OpenBSD -current Changelog

This selection is intended to include all important and all user-visible changes. For a complete record of all changes, please see the "source-changes" mailing list, called "OpenBSD CVS" in the archives, or use CVS.

Changes made between OpenBSD 7.9 and -current

• Sped up swap encryption/decryption by using AES on amd64 and arm64 when available.
• Fixed CoDel network packet drop scheduling.
• Reverted 'fix backlight max_brightness' in amdgpu(4) (caused bugs in Dell Inspiron 5505).
• Fixed relayd(8) deferring connections log.
• Made relayd(8) check proc_compose and imsg_compose_event return values.
• Protect the ipsec(4) TDB replay counter with mutex.
• Stopped uvm UVM_AMAP_BUCKET() memory violation, reading past end of an 80-byte amappl1 item.
• If a MIDI port is gone, sndiod(8) now disconnects its control clients.
• Updated to libexpat 2.8.3 (fixes #1297 #1300 #1286 #1305 #1306 #1303 CVE-2026-72522).
• Made sndio(7) identify MIDI ports by names as well as indices.
• Associate a midithru structure to MIDI ports by sndiod(8).
• Fixed network interface SIOCGIFDATA leak of 4 bytes of kernel stack.
• Fragment reassembly in pf(4)/inet(4)/inet6(4) now occurs in correct routing domain.
• Updated to libXfont2 2.0.9 (security issues fixed in this release n/a for OpenBSD).
• Reading server banner by ssh-keyscan(1) no longer blocks/freezes on a many-host keyscan.
• hdestroy(3) no longer frees key values, to match POSIX, NetBSD, and FreeBSD.
• Check HMAC() return value to avoid a later use of uninitialised data by ssl(8) (CID 25423).
• In limits.h _POSIX_THREAD_THREADS_MAX raised to 64, to match POSIX and the other BSDs.
• Ensure we get a valid segment and enforce use of the IOMMU.
• acpidmar(4): Store PCI domain in softc for segment mapping
• Avoid iked(8) crash in ca_validate_cert().
• Fixed npppd(8) LCP MRU option handing.
• Multiple bugfixes for amdgpu(4) and intel(4).
• Added daemon control script for lldpd(8).
• Reject d_secsize exceeding MAXPHYS in disklabel(8) 'init' and 'set'.
• Switched aarch64 CPU feature detection to elf_aux_info().
• Unwind failed amap copies in uvm.
• Fixed read buffer overrun in mandoc(1).
• Added MODCARGO_LIBTEST_ARGS variable to cargo-module(5).
• Fixed invalid memory access in setdisklabel(9).
• Improved fix to bus_dmamap_load() on arm64 and riscv64.
• Updated pkgconf to 3.0.5; simplified unveil(2) handling.
• Reverted switch to elf_aux_info() on aarch64 (which broke the install media).
• Allow setting log level from relayd.conf(5).
• Allow setting/clearing ssh-keygen(1) touch-required/verify-required flags on FIDO private keys when resetting the passphrase.
• Allow [email protected] requests when the ssh(1) agent is locked.
• Avoid potential realloc use-after-free in the ssh(1) client.
• Fixed npppd(8) LCP MRU option handing.
• Always unzoom before splitting tmux(1) windows, including for floating panes.
• Adjust pstat(8) to return the pid of the session leader process; allow '-t -M' to work.
• Made vmd(8) reject empty IMSG_VMDOP_LOAD messages from clients.
• Limit the range of deltas added to the rpki-client(8) queue.
• Made eigrpd(8) validate that the prefixlen to avoid overflow.
• Added 'T' to tmux(1), to change pane title.
• Fixed encoding of hppa protection bits.
• Made sndiod(8) allocate all midithru structures on the heap.
• Added tmux(1) refresh-now command.
• Made tmux(1) ignore Ms if it is invalid (eg no %p1), report in client mode.
• Converted re(4) to using 64 bit DMA for kstat.
• Fixed tmux(1) crash when synchronising groups and there is no current window.
• Added tmux(1) pane_private_modes format with list of DEC private modes.
• Added Intel Wildcat Lake Ethernet ids to pci(4).
• Performance improvements when using the high-level fuse(4) API.
• Incorporated new RTR v2 error codes from draft-ietf-sidrops-8210bis-26 to bgpd(8).
• Added SC7280 support to qcgpio(4).
• Multiple bugfixes for amdgpu(4) and intel(4) graphics.
• Switched smtpd(8) over to imsgbuf_get(3).
• Reordering of certificates tried during ssh(1) pubkey authentication.
• Added ssh(1) '-Z user@host' mode that lists pubkeys that will be tried for authentication.
• Fixed ssh(1) ML-KEM/ECDH interop problem.
• Eliminated holding raw shmseg over sleep-window in uvm_unmap.
• Fixed uchcom(4) CH340 operation.
• Make use of __builtin_cpu_supports() by libm on i386.
• Prevented tmux(1) from dumping core upon startup on landisk.
• Enabled 40-bit/48-bit addressing mode when the dwqe(4) hardware supports it.
• Fixed out of range access in acpi(4) System States.
• Improve llvm's sparc64 support.
• Let acme-client(1) handle '=' padding in base64url encoded EAB keys.
• Removed some key ssh(1) parsing and verification paths from the pre-auth attack surface.
• Restrict vmd(8) qcow2 cluster shifts at parse time; validate l1 table extents before allocation.
• Prevented use of partially initialised qcow2 l2 metadata by vmd(8) if the read is short.
• Ensure consistent states in persistent rpki-client(8) HTTP connections.
• Removed behaviour difference between rpki-client(8) versions with and without gbr support.
• Fixed memory leaks in vmd(8) error paths.
• Imported unbound(8) 1.25.2.
• Fixed stack corruption in QEMU OpenBIOS running macppc.
• Fixed mfii(4) crashes seen after using the patrol read start/stop commands.
• pkg_add(1) now detects and overcomes some endless loops with merge-sets.
• In httpd(8) now sends one imsg fastcgi param struct per parameter, to preserve config order.
• Added custom HTTP header support to httpd(8).
• Guard vmd(8) virtio entropy device register io and firmware config system state with a mutex.
• Prevent vmd(8) elf(5) loader leaking stack values into guest memory.
• Reject invalid payload sizes at vmd(8) control boundary.
• Add support for riscv Advanced Interrupt Architecture; added imsic(4) and aplic(4) drivers.
• Enabled 64-bit DMA mbuf support for aq(4).
• Fixed cache flush faults during bus_dmamap_sync() on riscv64 and arm64.
• Stopped getty(8) passing an empty string to login(1).
• fuse(4) filesystems like ntfs-3g will no longer silently fail if directory doesn't exist.
• Fixed signed integer overflow in perl(1) Storable (CVE-2026-57433).
• Fixed integer overflow in perl(1) pack and unpack (CVE-2026-57432).
• Fixed perl(1) incorrect regular expression matches (CVE-2026-13221).
• Added support for the Spacemit K3 SoC to smtclock(4).
• Preserve configured interface type on ospf6d(8) link update.
• Guard vmd(8)'s synchronous imsg channel with a mutex.
• Enabled use of 128 DMA segments for TSO packets again on ice(4).
• Improved SHA-3 performance.
• Correctly handle bit count for sha512(1).
• Made vmd(8) check for under reads/writes when copying qcow2 clusters.
• Keep negotiated IPv6CP IFID unchanged for link-local address.
• Fixed possible exit race in the rpki-client(8) parser.
• Reworked bgpd(8) IdleHoldTimer and how fast reconnects are implemented.
• Fixed ChannelTimeout and RekeyLimit not being applied in sshd_config(5).
• Enabled xhci(4) on Spacemit K3.
• Added ECDSA support to the relayd(8) CA privsep engine.
• Validate memory ranges in vmd(8) before vmm(4).
• Made authpf(8) read_config() remove trailing white space to avoid misconfigurations.
• Clean trailing slashes from fw_update(8) FWURL.
• Fixed NULL-deref in mg(1) parsexp.
• Load device tree for the Spacemit K3 Pico ITX board.
• Fixed httpd(8) suffix range handling.
• Stopped httpd(8) sending location fcgiparams twice.
• Properly handle qwx VIF DMA map allocation failures at attach time
• Fixed use of stale pointers on the qwx(4) vif list which caused crashes.
• Disambiguated vmd(8) fd variable naming.
• Avoid free with bad arg when trigger_len is <= 0 in gpioleds(4).
• Update to tzdata2026c from https://github.com/JodaOrg/global-tz.
• Made IP multicast router global variable MP safe.
• Made ld.so(1) print symbol name if lazy binding failed.
• netstat(1) can now print interface multicast counter; made '-q' more specific.
• Made rpki-client(8) only record NCA history on successful runs.
• Adjusted ddb(4) default 'ps' output, print 'struct process' and 'struct proc' seperately.
• Retired support for loongson architecture (not working with Clang 22).
• Ensure luna88k m8820x_initialize_cpu() initializes logical cpu #0 on non-MP kernels.
• Faster CMMU walk in luna88k m8820x_cpu_number().
• Check replies to dhcp6leased(8) contain expected server-id and client-id received.
• Check dhcp6leased(8) message belongs to the current transaction.
• Made ssl(8) check server-selected ciphersuite is valid for use with TLSv1.2.
• Ensure mrouted(8) logs errno message when ioctl(2) fails.
• Fixed sys/kern/ptrace regress hangs.
• When signalling untraced processes with a SIGKILL check the right process for PS_EXITING.
• Replaced existing SHA-256 and SHA-512 implementations in libc.
• Added tmux(1) modal panes, created currently with new-pane -O.
• Reworked the force_update logic in the bgpd(8) adj-rib-out.
• Fixed packet corruption in veb(4).
• rpki-client(8) will now only output config files on successful run.
• Fixed a potential 1-byte buffer overflow in usbd_get_string_desc().
• Imported nsd(8) 4.15.0.
• Fixed X.509 constraints URI host parsing.
• Fixed nfsd(8) vnode references, namei_pool leak, and some double-frees.
• Properly reset qwx(4) driver and device state if it fails to get RUNNING in qwx_init()
• Avoid race condition in qwx(4) device during power-on.
• Use the ioctl rwlock correctly in qwx(4) qwx_activate().
• Ensure qwx(4) rx_ring->bufs_max and freemap are always initialised correctly.
• Stopped qwx(4) init task waiting for the ioctl lock to become available.
• Limited the maximum value of shminfo.shmseg to prevent `size' overflow in sys_shmat().
• Fixed kernel memory leaks in __shm_atimensec/__shm_dtimensec/_shm_ctimensec.
• Do sleeping malloc(9) and copyin(9) before checks within sys_semop().
• Made msg_copyout() check the remaining space within userland buffer to avoid overflows.
• Restored msgrcv(2) MSG_NOERROR/E2BIG error path.
• Made concurrent sys_msgrcv() wait until we finish message delivery.
• Made qwx(4) properly errors which occur in qwx_qmi_fw_init_done().
• Free exec_package allocations in check_exec() error paths.
• Improved checking of elf(3) notes; prevent out of bounds access.
• Reject elf(3) interpreters without loadable segments.
• Disable kbind() and pinsyscalls() for static binaries inside exec_elf_makecmds().
• Fixed elf(5) structs to avoid leaking kernel stack contents.
• relayd(8) now rejects duplicate Content-Length headers with 400.
• Made ssh(1) authorized_keys "restrict" keyword apply correctly to tunnel forwarding.
• Free dispatcher in smtpd(8) mda_envelope_free() to avoid a leak.
• Handle allocation failure and track correct mbuf length in IPComp crypto.
• Increased cnmac(4) command buffer pool from 32 to 256 entries.
• veb(4) now returns ENOMEM when mallocarray() fails in veb_rule_list_get().
• Fixed ifconfig(8) 'vebX -tagged ifX' which accepted too many arguments.
• smtpd(8) now rejects empty or slash-bearing usernames before building the mbox path.
• smtpd(8) now rejects CR/LF in argv-derived fields before starting the SMTP enqueue dialogue.
• Properly free the copied envelope on the smtpd(8) smarthost lookup failure path.
• Properly free mda_subaddress in smtpd(8) mda_envelope_free() to avoid memory leak.
• Made smtpd(8) use inflateEnd() to tear down the inflate stream in uncompress_gzip_chunk().
• smtpd(8) now stops parsing DNS answers once unpack_rr() reports failure.
• Recheck sysv message queue limit after malloc(3).
• Ensured ipsec(4) IPComp decompression does not overflow mbuf cluster, prevents panic.
• Ensure ipsec(4) AH contains replay counter; prevent 'm_copydata: null mbuf' panic.
• Updated to gccmakedep 1.0.5.
• Updated to xkbutils 1.0.7, xlsatoms 1.1.5, xlsfonts 1.0.9, xrdb 1.2.3, xrefresh 1.1.1, xset 1.2.6, xsetroot 1.1.4, xvinfo 1.1.6, xwd 1.0.10, xwud to 1.0.8.
• Moved SysV sysctl(2) handlers out of sysctl_vslock(), serialize access to 'seminfo' and `shminfo'.
• Updated to libXfont2 2.0.8, libXi 1.8.3, xserver 21.1.24, xev 1.2.7, xlsclients 1.1.6, xclock 1.2.0, xedit 1.2.5, xfontsel 1.1.2.
• Updated perl(1) HTTP::Tiny to 0.096 (fix for CVE-2026-7017).
• In vmd(8), fixed qcow2 refcounts on lazy allocated refcnt blocks.
• Encrypt uvm swap pages 'inline' instead of going through a bounce buffer.
• Tightened up parsing of paged search controls in login_ldap(8) search results.
• Stopped 'pfctl -s all' dumping all OS fingerprints loaded to pf(4)
• Fixed sparc64 UA64 relocation mask selection; preserve unaligned relocation byte order.
• Batch rpki-client(8) retries of non-functional CAs based on their rsync base URI.
• Properly apply constraints to rpki-client(8) BGPsec Router certs.
• Stopped sndiod(8) pre-allocate the resampling history buffers to reduce memory usage.
• Ensure that the inode hash will always be unique for each mounted fuse(4) file system.
• Call slot_detach() for drained sndiod(8) slots.
• Upon sndiod(8) xrun, reset the number of unreported clock ticks.
• Fixed NULL pointer dereference in pf(4) outbound packet path.
• Fixed out-of-bounds read in pf(4) pf_rule_copyin().
• Made concurrent sys_msgrcv() wait until we finish message delivery.
• Deduplicated rpki-client(8) skiplist, shortlist, and NCA retry handling.
• Restored msgrcv(2) MSG_NOERROR/E2BIG error path.
• Made iked(8) store RADIUS-assigned IPv6 address in the IPv6 slot.
• LibXfont 2 fixes for CVE-2026-56001, CVE-2026-56002, and CVE-2026-56003.
• Xserver(1) fixes for CVE-2026-55999 and CVE-2026-56000.
• Removed incorrect free in rpki-client(8) nca_hist_load().
• In rpki-client(8) cert_ca_sia(), use the correct notify string in error message.
• Set ice(4) link state to full duplex.
• Avoid potential out-of-bounds access in acpi(4) while parsing AML byte stream opcodes.
• Uvm now only allocates psegs reserved for the pagedeamon if no other psegs are available.
• Removed unused evtag functions in base libevent.
• Enabled gpioleds(4) on riscv64.
• Implemented systcl(8) machdep.led_blink on arm64 and riscv64 for gpioleds(4).
• Updated perl(1) Socket to 2.041 (contains fix for CVE-2026-12087, out-of-bounds heap read).
• Fixed iked(8) to bzero(3) the mask data structure, rather than using mask4.
• Retired the cpp.sh script and install the cpp binary directly in /usr/bin.
• Improved Honor MagicBook Touchpad quirks.
• Validate routing socket replies in iked(8).
• Reworked how mbufs share references to external storage, to avoid global mutex.
• Added support for wakeup interrupts to bytgpio(4), fixes IdeaPad resuming from suspend.
• Made httpd(8) drain abort response via bufferevent to prevent errors being truncated.
• Prevent unnecessary PLT entries when LLVM emits calls to strlen(3) and wcslen(3).
• Fixed endless loop in ypldap(8), login_ldap(8), and ldap(1); check for evbuffer_add(3) errors.
• Properly check vnode identity after vget(9).
• Removed extraneous control socket objects in vmd(8).
• Fixed the priority_len bounds check in dhcpd(8).
• Prevent bus_dmamap_load(9) failures on a dmamap in acpi(4).
• Avoid download to server-controlled path when performing ssh(1) download via commandline.
• Avoid possible NULL deref in ssh(1); sanitise filenames received via remote glob.
• Restricted IMSG_CTL_PROCFD to parent and check process id/instance in iked(8), httpd8(), relayd(8), and snmpd(8).
• Switched the default TLS cipher in httpd.conf(5) set from 'compat' to 'secure.'
• Switched the default TLS cipher in relayd.conf(5) set from 'HIGH:!aNULL' to 'secure.'
• Updated libexpat to version 2.8.2, with many security fixes.
• Removed double fclose in a success path in rpki-client(8).
• Update link state after new port attached via trunk(4).
• tsort(1) will now print the file name when erroring out on invalid input.
• Made tsort(1) abort early if input lines contain NUL bytes.
• Added a coinflip to increase cycle-to-cycle jitter in rpki-client(8).
• Fixed OOB write in sysctl_ucominit with no ucom(4) devices.
• In uvm_swap, don't bounce unless we're doing encrypted writes.
• Added many new awk(1) tests, adapted from upstream.
• Merged nsd(8) 4.14.3.
• Fixes for CVE-2026-12244, CVE-2026-12245, CVE-2026-12246 and CVE-2026-12490 in nsd(8).
• Fixed a null dereference in radiusd(8) when authentication-filter configured and pap is used.
• Made resolver return statically built addresses (bot IPv4 and IPv6) when hostname == NULL.
• Sync get_crl_sk() in X509_verify(3) with BoringSSL and OpenSSL.
• Prevent authenticated RADIUS CP attribute mapping overflowing rr_cfg in iked(8).
• Made getaddrinfo(3) check hnok_lenient() earlier, for special handling for localhost names.
• Prevent OOB reads by vmd(8) in 32 and 64-bit elf(5) loaders with malformed elf(5) files.
• Stopped the resolver from silently truncate result of dname_expand.
• Prevent virtio scsi DoS from bad descriptor length passed by guest to vmd(8).
• Reject invalid PIT periods in vmd(8).
• Fixed fw_cfg leak of file directory buffer in vmd(8).
• Ensure ospfd(8) does not leak information on memory address layout from process.
• Reset ar_datalen and ar_data after free(3) like everywhere else.
• Major rework of tmux(1) prompts.
• Made mount(8) support DUIDs with -u; preserve DUID when updating file system
• Stop kernel pmap growing to its maximum and consuming all memory on small memory machines.
• Untrace traced children even when they're exiting to prevent triggering a KASSERT.
• Fixed broken -mfix-loongson2f-btb with Clang on loongson.
• Allow sparc64 Enterprise 4000 and similar with dead batteries to correctly attach clocks.
• Additional preparation for 52 disk partitions.
• Made divert-packet / divert(4) properly rdomain aware.
• Use midi_in() not midi_send() to generate sndiod(8) MIDI messages.
• Extended multicast router counter, made it MP-safe.
• Fixed FIFO handling to avoid overflowing sc_imess in ncr53c9x.c.
• Fixed kernel memory leaks in IPC_STAT and KERN_SYSVIPC_SHM_INFO.
• Attach aplmbox(4) early in RAMDISK kernels.
• Properly clear isakmpd(8) key material; clear sensitive data with freezero().
• In rpki-client(8), added a backoff retry mechanism for non-functional CAs.
• Stopped bgpd(8) leaking peer data to bgpctl(8).
• Made sndiod(8) ensure strings received from the network are 0-terminated.
• Cleanup write(1) and pledge(2) it on startup.
• Removed current directory from default pkg_add(1) search path.
• Made pstat(8) -d work for static kernel variables.
• Check for IPv6 scope truncation in getnameinfo(3).
• Removed IPv6 source routing from output path (deprecated by RFC 5095).
• For network interfaces, allocate mbufs in high memory if only 64 bit DMA interfaces exist.
• Stopped leaking transport in isakmpd(8) error paths of udp_encap_handle_message().
• Enforce per-type ID payload size in isakmpd(8) ipsec_validate_id_information().
• Avoid shift overflows in memmem(3) and strstr(3).
• Multiple additional bounds checks in isakmpd(8).
• Implemented ch_meta_locate() in bgpd(8).
• Mitigate CVE-2025-10263 (arm64).
• Properly check for errors returned by _asr_unpack_{header,query,rr}() when parsing invalid DNS data.
• Imported clang-scan-deps for clang(1).
• Made msg_copyout() check the remaining space within userland buffer to avoid overflows.
• Fixed EXFLAG_CRITICAL mishandling of unsupported asn1 extensions.
• Fixed tsort(1) heap buffer overread with embedded null bytes in input.
• Fixed drm(7) vmap_pfn() by using ptoa() to get the physical address.
• Reverted scatterlist dma_length changes from drm(7) which caused blank screen on meteor lake.
• cpp(1) no longer default to -traditional.
• Implemented bus DMA constraints from 'dma-ranges' properties in riscv device tree.
• llvm-readobj now recognises OpenBSD PAC mask notes in (arm64) coredumps.
• Discard vfs buffers after vclean error.
• Added bounds check for dhcpd(8) priority_len.
• Added server.thru control to sndiod(8) midithru/N ports.
• Implemented control of midithru ports with sndioctl(1).
• Fixed overflow in dhcpd(8) priority_list.
• Switch to timingsafe_memcmp(3) in iked(8) dsa_verify_final() and ikev2_msg_decrypt().
• Fixed mwx(4) panic on interface down.
• Made iked(8) reject all-zero curve25519 shared secrets.
• Limit iked(8) sa_eapmsk length.
• Avoid a 'Data modified on freelist' panic on boot with inteldrm(4) discrete cards (DG2).
• Harden mainbus(4) bus_dma_tag (no longer writable).
• Fixed leak of new SA on iked(8) rekey error; clear csa_rekey on error.
• No longer forward packets with a source ip of 0.0.0.0.
• Implemented support for HW crypto and wpakey in mwx(4).
• Enforce unique IKE spi in iked(8) rekeying.
• Reject empty CNAMEs in gethostbyname(3) / getaddrinfo(3).
• Rework non-functional CA statistics accounting in (8).
• No longer deactivate the whole usb device if umsm(4) attach can't find endpoints.
• When setting fuse_lowlevel_new(3) file attributes, set correct signal for invalid file handle.
• Raised the size of amd64 kernel virtual address space from 4G to 512G.
• Avoid access to uninitialised data in ip(4) at boot time.
• Skip aliases that are not valid hostnames in gethostbyname(3).
• Improved error check for timegm() and mktime() in touch(1) and date(1).
• Removed netlock dance in cad(4) ioctl.
• Avoid a NULL deref when radeon(4) wscons screen burner is enabled.
• Fixed incorrect path checking in ypbind(8) ypbindproc_domain_2x.
• Made httpd(8) and dhcpd(8) correctly error check timegm(3).
• Allocate a buffer for the vi(1) line cache instead of reaching into db data.
• Made ksh(1) restore source after interactive error recovery before continuing to prompt.
• Avoid stack exhaustion by unbounded recursion in iked(8).
• Fixed uvm amap lock order when disabling swap.
• Made snmpd(8) drop recvfd pledge; send data to peers immediately.
• Properly align receive buffers on vio(4).
• Drop incoming packets containing 16 MPLS labels with no BoS bit.
• Allow xen(4) to work with bounce buffers.
• Allow pppoe(4) to use 'mtu 1500' without requiring MTU manipulation on parent interface.
• Improved mwx(4) down/up recovery; made suspend/resume work.
• Kernel can support ports that talk directly to /dev/fuse0 rather than libfuse for fuse(4).
• Made the behaviour of the '(' command match the ')' command in vi(1).
• Fixed btrace(8) crash caused by incorrect refcounting in dt(4) backend.
• Fixed NULL dereference in isakmpd(8) message_validate_sa().
• In vi(1), fixed behaviour of ')' used in a range when sentence reaches EOF.
• Stop extra line being printed by ex(1) when the 'number' command is given the 'l flag.
• rpki-client(8) now rejects certs with duplicate extension OIDs.
• Prevent the dhcpleased(8) engine from sending us a negative amount of routes.
• Made dhcpleased(8) accept correct amount of routes from the engine process.
• Make sure dhcpleased(8) UDP header length field at least covers the UDP header.
• Let sparc64 accept ide nodes in IDE bootpaths for better interop with QEMU.
• Clear last_modified after each response on a persistent HTTP rpki-client(8) connection.
• Corrected ssl(8) secondary key share handling for HelloRetryRequests.
• Improved ssl(8) TLSv1.3 server handling of no shared groups.
• Send illegal parameter alerts for various HelloRetryRequest violations in ssl(8).
• Removed SSL_OP_LEGACY_SERVER_CONNECT from default options in ssl(8).
• Switched relayd(8) to new imsg API.
• Added experimental ssh(1) support for composite post-quantum mldsa44-ed25519 signature scheme.
• Provide a small SHA-1 implementation in hash(3).
• Fixed build without INET6 option set for ogx(4/octeon).
• In vfs, properly wake vclean after failed vnode lock attempts.
• Backed out sdmmc(4) arm64 hibernate fix, due to memory side effects.
• Fixed race condition during uipc_socket socket unsplicing.
• Preparation work for sdmmc(4) hibernation on arm64.
• Fixed LLVM crashes when using scalable TypeSizes (github issue 175868).
• Provide a separate executable file for syslogd(8) parent, for privilege separation.
• Implemented mwx(4) mwx_mac_tx_free() for MT7921. Allows MT7921 to connect to an open wifi.
• Fixed NULL dereference in isakmpd(8) message_alloc_reply() callers.
• Fixed possible unaligned 32 bit read by isakmpd(8).
• Validate isakmpd(8) DELETE payload SPI array size.
• Validate proposal and transform sizes in isakmpd(8).
• Added length checks for the Port-Message and State attributes in login_radius(8) Access-Challenge.
• Improved channel setup in mwx_preinit(); mark channels as passive in the DFS range.
• Fixed incorrect purpose check in the non-legacy x509_verify path in ssl(8).
• Fixed a vulnerability of integer overflow in amdgpu(4) kfd debugger.
• Removed the uvm buffer flipper, so the buffer cache has only one clean cache.
• Require lpd(8) data file path name to be in the spool dir.
• Ensure that buffer passed to mwx_mcu_send_firmware() does not overflow mwx(4) firmware image.
• Stopped incorrectly freeing a caller-owned buffer in PKCS7_verify().
• Added some missing bounds checks to ssl(8) ASN1_mbstring_copy().
• Avoid out-of-bounds read in ssl(8) CMS password-based decryption
• Avoid NULL dereference in ssl(8) password-based CMS decryption; fixes crash.
• Fixed intel(4) screen glitches when resuming from hibernate.
• Fixed tmux(1) cursor calculation when the status line is at the top.
• Added -H flag to tmux(1) capture-pane to show hyperlinks.
• Added -L to show line numbers with tmux(1) capture-pane and -F to show line flags.
• Enabled suspend/resume for qwz(4).
• Clear entire lines when removing from tmux(1) history or freeing.
• Adapt to pmap(9)'s new random direct map by also extracting pmap_direct_base with nlist.
• Redraw entire session when making a new tmux(1) pane.
• Added -g flag to tmux(1) kill-session to kill all sessions in a group.
• Imported updated moduli(5).
• Added X25519MLKEM768 to the ssl(3) ECDHE curves list.
• Made ufshci(4) survive a suspend on the Samsung Galaxy Book4 Edge.
• Made ssl(3) correctly handle failure to buffer DTLS messages.
• Fixed TLSv1.2 with X25519MLKEM768 in ssl(3).
• Properly set up pci(4) interrupts in multivec mode if we have multiple msix vectors but only one queue.
• Fixed interrupt barriers for the integrated MSI controller.
• Random-relink smtpd(8) and httpd(8) at boot.
• On amd64, place the pmap(9) direct map at a random location.
• Added an explicit-seed variant of the ssh(1) keygen function.
• Added signature malleability and pubkey validity checks to sshd(8) ed25519 verification.
• Made relayd(8) strip Content-Length for chunked messages (RFC 9112 section 6.1).
• httpd(8) now rejects CL.TE request framing (per RFC 9112 sections 6.1 and 6.3).
• Made relayd(8) reject obs-fold to prevent parser differentials (RFC 9112 5.2).
• Made httpd(8) reject obs-fold with 400 (RFC 9112 5.2).
• Fixed roaming between APs with qwx(4).
• Always allow data frame interrupts in qwx(4) while the interface is UP.
• Deleted __tmpfd(2) which is not used.
• Fixed uvideo(4) UVIDEO_FLAG_VENDOR_CLASS attach, broken since r1.147.
• Implemented mwx_reg_addr() for mwx(4) 7921 and 7925; L1 reg access for 7921 and 7925.
• Detect all possible variants that mwx(4) will cover (MT7920, MT7921, MT7922 and MT7925).
• Improved checking of elf(5) notes; prevent out of bounds access.
• Stopped daily(8) from deleting /tmp/run/user/* direct subdirectories.
• Fixed vblank timer, and many other bugfixes for amdgpu(4).
• Enabled the GXTP7936 touchscreen on the Samsung Galaxy Book4 Edge,
• Made pstat(8) -d fail when encountering an error doing kvm_read.
• Refactor code to account for acct(8) and quotactl(8) being able to see files beyond unveil.
• Replaced the existing SHA-1 implementation in libc.
• Refactored error check for timegm(3) in ntpd(8).
• Fixed uploads using httpd(8) chunked transfer-encoding.
• Fixed vmd(8) emulation for Linux guests, broken by too-strict memory safety checks.
• Cleaned up tls signature algorithm handling.
• Large refactoring of sshd(8) config management code.
• Fixed strlen(NULL) crash when X11 channel was created before x11-req SSH_MSG_CHANNEL_REQUEST was sent.
• Made sshd(8) force domain name received from the system resolver to lowercase.
• Fixed two one-byte out-of-cound reads in sshd(8).
• Made sshd_config(5) DisableForwarding=yes override PermitTunnel=yes.
• Stricter validation of transport state passed from the preauth to postauth sshd(8) process.
• Enforce a maximum size for usernames in ssh-agent(1) agent key use constraints.
• Fixed ssh(1) client use-after-free on error path if cipher_init() fails.
• Disallowed ssl(3) wildcard matching of a TLD specified as a FQDN.
• Fixed heap buffer overread in rs(1) column counting loop.
• Added support for Apple AIC interrupt controller v3 (found on M3 and later SoCs).
• Handle sections that specify alignment as 0 when loading an elf(5) interpreter (i.e. ld.so).
• Validate size of chunks copied to piglet during hibernate unpacking of disk image.
• Validate on-disk image sizes against integer overflow when reading chunks in unhibernate.
• Prevent disk image overreads when reading the chunktable in unhibernate.
• Disable kbind() and pinsyscalls() for static binaries at the correct time (inside exec_elf_makecmds).
• Unbroke and updated powerpc retguard for llvm 22.
• Fixed uvm fault panic introduced by new OF_getpropstr() function.
• Imported llvm/lld/clang/lldb from LLVM-21.1.6
• Added support for 40MHz channels to qwx(4).
• Made qwx(4) only allocate a new mbuf when a free Rx ring slot is available.
• Avoid calling bus_dmamap_create() from interrupt context in qwx(4).
• Handle country code events sent by qwx(4) firmware to make association more reliable.
• Properly free exec_package allocations in check_exec() error paths.
• Fixed timegm(3) invocations in acme-client(1).
• Unbreak vmd(8) when using images supplied with vmctl(8) -b.
• Introduced new FDT functions OF_getpropstr() and OF_freepropstr().
• Stopped leak in kernel stack contents in struct reg and struct fpreg.
• Added bounds checks to host-side vioscsi(4) array index values.
• Stopped vio(4) calling fatalx on malformed guest-provided descriptor lengths.
• Stopped privileged guest's ability to force host-side vioblk(4) reset or terminate.
• Reset qwx(4) command ring 'queued' counter when the command ring gets reset.
• Ensure that qwx(4) nq flags are always cleared when switching net80211 state.
• Fixed number of tx/rx streams set in qwx(4) mac config.
• Brought back the bgpd(8) path_id_tx hack for regular peers.
• In bgpd(8), improved mrt_dump_entry_mp() calculation handling, avoid overflow.
• Bumped limit for the build user to 2560M for loongson and octeon.
• Added new nwflag uapsd to ifconfig(8).
• Allow iwx(4) to enable uAPSD when supported by AP.
• Added support of uAPSD to ieee80211(9).
• Avoid infinite loop when parsing PFKEY replies in iked(8), isakmpd(8), bgpd(8), and ldpd(8).
• Fixed signed integer overflow in ul(1) column position tracking.
• Had bgpd(8) make sure the nexthop attribute is present if there is any nlri data.
• On nvme(4), properly use I/O submission queue entry size reported by controller.
• Added a "--" argv to the execvp of bgpctl(8) tp appease GNU libc.
• Stopped bgpd(8) failing hard on version mismatch; ignore extra end-of-params messages.
• Improved bgpd(8) handling of unknown extended communities.
• Increased the bgpd(8) MRT attribute buffer to MAX_EXT_PKTSIZE so it works in all cases.
• Fixed use-after-free in bgpd(8) rib_remove and parse.y.
• Allow glob(3) patterns in the logfile_name field of newsyslog.conf(5),
• Added ssh-agent(1) -V to print version, use it to test the binary is functional after relinking
• Made smtpd(8) clear userinfo before sending over imsg.
• Made smtpd(8) reject oversized sockaddr payloads received over privsep IPC.
• Zero the temporary smtpd(8) envelope parsing buffers before use to strengthen privsep.
• Clear pending asynchronous lookups at teardown, for stronger smtpd(8) privsep.
• Validate encrypted smtpd(8) queue buffer sizes before processing auth tag and IV data.
• Read ufs directory data through UFS_BUFATOFF() instead of routing into a kernel buffer.
• Added 802.11n with 40Mhz width to qwz(4).
• Fixed linking the riscv64 kernel with llvm 22.
• Avoid NULL-deref in iked(8) ocsp_connect_finish() and a potential double-free on oc_path.
• Imported unbound(8) 1.25.1.
• Add samsabi(4) driver for the Samsung Advanced BIOS Interface (SABI).
• Multiple bugfixes for amdgpu(4) VCN and JPEG v4.* ring.
• Fixed SMU7 voltage dependency on amdgpu(4) display clock.
• Fixed amdgpu(4) xgmi max speed reporting.
• Various net80211 bugfixes
• Stopped tmux(1) crashing when freeing layout cell.
• Added missing argument to tmux(1) %unlinked-window-renamed.
• Let qwz(4) handle QoS in native WiFi frames.
• Preserve tildes in ksh(1) completion.
• In dhcp6leased(8) and slaacd(8), ignore packages with invalid prefixlen.
• Added support for acme-client(1) external account binding.
• Attach ksmn(4) on 19h/1x devices, eg AMD EPYC 9354P 32-Core Processor.
• Removed relayd(8) X509_dup() call that leaks memory; add error checks for X509_set_*.
• For bgpctl(8) 'show mrt detail' print the last change time as an ISO format time.
• Added support for the RK8600 regulator used for cpu voltage on Radxa Zero 3 boards.
• Fixed vmd(8) crash if the admin enabled the agentx socket, and set custom permissions.
• Only allow __pledge_open(2) to open regular files in the /usr/share/zoneinfo directory.
• Added bgpd(8) force_update flag to force pend_prefix_add() calls in adjout_prefix_update().
• Made bgpd(8) respect RTR min-version in downgrade path and properly closing the connection.
• Allow list elements to be added or removed by sndioctl(8).
• Added the sndiod(8) server.mode control making the setting dynamic, changeable via sndioctl(1).
• Increase tmux(1) escape delay if the buffer contains a partial paste end.
• Walk all covering routes for bgpctl(8) 'show rib out <IP>.'
• Added more AMD "Krackan Point" device ids.
• Fixed qwz(4) memory leak when freeing rx descriptors.
• Stopped qwz(4) calling bus_dmamap_create(9) for rxbufs from interrupt context.
• Stopped zeroing already zeroed buffer in sysctl(2) sysctl_sysvipc().
• Implement bounce buffers for arm64.
• Improved bgpd(4) add-path send parser. Error out if max is used with best.
• Adjusted handling of limits in bgpd(4) up_generate_addpath().
• Made qwx(4) send the PMF good-bye deauth frame when hopping out of RUN state.
• Ensure no new tasks get scheduled while IFF_RUNNING is in qwx_stop(). Prevents qwz(4) crash.
• Make qwx(4) prefer ic_bss over the ephemeral node in the scan tree.
• Set correct wqx(4) firmware listen_intval in units of beacons.
• Add peer to qwx(4) firmware after starting the vdev, not before. Fixes a firmware crash.
• In relayd(8), added support for the MKCALENDAR HTTP method
• Fixed debug build of relayd(8).
• Add sambat(4) battery monitor for the SAM060B EC, as found on the Samsung Galaxy Book4 Edge.
• Avoid calling bus_dmamap_destroy() from interrupt context in qwz(4).
• Fix mix of character block size checks in find(1).
• Keep the cached ifstated(8) test status and execution time consistent across state re-entry.
• Introduce a maximum size for a single bgpctl(8) flowspec NLRI of 4000 bytes.
• In rpki-client(8), switch subordinates in CCR manifests to a simple queue
• Various fixes to the bgpctl(8) flowspec parser.
• Add 802.11n support to qwx(4). Advertise HT capabilities and pass HT/QoS peer association.
• Ask qwx(4) firmware to move into M3 state before resetting the device.
• Avoid calling bus_dmamap_destroy() from interrupt context in qwx(4).
• Added support for Intel E610 Ethernet devices to the ix(4) driver.
• Fixed incorrect FeatureCtrlMask setting on amdgpu(4) smu v14.0.x.
• Gate amdgpu(4) VM CPU HDP flush on reset lock.
• In amdgpu(4), use SMUIO 15.0.0 offsets for TSC upper and lower count.
• Clear amdgpu(4) VRAM on allocation to prevent stale data exposure.
• Force unmapping on error in drm(4) drm_gpusvm_get_pages.
• Fixed tmux(1) crash caused by including unattached clients on sorted list
• httpd(8) will now advertise Vary: Accept-Encoding whenever gzip-static is enabled.
• Made httpd(8) advertise static file revalidation, preserving Last-Modified and If-Modified-Since flow.
• Added tmux(1) new-pane command
• Let relayd(8) support multiple resolvable addresses.
• Let relayd(8) handle HTTP responses without bodies.
• In relayd(8), use explicit_bzero in ssl_password_cb.
• Made rpki-client(8) exclude hidden files and directories when synchronising via rsync.
• In rpki-client(8), limited the length of filenames in some ASN.1 fields to 255.
• Ensure ssl(3) X509V3_EXT_print() only returns 0 and 1.
• Fixed signed integer overflow in lex(1) repetition count.
• Allow explicit paths for certificates, keys and OCSP staples in (5).
• Made __pledge_open(2) of /etc/localtime and /usr/share/zoneinfo much more strict.
• Get qwz(4) in to an initial working state (assoc/rx/tx).
• Added interrupt-names property to the acpi(4) timer node.
• Avoid possibility a crafted dhcpleased(8) imsg could read the stack.
• Validate size of imsg_dhcp.len in dhcpleased(8).
• Ensure imsg is zeroed in dhcpleased(8) send_routes_withdraw.
• Mitigate AMD Zen-2 cache corruption.
• Limit the maximum value of shminfo.shmseg to prevent `size' overflow in sys_shmat().
• Added extended message capability to checks for what the bgpd(8) peer has enabled.
• Extra field checks in disklabel(8)
• Zero out the ktrace(1) signal structure ktr_psig before filling in to provide to userland.
• Made bgpd(8) return an error on unhandled imsg types in the adj-rib-out case.
• Stopped ssh(1) validating bad cipher/mac lists arguments as valid.
• Fixed ssh(1) NULL deref during pubkey auth.
• Fixed incomplete strncmp() check in rpki-client(8).
• Updated libexpat to version 2.8.1, to fix CVE-2026-45186.
• Fixed bgpd(8) port configuring on little endian systems.
• Extra size checks for bgpd(8) ibuf_set_maxsize().
• Added a guarded .note.GNU-stack section to crypto assembly files.
• Dropbear recently added a -Q option; make ssh(1) use it to query KEX if available.
• Fixed infinite loop in tmux(1) due to underflow when redrawing scrollbar.
• Fixed tmux(1) control mode teardown ordering for queued pane output.
• Introduce MAX_ADDPATH_COUNT (set to 100) and use this for the bgpd(8) add-path.
• Fixed signed overflow in ieee80211_40mhz_valid_secondary_below().
• Updated libexpat to version 2.8.0.
• Widen httpd(8) server flags to 64-bit integers.
• In bgpd(8) merge_peers() also set local_bgpid for cloned peers, not only regular peers.
• Switched some loops from pointer to int arithmetic, to avoid infinite loop with newer llvm.
• In smte(4/riscv64), improved error checking of received packets.
• Moved bpf(4) for outgoing packets later in the transmit path.
• Fixed regular MSI interrupts on the SpacemiT K1 SoC.
• In ssl(8) s_socket(), do not fail the accept on reverse DNS lookup failure.
• Further fixes for mandoc(1) '-T lint' regression.
• Added kernel support for the vector extension on riscv64.
• In ssl(8) s_client(), avoid two out of bounds writes.
• Implemented RSSI reporting for mwx(4).
• Record extension lengths in ssl(8) ClientHello hashing
• Avoid leaking memory when mbuf chain allocations fail in tun(4) tun_dev_write().
• Fix off-by-one in rpki-client(8) ip_addr_check_overlap().
• Fixed shortlist and skiplist checks in rpki-client(8).
• Detect out of bound reads from an int overflow in the bpf(4) bpf_mem backends.
• Loop counters converted from from uint8_t to u_int in bgpd(8).
• Fixed semop(2) semaphore id being destroyed/replaced during context switch.
• In patch(1), solved an infinite loop on malformed ed(1) script input.
• Made ifconfig(8) build without trunklacp.h.
• Reduce maximum configurable stale time to CAPA_GR_TIMEMASK (4095) in bgpd(8).
• Fixed leak of key memory in getpwent(3) yp_next().
• In bgpd(8) session_graceful_restart() also arm the SessionDown timer
• Use a define based instruction separator in SHA assembly, to match more assemblers.
• Stopped ipsec(4) overflowing the maximum packet size in the IP header.
• Prevent size_t underflow on a malformed packets in agentx(3) and snmpd(8).
• Made bgpd(8) check xp->rdesession to know if the RDE has the session running or not.
• Improved path_calc_hash() in bgpd(8)
• Fixed 'treat as withdraw' handling for invalid bgpd(8) ORIGIN attributes.
• Fixed two memory accounting issues in bgpd(8) chash.
• Added Emacs-style re-centre-top-bottom to tmux(1).
• Fixed deepsleep register for jpeg 5_0_0 and 5_0_2 and zero-size GDS range init in amdgpu(4).
• Avoid use of uninitialised ssl(8) decode_error variable.
• Added time limits to some tmux(1) loops.
• Added bounds check for the sparc64 relocation flags table.
• Fixed ip(4) build with ENCDEBUG defined, broken by rev 1.409.
• Ensure elf(5) header and program header fit into the shared library when loading.
• Fixed mandoc(1) regression so -T lint or -W style is used with multiple relative file names.
• Fixed memory size calculation in open_wmemstream(3)
• Fixed a pledge(2) in vfs(9).
• Corrected bounds test in amdgpu(4).
• Altered smtpd(8) code to avoid false bug reports from LLM scanners.
• Fixed potential information leak from an uninitialised ktrace(1) stack variable.
• Added missing flags to tmux(1) screen_mode_to_string.
• Additional checks on TLV encoding in bgpd(8).
• Added more error checks and safeguards to rpki-client.
• Limit all bgpd(8) ASPATH attributes to 750 elements.
• In bgpd(8), prevent overflow of the uint8_t length value in attr_optadd.
• Re-evaluate bgpd(8) prefixes if just PREFIX_FLAG_FILTERED changed.
• Classify ssh(1) dynamic-tcpip channels as bulk, not interactive (bz3958).
• Centralise speed benchmark timer handling in openssl(1).
• Now working on 7.9-current.