diff --git a/lib/Makefile.am b/lib/Makefile.am
index 1154a12aca..6ed1a6e1d9 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -112,6 +112,7 @@ libshadow_la_SOURCES = \
 	isexpired.c \
 	limits.c \
 	list.c \
+	list.h \
 	lockpw.c \
 	loginprompt.c \
 	mail.c \
diff --git a/lib/age.c b/lib/age.c
index fe8b0e6198..0da755f7d0 100644
--- a/lib/age.c
+++ b/lib/age.c
@@ -125,7 +125,8 @@ int expire (const struct passwd *pw, /*@null@*/const struct spwd *sp)
 		exit (EXIT_FAILURE);
 	}
 
-	while (((child = wait (&status)) != pid) && (child != (pid_t)-1));
+	while (((child = wait (&status)) != pid) && (child != (pid_t)-1))
+		continue;
 
 	if ((child == pid) && (0 == status)) {
 		return 1;
diff --git a/lib/cleanup.c b/lib/cleanup.c
index 4fc12eae88..9d39afec63 100644
--- a/lib/cleanup.c
+++ b/lib/cleanup.c
@@ -78,7 +78,8 @@ void add_cleanup (/*@notnull@*/cleanup_function pcf, /*@null@*/void *arg)
 	}
 
 	/* Add the cleanup_function at the end of the stack */
-	for (i=0; NULL != cleanup_functions[i]; i++);
+	for (i=0; NULL != cleanup_functions[i]; i++)
+		continue;
 	cleanup_functions[i] = pcf;
 	cleanup_function_args[i] = arg;
 }
diff --git a/lib/groupio.c b/lib/groupio.c
index 119afa33df..2b08bd06de 100644
--- a/lib/groupio.c
+++ b/lib/groupio.c
@@ -330,7 +330,8 @@ static /*@null@*/struct commonio_entry *merge_group_entries (
 		return NULL;
 
 	/* Concatenate the 2 list of members */
-	for (i=0; NULL != gptr1->gr_mem[i]; i++);
+	for (i=0; NULL != gptr1->gr_mem[i]; i++)
+		continue;
 	members += i;
 	for (i=0; NULL != gptr2->gr_mem[i]; i++) {
 		char **pmember = gptr1->gr_mem;
@@ -400,7 +401,8 @@ static int split_groups (unsigned int max_members)
 		if (NULL == gptr) {
 			continue;
 		}
-		for (members = 0; NULL != gptr->gr_mem[members]; members++);
+		for (members = 0; NULL != gptr->gr_mem[members]; members++)
+			continue;
 		if (members <= max_members) {
 			continue;
 		}
diff --git a/lib/groupmem.c b/lib/groupmem.c
index 1ebe2f9ba0..19efa11775 100644
--- a/lib/groupmem.c
+++ b/lib/groupmem.c
@@ -46,7 +46,8 @@
 		return NULL;
 	}
 
-	for (i = 0; grent->gr_mem[i]; i++);
+	for (i = 0; grent->gr_mem[i]; i++)
+		continue;
 
 	/*@-mustfreeonly@*/
 	gr->gr_mem = malloc_T(i + 1, char *);
diff --git a/lib/limits.c b/lib/limits.c
index 3fabe54d3a..c590c3e814 100644
--- a/lib/limits.c
+++ b/lib/limits.c
@@ -17,21 +17,20 @@
 
 #ifndef USE_PAM
 
-#ident "$Id$"
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <stdio.h>
 #include <ctype.h>
-#include "prototypes.h"
-#include "defines.h"
 #include <pwd.h>
-#include "getdef.h"
-#include "shadowlog.h"
+#include <stdio.h>
+#include <sys/types.h>
+#include <sys/stat.h>
 #include <sys/resource.h>
 
 #include "atoi/a2i.h"
 #include "io/fgets/fgets.h"
+#include "defines.h"
+#include "list.h"
+#include "getdef.h"
+#include "prototypes.h"
+#include "shadowlog.h"
 #include "string/memset/memzero.h"
 #include "string/strcmp/streq.h"
 #include "string/strcmp/strprefix.h"
diff --git a/lib/list.c b/lib/list.c
index 8fa0e085ac..aaf6bfe5a0 100644
--- a/lib/list.c
+++ b/lib/list.c
@@ -8,13 +8,16 @@
 
 #include "config.h"
 
+#include "list.h"
+
+#include <stddef.h>
+#include <stdlib.h>
+
 #include "alloc/malloc.h"
-#include "prototypes.h"
 #include "defines.h"
-#include "string/strchr/strchrcnt.h"
 #include "string/strcmp/streq.h"
 #include "string/strdup/strdup.h"
-#include "string/strtok/strsep2ls.h"
+#include "string/strtok/astrsep2ls.h"
 
 #undef NDEBUG
 #include <assert.h>
@@ -141,7 +144,8 @@ dup_list(char *const *list)
 
 	assert (NULL != list);
 
-	for (i = 0; NULL != list[i]; i++);
+	for (i = 0; NULL != list[i]; i++)
+		continue;
 
 	tmp = xmalloc_T(i + 1, char *);
 
@@ -197,7 +201,6 @@ comma_to_list(const char *comma)
 {
 	char *members;
 	char **array;
-	size_t  n;
 
 	assert (NULL != comma);
 
@@ -207,26 +210,29 @@ comma_to_list(const char *comma)
 
 	members = xstrdup (comma);
 
-	/*
-	 * Allocate the array we're going to store the pointers into.
-	 * n: number of delimiters + last element + NULL
-	 */
+	array = acsv2ls(members);
+	if (array == NULL)
+		exit(EXIT_FAILURE);
 
-	n = strchrcnt(members, ',') + 2;
-	array = xmalloc_T(n, char *);
+	if (array[0] == NULL)
+		free(members);
 
-	/*
-	 * Empty list is special - 0 members, not 1 empty member.  --marekm
-	 */
+	return array;
+}
 
-	if (streq(members, "")) {
-		*array = NULL;
-		free (members);
-		return array;
-	}
 
-	strsep2ls(members, ",", n, array);
+char **
+acsv2ls(char *s)
+{
+	char    **l;
+	size_t  n;
+
+	l = astrsep2ls(s, ",", &n);
+	if (l == NULL)
+		return NULL;
 
-	return array;
-}
+	if (streq(l[n-1], ""))
+		l[n-1] = NULL;
 
+	return l;
+}
diff --git a/lib/list.h b/lib/list.h
new file mode 100644
index 0000000000..7cf81939ee
--- /dev/null
+++ b/lib/list.h
@@ -0,0 +1,23 @@
+// SPDX-FileCopyrightText: 2025, Alejandro Colomar <alx@kernel.org>
+// SPDX-License-Identifier: BSD-3-Clause
+
+
+#ifndef SHADOW_INCLUDE_LIB_LIST_H_
+#define SHADOW_INCLUDE_LIB_LIST_H_
+
+
+#include "config.h"
+
+#include <stdbool.h>
+
+
+extern /*@only@*/char **add_list (/*@returned@*/ /*@only@*/char **, const char *);
+extern /*@only@*/char **del_list (/*@returned@*/ /*@only@*/char **, const char *);
+extern /*@only@*/char **dup_list (char *const *);
+extern void free_list (char **);
+extern bool is_on_list (char *const *list, const char *member);
+extern /*@only@*/char **comma_to_list (const char *);
+extern char **acsv2ls(char *s);
+
+
+#endif  // include guard
diff --git a/lib/prototypes.h b/lib/prototypes.h
index 8fb9f190d9..59a7d896f4 100644
--- a/lib/prototypes.h
+++ b/lib/prototypes.h
@@ -183,14 +183,6 @@ void audit_logger_with_group(int type, const char *op, const char *name,
 extern void setup_limits (const struct passwd *);
 #endif
 
-/* list.c */
-extern /*@only@*/char **add_list (/*@returned@*/ /*@only@*/char **, const char *);
-extern /*@only@*/char **del_list (/*@returned@*/ /*@only@*/char **, const char *);
-extern /*@only@*/char **dup_list (char *const *);
-extern void free_list (char **);
-extern bool is_on_list (char *const *list, const char *member);
-extern /*@only@*/char **comma_to_list (const char *);
-
 #ifdef ENABLE_LASTLOG
 /* log.c */
 extern void dolastlog (
diff --git a/lib/sgroupio.c b/lib/sgroupio.c
index ad3adc3463..afe12fefb7 100644
--- a/lib/sgroupio.c
+++ b/lib/sgroupio.c
@@ -56,7 +56,8 @@
 		return NULL;
 	}
 
-	for (i = 0; NULL != sgent->sg_adm[i]; i++);
+	for (i = 0; NULL != sgent->sg_adm[i]; i++)
+		continue;
 	/*@-mustfreeonly@*/
 	sg->sg_adm = malloc_T(i + 1, char *);
 	/*@=mustfreeonly@*/
@@ -81,7 +82,8 @@
 	}
 	sg->sg_adm[i] = NULL;
 
-	for (i = 0; NULL != sgent->sg_mem[i]; i++);
+	for (i = 0; NULL != sgent->sg_mem[i]; i++)
+		continue;
 	/*@-mustfreeonly@*/
 	sg->sg_mem = malloc_T(i + 1, char *);
 	/*@=mustfreeonly@*/
diff --git a/lib/shadow/group/sgetgrent.c b/lib/shadow/group/sgetgrent.c
index 2a13091ef0..af1d7add8e 100644
--- a/lib/shadow/group/sgetgrent.c
+++ b/lib/shadow/group/sgetgrent.c
@@ -18,41 +18,9 @@
 
 #include "alloc/malloc.h"
 #include "atoi/getnum.h"
-#include "defines.h"
-#include "prototypes.h"
-#include "string/strcmp/streq.h"
+#include "list.h"
 #include "string/strtok/stpsep.h"
 #include "string/strtok/strsep2arr.h"
-#include "string/strtok/astrsep2ls.h"
-
-
-/*
- * list - turn a comma-separated string into an array of (char *)'s
- *
- *	list() converts the comma-separated list of member names into
- *	an array of character pointers.
- *
- * FINALLY added dynamic allocation.  Still need to fix sgetsgent().
- *  --marekm
- */
-static char **
-list(char *s)
-{
-	static char **members = NULL;
-
-	size_t  n;
-
-	free(members);
-
-	members = astrsep2ls(s, ",", &n);
-	if (members == NULL)
-		return NULL;
-
-	if (streq(members[n-1], ""))
-		members[n-1] = NULL;
-
-	return members;
-}
 
 
 // from-string get group entry
@@ -60,7 +28,7 @@ struct group *
 sgetgrent(const char *s)
 {
 	static char         *dup = NULL;
-	static struct group grent;
+	static struct group grent = {};
 
 	char  *fields[4];
 
@@ -74,15 +42,14 @@ sgetgrent(const char *s)
 	if (strsep2arr_a(dup, ":", fields) == -1)
 		return NULL;
 
-	if (streq(fields[2], ""))
-		return NULL;
-
 	grent.gr_name = fields[0];
 	grent.gr_passwd = fields[1];
-	if (get_gid(fields[2], &grent.gr_gid) == -1) {
+	if (get_gid(fields[2], &grent.gr_gid) == -1)
 		return NULL;
-	}
-	grent.gr_mem = list(fields[3]);
+
+	free(grent.gr_mem);
+
+	grent.gr_mem = acsv2ls(fields[3]);
 	if (NULL == grent.gr_mem) {
 		return NULL;	/* out of memory */
 	}
diff --git a/lib/shadow/gshadow/sgetsgent.c b/lib/shadow/gshadow/sgetsgent.c
index a239b45ad9..c2f60cdeb8 100644
--- a/lib/shadow/gshadow/sgetsgent.c
+++ b/lib/shadow/gshadow/sgetsgent.c
@@ -14,9 +14,9 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "list.h"
 #include "shadow/gshadow/sgrp.h"
 #include "string/strcmp/streq.h"
-#include "string/strtok/astrsep2ls.h"
 #include "string/strtok/stpsep.h"
 #include "string/strtok/strsep2arr.h"
 
@@ -25,9 +25,6 @@
 static struct sgrp  sgroup = {};
 
 
-static char **build_list(char *s);
-
-
 // from-string get shadow group entry
 struct sgrp *
 sgetsgent(const char *s)
@@ -52,24 +49,12 @@ sgetsgent(const char *s)
 	free(sgroup.sg_adm);
 	free(sgroup.sg_mem);
 
-	sgroup.sg_adm = build_list(fields[2]);
-	sgroup.sg_mem = build_list(fields[3]);
-
-	return &sgroup;
-}
-
+	sgroup.sg_adm = acsv2ls(fields[2]);
+	sgroup.sg_mem = acsv2ls(fields[3]);
 
-static char **
-build_list(char *s)
-{
-	char    **l;
-	size_t  n;
-
-	l = xastrsep2ls(s, ",", &n);
-
-	if (streq(l[n-1], ""))
-		l[n-1] = NULL;
+	if (sgroup.sg_adm == NULL || sgroup.sg_mem == NULL)
+		return NULL;
 
-	return l;
+	return &sgroup;
 }
 #endif
diff --git a/src/chgpasswd.c b/src/chgpasswd.c
index 5c594d6219..88fc746d5d 100644
--- a/src/chgpasswd.c
+++ b/src/chgpasswd.c
@@ -22,6 +22,7 @@
 #include "defines.h"
 #include "groupio.h"
 #include "io/fprintf.h"
+#include "list.h"
 #include "nscd.h"
 #include "sssd.h"
 #include "prototypes.h"
diff --git a/src/gpasswd.c b/src/gpasswd.c
index 3e68632a3f..272ae8eaa0 100644
--- a/src/gpasswd.c
+++ b/src/gpasswd.c
@@ -28,6 +28,7 @@
 #include "exitcodes.h"
 #include "groupio.h"
 #include "io/fprintf.h"
+#include "list.h"
 #include "nscd.h"
 #include "prototypes.h"
 #ifdef SHADOWGRP
diff --git a/src/groupadd.c b/src/groupadd.c
index 483d282283..68a2724ca5 100644
--- a/src/groupadd.c
+++ b/src/groupadd.c
@@ -26,6 +26,7 @@
 #include "groupio.h"
 #include "io/fprintf.h"
 #include "io/syslog.h"
+#include "list.h"
 #include "nscd.h"
 #include "sssd.h"
 #include "prototypes.h"
diff --git a/src/groupdel.c b/src/groupdel.c
index 19d67fc315..dfebdc5927 100644
--- a/src/groupdel.c
+++ b/src/groupdel.c
@@ -267,7 +267,8 @@ static void group_busy (gid_t gid)
 
 	prefix_setpwent ();
 
-	while ( ((pwd = prefix_getpwent ()) != NULL) && (pwd->pw_gid != gid) );
+	while ( ((pwd = prefix_getpwent ()) != NULL) && (pwd->pw_gid != gid) )
+		continue;
 
 	prefix_endpwent ();
 
diff --git a/src/groupmod.c b/src/groupmod.c
index f847c9939b..b177cbf002 100644
--- a/src/groupmod.c
+++ b/src/groupmod.c
@@ -27,6 +27,7 @@
 #include "defines.h"
 #include "groupio.h"
 #include "io/fprintf.h"
+#include "list.h"
 #include "nscd.h"
 #include "prototypes.h"
 #include "pwio.h"
diff --git a/src/newgrp.c b/src/newgrp.c
index 69ee7c5611..e1fc8ad3a4 100644
--- a/src/newgrp.c
+++ b/src/newgrp.c
@@ -25,6 +25,7 @@
 #include "exitcodes.h"
 #include "getdef.h"
 #include "io/fprintf.h"
+#include "list.h"
 #include "prototypes.h"
 #include "search/l/lfind.h"
 #include "search/l/lsearch.h"
diff --git a/src/su.c b/src/su.c
index cc74ab3a74..56a3379e94 100644
--- a/src/su.c
+++ b/src/su.c
@@ -54,6 +54,7 @@
 #include "exitcodes.h"
 #include "getdef.h"
 #include "io/fprintf.h"
+#include "list.h"
 #ifdef USE_PAM
 #include "pam_defs.h"
 #endif				/* USE_PAM */
diff --git a/src/suauth.c b/src/suauth.c
index 453f9a4dfa..246f4db198 100644
--- a/src/suauth.c
+++ b/src/suauth.c
@@ -20,6 +20,7 @@
 #include "defines.h"
 #include "io/fgets/fgets.h"
 #include "io/syslog.h"
+#include "list.h"
 #include "prototypes.h"
 #include "string/strcmp/streq.h"
 #include "string/strcmp/strprefix.h"
diff --git a/src/useradd.c b/src/useradd.c
index a56d737123..8159b424de 100644
--- a/src/useradd.c
+++ b/src/useradd.c
@@ -44,6 +44,7 @@
 #include "io/fgets/fgets.h"
 #include "io/fprintf.h"
 #include "io/syslog.h"
+#include "list.h"
 #include "nscd.h"
 #include "prototypes.h"
 #include "pwauth.h"
diff --git a/src/userdel.c b/src/userdel.c
index 20f28281c1..7261db3d65 100644
--- a/src/userdel.c
+++ b/src/userdel.c
@@ -26,6 +26,7 @@
 #include "groupio.h"
 #include "io/fprintf.h"
 #include "io/syslog.h"
+#include "list.h"
 #include "nscd.h"
 #include "sssd.h"
 #include "prototypes.h"
diff --git a/src/usermod.c b/src/usermod.c
index bd9dc82c64..73eb9b321c 100644
--- a/src/usermod.c
+++ b/src/usermod.c
@@ -40,6 +40,7 @@
 #include "groupio.h"
 #include "io/fprintf.h"
 #include "io/syslog.h"
+#include "list.h"
 #include "nscd.h"
 #include "prototypes.h"
 #include "pwauth.h"