diff --git a/docs/bindings/vendor-ibm-astlpc.md b/docs/bindings/vendor-ibm-astlpc.md
index 27f5718..30b6113 100644
--- a/docs/bindings/vendor-ibm-astlpc.md
+++ b/docs/bindings/vendor-ibm-astlpc.md
@@ -93,7 +93,7 @@
 
 ## MCTP over LPC Transport
 
-### Concepts
+### MCTP over LPC: Concepts
 
 The basic components used for the transfer are:
 
@@ -117,7 +117,7 @@
    interrupt
 3. Read the MCTP packet from the LPC FW window
 
-### Scope
+### MCTP over LPC: Scope
 
 The document limits itself to describing the operation of the binding protocol.
 The following issues of protocol ABI are considered out of scope:
@@ -377,7 +377,7 @@
 The sequences below contain steps where the BMC updates the channel status and
 where commands are sent between the BMC and the host. The act of updating status
 or sending a command invokes the behaviour outlined in
-[KCS Control](#kcs-control).
+[KCS Control](#kcs-status-and-control-sequences).
 
 The packet transmission sequences assume that `BMC Active` and `Channel Active`
 are set.
diff --git a/docs/fuzzing.md b/docs/fuzzing.md
index 16beb7a..1fb271f 100644
--- a/docs/fuzzing.md
+++ b/docs/fuzzing.md
@@ -13,14 +13,14 @@
 
 Run with
 
-```
+```shell
 nice honggfuzz -T -i corpusdir --linux_perf_branch -- ./bhf/tests/fuzz/i2c-fuzz
 ```
 
 The `--linux_perf_branch` switch is optional, it requires permissions for perf
 counters:
 
-```
+```shell
 echo 0 | sudo tee /proc/sys/kernel/perf_event_paranoid
 ```
 
@@ -33,7 +33,7 @@
 
 Running a single instance (just for testing):
 
-```
+```shell
 afl-fuzz -i fuzzrun/hf11/ -o fuzzrun/out12single ./bfuzz/tests/fuzz/i2c-fuzz
 ```
 
@@ -42,7 +42,7 @@
 
 Running with 20 threads:
 
-```
+```shell
 nice aflr run  -t bfuzz/tests/fuzz/i2c-fuzz -i workdir/out5/m_i2c-fuzz/queue -o workdir/out6 -c bcmplog/tests/fuzz/i2c-fuzz -s bfuzzasan/tests/fuzz/i2c-fuzz -n 20  --session-name fuzz
 ```
 
@@ -66,7 +66,7 @@
 
 Typical usage, with corpus in `fuzzrun/corpus`:
 
-```
+```shell
 ./tests/fuzz/fuzz-coverage.py fuzzrun/corpus bnoopt/tests/fuzz/i2c-fuzz . bnoopt/ coverage-output
 ```
 
@@ -75,6 +75,6 @@
 When the fuzz run encounters a crash, the testcase can be run against the built
 target manually, and stepped through with GDB etc.
 
-```
+```shell
 ./bnoopt/tests/fuzz/i2c-fuzz < crashing.bin
 ```