diff --git a/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/TraceLogging/DataCollector.cs b/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/TraceLogging/DataCollector.cs
index d6c02501c5f8ba..e41ea97b986014 100644
--- a/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/TraceLogging/DataCollector.cs
+++ b/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/TraceLogging/DataCollector.cs
@@ -194,7 +194,7 @@ internal void AddArray(Array? value, int length, int itemSize)
                 length = ushort.MaxValue;
             }
 
-            int size = length * itemSize;
+            int size = checked(length * itemSize);
             if (this.bufferNesting != 0)
             {
                 this.EnsureBuffer(size + 2);
diff --git a/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/TraceLogging/FieldMetadata.cs b/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/TraceLogging/FieldMetadata.cs
index 925044259b962d..61ead226674d5d 100644
--- a/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/TraceLogging/FieldMetadata.cs
+++ b/src/libraries/System.Private.CoreLib/src/System/Diagnostics/Tracing/TraceLogging/FieldMetadata.cs
@@ -206,6 +206,7 @@ public void Encode(ref int pos, byte[]? metadata)
                     if (metadata != null)
                     {
                         Debug.Assert(custom != null);
+                        Debug.Assert(checked(pos + this.fixedCount) <= metadata.Length);
                         Buffer.BlockCopy(custom, 0, metadata, pos, this.fixedCount);
                     }
                     pos += this.fixedCount;
diff --git a/src/libraries/System.Private.CoreLib/src/System/Security/SecureString.cs b/src/libraries/System.Private.CoreLib/src/System/Security/SecureString.cs
index ffdd9402ffe5ac..bdb0d3dba5e985 100644
--- a/src/libraries/System.Private.CoreLib/src/System/Security/SecureString.cs
+++ b/src/libraries/System.Private.CoreLib/src/System/Security/SecureString.cs
@@ -441,6 +441,8 @@ internal static unsafe void Copy(UnmanagedBuffer source, UnmanagedBuffer destina
                     return;
                 }
 
+                Debug.Assert(bytesLength <= destination.ByteLength);
+
                 byte* srcPtr = null, dstPtr = null;
                 try
                 {
diff --git a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.cs b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.cs
index c8ce61359aa8fb..bc0050b44c038c 100644
--- a/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.cs
+++ b/src/libraries/System.Runtime.InteropServices.JavaScript/src/System/Runtime/InteropServices/JavaScript/JSHostImplementation.cs
@@ -109,25 +109,23 @@ public static async Task<JSObject> CancellationHelper(Task<JSObject> jsTask, Can
         public static unsafe JSFunctionBinding GetMethodSignature(ReadOnlySpan<JSMarshalerType> types, string? functionName, string? moduleName)
         {
             int argsCount = types.Length - 1;
-            int size = JSFunctionBinding.JSBindingHeader.JSMarshalerSignatureHeaderSize + ((argsCount + 2) * sizeof(JSFunctionBinding.JSBindingType));
+            int size = checked(JSFunctionBinding.JSBindingHeader.JSMarshalerSignatureHeaderSize + ((argsCount + 2) * sizeof(JSFunctionBinding.JSBindingType)));
 
             int functionNameBytes = 0;
             int functionNameOffset = 0;
             if (functionName != null)
             {
                 functionNameOffset = size;
-                size += 4;
-                functionNameBytes = functionName.Length * 2;
-                size += functionNameBytes;
+                functionNameBytes = checked(functionName.Length * 2);
+                size = checked(size + 4 + functionNameBytes);
             }
             int moduleNameBytes = 0;
             int moduleNameOffset = 0;
             if (moduleName != null)
             {
                 moduleNameOffset = size;
-                size += 4;
-                moduleNameBytes = moduleName.Length * 2;
-                size += moduleNameBytes;
+                moduleNameBytes = checked(moduleName.Length * 2);
+                size = checked(size + 4 + moduleNameBytes);
             }
 
             // this is never unallocated