HardenedBSD/src b2b8796sys/net bpf.c, sys/netinet ip_fw.h

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+268-0tests/sys/net/bpf/pcap-test.c
+30-103sys/net/bpf.c
+59-2tests/sys/net/bpf/bpf.sh
+3-1tests/sys/net/bpf/Makefile
+1-1sys/netinet/ip_fw.h
+1-1sys/sys/mbuf.h
+362-1082 files not shown
+362-1108 files

HardenedBSD/src 74111acsys/net bpf.c, sys/netinet ip_fw.h

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+268-0tests/sys/net/bpf/pcap-test.c
+30-103sys/net/bpf.c
+59-2tests/sys/net/bpf/bpf.sh
+3-1tests/sys/net/bpf/Makefile
+1-1sys/netinet/ip_fw.h
+1-1sys/sys/mbuf.h
+362-1081 files not shown
+362-1097 files

HardenedBSD/ports ba9675fdeskutils/calibre/files user-agent-data.json, misc/gemini-cli pkg-plist

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+6,314-0misc/gemini-cli/files/package-lock.json
+2,390-3misc/gemini-cli/pkg-plist
+67-67security/kanidm/distinfo
+63-53www/grafana/distinfo
+56-56deskutils/calibre/files/user-agent-data.json
+32-32security/kanidm/Makefile.crates
+8,922-21147 files not shown
+9,102-31853 files

HardenedBSD/src e20e572sys/net bpf.c

bpf: remove DDB code

With modern debugging tools it isn't useful at all and is just a
maintenance burden.
DeltaFile
+0-37sys/net/bpf.c
+0-371 files

HardenedBSD/ports 66f3de7security/kanidm distinfo Makefile.crates

security/kanidm: Update to 1.8.1

ChangeLog: https://github.com/kanidm/kanidm/releases/tag/v1.8.1

PR:             291090
Reported by:    andreas at turriff.net
Approved by:    bofh@ (implicit)
DeltaFile
+67-67security/kanidm/distinfo
+32-32security/kanidm/Makefile.crates
+1-1security/kanidm/Makefile
+100-1003 files

HardenedBSD/ports a82b06fsysutils/logwatch Makefile, sysutils/logwatch/files patch-scripts_services_postfix pkg-message.in

sysutils/logwatch: Add support of the upcoming postfix 3.11

- The upcoming postfix 3.11 stable and next postfix-current version
  will break the postfix service script:
  https://www.postfix.org/postconf.5.html#smtp_log_tls_feature_status
- A patched postfix service script will deal with old and new status
  report lines.
- This patch has been reported upstream:
  https://sourceforge.net/p/logwatch/patches/95/
- Patch has been tested with a logfiles from past 360 days.
- files/pkg-message.in has been updated accordingly.

PR:     291130
DeltaFile
+43-0sysutils/logwatch/files/patch-scripts_services_postfix
+4-0sysutils/logwatch/files/pkg-message.in
+1-0sysutils/logwatch/Makefile
+48-03 files

HardenedBSD/ports 69245c1net-p2p/libtorrent distinfo pkg-plist, net-p2p/rtorrent distinfo Makefile

net-p2p/{lib,r}torrent: Update to 0.16.3

ChangeLog:      https://github.com/rakshasa/rtorrent/releases/tag/v0.16.3
MFH:            2025Q4 (bugfixes)
DeltaFile
+3-3net-p2p/rtorrent/distinfo
+3-3net-p2p/libtorrent/distinfo
+3-3net-p2p/libtorrent/pkg-plist
+1-2net-p2p/rtorrent/Makefile
+1-2net-p2p/libtorrent/Makefile
+11-135 files

HardenedBSD/ports 111df9bx11/xfce4-screensaver Makefile, x11/xfce4-screensaver/files patch-src_gs-lock-plug.c

x11/xfce4-screensaver: Make sure pgrep evaluates all processes

Use "-a" flag in pgrep invocation to make sure pgrep does not ignore
his "ancestor" processes.

Reported by:    kevans (via irc)
DeltaFile
+1-1x11/xfce4-screensaver/Makefile
+1-1x11/xfce4-screensaver/files/patch-src_gs-lock-plug.c
+2-22 files

HardenedBSD/ports ff512aadeskutils/calibre distinfo Makefile, deskutils/calibre/files user-agent-data.json

deskutils/calibre: Update to 8.15.0
DeltaFile
+56-56deskutils/calibre/files/user-agent-data.json
+5-5deskutils/calibre/distinfo
+2-2deskutils/calibre/Makefile
+63-633 files

HardenedBSD/src fd91012sys/net bpf.c

bpf: leave only locked version of bpf_detachd()

The unlocked one is used only once.  No functional change.
DeltaFile
+10-17sys/net/bpf.c
+10-171 files

HardenedBSD/src ff3ccf6sys/net bpf.c

bpf: refactor buffer pre-allocation for BIOCSETIF

This basically refactors 4f42daa4a326f to use less indentation and
variables.  The code is still not race proof.
DeltaFile
+20-25sys/net/bpf.c
+20-251 files

HardenedBSD/src 5469a34sys/net bpf.c bpf.h

bpf: remove dead code

Should have gone together with 9738277b5c66.
DeltaFile
+0-24sys/net/bpf.c
+0-1sys/net/bpf.h
+0-252 files

HardenedBSD/src fd02961sys/sys mbuf.h

mbuf: allow const pointer for m_rcvif()
DeltaFile
+1-1sys/sys/mbuf.h
+1-11 files

HardenedBSD/src 88b38d4sys/netinet ip_fw.h

ipfw: add extra parenthesis around ACTION_PTR() macro

This allows to immediately dereference ipfw_insn member.
DeltaFile
+1-1sys/netinet/ip_fw.h
+1-11 files

HardenedBSD/src 1ea3edatests/sys/net/bpf pcap-test.c bpf.sh

tests/net: add some bpf(4) tests

A test helper program pcap-test allows to capture, inject and compare.
Build a simple test case on top of it.  More test cases can be easily
constructed.
DeltaFile
+268-0tests/sys/net/bpf/pcap-test.c
+59-2tests/sys/net/bpf/bpf.sh
+3-1tests/sys/net/bpf/Makefile
+330-33 files

HardenedBSD/ports bad451bwww/grafana distinfo Makefile

www/grafana: Update 12.2.0 => 12.3.0

Changelogs:
https://github.com/grafana/grafana/blob/main/CHANGELOG.md#1230-2025-11-19

PR:             291109
Security:       CVE-2025-41115
MFH:            2025Q4
DeltaFile
+63-53www/grafana/distinfo
+8-4www/grafana/Makefile
+71-572 files

HardenedBSD/ports b760b9agraphics/p5-Image-ExifTool-devel distinfo Makefile

graphics/p5-Image-ExifTool-devel: Update 13.41 => 13.42

ChangeLog:
https://exiftool.org/history.html

PR:     291116
DeltaFile
+3-3graphics/p5-Image-ExifTool-devel/distinfo
+1-1graphics/p5-Image-ExifTool-devel/Makefile
+4-42 files

HardenedBSD/ports f1f4afbdevel/sdbus-cpp distinfo Makefile

devel/sdbus-cpp: update to 2.2.1

Changes:        https://github.com/Kistler-Group/sdbus-cpp/releases/tag/v2.2.1
Reported by:    GitHub (watch releases)
DeltaFile
+3-3devel/sdbus-cpp/distinfo
+1-1devel/sdbus-cpp/Makefile
+4-42 files

HardenedBSD/src 095caf8sys/dev/sound/pci hdspe-pcm.c

HBSD: Remove reference to now-undefined kernel function

In commit 9d18115ca0ab0ef3f34173d4e2bdabec916d0b60, FreeBSD removed some
old mutex wrappers. We carry a diff to an affected file to mitigate a
potential NULL pointer dereference in the sound subsystem.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
MFC-to:         15-STABLE
MFC-to:         14-STABLE
X-MFC-With:     9d18115ca0ab0ef3f34173d4e2bdabec916d0b60
DeltaFile
+0-1sys/dev/sound/pci/hdspe-pcm.c
+0-11 files

HardenedBSD/ports 6ae5d4bsecurity/kanidm Makefile

security/kanidm: Pass implicit approval to dtxdf

Changelog: https://github.com/kanidm/kanidm/releases/tag/v${NEW_VERSION}
DeltaFile
+1-0security/kanidm/Makefile
+1-01 files

HardenedBSD/ports 6e032f8x11-wm/cosmic-comp distinfo Makefile.crates

x11-wm/cosmic-comp: update to 1.0.0.b.7

Changes:        https://github.com/pop-os/cosmic-comp/compare/epoch-1.0.0-beta.6...epoch-1.0.0-beta.7
Reported by:    Repology
DeltaFile
+5-5x11-wm/cosmic-comp/distinfo
+1-1x11-wm/cosmic-comp/Makefile.crates
+1-1x11-wm/cosmic-comp/Makefile
+7-73 files

HardenedBSD/ports 766e209lang/php85 Makefile distinfo

lang/php85: Update version 8.5.0RC5=>8.5.0

Changelog: https://www.php.net/ChangeLog-8.php#8.5.0
DeltaFile
+3-4lang/php85/Makefile
+3-3lang/php85/distinfo
+6-72 files

HardenedBSD/ports 6584189lang/php84 distinfo Makefile

lang/php84: Update version 8.4.14=>8.4.15

Changelog: https://www.php.net/ChangeLog-8.php#8.4.15
DeltaFile
+3-3lang/php84/distinfo
+1-1lang/php84/Makefile
+4-42 files

HardenedBSD/ports a158838databases/freetds-devel distinfo Makefile

databases/freetds-devel: Update version 1.5.154=>1.5.155
DeltaFile
+3-3databases/freetds-devel/distinfo
+1-1databases/freetds-devel/Makefile
+4-42 files

HardenedBSD/ports dac13d8databases/freetds distinfo Makefile

databases/freetds: Update version 1.5.8=>1.5.9
DeltaFile
+3-3databases/freetds/distinfo
+1-1databases/freetds/Makefile
+4-42 files

HardenedBSD/ports 3777929graphics/R-cran-rgl distinfo Makefile

graphics/R-cran-rgl: Update to 1.3.31

Changelog: https://cran.r-project.org/web/packages/rgl/news/news.html
DeltaFile
+3-3graphics/R-cran-rgl/distinfo
+1-1graphics/R-cran-rgl/Makefile
+4-42 files

HardenedBSD/ports d70675adevel/electron38 distinfo Makefile.version

devel/electron38: Update to 38.7.1

Changelog: https://github.com/electron/electron/releases/tag/v38.7.1

Reported by:    GitHub (watch releases)
DeltaFile
+5-5devel/electron38/distinfo
+1-1devel/electron38/Makefile.version
+6-62 files

HardenedBSD/ports 54ac78cmisc/github-copilot-cli distinfo pkg-plist, misc/github-copilot-cli/files package-lock.json package-lock-keytar.json

misc/github-copilot-cli: update 0.0.354 → 0.0.362.0
DeltaFile
+7-7misc/github-copilot-cli/distinfo
+4-4misc/github-copilot-cli/files/package-lock.json
+3-3misc/github-copilot-cli/files/package-lock-keytar.json
+3-3misc/github-copilot-cli/files/package-lock-sharp.json
+2-2misc/github-copilot-cli/pkg-plist
+1-2misc/github-copilot-cli/Makefile
+20-216 files

HardenedBSD/ports 656a1fdgraphics/py-agx-emulsion Makefile

graphics/py-agx-emulsion: Fix build by correcting the dependency line

Reported by:    fallout
DeltaFile
+1-1graphics/py-agx-emulsion/Makefile
+1-11 files

HardenedBSD/ports 29733fcmisc/gemini-cli pkg-plist distinfo, misc/gemini-cli/files package-lock.json

misc/gemini-cli: update 0.15.3 → 0.16.0
DeltaFile
+6,314-0misc/gemini-cli/files/package-lock.json
+2,390-3misc/gemini-cli/pkg-plist
+3-3misc/gemini-cli/distinfo
+1-1misc/gemini-cli/Makefile
+8,708-74 files