linux: Bound native getdents and getdents64 batches
linux_getdents() and linux_getdents64() round their native read size up
to DEV_BSIZE before converting entries. For an unaligned caller buffer,
the native batch can contain more entries than fit in the Linux buffer.
Conversion then returns EINVAL even after copying complete entries,
and the native read has already advanced the directory position.
For counts of at least DEV_BSIZE, use min(args->count, MAXBSIZE) instead.
A 768-byte request, such as rustix's initial directory read, now uses a
768-byte native buffer rather than 1024. The converted Linux dirent and
dirent64 records are no larger than their native counterparts, so the
whole translated batch fits. Returning a short batch is allowed, and
consuming the whole native batch avoids needing to rewind the directory
position.
Keep the existing sizing for counts below DEV_BSIZE. This fixes the
oversized-batch case in both getdents interfaces, including legacy
getdents for 32-bit and 64-bit callers. The remaining small-buffer,
[8 lines not shown]
devel/got: Cherry-pick patches for shared locking
When operating on a worktree, got locks the tree in order to avoid
problems with concurrent operations. Until now, got always used
exclusive locks, which caused problems when e.g. two separate parts
of the FreeBSD release build ran 'got tree' at once.
This has been fixed upstream but the 15.2 release cycle needs the
changes urgently and can't wait for the next got-portable release,
so cherry-pick those patches.
Reviewed by: naddy
Sponsored by: Amazon
MFC after: 1 minute
Differential Revision: https://reviews.freebsd.org/D61327
image -t zsnapshot: Remove stale files from the previous image
With -i, files removed from the world were left behind in the new image.
Fixes: dd61d5134c ("do_clone: Stop overwriting - move that to do_clone_del")
(cherry picked from commit c10dc9a7fc71d6049254c39a5ad71b91886cb1c0)
Conflicts:
src/share/poudriere/image_zsnapshot.sh
jail -u -m src=: Remove stale files from the /usr/src copy
Files removed from the src tree were left behind in the jail's /usr/src.
Issue #1299
Fixes: dd61d5134c ("do_clone: Stop overwriting - move that to do_clone_del")
(cherry picked from commit 0ceb8092c18377bd45e69baa581e2a214b9cae2b)
Conflicts:
src/share/poudriere/jail.sh
cryptodev: zero key material before freeing it
The /dev/crypto cipher and MAC keys are copied from userland and
released with free(), leaving the key bytes in freed kernel memory.
Use zfree() so the key material is cleared on session teardown and on
the setup error path.
Reviewed by: markj
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61324
powerpc/idle: Set 'RL' field in PSSCR on POWER9
The POWER9 does not do automatic state transitions when idling, so the
'MTL' field (Maximum Transition Level) is ignored. Thus, setting '0'
for the 'RL' field (Requested Level) as was done means it
doesn't transition to any power saving level. To fix this, set both the
'MTL' and the 'RL' fields to the same level.
On a Talos II at idle this drops the reported temperatures by ~10-15%.
MFC after: 3 days
misc/zoneinfo: Update to 2026f
Upstream changes:
* Cuba will not fall back to -05 on 2026-11-01 and instead plans to
maintain -04 through 2027-11-07.
* No more leap seconds, and leap second tables no longer expire
* Improve 1965/1966 data for Brazil: in 1965 Brazil ended DST on
03-31 at 24:00 not 00:00, and in 1966 it ended DST on 03-01 at
01:00 not 00:00.
Changelog: https://data.iana.org/time-zones/tzdb/NEWS
comms/py-pynitrokey: Update 0.14.0 => 0.14.1
This is a maintenance release that updates the bundled root
certificates to remove the compromised emSign certificate.
Changelog:
https://github.com/Nitrokey/pynitrokey/releases/tag/v0.14.1
PR: 299842
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
libdwarf: standard DWARF 5 form names, DW_LANG_C17 and C23
7bb441c86678 added the fixed-size string and address index forms
0x25 to 0x2c as DW_FORM_ref_strx1..4 and DW_FORM_ref_addrx1..4; the
standard (DWARF 5, table 7.6) names them DW_FORM_strx1..4 and
DW_FORM_addrx1..4, with no "ref". Rename them, keep the old spellings
as aliases since the header is installed, and update dwarf_dump.c's
form names accordingly. Add DW_LANG_C17 (0x2c) and DW_LANG_C23 (0x3e),
which clang emits for -std=c17 and -std=c23 units. ctfconv(1) needs
all of these; it carried them in a private header until now.
Reviewed by: markj, emaste
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D61154
security/py-certifi: Update to 2026.10.23
The bundle drops "emSign ECC Root CA - G3", "emSign Root CA - C1" and
"emSign ECC Root CA - C3", following the eMudhra emSign CA compromise:
2026.10.18 removed the emSign roots, 2026.10.19 restored the ones that
are not affected, and 2026.10.23 removed two more. The package layout
and the build are unchanged.
Commit log:
https://github.com/certifi/python-certifi/compare/2026.07.22...2026.10.23
PR: 299779
Approved by: sunpoet (maintainer timeout, 13 days)
Approved by: osa, vvd (mentors, implicit)
MFH: 2026Q4
(cherry picked from commit 8f6ec8f61ee24a69eaac2b1131a0f411bde9a004)
