dns/register-dnsclient: use mktemp for KRB5CCNAME, destroy ticket on exit, quote vars
KRB5CCNAME was a predictable, fixed path (/tmp/krb5cc_$name), shared by
every invocation and never cleaned up; use mktemp to get a private,
per-run ccache and destroy it via kdestroy in clean_exit. Quote
$KRB5_CLIENT_PRINCIPAL and the tr arguments to avoid word-splitting/glob
expansion and fix the broken backslash-escaped tr "\"[:lower:]\""
quoting, which only worked by accident under sh.
Bump PORTVERSION.
Co-Authored-By: Claude Sonnet 5 <noreply at anthropic.com>
ice: Use the absolute VF number when adding a VSI
The Add VSI AdminQ command requires an absolute hardware VF number, while
vsi->vf_num is relative to its PF. Add the PF's vf_base_id, as the VF Tx
queue context already does.
On an E810 PF with vf_base_id 128, relative VFs 0 and 1 were associated
with hardware VFs 0 and 1 instead of 128 and 129. Their receive queues
became blocked and both native iavf and DPDK receivers dropped traffic.
A PF whose VF base is zero hides the error.
Validated the VSI-to-function mapping and receive traffic on that PF,
including VF reset recovery and local PF/VF forwarding with VSI loopback
enabled.
Fixes: bc761988b724 ("ice: Add host SR-IOV support")
MFC after: 2 weeks
Sponsored by: BBOX.io
ice: Allow VSI loopback in VEB mode
The embedded switch installs local forwarding rules with loopback enabled,
but their source VSI must also permit loopback. Without that permission,
traffic between host-attached VFs can trigger Tx data MDD events instead
of reaching the destination VSI.
Set ICE_AQ_VSI_SW_FLAG_ALLOW_LB when initializing a VSI in VEB mode, matching
the forwarding rules to the VSI permission. Keep MAC anti-spoof checking
enabled.
Validated on E810 with native iavf and DPDK VFs, together with the absolute
VF number correction. Local forwarding and queue/reset recovery passed;
spoofed source MACs were still rejected and isolated.
Fixes: bc761988b724 ("ice: Add host SR-IOV support")
MFC after: 2 weeks
Sponsored by: BBOX.io
[Clang] Support `--offload-compress` for offload binaries (#227765)
Summary:
https://github.com/llvm/llvm-project/pull/222774 added support for
compressing binaries. This PR does the minimal work required to hook
this up to the existing handling. The end goal is to be able to replace
the bundler in HIP.
The one change is moving the `--verbose` handling from the shared helper
so this can be unified.
[IRNormalizer] Keep memory accesses in program order (#237128)
IRNormalizer can move a load past a store to the same address, changing
the value it reads. Include memory-accessing instructions in the initial
top-down traversal so memory accesses retain their relative order within
each basic block.
Alive2 (IRNormalizer load/store ordering):
Before (miscompiles 42 -> 7): https://alive2.llvm.org/ce/z/6VYPd5
After (verifies): https://alive2.llvm.org/ce/z/pY6t9g
Fixes #236128.
Assisted-by: Claude Code
openexr: update to 3.5.3.
## Version 3.5.3 (October 30, 2026)
Patch release that addresses 15 security vulnerabilities, 10 with
pending CVE IDs, primarily heap buffer overflows and out-of-bounds
writes triggered by malformed or malicious EXR files — several capable
of remote code execution. See the Security section below for details.
This release includes no new features or changes in behavior other
than improved error detection and rejection of invalid input, except
for a fix for a regression introduced in v3.4.14 in reading deep
images on big-endian hosts, due to a byte-order bug that returned an
incorrect deep sample count table. Little-endian hosts are unaffected.
As part of this effort, the full test suite now passes cleanly under
the address, undefined-behavior, and thread sanitizers.
Also in this release:
[11 lines not shown]
