diff --git a/hw/pflash_cfi01.c b/hw/pflash_cfi01.c
index 065dd2c..f50d7ba 100644
--- a/hw/pflash_cfi01.c
+++ b/hw/pflash_cfi01.c
@@ -353,6 +353,8 @@
 
             pfl->counter--;
             break;
+        default:
+            goto error_flash;
         }
         return;
     case 3: /* Confirm mode */
@@ -361,11 +363,14 @@
             if (cmd == 0xd0) {
                 pfl->wcycle = 0;
                 pfl->status |= 0x80;
-                break;
             } else {
                 DPRINTF("%s: unknown command for \"write block\"\n", __func__);
                 PFLASH_BUG("Write block confirm");
+                goto reset_flash;
             }
+            break;
+        default:
+            goto error_flash;
         }
         return;
     default:
diff --git a/vl.c b/vl.c
index b1e0cc7..e54afbf 100644
--- a/vl.c
+++ b/vl.c
@@ -8269,7 +8269,7 @@
         kqemu_allowed = 0;
 #endif
     linux_boot = (kernel_filename != NULL);
-    net_boot = (boot_devices_bitmap >> ('n' - 'a')) && 0xF;
+    net_boot = (boot_devices_bitmap >> ('n' - 'a')) & 0xF;
 
     /* XXX: this should not be: some embedded targets just have flash */
     if (!linux_boot && net_boot == 0 &&