diff --git a/tests/grp_pwd_test.cpp b/tests/grp_pwd_test.cpp
index bf65720..65a54a6 100644
--- a/tests/grp_pwd_test.cpp
+++ b/tests/grp_pwd_test.cpp
@@ -441,6 +441,17 @@
     }
     return result;
   };
+
+  // AID_PRNG_SEEDER (1092) was added in TM-QPR2, but CTS is shared
+  // across Android 13 versions so we may or may not find it in this
+  // test (b/253185870).
+  if (android::base::GetIntProperty("ro.build.version.sdk", 0) == __ANDROID_API_T__) {
+#ifndef AID_PRNG_SEEDER
+#define AID_PRNG_SEEDER 1092
+#endif
+    ids.erase(AID_PRNG_SEEDER);
+    expected_ids.erase(AID_PRNG_SEEDER);
+  }
   EXPECT_EQ(expected_ids, ids) << return_differences();
 }
 #endif
diff --git a/tests/gwp_asan_test.cpp b/tests/gwp_asan_test.cpp
index b2c7780..23fb8b9 100644
--- a/tests/gwp_asan_test.cpp
+++ b/tests/gwp_asan_test.cpp
@@ -50,6 +50,15 @@
          R"(\[  PASSED  \] [1-9]+0? test)");
 }
 
+// GWP-ASan tests can run much slower, especially when combined with HWASan.
+// Triple the deadline to avoid flakes (b/238585984).
+extern "C" bool GetInitialArgs(const char*** args, size_t* num_args) {
+  static const char* initial_args[] = {"--deadline_threshold_ms=270000"};
+  *args = initial_args;
+  *num_args = 1;
+  return true;
+}
+
 // This file implements "torture testing" under GWP-ASan, where we sample every
 // single allocation. The upper limit for the number of GWP-ASan allocations in
 // the torture mode is is generally 40,000, so that svelte devices don't
diff --git a/tests/heap_tagging_level_test.cpp b/tests/heap_tagging_level_test.cpp
index 96c2ffd..ae678b7 100644
--- a/tests/heap_tagging_level_test.cpp
+++ b/tests/heap_tagging_level_test.cpp
@@ -222,6 +222,7 @@
 
 TEST_P(MemtagNoteTest, SEGV) {
 #if defined(__BIONIC__) && defined(__aarch64__)
+  SKIP_WITH_NATIVE_BRIDGE;  // http://b/242170715
   // Note that we do not check running_with_hwasan() - what matters here is whether the test binary
   // itself is built with HWASan.
   bool withHWASAN = __has_feature(hwaddress_sanitizer);
diff --git a/tests/mntent_test.cpp b/tests/mntent_test.cpp
index b86af9f..4b8fc9a 100644
--- a/tests/mntent_test.cpp
+++ b/tests/mntent_test.cpp
@@ -19,24 +19,40 @@
 #include <mntent.h>
 
 TEST(mntent, mntent_smoke) {
+  // Read all the entries with getmntent().
   FILE* fp = setmntent("/proc/mounts", "r");
   ASSERT_TRUE(fp != nullptr);
 
-  ASSERT_TRUE(getmntent(fp) != nullptr);
+  std::vector<std::string> fsnames;
+  std::vector<std::string> dirs;
+  mntent* me;
+  while ((me = getmntent(fp)) != nullptr) {
+    fsnames.push_back(me->mnt_fsname);
+    dirs.push_back(me->mnt_dir);
+  }
 
-  bool saw_proc = false;
+  ASSERT_EQ(1, endmntent(fp));
+
+  // Then again with getmntent_r(), checking they match.
+  fp = setmntent("/proc/mounts", "r");
+  ASSERT_TRUE(fp != nullptr);
 
   struct mntent entry;
   char buf[BUFSIZ];
+  size_t i = 0;
   while (getmntent_r(fp, &entry, buf, sizeof(buf)) != nullptr) {
-    if (strcmp(entry.mnt_fsname, "proc") == 0 && strcmp(entry.mnt_dir, "/proc") == 0) {
-      saw_proc = true;
-    }
+    ASSERT_EQ(fsnames[i], entry.mnt_fsname);
+    ASSERT_EQ(dirs[i], entry.mnt_dir);
+    i++;
   }
 
-  ASSERT_TRUE(saw_proc);
-
   ASSERT_EQ(1, endmntent(fp));
+
+  // And just for good measure: we did see a /proc entry, right?
+  auto it = std::find(fsnames.begin(), fsnames.end(), "proc");
+  ASSERT_TRUE(it != fsnames.end());
+  size_t proc_index = it - fsnames.begin();
+  ASSERT_EQ("/proc", dirs[proc_index]);
 }
 
 TEST(mntent, hasmntopt) {
diff --git a/tests/stack_protector_test_helper.cpp b/tests/stack_protector_test_helper.cpp
index fd90b93..eddd940 100644
--- a/tests/stack_protector_test_helper.cpp
+++ b/tests/stack_protector_test_helper.cpp
@@ -19,7 +19,8 @@
   // We can't use memset here because it's fortified, and we want to test
   // the line of defense *after* that.
   // Without volatile, the generic x86/x86-64 targets don't write to the stack.
-  volatile char* p;
-  p = reinterpret_cast<volatile char*>(&p + 1);
-  *p = '\0';
+  // We can't make a constant change, since the existing byte might already have
+  // had that value.
+  volatile char* p = reinterpret_cast<volatile char*>(&p + 1);
+  *p = ~*p;
 }