There are a few spots where the coding of libjdwp can be enhanced and made a bit more robust.

In detail:
src/jdk.jdwp.agent/share/native/libjdwp/VirtualMachineImpl.c, static void writePaths(PacketOutputStream *out, char *string):
    strchr could be called with NULL argument because of assignment pos = psPos; in line 856 (last line of for loop). Proposal: check pos for NULL in head of for loop
src/jdk.jdwp.agent/share/native/libjdwp/error_messages.h
    formatting changes
 src/jdk.jdwp.agent/share/native/libjdwp/error_messages.c, static void vprint_message(FILE *fp, const char *prefix, const char *suffix, const char *format, va_list ap):
    potentially unterminated vsnprintf call. Proposal: terminate
src/jdk.jdwp.agent/share/native/libjdwp/eventHandler.c, static jboolean synthesizeUnloadEvent(void *signatureVoid, void *envVoid):
    checking eventBag for NULL and then calling JDI_ASSERT only in that case is a bit dubious. It leads the coverity code scan tool to think that eventBag might be NULL when eventHelper_recordClassUnload is called which would eventually try to dereference a NULL eventbag and hence crash. Proposal: remove the NULL check but unconditionally assert.
src/jdk.jdwp.agent/share/native/libjdwp/invoker.c
    formatting changes
src/jdk.jdwp.agent/share/native/libjdwp/log_messages.c, void log_message_end(const char *format, ...):
    potentially unterminated vsnprintf call. Proposal: terminate