I've checked the new records found by Coverity static analysis tool (one running by EAP QE team, with more info on internal page https://mojo.redhat.com/docs/DOC-180330).

There are two bugs that should be considered to be fixed,:

• RecoveryManager#terminate changes the recovery manager instance to null. But the _recoveryManager is a static variable which should be synchorinzed on class not on the instance. Especially when #manager(boolean method is public static, see https://github.com/jbosstm/narayana/blob/5.10.5.Final/ArjunaCore/arjuna/classes/com/arjuna/ats/arjuna/recovery/RecoveryManager.java#L212
• If the XAResourceRecord is called with params != null then the check verifies if the params length is with equal or more than the value of constant XACONNECTION. If the constant XACONNECTION is zero then for empty params array the access to params[0] will fail with ArrayIndexOutOfBoundsException, see https://github.com/jbosstm/narayana/blob/5.10.5.Final/ArjunaJTA/jta/classes/com/arjuna/ats/internal/jta/resources/arjunacore/XAResourceRecord.java#L126

Plus few minor ones.