ipsec: Fix sizing and alignment in IPsec policy import and export.
Note: I'm not sure whether it makes sense to have mismatched src and
dst address families -- I doubt it, since userland libipsec rejects
it in ipsec_set_policy(3). I'm also not sure whether it makes sense
to have numbers of addresses other than 0 or 2. But those can be
addressed in a separate commit.
PR kern/60669: netipsec key_sp2msg buffer overrun
turnstile(9): Fix priority inheritance if trylock requires restart.
While here, sprinkle some comments explaining what's going on.
Not 100% sure this optimization, which was added in 2007 by yamt@ in
the original implementation of priority inheritance, is worthwhile,
but it's easy enough to fix for now.
PR kern/60739: Turnstile priority inheritance short-circuits walking
of waiter chain when trylock fails
Import bind-9.20.29 (previous was 9.20.27)
BIND 9.20.29
Security Fixes
[CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC
responses. a0a61dba9e
A malicious authoritative server could serve a securely delegated zone
whose DS and DNSKEY records carry many distinct key tags but no valid
match, forcing a validating resolver into excessive key-tag matching
and high CPU use for every query. BIND now bounds this work with the
per-query validation limit (max-validations-per-fetch). [GL #5349]
[CVE-2026-19033] Require a TSIG on every message of incoming zone
transfers. 9404cd2b8c
BIND 9 used to accept TSIG-signed zone transfers in which some messages
were unsigned, and processed those messages before the next signature
could vouch for them. It now requires a TSIG on every message of an
incoming AXFR or IXFR; all modern nameserver already sign every message,
so no change is expected in practice. [GL #6062]
[327 lines not shown]
mips/asm.h: Tidy typography of SYNC_PLUNGER comment block.
And fix a misquoted register number to make it make sense.
The CN78XX manual's typography got all screwed up; the CN50XX manual
is clearer (and maybe we should just quote from that one instead but
whatever).
improve table load error in npf
an EEXIST should clearly state already defined and a load failure should
also clearly be stated. do not class all error returns under EEXIST
since npf_table_insert can return other errors aside EEXIST.
Import unbound-1.26.1 (previous was unbound-1.25.1)
Unbound 1.26.1
==============
This release has a number of security fixes.
The release is signed with the OpenPGP software signing key that is
in use since Jan 1st 2026:
User ID: NLnet Labs releases signing key G2 releases at nlnetlabs.nl
Key ID: A144 323D EAAC DF45
Fingerprint: 2310 1869 0C4D 903E F419 146A A144 323D EAAC DF45
The key is available from https://nlnetlabs.nl/signing-keys .
This release consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-77860, CVE-2026-77955,
CVE-2026-78227, CVE-2026-80225, CVE-2026-81634, CVE-2026-81642,
CVE-2026-82717, CVE-2026-82720 and CVE-2026-85501.
Bug Fixes
Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code
[325 lines not shown]
uipc_usrreq: Fix unix-domain socket inode assignment.
1. `if (unp->unp_ino == 0) unp->unp_ino = unp_ino++' would assign
zero the first time around by mistake, and then assign nonzero
after that. `if (unp->unp_ino == 0) unp->unp_ino = ++unp_ino'
avoids this silliness.
2. Make the ++unp_ino part atomic.
PR kern/60729: incosistent st_ino from the first stat(2) on a socket
x86/sysbeep(4): Don't detach at shutdown.
This reverts sys/arch/x86/isa/clock.c rev. 1.32, which was the first
of a spate of changes to sprinkle DVF_DETACH_SHUTDOWN for reasons
that were unclear and apparently interfere with other functionality:
> Module Name: src
> Committed By: dyoung
> Date: Tue Apr 7 17:51:46 UTC 2009
>
> Modified Files:
> src/sys/arch/x86/isa: clock.c
>
> Log Message:
> Detach sysbeep0 at shutdown.
>
>
> To generate a diff of this commit:
> cvs rdiff -u -r1.31 -r1.32 src/sys/arch/x86/isa/clock.c
[18 lines not shown]
adjtime.2 & gettimeofday.2: minor wording and style tweaks
(Various man pages can't decide between "super user", "super-user", and
"superuser"; let's at least be consistent from line to line in one
man page.)
ld.elf_so: g/c empty conditional
It was not empty for about two hours before the commit that introduced
it had been reverted. Its content was revered, but the conditional
itself was forgoten.
While here, add "compat32" in the comment for the MLIBDIR block to
make this place more easily findable.
risc-v: revert the change for generic_bs_r_4
According to the RISC-V ABI Calling Convention an integer scalars
narrower than XLEN bits are widened according to the sign of their
type up to 32 bits, then sign-extended to XLEN bits.
wg(4): Assert task is nonzero before queueing work.
Prompted by (though I can't see any way it could be the source of):
PR kern/60728: workqueue panic in wg
arm64: don't consult mvfr1_el1 for AArch64 fp capabilities
The MVFR1_EL1 register describes features for the AArch32 AdvSIMD and FP
implementation and the contents of this register are UNKNOWN when FEAT_AA32
is not implemented.
So let's ignore this register and just set FPCR defaults for IEEE 754
compatibility.
Before this change, 7 tests in lib/libm failed on a VMware Fusion VM
(Apple M4 Pro) where MVFR1_EL1 reads as zero. With this change, all
tests pass.
