diff --git a/lib/libc/tests/secure/Makefile b/lib/libc/tests/secure/Makefile
--- a/lib/libc/tests/secure/Makefile
+++ b/lib/libc/tests/secure/Makefile
@@ -18,10 +18,18 @@
 FORTIFY_TCATS+=	wchar
 
 # Manually run after updating the test generator.
-generate-tests: .PHONY
+lint-generator: .PHONY
+	@if ! which luacheck>/dev/null; then \
+		1>&2 echo "devel/lua-luacheck is required to regenerate and lint these tests"; \
+		exit 1; \
+	fi
+	luacheck ${.CURDIR}/generate-fortify-tests.lua
+
+generate-tests: .PHONY lint-generator
 .for tcat in ${FORTIFY_TCATS}
 ATF_TESTS_C+=	fortify_${tcat}_test
 
+.ORDER: lint-generator generate-tests-${tcat}
 generate-tests: generate-tests-${tcat}
 generate-tests-${tcat}: .PHONY
 	${.CURDIR}/generate-fortify-tests.lua ${tcat} > ${.CURDIR}/fortify_${tcat}_test.c
diff --git a/lib/libc/tests/secure/generate-fortify-tests.lua b/lib/libc/tests/secure/generate-fortify-tests.lua
--- a/lib/libc/tests/secure/generate-fortify-tests.lua
+++ b/lib/libc/tests/secure/generate-fortify-tests.lua
@@ -1113,7 +1113,7 @@
 end
 
 local function generate_stackframe(buftype, bufsize, disposition, heap, def)
-	local function len_offset(inverted, disposition)
+	local function len_offset(inverted)
 		-- Tests that don't use __len in their arguments may use an
 		-- inverted sense because we can't just specify a length that
 		-- would induce an access just after the end.  Instead, we have
@@ -1128,7 +1128,7 @@
 		end
 	end
 
-	local function test_uses_len(def)
+	local function test_uses_len()
 		if def.uses_len then
 			return true
 		end
@@ -1151,8 +1151,8 @@
 	local vars = "\tstruct {\n"
 	vars = vars .. "\t\tuint8_t padding_l;\n"
 
-	local uses_len = test_uses_len(def)
-	local bufsize_offset = len_offset(not uses_len, disposition)
+	local uses_len = test_uses_len()
+	local bufsize_offset = len_offset(not uses_len)
 	local buftype_elem = array_type(buftype)
 	local size_expr = bufsize
 
@@ -1230,7 +1230,7 @@
 		return
 	end
 
-	local function need_addr(buftype)
+	local function need_addr()
 		return not (buftype:match("%[%]") or buftype:match("%*"))
 	end
 
@@ -1292,7 +1292,7 @@
 		end
 
 		if arg == "__buf" then
-			if not heap and need_addr(buftype) then
+			if not heap and need_addr() then
 				body = body .. "&"
 			end