diff --git a/array.c b/array.c
index 9f13b1bf5142b3..d9dff28ad95ebd 100644
--- a/array.c
+++ b/array.c
@@ -1439,10 +1439,12 @@ rb_ary_pop(VALUE ary)
     {
         ary_resize_capa(ary, n * 2);
     }
-    --n;
-    ARY_SET_LEN(ary, n);
+
+    VALUE obj = RARRAY_AREF(ary, n - 1);
+
+    ARY_SET_LEN(ary, n - 1);
     ary_verify(ary);
-    return RARRAY_AREF(ary, n);
+    return obj;
 }
 
 /*
diff --git a/internal/array.h b/internal/array.h
index 398676df4aa80d..3a689646fbb0f4 100644
--- a/internal/array.h
+++ b/internal/array.h
@@ -140,6 +140,8 @@ RARRAY_AREF(VALUE ary, long i)
     VALUE val;
     RBIMPL_ASSERT_TYPE(ary, RUBY_T_ARRAY);
 
+    RUBY_ASSERT(i < RARRAY_LEN(ary));
+
     RBIMPL_WARNING_PUSH();
 #if defined(__GNUC__) && !defined(__clang__) && __GNUC__ == 13
     RBIMPL_WARNING_IGNORED(-Warray-bounds);
diff --git a/load.c b/load.c
index 1c1fe1afa15109..217d7bad847fa5 100644
--- a/load.c
+++ b/load.c
@@ -630,6 +630,7 @@ rb_feature_p(vm_ns_t *vm_ns, const char *feature, const char *ext, int rb, int e
                 index = rb_darray_get(feature_indexes, i);
             }
 
+            if (index >= RARRAY_LEN(features)) continue;
             v = RARRAY_AREF(features, index);
             f = StringValuePtr(v);
             if ((n = RSTRING_LEN(v)) < len) continue;
diff --git a/proc.c b/proc.c
index ae1068e24fe9cf..8f0eb0a898b711 100644
--- a/proc.c
+++ b/proc.c
@@ -3332,9 +3332,10 @@ method_inspect(VALUE method)
         for (int i = 0; i < RARRAY_LEN(params); i++) {
             pair = RARRAY_AREF(params, i);
             kind = RARRAY_AREF(pair, 0);
-            name = RARRAY_AREF(pair, 1);
-            // FIXME: in tests it turns out that kind, name = [:req] produces name to be false. Why?..
-            if (NIL_P(name) || name == Qfalse) {
+            if (RARRAY_LEN(pair) > 1) {
+                name = RARRAY_AREF(pair, 1);
+            }
+            else {
                 // FIXME: can it be reduced to switch/case?
                 if (kind == req || kind == opt) {
                     name = rb_str_new2("_");
@@ -3348,6 +3349,9 @@ method_inspect(VALUE method)
                 else if (kind == nokey) {
                     name = rb_str_new2("nil");
                 }
+                else {
+                    name = Qnil;
+                }
             }
 
             if (kind == req) {
diff --git a/vm_backtrace.c b/vm_backtrace.c
index cc8607b2d724c7..aaa0b5051cc637 100644
--- a/vm_backtrace.c
+++ b/vm_backtrace.c
@@ -858,7 +858,7 @@ rb_backtrace_to_location_ary(VALUE self)
 VALUE
 rb_location_ary_to_backtrace(VALUE ary)
 {
-    if (!RB_TYPE_P(ary, T_ARRAY) || !rb_frame_info_p(RARRAY_AREF(ary, 0))) {
+    if (!RB_TYPE_P(ary, T_ARRAY) || RARRAY_LEN(ary) == 0 || !rb_frame_info_p(RARRAY_AREF(ary, 0))) {
         return Qfalse;
     }