diff --git a/ncat/ncat_core.h b/ncat/ncat_core.h
index 804ac9475..3a53fb1a1 100644
--- a/ncat/ncat_core.h
+++ b/ncat/ncat_core.h
@@ -165,7 +165,7 @@ enum exec_mode {
 #define PROXYDNS_REMOTE 2
 
 struct options {
-    unsigned int portno;
+    u32 portno;
 
     int verbose;
     int debug;
diff --git a/ncat/ncat_main.c b/ncat/ncat_main.c
index 3666f50a5..a1107e911 100644
--- a/ncat/ncat_main.c
+++ b/ncat/ncat_main.c
@@ -287,8 +287,9 @@ int main(int argc, char *argv[])
     struct host_list_node *deny_host_list = NULL;
 
     unsigned short proxyport;
-    long max_port = 65535;
-    long srcport = -1;
+    /* vsock ports are 32 bits, so port variables must be at least that wide. */
+    u32 max_port = 65535;
+    s64 srcport = -1;
     char *source = NULL;
 
     struct option long_options[] = {
@@ -454,7 +455,7 @@ int main(int argc, char *argv[])
             break;
         case 'p':
             errno = 0;
-            srcport = strtol(optarg, NULL, 10);
+            srcport = strtoul(optarg, NULL, 10);
             if (errno != 0 || srcport < 0)
                 bye("Invalid source port %ld.", srcport);
             break;
@@ -958,14 +959,14 @@ int main(int argc, char *argv[])
         loguser_noprefix(". QUITTING.\n");
         exit(2);
     } else if (optind + 1 == argc) {
-        long long_port;
+        u64 long_port;
 
         errno = 0;
-        long_port = strtol(argv[optind], NULL, 10);
-        if (errno != 0 || long_port < 0 || long_port > max_port)
+        long_port = strtoul(argv[optind], NULL, 10);
+        if (errno != 0 || long_port > max_port)
             bye("Invalid port number \"%s\".", argv[optind]);
 
-        o.portno = (unsigned int) long_port;
+        o.portno = (u32) long_port;
     }
 
     if (o.proxytype && !o.listen)
@@ -1001,7 +1002,7 @@ int main(int argc, char *argv[])
         if (o.listen) {
             /* Treat "ncat -l -p <port>" the same as "ncat -l <port>" for nc
                compatibility. */
-            o.portno = srcport;
+            o.portno = (u32) srcport;
         } else {
             if (srcaddr.storage.ss_family == AF_UNSPEC) {
                 /* We have a source port but not an explicit source address;
diff --git a/ncat/util.c b/ncat/util.c
index 0cdacee6d..3ce3b8168 100644
--- a/ncat/util.c
+++ b/ncat/util.c
@@ -535,6 +535,8 @@ int do_listen(int type, int proto, const union sockaddr_u *srcaddr_u)
     return sock;
 }
 
+/* Only used in proxy connect functions, so doesn't need to support address
+ * families that don't support proxying like AF_UNIX and AF_VSOCK */
 int do_connect(int type)
 {
     int sock = 0;