcr.io/linux-nvme/debian:latest
+      image: ghcr.io/linux-nvme/${{ matrix.distro }}:latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Mark repo as safe for git
diff --git a/libnvme/src/nvme/mi.c b/libnvme/src/nvme/mi.c
index f5153a6e9d..effb703701 100644
--- a/libnvme/src/nvme/mi.c
+++ b/libnvme/src/nvme/mi.c
@@ -1440,6 +1440,8 @@ void nvme_mi_aem_aeolli_set_aeoltl(struct nvme_mi_aem_occ_list_hdr *hdr, __u32 a
 
 static int validate_enabled_list(struct nvme_mi_aem_supported_list *list, size_t len)
 {
+	if (len < sizeof(struct nvme_mi_aem_supported_list))
+		return -EPROTO;
 	if (list->hdr.aeslver != 0)
 		return -EPROTO;
 	if (list->hdr.aeslhl != sizeof(struct nvme_mi_aem_supported_list))
diff --git a/libnvme/test/ioctl/misc.c b/libnvme/test/ioctl/misc.c
index dcd82fe6fb..3045267c62 100644
--- a/libnvme/test/ioctl/misc.c
+++ b/libnvme/test/ioctl/misc.c
@@ -989,7 +989,7 @@ static void test_copy(void)
 
 	_cleanup_free_ struct nvme_copy_range *copy = NULL;
 
-	copy = malloc(copy_size);
+	copy = calloc(1, copy_size);
 	check(copy, "copy: ENOMEM");
 
 	struct mock_cmd mock_io_cmd = {