diff --git a/src/DNS_Mgr.cc b/src/DNS_Mgr.cc
index a7747e3c67..53727290ae 100644
--- a/src/DNS_Mgr.cc
+++ b/src/DNS_Mgr.cc
@@ -891,7 +891,7 @@ void DNS_Mgr::Event(EventHandlerPtr e, const DNS_MappingPtr& old_dm, DNS_Mapping
         event_mgr.Enqueue(e, BuildMappingVal(old_dm), BuildMappingVal(new_dm));
 }
 
-ValPtr DNS_Mgr::BuildMappingVal(const DNS_MappingPtr& dm) {
+RecordValPtr DNS_Mgr::BuildMappingVal(const DNS_MappingPtr& dm) {
     if ( ! dm_rec )
         return nullptr;
 
diff --git a/src/DNS_Mgr.h b/src/DNS_Mgr.h
index 3fed818a7f..5d0f9a84b7 100644
--- a/src/DNS_Mgr.h
+++ b/src/DNS_Mgr.h
@@ -32,6 +32,7 @@ class Val;
 class ListVal;
 class TableVal;
 class StringVal;
+class RecordVal;
 
 template<class T>
 class IntrusivePtr;
@@ -39,6 +40,7 @@ using ValPtr = IntrusivePtr<Val>;
 using ListValPtr = IntrusivePtr<ListVal>;
 using TableValPtr = IntrusivePtr<TableVal>;
 using StringValPtr = IntrusivePtr<StringVal>;
+using RecordValPtr = IntrusivePtr<RecordVal>;
 
 } // namespace zeek
 
@@ -263,7 +265,7 @@ protected:
     void Event(EventHandlerPtr e, const DNS_MappingPtr& dm, ListValPtr l1, ListValPtr l2);
     void Event(EventHandlerPtr e, const DNS_MappingPtr& old_dm, DNS_MappingPtr new_dm);
 
-    ValPtr BuildMappingVal(const DNS_MappingPtr& dm);
+    RecordValPtr BuildMappingVal(const DNS_MappingPtr& dm);
 
     void CompareMappings(const DNS_MappingPtr& prev_dm, const DNS_MappingPtr& new_dm);
     ListValPtr AddrListDelta(ListValPtr al1, ListValPtr al2);
diff --git a/src/Type.cc b/src/Type.cc
index 2c5580d50c..2cb68da590 100644
--- a/src/Type.cc
+++ b/src/Type.cc
@@ -2303,7 +2303,7 @@ TypePtr merge_record_types(const Type* t1, const Type* t2) {
     return make_intrusive<RecordType>(tdl3);
 }
 
-TypePtr merge_list_types(const Type* t1, const Type* t2) {
+TypeListPtr merge_list_types(const Type* t1, const Type* t2) {
     const TypeList* tl1 = t1->AsTypeList();
     const TypeList* tl2 = t2->AsTypeList();
 
diff --git a/src/analyzer/protocol/ftp/functions.bif b/src/analyzer/protocol/ftp/functions.bif
index dedeb57c72..bac6e5b370 100644
--- a/src/analyzer/protocol/ftp/functions.bif
+++ b/src/analyzer/protocol/ftp/functions.bif
@@ -4,7 +4,7 @@ type ftp_port: record;
 %%{
 #include "zeek/Reporter.h"
 
-static zeek::ValPtr parse_port(const char* line)
+static zeek::RecordValPtr parse_port(const char* line)
 	{
 	auto r = zeek::make_intrusive<zeek::RecordVal>(zeek::BifType::Record::ftp_port);
 
@@ -47,7 +47,7 @@ static zeek::ValPtr parse_port(const char* line)
 	return r;
 	}
 
-static zeek::ValPtr parse_eftp(const char* line)
+static zeek::RecordValPtr parse_eftp(const char* line)
 	{
 	auto r = zeek::make_intrusive<zeek::RecordVal>(zeek::BifType::Record::ftp_port);
 
diff --git a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
index b1fb8fdc83..7de578a240 100644
--- a/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
+++ b/src/analyzer/protocol/ntlm/ntlm-analyzer.pac
@@ -1,12 +1,12 @@
 %header{
-	zeek::ValPtr filetime2zeektime(uint64_t ts);
+	zeek::IntrusivePtr<zeek::TimeVal> filetime2zeektime(uint64_t ts);
 	zeek::RecordValPtr build_version_record(NTLM_Version* val);
 	zeek::RecordValPtr build_negotiate_flag_record(NTLM_Negotiate_Flags* val);
 %}
 
 %code{
 	// This is replicated from the SMB analyzer. :(
-	zeek::ValPtr filetime2zeektime(uint64_t ts)
+	zeek::IntrusivePtr<zeek::TimeVal> filetime2zeektime(uint64_t ts)
 		{
 		double secs = (ts / 10000000.0);
 
diff --git a/src/analyzer/protocol/rpc/Portmap.cc b/src/analyzer/protocol/rpc/Portmap.cc
index cd93b6b59f..01bc95fe18 100644
--- a/src/analyzer/protocol/rpc/Portmap.cc
+++ b/src/analyzer/protocol/rpc/Portmap.cc
@@ -164,7 +164,7 @@ bool PortmapperInterp::RPC_BuildReply(RPC_CallInfo* c, BifEnum::rpc_status statu
     return true;
 }
 
-ValPtr PortmapperInterp::ExtractMapping(const u_char*& buf, int& len) {
+RecordValPtr PortmapperInterp::ExtractMapping(const u_char*& buf, int& len) {
     static auto pm_mapping = id::find_type<RecordType>("pm_mapping");
     auto mapping = make_intrusive<RecordVal>(pm_mapping);
 
@@ -181,7 +181,7 @@ ValPtr PortmapperInterp::ExtractMapping(const u_char*& buf, int& len) {
     return mapping;
 }
 
-ValPtr PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) {
+RecordValPtr PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) {
     static auto pm_port_request = id::find_type<RecordType>("pm_port_request");
     auto pr = make_intrusive<RecordVal>(pm_port_request);
 
@@ -198,7 +198,7 @@ ValPtr PortmapperInterp::ExtractPortRequest(const u_char*& buf, int& len) {
     return pr;
 }
 
-ValPtr PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len) {
+RecordValPtr PortmapperInterp::ExtractCallItRequest(const u_char*& buf, int& len) {
     static auto pm_callit_request = id::find_type<RecordType>("pm_callit_request");
     auto c = make_intrusive<RecordVal>(pm_callit_request);
 
diff --git a/src/analyzer/protocol/rpc/Portmap.h b/src/analyzer/protocol/rpc/Portmap.h
index efcc52cd37..5f900166fc 100644
--- a/src/analyzer/protocol/rpc/Portmap.h
+++ b/src/analyzer/protocol/rpc/Portmap.h
@@ -19,9 +19,9 @@ protected:
 
     void Event(EventHandlerPtr f, ValPtr request, BifEnum::rpc_status status, ValPtr reply);
 
-    ValPtr ExtractMapping(const u_char*& buf, int& len);
-    ValPtr ExtractPortRequest(const u_char*& buf, int& len);
-    ValPtr ExtractCallItRequest(const u_char*& buf, int& len);
+    RecordValPtr ExtractMapping(const u_char*& buf, int& len);
+    RecordValPtr ExtractPortRequest(const u_char*& buf, int& len);
+    RecordValPtr ExtractCallItRequest(const u_char*& buf, int& len);
 };
 
 } // namespace detail
diff --git a/src/analyzer/protocol/snmp/snmp-analyzer.pac b/src/analyzer/protocol/snmp/snmp-analyzer.pac
index 9ba78073c0..589368fe2f 100644
--- a/src/analyzer/protocol/snmp/snmp-analyzer.pac
+++ b/src/analyzer/protocol/snmp/snmp-analyzer.pac
@@ -10,7 +10,7 @@
 %header{
 zeek::AddrValPtr network_address_to_val(const ASN1Encoding* na);
 zeek::AddrValPtr network_address_to_val(const NetworkAddress* na);
-zeek::ValPtr     asn1_obj_to_val(const ASN1Encoding* obj);
+zeek::RecordValPtr asn1_obj_to_val(const ASN1Encoding* obj);
 
 zeek::RecordValPtr build_hdr(const Header* header);
 zeek::RecordValPtr build_hdrV3(const Header* header);
@@ -42,7 +42,7 @@ zeek::AddrValPtr network_address_to_val(const ASN1Encoding* na)
 	return zeek::make_intrusive<zeek::AddrVal>(ntohl(network_order));
 	}
 
-zeek::ValPtr asn1_obj_to_val(const ASN1Encoding* obj)
+zeek::RecordValPtr asn1_obj_to_val(const ASN1Encoding* obj)
 	{
 	zeek::RecordValPtr rval = zeek::make_intrusive<zeek::RecordVal>(zeek::BifType::Record::SNMP::ObjectValue);
 	uint8 tag = obj->meta()->tag();
diff --git a/src/packet_analysis/protocol/gtpv1/gtpv1-analyzer.pac b/src/packet_analysis/protocol/gtpv1/gtpv1-analyzer.pac
index 7b81126469..eead7bbdc0 100644
--- a/src/packet_analysis/protocol/gtpv1/gtpv1-analyzer.pac
+++ b/src/packet_analysis/protocol/gtpv1/gtpv1-analyzer.pac
@@ -33,7 +33,7 @@ static zeek::ValPtr BuildIMSI(const InformationElement* ie)
 	return zeek::val_mgr->Count(ie->imsi()->value());
 	}
 
-static zeek::ValPtr BuildRAI(const InformationElement* ie)
+static zeek::RecordValPtr BuildRAI(const InformationElement* ie)
 	{
 	auto ev = zeek::make_intrusive<zeek::RecordVal>(zeek::BifType::Record::gtp_rai);
 	ev->Assign(0, ie->rai()->mcc());
@@ -83,7 +83,7 @@ static zeek::ValPtr BuildTraceType(const InformationElement* ie)
 	return zeek::val_mgr->Count(ie->trace_type()->value());
 	}
 
-zeek::ValPtr BuildEndUserAddr(const InformationElement* ie)
+zeek::RecordValPtr BuildEndUserAddr(const InformationElement* ie)
 	{
 	auto ev = zeek::make_intrusive<zeek::RecordVal>(zeek::BifType::Record::gtp_end_user_addr);
 	ev->Assign(0, ie->end_user_addr()->pdp_type_org());
@@ -127,7 +127,7 @@ zeek::ValPtr BuildProtoConfigOptions(const InformationElement* ie)
 	return zeek::make_intrusive<zeek::StringVal>(new zeek::String(d, len, false));
 	}
 
-zeek::ValPtr BuildGSN_Addr(const InformationElement* ie)
+zeek::RecordValPtr BuildGSN_Addr(const InformationElement* ie)
 	{
 	auto ev = zeek::make_intrusive<zeek::RecordVal>(zeek::BifType::Record::gtp_gsn_addr);
 
@@ -153,7 +153,7 @@ zeek::ValPtr BuildMSISDN(const InformationElement* ie)
 	return zeek::make_intrusive<zeek::StringVal>(new zeek::String(d, len, false));
 	}
 
-zeek::ValPtr BuildQoS_Profile(const InformationElement* ie)
+zeek::RecordValPtr BuildQoS_Profile(const InformationElement* ie)
 	{
 	auto ev = zeek::make_intrusive<zeek::RecordVal>(zeek::BifType::Record::gtp_qos_profile);
 
@@ -187,7 +187,7 @@ zeek::ValPtr BuildOMC_ID(const InformationElement* ie)
 	return zeek::make_intrusive<zeek::StringVal>(new zeek::String((const u_char*) d, len, false));
 	}
 
-zeek::ValPtr BuildPrivateExt(const InformationElement* ie)
+zeek::RecordValPtr BuildPrivateExt(const InformationElement* ie)
 	{
 	auto ev = zeek::make_intrusive<zeek::RecordVal>(zeek::BifType::Record::gtp_private_extension);