diff --git a/native/src/base/misc.cpp b/native/src/base/misc.cpp
index d02f65f8f..0dc6189f6 100644
--- a/native/src/base/misc.cpp
+++ b/native/src/base/misc.cpp
@@ -214,7 +214,11 @@ vector<string_view> split_ro(string_view s, string_view delims) {
 
 #undef vsnprintf
 int vssprintf(char *dest, size_t size, const char *fmt, va_list ap) {
-    return std::min(vsnprintf(dest, size, fmt, ap), (int) size - 1);
+    if (size > 0) {
+        *dest = 0;
+        return std::min(vsnprintf(dest, size, fmt, ap), (int) size - 1);
+    }
+    return -1;
 }
 
 int ssprintf(char *dest, size_t size, const char *fmt, ...) {
diff --git a/native/src/core/bootstages.cpp b/native/src/core/bootstages.cpp
index 5fb3aad03..8908a0750 100644
--- a/native/src/core/bootstages.cpp
+++ b/native/src/core/bootstages.cpp
@@ -126,7 +126,7 @@ static bool magisk_env() {
     string pkg;
     get_manager(0, &pkg);
 
-    sprintf(buf, "%s/0/%s/install", APP_DATA_DIR,
+    ssprintf(buf, sizeof(buf), "%s/0/%s/install", APP_DATA_DIR,
             pkg.empty() ? "xxx" /* Ensure non-exist path */ : pkg.data());
 
     // Alternative binaries paths
diff --git a/native/src/zygisk/deny/utils.cpp b/native/src/zygisk/deny/utils.cpp
index 41ee4752c..776867ecf 100644
--- a/native/src/zygisk/deny/utils.cpp
+++ b/native/src/zygisk/deny/utils.cpp
@@ -41,10 +41,6 @@ static void rescan_apps() {
 
     app_id_to_pkgs.clear();
 
-    struct stat st{};
-    if (xstat("/data/data/com.android.systemui", &st) == 0)
-        sys_ui_app_id = to_app_id(st.st_uid);
-
     auto data_dir = xopen_dir(APP_DATA_DIR);
     if (!data_dir)
         return;
@@ -54,6 +50,7 @@ static void rescan_apps() {
         int dfd = xopenat(dirfd(data_dir.get()), entry->d_name, O_RDONLY);
         if (auto dir = xopen_dir(dfd)) {
             while ((entry = xreaddir(dir.get()))) {
+                struct stat st{};
                 // For each package
                 if (xfstatat(dfd, entry->d_name, &st, 0))
                     continue;
@@ -61,6 +58,8 @@ static void rescan_apps() {
                 if (auto it = pkg_to_procs.find(entry->d_name); it != pkg_to_procs.end()) {
                     app_id_to_pkgs[app_id].insert(it->first);
                 }
+                if (entry->d_name == "com.android.systemui"sv)
+                    sys_ui_app_id = app_id;
             }
         } else {
             close(dfd);