FreeBSD/src f908fbbsys/dev/iavf if_iavf_iflib.c iavf_vc_common.c

iavf: Honor PF-negotiated RSS sizes

Use the key and lookup table lengths returned by GET_VF_RESOURCES when
configuring RSS through virtchnl, as DPDK does.  The Windows E835 PF
advertises a 40-byte key and rejects our fixed 52-byte CONFIG_RSS_KEY
request, leaving receive traffic on queue zero.

Validate the negotiated lengths before constructing AdminQ messages and
publish the lookup table size to iflib.  Preserve register-mode RSS
selection and its fixed hardware sizes.  Use aligned, zero initialized
key storage so an RSS kernel's 40-byte key does not leave an uninitialized
tail when the PF requests 52 bytes.

Validation: normal and RSS enabled iavf module builds passed.  On an E835
VF under Hyper-V Server 2025, repeated IPv4 and IPv6 receive tests used all
three configured guest RX queues in both transparent hn and non-transparent
lagg modes.  The RSS key rejection disappeared, IPv4 transmit tests passed,
and no TX watchdog fired.  Each traffic case used three runs of 16 streams.


    [3 lines not shown]
DeltaFile
+14-1sys/dev/iavf/iavf_lib.c
+4-4sys/dev/iavf/iavf_vc_common.c
+3-0sys/dev/iavf/if_iavf_iflib.c
+21-53 files

FreeBSD/src f74d7fcsys/dev/thunderbolt router.c

thunderbolt: Account for CRC in router config write message size

Fixes:          9c6e9bfb3474 ("thunderbolt: Support writing to router config space")
Sponsored by:   The FreeBSD Foundation
DeltaFile
+2-1sys/dev/thunderbolt/router.c
+2-11 files

FreeBSD/src 3189611sys/dev/hyperv/netvsc if_hnvar.h if_hn.c

hn: Forward capability changes to transparent VFs

The transparent VF capability handler ignored the requested change and
only copied the VF's enabled capabilities.  Forward SIOCSIFCAP to the VF
and return its result.  Preserve VF capabilities which hn does not expose.

Limit advertised capabilities to those supported by the transparent
packet path and VLAN relay.  Do not inherit VF services such as send tags
or the extended capability ioctl when hn has no corresponding methods.
At handoff, adopt the VF's enabled offloads without reconfiguring it.

Mark the datapath as switching while the VF applies a capability change,
since its ioctl may reinitialize the device.  If the association is still
ready and unchanged afterwards, synchronize hn with the actual VF state
even on error and restrict checksum assistance to the forwarded offloads.
Republish link state suppressed during the transition when the VF is
still ready.  Refresh VLAN child capabilities after adoption and when
restoring the synthetic path.


    [9 lines not shown]
DeltaFile
+112-20sys/dev/hyperv/netvsc/if_hn.c
+2-0sys/dev/hyperv/netvsc/if_hnvar.h
+114-202 files

FreeBSD/src 83b3088sys/dev/hyperv/netvsc if_hnvar.h if_hn.c

hn: Relay VLAN membership to transparent VFs

VLANs configured on the synthetic interface do not otherwise reach the
accelerating VF's VLAN callbacks.  Those callbacks can be needed for
hardware filter membership or for interpreting stripped VLAN tags, even
though no vlan interface is attached directly to the VF.

Subscribe to VLAN events only in transparent mode and schedule the
existing VF task.  Snapshot the synthetic interface's VLAN topology under
network epoch, then leave epoch before invoking the VF callbacks, which
may sleep.  Do not acquire hn_lock or configure the VF from a VLAN event
handler; the worker applies membership outside the VLAN configuration
lock.

Keep an applied-VID bitmap under hn_lock and relay only changes.  Replay
VLANs configured before VF arrival, reconcile changes while acceleration
is active, and preserve membership across temporary datapath switches.
This relays guest intent; it does not configure host access VLAN policy
or overcome PF restrictions on tagged traffic.

    [7 lines not shown]
DeltaFile
+81-4sys/dev/hyperv/netvsc/if_hn.c
+8-0sys/dev/hyperv/netvsc/if_hnvar.h
+89-42 files

FreeBSD/src b272b2asys/dev/ice ice_osdep.h

ice: Use sleepable locks in shared code

The Intel shared code can wait for firmware resources while holding its
OS abstraction locks.  FreeBSD mapped these locks to mutexes, which
cannot be held across a voluntary sleep.  Concurrent PF rebuilds
therefore trigger WITNESS when RSS profile updates contend for the
firmware change lock.

Map the shared-code lock abstraction to exclusive sx locks.  This also
covers tunnel and flow-profile operations which can reach the same
firmware wait while serialized.

Validated with WITNESS on a dual port Intel E835.  Sixteen CORE resets
rebuilt both PFs without lock warnings, reset failures, or watchdogs.
Ten interface down/up cycles and twenty promiscuous-filter cycles also
completed cleanly.

Reviewed by:    erj
MFC after:      2 weeks

    [2 lines not shown]
DeltaFile
+13-11sys/dev/ice/ice_osdep.h
+13-111 files

FreeBSD/ports 57f8625emulators/virtualbox-ose-72 Makefile distinfo, emulators/virtualbox-ose-additions-72 Makefile distinfo

emulators/virtualbox-ose-*72: Update 7.2.16 => 7.2.18 (19 CVEs)

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2#v18

Oracle Critical Security Patch Update Advisory - September 2026:
https://www.oracle.com/security-alerts/cspusep2026.html#AppendixOVIR

Sponsored by:   UNIS Labs
Security:       CVE-2026-87273
Security:       CVE-2026-87268
Security:       CVE-2026-87269
Security:       CVE-2026-87270
Security:       CVE-2026-87271
Security:       CVE-2026-87272
Security:       CVE-2026-87276
Security:       CVE-2026-87277
Security:       CVE-2026-87278
Security:       CVE-2026-87279

    [12 lines not shown]
DeltaFile
+7-7emulators/virtualbox-ose-72/distinfo
+3-3emulators/virtualbox-ose-kmod-72/distinfo
+3-3emulators/virtualbox-ose-additions-72/distinfo
+1-1emulators/virtualbox-ose-kmod-72/Makefile
+1-1emulators/virtualbox-ose-additions-72/Makefile
+1-1emulators/virtualbox-ose-72/Makefile
+16-166 files

FreeBSD/ports 13ab7c5emulators/virtualbox-ose-72 Makefile distinfo, emulators/virtualbox-ose-additions-72 Makefile distinfo

emulators/virtualbox-ose-*72: Update 7.2.16 => 7.2.18 (19 CVEs)

Changelog:
https://www.virtualbox.org/wiki/Changelog-7.2#v18

Oracle Critical Security Patch Update Advisory - September 2026:
https://www.oracle.com/security-alerts/cspusep2026.html#AppendixOVIR

Sponsored by:   UNIS Labs
Security:       CVE-2026-87273
Security:       CVE-2026-87268
Security:       CVE-2026-87269
Security:       CVE-2026-87270
Security:       CVE-2026-87271
Security:       CVE-2026-87272
Security:       CVE-2026-87276
Security:       CVE-2026-87277
Security:       CVE-2026-87278
Security:       CVE-2026-87279

    [10 lines not shown]
DeltaFile
+7-7emulators/virtualbox-ose-72/distinfo
+3-3emulators/virtualbox-ose-kmod-72/distinfo
+3-3emulators/virtualbox-ose-additions-72/distinfo
+1-1emulators/virtualbox-ose-kmod-72/Makefile
+1-1emulators/virtualbox-ose-additions-72/Makefile
+1-1emulators/virtualbox-ose-72/Makefile
+16-166 files

FreeBSD/ports a098517devel/sentry-cli Makefile distinfo

devel/sentry-cli: Update to 3.8.0

Changelog: https://github.com/getsentry/sentry-cli/blob/3.8.0/CHANGELOG.md

Reported by:    GitHub (watch releases)
DeltaFile
+3-3devel/sentry-cli/distinfo
+1-2devel/sentry-cli/Makefile
+4-52 files

FreeBSD/ports 1885886misc/crush Makefile distinfo, misc/crush/files extra-patch-disable-command-blocking

misc/crush: Update to 0.95.0

Changelog: https://github.com/charmbracelet/crush/releases/tag/v0.95.0

Reported by:    GitHub (watch releases)
DeltaFile
+5-5misc/crush/distinfo
+2-2misc/crush/files/extra-patch-disable-command-blocking
+1-1misc/crush/Makefile
+8-83 files

FreeBSD/ports 57ae357security/vuxml/vuln 2026.xml

security/vuxml: Document vulnerabilities in net/traefik
DeltaFile
+31-0security/vuxml/vuln/2026.xml
+31-01 files

FreeBSD/ports 2635272security/vuxml/vuln 2026.xml

security/vuxml: Document vulnerabilities in multimedia/mkvtoolnix
DeltaFile
+29-0security/vuxml/vuln/2026.xml
+29-01 files

FreeBSD/ports 310043cgraphics/hyprland-protocols Makefile distinfo

graphics/hyprland-protocols: Update to 0.7.1

Changelog: https://github.com/hyprwm/hyprland-protocols/releases/tag/v0.7.1

Reported by:    GitHub (watch releases)
DeltaFile
+3-3graphics/hyprland-protocols/distinfo
+3-2graphics/hyprland-protocols/Makefile
+6-52 files

FreeBSD/ports e262e7fnet-mgmt/nagios-pf-plugin Makefile, net-mgmt/nagios-pf-plugin/files patch-Makefile patch-check_pf.c

net-mgmt/nagios-pf-plugin: fix build on FreeBSD 15+

PR:             294009
Approved by:    maintainer timeout (never replied)
MFH:            2026Q3

(cherry picked from commit 9eddf7dd87dfa63edde409b82273742b00b1344a)
DeltaFile
+149-0net-mgmt/nagios-pf-plugin/files/extra-patch-check_pf_15.c
+0-64net-mgmt/nagios-pf-plugin/files/patch-check_pf.c
+64-0net-mgmt/nagios-pf-plugin/files/extra-patch-check_pf.c
+14-5net-mgmt/nagios-pf-plugin/Makefile
+14-2net-mgmt/nagios-pf-plugin/files/patch-Makefile
+241-715 files

FreeBSD/ports 9eddf7dnet-mgmt/nagios-pf-plugin Makefile, net-mgmt/nagios-pf-plugin/files patch-Makefile patch-check_pf.c

net-mgmt/nagios-pf-plugin: fix build on FreeBSD 15+

PR:             294009
Approved by:    maintainer timeout (never replied)
MFH:            2026Q3
DeltaFile
+149-0net-mgmt/nagios-pf-plugin/files/extra-patch-check_pf_15.c
+0-64net-mgmt/nagios-pf-plugin/files/patch-check_pf.c
+64-0net-mgmt/nagios-pf-plugin/files/extra-patch-check_pf.c
+14-5net-mgmt/nagios-pf-plugin/Makefile
+14-2net-mgmt/nagios-pf-plugin/files/patch-Makefile
+241-715 files

FreeBSD/ports 45a47e1audio/shairport-sync Makefile distinfo

audio/shairport-sync: Update to 5.5.2
DeltaFile
+3-3audio/shairport-sync/distinfo
+1-1audio/shairport-sync/Makefile
+4-42 files

FreeBSD/src 0380d01lib/libbsdconf bsdconf.h bsdconf.c, usr.sbin/sysconf sysconf_priv.h sysconf.c

libbsdconf: independent version macros

sysconf(8) --version now prints the library version alongside its
own so each can move on its own clock.  Assigning a bitmask to
bool already converts zero/nonzero; drop the redundant != 0 (fuz).

Reviewed by:    fuz, kfv
Differential Revision:  https://reviews.freebsd.org/D59720
DeltaFile
+11-11lib/libbsdconf/bsdconf_put.c
+6-6lib/libbsdconf/bsdconf.c
+6-2usr.sbin/sysconf/sysconf.8
+8-0lib/libbsdconf/bsdconf.h
+3-2usr.sbin/sysconf/sysconf.c
+1-1usr.sbin/sysconf/sysconf_priv.h
+35-226 files

FreeBSD/ports 2fab821audio/noctavox Makefile Makefile.crates, audio/noctavox/files patch-cargo-crates_cpal-0.18.1_src_host_mod.rs patch-cargo-crates_cpal-0.18.1_src_host_alsa_mod.rs

audio/noctavox: Update to 0.3.5

ChangeLog:

1. https://github.com/Jaxx497/NoctaVox/releases/tag/v0.3.5

Reported by:    "github-actions[bot]" <notifications at github.com>
DeltaFile
+103-105audio/noctavox/distinfo
+50-51audio/noctavox/Makefile.crates
+0-50audio/noctavox/files/patch-cargo-crates_cpal-0.18.1_src_host_alsa_mod.rs
+0-10audio/noctavox/files/patch-cargo-crates_cpal-0.18.1_src_host_mod.rs
+2-2audio/noctavox/Makefile
+155-2185 files

FreeBSD/ports ba0bd56multimedia/mkvtoolnix Makefile pkg-plist

multimedia/mkvtoolnix: Update to upstream release 102.0

Details:
Bug- and security fixes, see
https://mkvtoolnix.download/doc/NEWS.md

MFH:            2026Q3
Security:       CVE-2026-90783
DeltaFile
+3-3multimedia/mkvtoolnix/distinfo
+5-0multimedia/mkvtoolnix/pkg-plist
+1-1multimedia/mkvtoolnix/Makefile
+9-43 files

FreeBSD/ports 8fb2c0fnet/traefik distinfo Makefile

net/traefik: Update to upstream release 3.7.13

Details:
* Bug- and security fixes, see
  https://github.com/traefik/traefik/releases/tag/v3.7.13
* Changes may require updating the configuration, see
  https://doc.traefik.io/traefik/v3.7/migrate/v3/#v3713

MFH:            2026Q3
Security:       https://github.com/traefik/traefik/security/advisories/GHSA-qqjf-53cj-pwvv
                https://github.com/traefik/traefik/security/advisories/GHSA-f52w-8j3h-j724
                https://github.com/traefik/traefik/security/advisories/GHSA-v67p-phpq-fc8x
                https://github.com/traefik/traefik/security/advisories/GHSA-w4v4-9rw7-5326
                https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6
DeltaFile
+3-3net/traefik/Makefile
+3-1net/traefik/distinfo
+6-42 files

FreeBSD/src 3fe5961lib/libbsdconf bsdconf_stmt.c bsdconf_format.3, usr.sbin/sysconf sysconf.8 sysconf.c

Add sysconf(8) and libbsdconf(3)

Complete the native configuration trinity: sysctl(8) for live kernel
state, sysrc(8) for rc.conf(5), and sysconf(8) for the remaining base
configuration -- loader.conf(5), sysctl.conf(5), and the make.conf(5)
family -- atop libbsdconf(3).

libbsdconf resurrects figpar as a unified reader/writer.  Callbacks own
semantics; statements may span multiple lines via backslash continuation;
non-seekable input is spooled; writes are atomic (mkstemp, fsync, rename)
with mode/owner preservation.  Format descriptors name each target, its
files, and quoting rules without private parsers.  Multi-file targets
follow boot sourcing order; loader chases loader_conf_files as the boot
loader does.

sysconf(8) is the operator-facing tool: name / name=value on a required
target, sysrc-style list edits, make append and list-strike where they
belong, jail/altroot, and a capsicum sandbox for read-only use.


    [21 lines not shown]
DeltaFile
+761-0usr.sbin/sysconf/sysconf.c
+733-0lib/libbsdconf/bsdconf.c
+704-0usr.sbin/sysconf/sysconf.8
+693-0lib/libbsdconf/bsdconf_format.c
+560-0lib/libbsdconf/bsdconf_format.3
+547-0lib/libbsdconf/bsdconf_stmt.c
+3,998-041 files not shown
+10,120-047 files

FreeBSD/ports 3f1a145math/octave-forge-statistics Makefile distinfo

math/octave-forge-statistics: Update to 1.9.3.
DeltaFile
+3-3math/octave-forge-statistics/distinfo
+1-1math/octave-forge-statistics/Makefile
+4-42 files

FreeBSD/src f308d6dshare/man/man4 em.4, sys/dev/e1000 if_igbv.c

igbv: Recover disabled Hyper-V transmit queues

The Windows PF can disable a VF transmit queue while continuing to
report carrier up.  Link polling alone then leaves the VF operationally
up even though it cannot transmit.  The reproduced VLAN failure shows
this state with PF driver 14.1.5.0 and an MDD indication in the host trace.

Check queue zero from the admin path only while the Hyper-V VF is
running with sanitized queues and a completed host handshake.  Report
operational link down and invalidate the statistics baseline when the
queue is disabled.  Request recovery through the normal iflib stop/init
path only when a fresh, accessible STATUS read reports carrier up.
Rate limit requests if the host continues to hold the queue disabled,
and leave recovery pending while carrier is down.

Document the recovery behavior and clarify why the Hyper-V reset retains
the VF-local software reset before its host reset/MAC exchange.

Sponsored by:   BBOX.io
DeltaFile
+35-0sys/dev/e1000/if_igbv.c
+7-1share/man/man4/em.4
+42-12 files

FreeBSD/ports 9b95040devel Makefile

devel/Makefile: add missing py-opengrok-tools

Reported by:    rcm at rcm.sh
Fixes:          789a6e9d868a
DeltaFile
+1-0devel/Makefile
+1-01 files

FreeBSD/doc 0e06804website/archetypes/release hardware.adoc

hardware: Add the amdsmu driver
DeltaFile
+2-0website/archetypes/release/hardware.adoc
+2-01 files

FreeBSD/ports 8986ed8math/R-cran-combinat Makefile distinfo

math/R-cran-combinat: Update 0.0-8 => 0.0-9

While here, populate pkg-descr.

Commit log:
https://github.com/cran/combinat/compare/0.0-8...0.0-9

PR:             298551
Approved by:    no maintainer
Approved by:    osa, vvd (Mentors, implicit)
DeltaFile
+3-3math/R-cran-combinat/distinfo
+5-1math/R-cran-combinat/pkg-descr
+1-2math/R-cran-combinat/Makefile
+9-63 files

FreeBSD/src 2072f71share/man/man4 amdsmu.4

amdsmu.4: Canonicalize SYNOPSIS and HARDWARE

MFC after:              no
Reviewed by:            obiwac
Differential Revision:  https://reviews.freebsd.org/D59738
DeltaFile
+7-16share/man/man4/amdsmu.4
+7-161 files

FreeBSD/src ed5fc80sys/dev/cxgbe/crypto t7_kern_tls.c

cxgbe: Use the correct GHASH offset for a GMAC from a full TLS record

If a TLS request transmits all but a part of the GMAC at the end of a
TLS record, the work request asks the crypto engine to return the
calculated GMAC to the driver so it can be sent in a simple TCP packet
when the rest of the TLS record is transmitted in the future.
However, the offset of the returned GHASH offset was calculated
incorrectly in this case causing the driver to not recognize the
cached GMAC and instead use a more wasteful work request in the future
that encrypted the entire TLS record discarding all but the needed
bytes of the trailer.

Note that this does not effect correctness, just efficiency.

Reviewed by:    np
Fixes:          9e269eafebfc ("cxgbe: Use partial GCM mode for partial TLS records on T7")
Sponsored by:   Chelsio Communications
Differential Revision:  https://reviews.freebsd.org/D59711
DeltaFile
+1-1sys/dev/cxgbe/crypto/t7_kern_tls.c
+1-11 files

FreeBSD/poudriere 8b41a68src/share/poudriere ports.sh jail.sh

jail, ports: Avoid set -e trap in quiet-mode "done" idiom

4cb78962 introduced `[ -n "${quiet}" ] && echo " done"` in the svn/git
checkout and update paths of install_from_vcs() (jail.sh) and ports.sh.
When quiet is unset the test is false, so the statement returns exit 1;
under set -e a bare call to the enclosing function/case arm would abort
the script right after that line runs, as seen with the identical
pattern in image.sh (PR #1378). None of these 8 occurrences are
currently a function's last statement, so they don't trip today, but
the pattern is fragile under refactoring. Use an if/fi block instead,
matching the idiom already used for the preceding header line, so the
statement always returns 0.

This closes #1387
DeltaFile
+12-4src/share/poudriere/ports.sh
+12-4src/share/poudriere/jail.sh
+24-82 files

FreeBSD/src 50b3763sys/net if_vlan.c

vlan: Notify the parent when replacing a VLAN ID

Changing the VID of an existing VLAN interface rehashes the interface and
announces the new VID, but does not unregister the old VID.  Parent
drivers and VLAN event consumers can consequently retain stale filter
membership.

After successfully inserting the new VID, emit vlan_unconfig for the old
VID before the existing vlan_config notification.  Do not unregister
anything if insertion fails and the old VID is restored.

MFC after:      2 weeks
Sponsored by:   BBOX.io
DeltaFile
+2-0sys/net/if_vlan.c
+2-01 files

FreeBSD/poudriere 9cc4067src/share/poudriere jail.sh

jail: Reject a period in the new name on rename

create_jail() rejects a period in JAILNAME since jail(8) names cannot
contain one, but rename_jail() never validated NEWJAILNAME at all, so
'poudriere jail -r' could rename a jail to a name jail(8) itself would
reject. Apply the same check used at creation.

This closes #1388
DeltaFile
+2-0src/share/poudriere/jail.sh
+2-01 files