HardenedBSD/src 74398c4contrib/libfido2/fuzz functions.txt fuzz_attobj.c, contrib/libfido2/regress cred.c dev.c

Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/cross-dso-cfi
DeltaFile
+553-543contrib/libfido2/fuzz/functions.txt
+972-94contrib/libfido2/regress/cred.c
+333-0contrib/libfido2/fuzz/fuzz_attobj.c
+14-220contrib/libfido2/regress/dev.c
+182-0contrib/libfido2/regress/mock.c
+75-70contrib/libfido2/tools/test.sh
+2,129-92793 files not shown
+3,476-1,60299 files

HardenedBSD/src 058fbc8contrib/libfido2/fuzz functions.txt fuzz_attobj.c, contrib/libfido2/regress cred.c dev.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+553-543contrib/libfido2/fuzz/functions.txt
+972-94contrib/libfido2/regress/cred.c
+333-0contrib/libfido2/fuzz/fuzz_attobj.c
+14-220contrib/libfido2/regress/dev.c
+182-0contrib/libfido2/regress/mock.c
+75-70contrib/libfido2/tools/test.sh
+2,129-92793 files not shown
+3,476-1,60299 files

HardenedBSD/src 44ae776etc/mtree BSD.usr.dist, share/doc/atf Makefile

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+100-90sys/fs/cd9660/cd9660_rrip.c
+7-7etc/mtree/BSD.usr.dist
+6-6share/doc/atf/Makefile
+5-5share/man/man4/Makefile
+5-5share/man/man1/Makefile
+4-2sys/amd64/conf/FIRECRACKER
+127-11512 files not shown
+166-13318 files

HardenedBSD/ports 9e84fcdgraphics/openjump pkg-plist Makefile, graphics/openjump/files patch-bin_oj__linux.sh

Merge branch 'freebsd/main' into hardenedbsd/main
DeltaFile
+48-195graphics/openjump/files/patch-bin_oj__linux.sh
+82-57graphics/openjump/pkg-plist
+21-25sysutils/zellij/distinfo
+0-37net-im/nheko/files/patch-git-g8ff2824527
+9-10sysutils/zellij/Makefile.crates
+7-5graphics/openjump/Makefile
+167-32956 files not shown
+305-43262 files

HardenedBSD/ports b1a1ef5sysutils/zellij distinfo Makefile.crates

sysutils/zellij: Update to 0.44.1
DeltaFile
+21-25sysutils/zellij/distinfo
+9-10sysutils/zellij/Makefile.crates
+1-1sysutils/zellij/Makefile
+31-363 files

HardenedBSD/ports 03e64fdwww/forgejo-lts Makefile distinfo

www/forgejo-lts: Fix PAM authentication

Add an upstream patch which addresses an issue with PAM authentication.

MFH:            2026Q2
DeltaFile
+4-0www/forgejo-lts/Makefile
+3-1www/forgejo-lts/distinfo
+7-12 files

HardenedBSD/ports 2b64940www/forgejo distinfo Makefile

www/forgejo: Fix PAM authentication

Add an upstream patch which addresses an issue with PAM authentication.

MFH:            2026Q2
DeltaFile
+3-1www/forgejo/distinfo
+4-0www/forgejo/Makefile
+7-12 files

HardenedBSD/ports b4be248audio/baresip distinfo Makefile

audio/baresip: Update 4.6.0 => 4.7.0

Changelog:
https://github.com/baresip/baresip/releases/tag/v4.7.0

PR:             294307
Sponsored by:   UNIS Labs
DeltaFile
+5-5audio/baresip/distinfo
+2-2audio/baresip/Makefile
+2-2audio/baresip/pkg-plist
+9-93 files

HardenedBSD/ports fbc2cb2audio/re distinfo pkg-plist

audio/re: Update 4.6.0 => 4.7.0

Changelog:
https://github.com/baresip/re/releases/tag/v4.7.0

PR:             294307
Sponsored by:   UNIS Labs
DeltaFile
+3-3audio/re/distinfo
+2-2audio/re/pkg-plist
+1-1audio/re/Makefile
+6-63 files

HardenedBSD/ports 013168emath/octave-forge-mboct-fem-pkg Makefile

math/octave-forge-mboct-fem-pkg: Fix errant error message.

Remove messages such as "warning: Command "gcc14 --version" exited
with status 127" during poudriere build.

PR:             294019
Reported by:    Einar Bjarni Halldórsson <einar at isnic.is>
DeltaFile
+1-1math/octave-forge-mboct-fem-pkg/Makefile
+1-11 files

HardenedBSD/ports f5e12e1graphics/openjump pkg-plist Makefile, graphics/openjump/files patch-bin_oj__linux.sh

graphics/openjump: Update to 2.4.0

- Updated PLUS_REV from 5095 to 5303
- Detects the Java major version at runtime
- With Java 25 compatibility fix
- Remove incompatibility with -Djava.system.class.loader JVM flag
  that causes ClassNotFoundException with Java 9+
- Fix Java 9+ compatibility by adding reflective access permissions
- Add --add-opens flags for java.lang and jdk.internal.loader
- Keep original -Djava.system.class.loader flag
- Add explicit -Djava.library.path="$NATIVE_PATH" to Java command line
- Extend NATIVE_PATH to include /usr/local/lib and ${PREFIX}/lib
- Remove obsolete macOS path reference (/usr/local/opt/sqlite/lib)
- Enhance GDAL native path to include FreeBSD library directories
- Add --enable-native-access=ALL-UNNAMED flag for Java 25
- Fix About window by installing Readme.txt to root
- Make memory detection FreeBSD compatible
- Remove TurboJPEG JARs to suppress native library error
  The turbojpeg-wrapper and imageio-ext-turbojpeg JARs attempt to load

    [11 lines not shown]
DeltaFile
+48-195graphics/openjump/files/patch-bin_oj__linux.sh
+82-57graphics/openjump/pkg-plist
+7-5graphics/openjump/Makefile
+3-3graphics/openjump/distinfo
+140-2604 files

HardenedBSD/ports 2176938net/bird2 distinfo Makefile

net/bird2: Update to 2.18.1

Sponsored by:   Netflix
DeltaFile
+3-3net/bird2/distinfo
+1-1net/bird2/Makefile
+4-42 files

HardenedBSD/ports 966e95cnet/bird3 distinfo Makefile

net/bird3: Update to 3.2.1

Sponsored by:   Netflix
DeltaFile
+3-3net/bird3/distinfo
+1-1net/bird3/Makefile
+4-42 files

HardenedBSD/ports 320e885lang/nll distinfo Makefile

lang/nll: Update 20260110a => 20260317a

Changelog:
- Changed the delimiter for line number from space to comma.
- Modified the bug to read the floating number having many number of digits.
https://kozos.jp/nlux/download.html

PR:             294297
Reported by:    SAKAI Hiroaki <kozos at kozos.jp> (maintainer)
Approved by:    osa (mentor), vvd (co-mentor)
MFH:            2026Q2
DeltaFile
+3-3lang/nll/distinfo
+1-1lang/nll/Makefile
+4-42 files

HardenedBSD/src a371b00stand/common commands.c, stand/efi/loader main.c

Add boot_setenv

Move is_restricted_var() to libsa/environment.c so it can be leveraged
by boot_setenv called from subr_boot with not truted input.

Also, allow for local tuning via ENV_IS_RESTRICTED_ALLOWED_LIST and
ENV_IS_RESTRICTED_LIST

Sponsored by:   Hewlett Packard Enterprise Development LP.

Reviewed by:    kevans, imp
Differential Revision:  https://reviews.freebsd.org/D56287
DeltaFile
+76-0stand/libsa/environment.c
+3-57stand/common/commands.c
+5-0stand/efi/loader/main.c
+3-0stand/libsa/stand.h
+1-1sys/kern/subr_boot.c
+88-585 files

HardenedBSD/ports 5b7f868security/keepassxc Makefile

HBSD: Fix mismerge

I accidentally kept an unndeeded line.

Signed-off-by:  Shawn Webb <shawn.webb at hardenedbsd.org>
DeltaFile
+0-1security/keepassxc/Makefile
+0-11 files

HardenedBSD/src fb3538fetc/mtree BSD.usr.dist BSD.root.dist

pkgbase: Move all of Kyua into the kyua package

Some Kyua directories were improperly tagged as belonging to the tests
package.  Move them to the kyua package, which contains all of the
files found in these directories.

PR:             294129
MFC after:      1 week
Reviewed by:    ivy, emaste
Differential Revision:  https://reviews.freebsd.org/D56159

(cherry picked from commit 40e8afadc393a102f4199228ae2047d3e6c71251)
DeltaFile
+5-5etc/mtree/BSD.usr.dist
+1-1etc/mtree/BSD.root.dist
+6-62 files

HardenedBSD/src b68e27dsys/fs/cd9660 cd9660_rrip.c

cd9660: Partial style sweep of Rock Ridge code

This mostly just fixes indentation and continuations and adds spaces
after commas and around binary operators and parentheses around return
values, but cd9660_rrip_extref() was so egregiously unreadable I
rewrote it.  Note that this was done manually, so I may have missed a
few spots, and I made no attempt to fix over-long lines.

MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D55865

(cherry picked from commit e6a77f81d1eb345f6a8c827ecf555b88996c8763)
DeltaFile
+96-90sys/fs/cd9660/cd9660_rrip.c
+96-901 files

HardenedBSD/src 4f13c34etc/mtree BSD.usr.dist, libexec/atf/atf-sh Makefile

pkgbase: Move all of ATF into the atf package

Parts of ATF (including the licence and some of the documentation) were
for some reason part of the tests package instead of the atf package.
Moving them to where they logically belong poses no problem since tests
already depends on atf.

PR:             294129
MFC after:      1 week
Reviewed by:    ivy
Differential Revision:  https://reviews.freebsd.org/D56158

(cherry picked from commit 0a6dbf51d8ea112a1d164be260004ec795b4368d)
DeltaFile
+6-6share/doc/atf/Makefile
+5-5share/man/man1/Makefile
+5-5share/man/man4/Makefile
+2-2etc/mtree/BSD.usr.dist
+0-1libexec/atf/atf-sh/Makefile
+18-195 files

HardenedBSD/src 7c717c3sys/fs/cd9660 cd9660_rrip.c

cd9660: Add length checks to Rock Ridge parser

* cd9660_rrip_slink() did not check that the lengths of individual
  entries do not exceed the length of the overall record.

* cd9660_rrip_altname() did not check that the length of the record
  was at least 5 before subtracting 5 from it.

Note that in both cases, a better solution would be to check the length
of the data before calling the handler, or immediately upon entry of
the handler, but this would require significant refactoring.

MFC after:      1 week
Reported by:    Calif.io in collaboration with Claude and Anthropic Research
Reported by:    Adam Crosser, Praetorian
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56215

(cherry picked from commit d0afead876076f605c363f03d92304d1bd75be1c)
DeltaFile
+4-0sys/fs/cd9660/cd9660_rrip.c
+4-01 files

HardenedBSD/src 8396b38sys/amd64/conf FIRECRACKER GENERIC, sys/arm64/conf std.arm64

kernel: Be clearer about what ZSTDIO is for

ZSTDIO is not just for core dumps, and it is now required by ZFS, so
move it (and GZIO, which is still just for dumps) to a new “Compression
support” section in GENERIC, and add them both to MINIMAL.

MFC after:      1 week
Reviewed by:    imp
Differential Revision:  https://reviews.freebsd.org/D55940

(cherry picked from commit 092687a031064dc08ac198648c6393cc50b06cee)
DeltaFile
+4-2sys/riscv/conf/GENERIC
+4-2sys/amd64/conf/FIRECRACKER
+4-2sys/amd64/conf/GENERIC
+4-2sys/arm64/conf/std.arm64
+4-2sys/powerpc/conf/GENERIC
+4-2sys/powerpc/conf/GENERIC64
+24-125 files not shown
+42-1811 files

HardenedBSD/src 53b4ae3sys/fs/nfs nfs_commonsubs.c nfsid.h, sys/nfs nfs_diskless.c

nfs_diskless: Fix handling of nfsuserd case for NFSv4

Commit 8b9775912cbc added support for an NFSv4 mounted
root file system, but only if the NFSv4 configuration
used id numbers in the strings.

This patch adds support for the case where the NFSv4
configuration uses name<-->id mappings via nfsuserd(8)
by priming the mapping cache with just enough entries
so that it works until the nfsuserd(8) is running.
They are listed in nfs_prime_userd[] in
sys/fs/nfs/nfs_commonsubs.c.

The entries in nfs_prime_userd[] are also wired into
the kernel's cache for name<-->id mappings when nfsuserd(8)
starts up.  This is necessary, since an upcall to the
nfsuserd(8) daemon for a mapping when looking up the
path to the passwd/group database files (/etc) will
hang the system, due to a vnode lock being held on

    [15 lines not shown]
DeltaFile
+66-10sys/fs/nfs/nfs_commonsubs.c
+44-0sys/nfs/nfs_diskless.c
+13-0sys/fs/nfs/nfsid.h
+1-0sys/fs/nfs/nfsrvstate.h
+124-104 files

HardenedBSD/src 8007a78sys/dev/sound/pcm channel.c

sound: Make chn_reset() control flow clearer

I think this is cleaner than playing around with return values.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56264
DeltaFile
+18-15sys/dev/sound/pcm/channel.c
+18-151 files

HardenedBSD/src 66a82f5sys/dev/sound/pcm channel.c

sound: De-macro array definitions in chn_calclatency()

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56263
DeltaFile
+16-21sys/dev/sound/pcm/channel.c
+16-211 files

HardenedBSD/src 8b18fc4sys/dev/sound/pcm channel.c

sound: Simplify parts of chn_notify()

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56240
DeltaFile
+20-27sys/dev/sound/pcm/channel.c
+20-271 files

HardenedBSD/src 2d84c8asys/dev/sound/pcm channel.c channel.h

sound: Retire unused CHN_N_* defines

These still haven't been implemented by the original author, and there
doesn't seem to be much use for them anyway.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56239
DeltaFile
+1-25sys/dev/sound/pcm/channel.c
+2-5sys/dev/sound/pcm/channel.h
+3-302 files

HardenedBSD/src f369d41sys/dev/sound/pcm feeder.c feeder.h

sound: Mark some snd_fmt* functions as static

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D56238
DeltaFile
+3-3sys/dev/sound/pcm/feeder.c
+0-3sys/dev/sound/pcm/feeder.h
+3-62 files

HardenedBSD/ports f1b75acsysutils/appjail-devel distinfo Makefile

sysutils/appjail-devel: Update to 4.11.0.20260407

ChangeLog:
https://github.com/DtxdF/AppJail/commits/3134061156a45e77d448f8ad31158c1380b71922/

MFH:    2026Q2
DeltaFile
+3-3sysutils/appjail-devel/distinfo
+3-2sysutils/appjail-devel/Makefile
+2-0sysutils/appjail-devel/pkg-plist
+8-53 files

HardenedBSD/ports a394ceasysutils/appjail distinfo Makefile

sysutils/appjail: Update to 4.11.0

ChangeLog: https://github.com/DtxdF/AppJail/releases/tag/v4.11.0

MFH:    2026Q2
DeltaFile
+3-3sysutils/appjail/distinfo
+2-1sysutils/appjail/Makefile
+2-0sysutils/appjail/pkg-plist
+7-43 files

HardenedBSD/src 6642ba3tests/sys/netpfil/pf anchor.sh

pf tests: explicitly test zeroing counters within an anchor

While here fix the match pattern in the existing test.

Sponsored by:   Rubicon Communications, LLC ("Netgate")
DeltaFile
+13-1tests/sys/netpfil/pf/anchor.sh
+13-11 files