HardenedBSD/src 8d92005sys/dev/e1000 if_igb_iov.c, sys/dev/igc igc_base.c if_igc.c

Merge remote-tracking branch 'rad/hardened/current/master' into hardened/current/pledge
DeltaFile
+143-20sys/dev/e1000/if_igb_iov.c
+111-4sys/netinet6/in6_mcast.c
+65-23sys/dev/igc/if_igc.c
+29-0sys/dev/igc/igc_base.c
+11-12sys/netipsec/xform_tcp.c
+14-8sys/netinet/tcp_stacks/rack_bbr_common.c
+373-6716 files not shown
+457-8922 files

HardenedBSD/src e164c6dsys/dev/e1000 if_igb_iov.c, sys/dev/igc igc_base.c if_igc.c

Merge branch 'freebsd/current/main' into hardened/current/master
DeltaFile
+143-20sys/dev/e1000/if_igb_iov.c
+111-4sys/netinet6/in6_mcast.c
+65-23sys/dev/igc/if_igc.c
+29-0sys/dev/igc/igc_base.c
+11-12sys/netipsec/xform_tcp.c
+14-8sys/netinet/tcp_stacks/rack_bbr_common.c
+373-6716 files not shown
+457-8922 files

HardenedBSD/src a8f4949bin/pwait pwait.c, bin/pwait/tests pwait_reap.c

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+321-67contrib/unbound/services/outside_network.c
+159-75contrib/unbound/services/listen_dnsport.c
+188-0bin/pwait/tests/pwait_reap.c
+96-11contrib/unbound/services/outside_network.h
+57-18bin/pwait/pwait.c
+47-20contrib/unbound/iterator/iterator.c
+868-19165 files not shown
+1,476-41971 files

HardenedBSD/src 236794fbin/pwait pwait.1 pwait.c

pwait: Add a SIGINFO handler

On SIGINFO, print a space-separated list or remaining processes to
standard error.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58386

(cherry picked from commit eddd8aa99ca84c85faea5761af800b5b089d6ba1)
DeltaFile
+29-7bin/pwait/pwait.c
+13-0bin/pwait/pwait.1
+42-72 files

HardenedBSD/src e87afadbin/pwait/tests Makefile pwait_reap.c

pwait: Test the new -r option

Test that pwait without -r reports a process as soon as it terminates,
while pwait with -r does not report it until it has been reaped.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D58385

(cherry picked from commit e115066370dcfec410d914362756d09c268a5b4e)
DeltaFile
+188-0bin/pwait/tests/pwait_reap.c
+1-0bin/pwait/tests/Makefile
+189-02 files

HardenedBSD/src 600d57dbin/pwait pwait.1 pwait.c

pwait: Optionally wait until process is reaped

If the new -r option is specified, wait until the target process not
only terminates but is reaped.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58314

(cherry picked from commit c8f5e6819d4d81906c4a1641b5c9f02d8730481c)
DeltaFile
+29-12bin/pwait/pwait.c
+14-3bin/pwait/pwait.1
+43-152 files

HardenedBSD/src 237ab14. UPDATING, libexec/rc rc.subr

rc.subr: Fix premature return from wait_for_pids

Use pwait's new -r option to wait until the target processes have not
only terminated, but also been reaped.

PR:             293183
MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D58391

(cherry picked from commit 356d0b79cf6fc693ed1a5564232e240ce15ccb8a)
DeltaFile
+6-14libexec/rc/tests/rc_subr_test.sh
+12-0UPDATING
+2-2libexec/rc/rc.subr
+20-163 files

HardenedBSD/src 6eb614cbin/pwait/tests pwait_reap.c

pwait: Fix pwait_normal test case

Reported by:    markj
Fixes:          e115066370dc ("pwait: Test the new -r option")

(cherry picked from commit 51c0cdb04919f776516a7fac8529e7279ea5efad)
DeltaFile
+1-1bin/pwait/tests/pwait_reap.c
+1-11 files

HardenedBSD/src 4ce8f29lib/libsys kqueue.2, lib/libsysdecode flags.c

kqueue: Add NOTE_REAP

Add a NOTE_REAP event for EVFILTER_PROC which provides a notification
when the process is reaped.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58313

(cherry picked from commit 2bacbbecb165dd761ea7ec2fc35630db61508cdf)
DeltaFile
+8-5sys/kern/kern_event.c
+4-7sys/sys/event.h
+8-2lib/libsys/kqueue.2
+6-3sys/kern/sys_procdesc.c
+2-2lib/libsysdecode/flags.c
+1-0sys/kern/kern_exit.c
+29-196 files

HardenedBSD/src 48f7397. UPDATING, bin/pwait pwait.1

Bump dates

Fixes:          c8f5e6819d4d ("pwait: Optionally wait until process is reaped")
Fixes:          eddd8aa99ca8 ("pwait: Add a SIGINFO handler")
Fixes:          356d0b79cf6f ("rc.subr: Fix premature return from wait_for_pids")
(cherry picked from commit 9d852922f6687ce9a699efe5e09e3634923b2b60)
DeltaFile
+1-1lib/libsys/kqueue.2
+1-1bin/pwait/pwait.1
+1-1UPDATING
+3-33 files

HardenedBSD/src c4e2521contrib/unbound/iterator iterator.c, contrib/unbound/services mesh.c outside_network.h

unbound: Update to 1.25.2

Release notes at
        https://community.nlnetlabs.nl/t/unbound-1-25-2-released

Merge commit 'c68e7bcd81d62e9f5364c6da22fd9917976acf85'

Security:       CVE-2026-14586
Security:       CVE-2026-32665
Security:       CVE-2026-40691
Security:       CVE-2026-41637
Security:       CVE-2026-42955
Security:       CVE-2026-44621
Security:       CVE-2026-44687
Security:       CVE-2026-44690
Security:       CVE-2026-46582
Security:       CVE-2026-50045
Security:       CVE-2026-50046
Security:       CVE-2026-50243

    [13 lines not shown]
DeltaFile
+321-67contrib/unbound/services/outside_network.c
+159-75contrib/unbound/services/listen_dnsport.c
+96-11contrib/unbound/services/outside_network.h
+47-20contrib/unbound/iterator/iterator.c
+52-14contrib/unbound/services/mesh.c
+56-3contrib/unbound/validator/validator.c
+731-19051 files not shown
+1,131-33857 files

HardenedBSD/src c78190dbin/pwait/tests pwait_test.sh

pwait: Don't use init as a target

The time_unit test case uses PID 1 as a target for pwait.  This doesn't
work in a jail.  Since all we need is a process that we know won't die
while the test is running, we may as well use ourselves.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   NetApp, Inc.
Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D58418

(cherry picked from commit 5922e9d7e72bfa8a85b0f37bcfd1a8b5d866ec3b)
DeltaFile
+19-21bin/pwait/tests/pwait_test.sh
+19-211 files

HardenedBSD/src eeba99asys/kern sys_procdesc.c kern_event.c

kqueue: Fix delivery of unwanted events

In both procdesc_kqops_event() and filt_proc(), the event variable can
have more than one bit set.  This means that:

* We cannot compare it directly with NOTE_EXIT; we must binary-and them
  instead.

* We cannot binary-or it with the report mask; we must binary-and it
  with the request mask first.

MFC after:      1 week
Fixes:          2a5e58c59694 ("procdesc: add NOTE_PDSIGCHLD")
Fixes:          b328975b9d7c ("procdesc: report NOTE_PDSIGCHLD for traced and stopped process")
Reviewed by:    kib, markj
Differential Revision:  https://reviews.freebsd.org/D58395

(cherry picked from commit 4627fe9e5afc0dce4469f5964f5d4b0e49a24274)
DeltaFile
+3-3sys/kern/kern_event.c
+2-2sys/kern/sys_procdesc.c
+5-52 files

HardenedBSD/src 9fffb4esys/netinet6 in6_mcast.c

netinet6: We will never support the KAME :: feature to listen for all groups.

Comment updated only. No functional change.

It is unrealistic to expect that this feature will ever be resurrected from
the legacy KAME tree, given historical divergence, and that applications
which really need to consume all group state (e.g. proxies) will either
join on a per-group basis, or use link-layer mechanisms anyway. It was also
very poorly documented to begin with.
DeltaFile
+0-3sys/netinet6/in6_mcast.c
+0-31 files

HardenedBSD/src 0e80d9cshare/man/man4 ip6.4

netinet6: Document IPv4-mapped extension to IPV6_JOIN_GROUP et al.

The IPv6 socket options IPV6_JOIN_GROUP and IPV6_LEAVE_GROUP
socket options are being extended to accept IPv4 multicast group
addresses in the RFC 3493 IPv4-mapped address format as a convenience
to application developers.

Caveat this addition carefully in the newly added HISTORY section,
addressing all previous review comments.

Approved by:    ziaee
Reviewed by:    ziaee, glebius
PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
Differential Revision:  https://reviews.freebsd.org/D55382
DeltaFile
+20-1share/man/man4/ip6.4
+20-11 files

HardenedBSD/src 4e4c7b8sys/dev/wg wg_crypto.c if_wg.c

if_wg: Prefix crypto_init() & crypto_deinit() with wg_ for a cleaner namespace.

Both these functions have non-static linkage for good reasons, however, their
naming may confuse folk when working with crypto(9) code at global scope.
DeltaFile
+2-2sys/dev/wg/wg_crypto.c
+2-2sys/dev/wg/if_wg.c
+2-2sys/dev/wg/crypto.h
+6-63 files

HardenedBSD/src f9cdaeesys/netinet in_var.h in_mcast.c, sys/netinet6 in6_mcast.c

netinet6: Pass IPv4-mapped ASM multicast joins/leaves to netinet.

Add support for allowing IPv4 multicast groups to be joined on IPv6 sockets,
as a number of applications began to rely on this over the years, despite it
only ever having been a convenience which appeared in Solaris & Linux over
the course of the 00s decade. It is limited to any-source joins (ASM).

To avoid further quibbling over the meaning of the term "undocumented" as it
applies to this change, I have chosen to use the wording "non-IETF-ratified
extension" in comments, with reference to the updated ip6(4) man page.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=193246
DeltaFile
+111-1sys/netinet6/in6_mcast.c
+2-4sys/netinet/in_mcast.c
+5-0sys/netinet/in_var.h
+118-53 files

HardenedBSD/src 0efe935sys/netipsec xform_tcp.c

netipsec: Update my copyright notice on the TCP-MD5 feature.
DeltaFile
+1-1sys/netipsec/xform_tcp.c
+1-11 files

HardenedBSD/src b451bdbsys/netipsec xform_tcp.c

netipsec: Refactor TCP-MD5 shim to use ip6_hdr_pseudo{} for brevity.

This brings xform_tcp.c into line with possible future OCF related imports.
DeltaFile
+10-11sys/netipsec/xform_tcp.c
+10-111 files

HardenedBSD/src 4a59a0csys/netinet6 ip6_var.h

netinet6: Add a definition of struct ip6_hdr_pseudo{} for OCF compatibility.

This change is intended to address @glebius comments from the original D55663.
ip6_hdr_pseudo{} is referenced by certain OpenBSD OCF related components. I am
using __aligned(4) and not __packed as urged by the late Hans-Petter Selasky.
Use C99 types and style. We must eat the churn now cross-BSD compatibility
is "Fade to Black".

Put _Static_assert under #ifdef INVARIANTS to not disrupt regular compilation,
as this resides in a commonly included header file.
DeltaFile
+18-0sys/netinet6/ip6_var.h
+18-01 files

HardenedBSD/src c9df1a6sys/netinet tcp_input.c, sys/netinet/tcp_stacks rack_bbr_common.c

tcp: improve SEG.SEQ validation for RST segments

A RST segment can be sent in response to
(a) received segment or
(b) by the upper layer protocol.

The SEG.SEQ validation consists of two checks:
(1) the in-window check of SEG.SEQ and
(2) the exact match check of SEG.SEQ.

For the in-window check (1), the left edge of the window needs to be
based on tp->last_ack_sent to cover the delayed ACK case, whereas the
right edge needs to be based on tp->rcv_nxt + tp->rcv_wnd. This both
assumes that tp->rcv_wnd is not zero. For the special case of
tp->rcv_wnd being zero, add checks against tp->last_ack_sent for (a)
and on tp->rcv_nxt for (b). This applies to all TCP stacks.

When the exact match (2) of SEG.SEQ is performed, it should be based
on tp->last_ack_sent for (a) and on tp->rcv_nxt for (b). To cover both,

    [10 lines not shown]
DeltaFile
+14-8sys/netinet/tcp_stacks/rack_bbr_common.c
+12-6sys/netinet/tcp_input.c
+26-142 files

HardenedBSD/src a108ee9sys/dev/igc igc_regs.h igc_mac.c

igc: Correct hardware error statistics

Track RERC separately instead of adding receive errors to the collision
count, and read the previously omitted RXERRC register.  Include RFC in
input errors because CRCERRS does not count bad-CRC runts, implementing
the I225 length-error accounting workaround alongside RUC and ROC.

Stop treating host transmit MAC discards as receive errors.  Expose both
RERC and HTDPMC as dedicated MAC statistics so their overlapping counts
remain available without corrupting aggregate interface counters.

MFC after:      2 weeks
DeltaFile
+14-3sys/dev/igc/if_igc.c
+1-0sys/dev/igc/igc_regs.h
+1-0sys/dev/igc/igc_mac.c
+1-0sys/dev/igc/igc_hw.h
+17-34 files

HardenedBSD/src 7094265sys/dev/igc igc_defines.h if_igc.c

igc: Work around I225 v1 minimum IPG erratum

I225 v1 cannot receive the minimum inter-packet gap required at
2.5 Gb/s.  For affected back-to-back links, Intel recommends using a
15-byte transmit IPG instead of 12 bytes.

Program TIPG.IPGT to 0xb for pre-v2 I225 devices at 2.5 Gb/s and
restore the default at lower speeds.  Avoid penalizing fixed I225 and
I226 parts.

MFC after:      2 weeks
DeltaFile
+29-0sys/dev/igc/if_igc.c
+1-0sys/dev/igc/igc_defines.h
+30-02 files

HardenedBSD/src 1c91c3asys/dev/e1000 if_igb_iov.c

igb: recover retained i350 admin interrupts

I350 can retain EICR.OTHER with MDDET and LVMMC asserted while the
admin vector and legacy cause remain enabled. The anti-spoof filter
continues dropping packets, but no MSI-X is delivered and the spoof
diagnostic is lost.

Preserve the one-shot setup drain across iflib reset preparation,
clear ICR before LVMMC during i350 setup, and kick the enabled admin
vector from each admin pass. The synthetic no-cause interrupt stays
in the filter and also releases a retained MDDET cause.

Keep 82576 drain ordering and stop-time cleanup unchanged.
DeltaFile
+31-3sys/dev/e1000/if_igb_iov.c
+31-31 files

HardenedBSD/src 176259esys/dev/e1000 if_em.h if_em.c

igb: drain stale MDD state before interrupt arm

IOV policy setup can leave MDDET and its read-clear diagnostic
registers populated while the admin vector is masked. Carrying that
state across the unmask can suppress the next spoof-event edge.

Mark initialization for a one-shot drain and consume LVMMC, WVBR when
applicable, and ICR immediately before EIMS/IMS arms the vector.
Preserve the synthetic link-status cause across the arm-time ICR read,
and clear the one-shot latch at reset preparation.
DeltaFile
+50-0sys/dev/e1000/if_igb_iov.c
+2-0sys/dev/e1000/if_igb_iov.h
+1-0sys/dev/e1000/if_em.h
+1-0sys/dev/e1000/if_em.c
+54-04 files

HardenedBSD/src ac2be06sys/dev/e1000 if_em.h if_em.c

igb: preserve coalesced 82576 MDD events

WVBR is read-clear, so reading it from the deferred admin pass loses
earlier queue bits when multiple VF malicious-driver events arrive
before that pass.

Snapshot WVBR in the interrupt filter, translate its staggered queue
bitmap to pool bits, and OR observations into software latches for
deferred notification and recovery.

Retain the one-queue VMDq policy used for mixed-driver safety (the
vswitch cannot handle a 2Q guest loopback to a 1Q guest per errata).
DeltaFile
+65-20sys/dev/e1000/if_igb_iov.c
+1-0sys/dev/e1000/if_em.h
+1-0sys/dev/e1000/if_em.c
+67-203 files

HardenedBSD/src 4a28d39sys/dev/igc igc_base.h igc_base.c

igc: Disable PCIe L1.2 on I225

I225 devices can incorrectly enter L1 substates while CLKREQ# is
asserted, both while idle and in D3.  Disable ASPM and PCI-PM L1.2 on
I225 to prevent the resulting packet loss.

Keep the I226 workaround ASPM-only because it addresses a separate
traffic exit latency observation.

PR:             265714
MFC after:      4 days
DeltaFile
+22-20sys/dev/igc/if_igc.c
+29-0sys/dev/igc/igc_base.c
+1-0sys/dev/igc/igc_base.h
+52-203 files

HardenedBSD/src a9305a6sys/dev/e1000 if_em.c

e1000: clear VFTA when last VLAN is removed

The conventional VLAN filter update skipped zero shadow words. Removing
the final VLAN represented by a VFTA word therefore left the hardware
bit programmed even though the software shadow was clear.

Pass the changed word to em_if_vlan_filter_write() and write it even
when its new value is zero. Retained nonzero words continue to be
replayed as before.
DeltaFile
+10-5sys/dev/e1000/if_em.c
+10-51 files

HardenedBSD/src 1cfa1f1contrib/netbsd-tests/lib/libpthread t_condwait.c, lib/libsys _umtx_op.2

Merge branch 'freebsd/15-stable/main' into hardened/15-stable/main
DeltaFile
+92-18contrib/netbsd-tests/lib/libpthread/t_condwait.c
+55-35sys/kern/kern_umtx.c
+50-22lib/libthr/thread/thr_cond.c
+35-3share/man/man3/pthread_cond_timedwait.3
+22-6lib/libthr/thread/thr_umtx.c
+21-2lib/libsys/_umtx_op.2
+275-868 files not shown
+309-9514 files

HardenedBSD/src 25d1f68sys/fs/nfs nfs_commonkrpc.c

nfs_commonkrpc.c: Handle NFSERR_DELAY for Sequence correctly

Unlike RFC5661 (the original NFSv4.1 RFC), RFC8881 specifies
that a NFS4ERR_DELAY reply to the SEQUENCE operation requires
a reply using the same slot/sequence#.

This patch fixes handling of this case, so it conforms to
RFC8881.

(cherry picked from commit 6901cbbd5a2c00d378a7f87426b36d6ee6ce0aa2)
DeltaFile
+14-1sys/fs/nfs/nfs_commonkrpc.c
+14-11 files