FreeBSD git weekly: 2026-11-09 to 2026-11-15

Signed-off-by: _ov4 <ov4@ov4.org>
Reviewed-by: ngie
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2526

libsys/poll.2: bump .Dd for the prior change

MFC after:      1 week
MFC with:       72a80a4733b2

libsys/ppoll.2: fix .Dd modification to manpage

Reported by:    gcc 14
Fixes:  https://cgit.freebsd.org/src/commit/?id=89d6ddee2028 ("libsys/poll.2: bump .Dd for the prior change")

+ Increase portability by never starting content lines with symbols
+ Improve search results by adding tunables to the variable database
+ Improve search result consistency by correcting description style

MFC after:      3 days

Crossreferences in titles are strongly discouraged and incompatible
with our own tooling. This is a wontfix by most of manpages ecosystem
because it is bad editorial style in the first place.

MFC after:      3 days

Crossreferences in titles are strongly discouraged and incompatible
with our own tooling. This is a wontfix by most of manpages ecosystem
because it is bad editorial style in the first place.

MFC after:      3 days

Crossreferences in titles are strongly discouraged and incompatible
with our own tooling. This is a wontfix by most of manpages ecosystem
because it is bad editorial style in the first place.

MFC after:      3 days

Align description with EuroBSD netgraph document descriptions rewrite.

MFC after:      3 days

Reported by: bjk

And remove the duplicated list from the description of the condition
variable.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Mention the extended locale (_l) versions of strtol(3), strtoul(3),
strtod(3), wcstol(3), and wcstod(3) and point to xlocale(3).

While here, add missing serial commas in function lists and widen the
strtol(3) RETURN VALUES table columns to fit INTMAX_MIN/INTMAX_MAX.

Obtained from:  https://github.com/apple-oss-distributions/libc (partially)
Sponsored by:   Klara, Inc.

Fixes:        https://cgit.freebsd.org/src/commit/?id=76edfabbecde ("libc: Document support for binary integers.")
Sponsored by:   Klara, Inc.

The accessed bit may be set in only some of an L3C superpage's L3
PTEs.  However, when pmap_mincore() found an L3C mapping, it reported
the accessed state of the specified L3 PTE only, so mincore(2) could
fail to report MINCORE_REFERENCED for an L3C superpage that had been
accessed.  When the accessed bit is not set in the specified entry, use
pmap_load_l3c() to combine the accessed bits from all of the L3C
superpage's L3 PTEs.

Found by:       Claude Code (Opus 5.5)
MFC after:      1 week

In preparation for storing a non-user register rename the struct so and
array so they are more obviously for sanitized registers.

While here switch to a flag field and add a flag to record if the
register is for userspace or just the kernel and check for this when
reading the value for userspace.

Sponsored by:   Arm Ltd
Differential Revision:  https://reviews.freebsd.org/D60742

Globally allocated per:
https://github.com/riscv/riscv-isa-manual/blob/main/marchid.md

MFC after:      3 days
Sponsored by:   The FreeBSD Foundation

asmc: split the debug key access into asmc_debug.c

Move the ASMC_DEBUG code out of asmc.c into a file compiled only when the
option is set, gated in files.amd64 the way acpi_debug gates the ACPICA
debugger sources. The module Makefile writes the define into opt_asmc.h so
every translation unit sees it; the old CFLAGS.asmc.c form covered one.

No functional change.

MFC After: 1 Week
Approved-by: ngie (co-mentor)

Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D61294

asmc: split the PIO backend into asmcpio.c

Moved the inline PIO transactions out of the key transport routines,
which now only dispatch on sc_is_mmio, matching asmcmmio.c. getbyindex and
getinfo stay fused: PIO needs both halves under one hold of sc_mtx.

No functional change.

MFC After: 1 Week
Approved-by: ngie (co-mentor)

Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D61296

asmc: split the sysctl layer into asmcsysctl.c

Moved the dev.asmc.N tree out of asmc.c

No functional change

MFC After: 1 Week
Approved-by: ngie (co-mentor)

Reviewed by:    ngie
Differential Revision:  https://reviews.freebsd.org/D61300

asmc: Use c99 initializers with for-loop counters to improve scoping

declared loop indices in the for statement
Index types are unchanged.

No functional change.

MFC After: 1 Week
Approved-by: ngie (co-mentor)

Reviewed by:    ngie, imp
Differential Revision:  https://reviews.freebsd.org/D61301

No functional change.

MFC After: 1 Week
Approved-by: ngie (co-mentor)

Reviewed by:    ngie, adrian
Differential Revision:  https://reviews.freebsd.org/D61303

nvme: Byte-swap the nsid in the Get/Set Features command builders

nvme_admin_get_feature_cmd() and nvme_admin_set_feature_cmd() stored
the namespace ID in the command without converting it to little
endian, unlike the other command building functions.  Any caller
passing a non-zero namespace ID would send the wrong namespace ID on
big endian machines.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=7a9e4375316b
MFC after:      1 week
Sponsored by:   Spectra Logic
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

nvme: Mask the fields in the Format NVM command builder

nvme_admin_format_cmd() did not mask any of the fields it composes
into cdw10, so an out of range value in one field would corrupt
neighboring fields.  In particular, an LBA format index greater
than 15 would bleed into the metadata settings and protection
information fields.  It also had no support for LBA format indexes
above 15, which NVMe 2.0 encodes via the separate LBAFU field.

Mask all of the fields, and encode bits 5:4 of the LBA format index
in the LBAFU field (cdw10 bits 13:12).

Also reject out of range LBA format indexes in camcontrol's
nvformat global (-G) mode, which has no namespace data to validate
against.  The per-namespace mode already validates the index
against NLBAF.

sys/dev/nvme/nvme.h:
        Mask the SES, PIL, PI, MSET and LBAF fields in
        nvme_admin_format_cmd() and encode the upper two bits of
        the LBA format index in LBAFU.

sbin/camcontrol/nvformat.c:
        Reject LBA format indexes greater than 63 in -G mode.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=7a9e4375316b
Fixes:          https://cgit.freebsd.org/src/commit/?id=80f090111ae4
MFC after:      1 week
Sponsored by:   Spectra Logic
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

nvme: Fix the data length in the Reservation Report command builder

nvme_ns_resv_report_cmd() put its length argument, which callers
supply in bytes, directly into cdw10.  The NUMD field is a 0's
based count of dwords, so the command asked the controller to
transfer nearly four times the size of the supplied data buffer.
In practice controllers limit the transfer to the length described
by the PRP entries, which is why this worked in testing, but the
command was incorrect.

Convert the byte count to a 0's based dword count in the builder.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=7a9e4375316b
MFC after:      1 week
Sponsored by:   Spectra Logic
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

nvme: Restore the host memory buffer size calculation

When the nvme_ctrlr_cmd_set_feature() call in
nvme_ctrlr_hmb_enable() was rewritten for the widened Set Features
API, the HSIZE calculation reverted to dividing by a hard coded
4096 instead of the controller page size, undoing commit
3740a8db13ba.  The Host Memory Buffer Size field is in units of
the current memory page size (CC.MPS), so the wrong size would be
programmed on controllers configured with a page size other than
4KB.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=7a9e4375316b
MFC after:      1 week
Sponsored by:   Spectra Logic
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Match the platform by CPU model and attach on acpi with PWRM at
0xfe000000; the PMC is not PCI-enumerable on these platforms.
SLP_S0_RES offsets and granularities follow each generation's PCH
Family Datasheet Volume 2.  A mismatch between the LPIT residency
counter address and SLP_S0_RES is reported on attach.

Reviewed by:    olce, adrian
Differential Revision:  https://reviews.freebsd.org/D59596

ixgbe_mdio_attach() ran from ixgbe_if_attach_post(), which iflib calls
with the context lock held.  Attaching the MDIO bus there also probes
and attaches the devices on it, and their register accesses go through
ixgbe_mdio_readreg_c22() and ixgbe_mdio_writereg_c22(), which take the
same lock.  A driver on the bus that was in the kernel or loaded by
loader(8) therefore recursed on the non-recursive iflib sx lock as soon
as it touched a register: INVARIANTS kernels panic in _sx_xlock_hard(),
others recurse silently.

Wrap iflib_device_attach() and attach the MDIO bus once it has
returned, so the children take the context lock like any later MDIO
access does.

Reviewed by:            kbowling
Fixes:                  https://cgit.freebsd.org/src/commit/?id=cfec995c87f3 ("ixgbe: add MDIO bus support")
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D61199

twsi_control_set() and twsi_control_clear() read the control register,
change some bits and write it back.  On the controllers where the
interrupt flag is cleared by writing a 1 to it (iflag_w1c), this clears
it as the flag is read as set.

In the polled mode this breaks the repeated start: START is set with
the flag cleared by the write, the hardware sends the repeated start at
once, and the flag is then cleared a second time, which loses the event
and leaves the controller with the status of the previous transfer.
Transfers with a repeated start fail with IIC_ESTATUS on an Allwinner
H6 until the controller works with interrupts.

Mask the flag out of the value that is written back, unless the caller
asks for it.

Tested on: H6

The driver only took a write as two messages, the offset and then the
data.  A write on an I2C bus is a single message that starts with the
register, which is how a driver that can be on I2C or on RSB, like
axp81x, does it.  Split such a message into the two the controller
needs.

Tested on: A64

axp81x: Move the sensors, sysctls and thresholds out of attach

Add one function for each of them: axp8xx_add_sensors(),
axp8xx_add_sysctls() and axp8xx_get_thresholds().

No functional change. This is a preparation to support PMUs without a
battery, like the AXP805, with this driver.

axp81x: Move the interrupt setup out of attach

Add axp8xx_setup_intr() which enables the interrupts and installs the
handler.

No functional change.

axp81x: Fix the register accesses

The register pointer was written without IIC_M_NOSTOP, so the controller
sends a STOP before the read message. On the Allwinner H6 (twsi) this
makes the reads return garbage without any error.

Set IIC_M_NOSTOP on it, and send the register and its value in a single
write message, like the other PMIC drivers do.

Tested on: A64, H6

axp81x: Serialize the register accesses

The registers were accessed with iicbus_transfer(), which does not own
the bus.  The interrupt driven transfers of the Allwinner twsi
controller drop their mutex while they sleep waiting for the interrupt,
so two accesses can overlap, and the PMU shares its bus with other
devices, an RTC for instance.  Use iicbus_transfer_excl() so that the
accesses are arbitrated.

The regulators share the enable registers and the regulator framework
only serializes the accesses to a single regulator.  Protect the
read-modify-write of these registers with a lock, so that regulators
enabled at the same time cannot lose each other's update.

No failure was seen without this, it is there for correctness.

Tested on: A64, H6

axp81x: Check the errors of the register accesses

axp8xx_regnode_enable() wrote back a value computed from a register it
failed to read, which clears the enable bits of all the other
regulators of that register.  Return an error instead, and do the same
in the other regnode methods, which used an uninitialised value when an
access failed.

Also initialise udelay in axp8xx_regnode_init(), as
axp8xx_regnode_set_voltage() can now fail before setting it.

Tested on: A64, H6

axp81x: Add a function to get the regulator definition

Move the lookup of the regulator definitions out of axp8xx_attach().
This also fixes an off-by-one: the test was i <= nitems(common), so the
first regulator of the per-chip table (dc1sw or dcdc7) was never
registered and one entry past the end of the common table was read.

Tested on: A64

axp81x: Get the voltage of the regulators with a single range

axp8xx_regnode_get_voltage() failed when the regulator has no second
step, which is the case of the ones with a single range. Only the first
step is mandatory, as in axp8xx_regnode_set_voltage().

Tested on: A64, H6

axp81x: Do not change the voltage of a regulator in range

axp8xx_regnode_init() set every regulator described in the FDT to its
minimum voltage, even if the firmware had already set a voltage in the
range. For a regulator that is in use, like the one of the CPU, this can
make the system crash. Only set the voltage when the current one is out
of the range.

Tested on: A64, H6

axp81x: Skip the regulators that have no name in the FDT

A regulator that is not used is described in the FDT by a node without
regulator-name, and regulator_parse_ofw_stdparam() fails for it, which
printed two errors at every boot.  Skip these nodes, and only tell about
it when booting verbose.

axp81x: Add support for the AXP805 and AXP806

The AXP805 and AXP806 are regulator only PMUs, with different registers
than the AXP803 and AXP813, and without a battery, ADC sensors or GPIO.
Add the regulators (voltage ranges from the datasheet and the Linux
driver) and the interrupts: the power key short press powers the system
off and the die temperature is sent to devd.  The battery, sensors,
thresholds, shutdown handler and GPIO bus are not set up for them.

Tested on a Pine H64 (AXP805 on the R_I2C).

Upstream's mapfile.csv lists models without leading zeros, so entries
for models below 10h had to be fixed up by hand on every import.  Strip
them before matching and use the entries as imported.

Add tests to validate the functionality.

Reviewed by:    mhorne, Ali Mashtizadeh <ali@mashtizadeh.com>
Sponsored by:   Advanced Micro Devices, Inc.
MFC after:      1 week
Signed-off-by:  Osvaldo Janeri Filho <ojanerif@amd.com>
Differential Revision:  https://reviews.freebsd.org/D60790

The interrupt filter reads the PIO interrupt port, but sc_ioport is NULL
under MMIO; the capability test only probed for keys, which says nothing
about the backend.

No MMIO-capable machine has a sudden motion sensor anyway. It existed to
park the heads of spinning disks.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D61383

The locality release wait times out on every command on a Framework 13
(Pluton start method), logging every 10 seconds.

Reported by:    emaste, tuexen
Reviewed by:    kbowling
Approved by:    kbowling
Fixes:          https://cgit.freebsd.org/src/commit/?id=bfe4be85a935 ("tpm_crb: wait for idle and locality release after each command")

Reject tokens and option counts that exceed the fixed parser buffers,
and fix the terminating NUL offset. Have the sysctl handlers propagate
parser errors before applying settings.

Handle SYSL_U32 options and reject failed numeric conversions instead of
using an uninitialized value. Fix the duplex case falling through to an
error, and initialize the link-setting strings for unexpected speeds.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D61339

Return positive errno values from the FreeBSD sysctl handlers so that
userland reports the proper error instead of "Unknown error: -22".

Convert the negative phy_config_aneg() result at the sysctl boundary,
matching axgbe_if_media_change(), and retain the PHY code's internal
error convention.

MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D61400

vid_enum_outputs() only registers a child whose _ADR appears in the
graphics controller's _DOD. _DOD is filled in from the graphics driver's
ACPI opregion on some platforms, so with no such driver attached it can
describe no device at all while the panel still implements _BCL, _BCM and
_BQC. The match then fails for every child and the machine is left with
no brightness control.

Fall back to registering the first child that implements _BCL when _DOD
matched nothing, so such a machine gets a working
hw.acpi.video.lcd0.brightness and the brightness keys that ride on it.

MFC after: 1 week

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D60826

Register an acpi_lid_event consumer that saves the current _BQC level and
drives _BCM to the lowest level _BCL offers when the lid closes, putting
the saved level back when it opens.  Only an output already classified as
an internal panel is touched, and only a level this handler dimmed is
restored, so a brightness change made while the lid was shut survives.

Disabled by default; set hw.acpi.video.lid_blank=1 to enable.

Reviewed by:    adrian
Differential Revision:  https://reviews.freebsd.org/D60827

lookup_fte_locked() scanned every FTE in a flow group with xa_next()
and memcmp() on each one.  A new RX TLS session always misses, so the
whole group was walked under the group lock for every insertion.  With
tens of thousands of RX-offloaded sessions in the same IPv6 TCP group
this costs milliseconds per call and grows linearly with the number of
FTEs.

Keep a hash table of the FTEs in each flow group, keyed by a jhash of
the match value.  The table is sized from the group size, capped at
16K buckets.  It is updated in insert_fte() and del_sw_fte(), both of
which hold the group write lock, and read in lookup_fte_locked() under
the group read or write lock.  The xarray is kept for index
allocation.  No lockless reads are introduced.

Reported by:    NetApp
Reviewed by:    kib
Sponsored by:   NVidia networking
MFC after:      1 week

This had been introduced in 3331373ce733 ("Disable CPU idle states
during suspend and reenable them during resume.") to work around C-state
selection logic which would skip C-states which returned immediately,
considering them "broken".

This workaround is incompatible with suspend-to-idle however, which
requires CPUs to be in their idle states, and is no longer relevant
either way since b0baaaaecf1a ("Avoid comparing negative signed to
positive unsignad values.") removed the C-state skipping logic the
previous change was working around.

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Pull Request:   https://ron-dev.freebsd.org/FreeBSD/src/pulls/71
Differential Revision:  https://reviews.freebsd.org/D60649

enable_idle(), which was called on resume before 427747fc16c9
("acpi_cpu: No longer disable idle during suspend"), also set BM_RLD.

This commit brings back just setting BM_RLD on resume because some
firmware might not be doing this itself on some machines.

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D61431

The ACPI entry describing the maintenance interrupt INTID is already
available as "VgicInterrupt", but it is not exposed to the GIC driver.

Check that the value is valid and consistent between CPUs, then publish
it for the GIC driver to use under rid 0 if so.

Print a warning if the maintenance interrupt is configured to be
edge-sensitive in ACPI, as the GIC spec explicitly states "maintenance
interrupts are level-sensitive".

Signed-off-by: Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2527

If one is available, register the maintenance IRQ so that vmm can
receive and process guest exits when the maintenance IRQ is asserted.

Since vmm and vgic can still operate without it, print a warning but
attach the vgic regardless if the maintenance IRQ cannot be registered.

Signed-off-by: Kajetan Puchalski <kajetan.puchalski@arm.com>
Reviewed by:    andrew
Sponsored by:   Arm Ltd
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2530

The amd64 and arm64 pmaps failed to decrement the count when tearing
down a 1GB largepage mapping.  The riscv pmap failed to decrement the
count when unwiring a superpage mapping.

Reported by:    alc
Reviewed by:    bnovkov, alc, kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D61414

key_updateaddresses() gives the clone of an SA a new SAH reference when
the SA index comes from key_newsah() or key_getsah(), but nothing
releases the reference of the old SA: key_delsav() leaves the SAH alone,
because key_unlinksav() normally releases it, and an SA that is replaced
never goes through that.  The SAH then stays allocated for good, after
its SAs are flushed and after the vnet is destroyed, as an SADB_UPDATE
with a new address does each time an IKE daemon moves an SA.

The old SA cannot release the reference when it is replaced, since a
sender that still holds it reads its SAH.  Release it in key_delsav()
instead.  When only the NAT-T config changes, the clone used to take over
the reference of the old SA; take a new one in that case as well, so that
every SA holds its own.

Reviewed by:            kib, markj
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D61101

ipfilter: Only recalculate the UDP header when we have one

When ipf_nat_out processes NAT_DIVERTOUT (ipnat rdr statements)
it also fixes the checksum in the UDP header. Test for a UDP header
before adjusting its length.

While we are here, the length in the UDP header must be converted
from network byte order to host byte order. Add the missing ntohs().

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296944
MFC after:      3 days

ipfilter: Remove erroneous ntohs()

The original commit was wrong.  ipf_nat_builddivertmp() builds the UDP
template with the length in host byte order

M_DUP() copies that value unchanged. The old code was therefore correct.
It added fin_plen in host order and then did a single htons().

The original patch was discussed with Co-Pilot, which pointed out the
original bug. claude-opus-5-5 discovered the ntohs() error that
co-pilot suggested.

Interestingly this code had been running here for a couple of months.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=72cc9e3766f4

The error paths of ah_input_cb(), ah_output_cb(), ipcomp_input_cb() and
ipcomp_output_cb() called CURVNET_RESTORE() before key_freesav() and
key_freesp().  When the callback runs on a crypto return thread, no
vnet is set after the restore, and key_freesav() panics with "vnet is
not set" on INVARIANTS kernels.  Without INVARIANTS, the last reference
would be released without a vnet.

Restore the vnet last, as the ESP callbacks do.

Reviewed by:            mjg
Fixes:                  https://cgit.freebsd.org/src/commit/?id=8a9269edd71a ("ipsec: sprinkle CURVNET_ASSERT_SET")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D61386

Simply the TXQ_AVAIL() macro to avoid using
get_inuse(txq->ift_size, txq->ift_cidx, txq->ift_pidx, txq->ift_gen)
and instead define it in terms of txq->ift_in_use.

Note that in_use is equivalent, because it is updated at the same time
as cidx/pidx and gen, and under the same serialization. The advantage
is that its cheaper due to using one read and no branches, and
safer, since unlocked reads get an atomic snapshot of availability,
but an unlocked read of multiple counters can produce inconsistent
results.

Reviewed by: kbowling, kgalazka
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D61279

When simple_tx gives up & return ENOBUFS because the tx ring is full,
we were doing a GROUPTASK_ENQUEUE(&txq->ift_task) each time.
On a tx ring that has overflowed and is being hammered on
by a fast UDP sender, this can result in a massive increase in
context switches (I've seen over 30M ctxw/sec due to this, and
the ctxsw codepath taking roughly 50% CPU).

This change removes the GROUPTASK_ENQUEUE() and replaces it
with a call to a callout which drains the tx ring. The callout time is
determined based on the link speed, estimating how long it would take
for a large fraction of of a ring containing full-MTU packets to drain.

This removes the 30M ctxsw / sec in my test case and reduces it
to roughly a doubling of ctxsws.

Reviewed by: kbowling
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D61313

Major changes in 1.22.3 (2026-11-09)
====================================

This is a bug fix release, with a focus on security issues discovered
with the aid of large language models.  See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.

* Fix a logic error when checking PAC server checksums
   [CVE-2026-111423].

* Check for unkeyed checksums when validating CAMMAC verifiers
   [CVE-2026-71199].

* Fix a loophole in the KDC's client authdata filtering which could
   allow clients to include fake PAC and CAMMAC authdata values when
   requesting service tickets.  These fake values would be rejected by
   application servers, were it not for the two bugs noted above.

* Check for the lockdown_keys attribute when processing password
   change protocol requests in kadmind [CVE-2026-107884].

* In libgssrpc, when processing RPC messages using the RPCSEC_GSS
   flavor, use the verified service type included in the RPC request to
   determine how to unwrap arguments and wrap return values, instead of
   the unverified service type included during authentication
   [CVE-2026-118380].

* In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the
   "GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set.  AUTH_GSSAPI
   is only needed for very old (pre-1.4) clients [CVE-2026-112322]
   [CVE-2026-112323].

* Fix numerous null pointer deferences, read overruns, unbounded
   memory allocations, and memory leaks that could be used as denial of
   service attacks against the KDC, kadmind, application servers, or
   client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200]
   [CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778]
   [CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316]
   [CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319]
   [CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323]
   [CVE-2026-119079].

* Fix a client crash when a KKDCP proxy daemon closes the TLS session
   without supplying any response data.

* Shut down kpropd gracefully when a termination signal is received,
   when operating in incremental propagation mode.

* Detect when an incremental propagation update is applied to a
   nonexistent principal; when this happens, force a full resync
   instead of crashing.

* Fix a KDC crash when the LDAP KDB module loses its connection to the
   LDAP server.

* Avoid a crash on macOS when the native API ccache type is used
   before and after forking a process.

* When an application accepts a GSS context without asking for
   delegated credentials, discard any credentials sent by the initiator
   without parsing them first.

Security:       https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt
MFC after:      3 days
Merge commit '5f11ec7e8ab9647977a56fca934c40951e051779' into krb5-1.22.3

183513d15f22 made the AH, ESP and IPComp input callbacks hold the
sahtree read lock, but only esp_input_cb() drops it before resubmitting
a request that the crypto framework completed with EAGAIN.
ah_input_cb() and ipcomp_input_cb() return with the lock still held.

crypto_invoke() completes requests with EAGAIN while their driver
detaches.  Detaching ossl(4) under inbound AH traffic then hangs the
next rmlock writer, and the system panics with "spin lock held too
long" in smp_rendezvous_cpus() called from _rm_wlock().

Release the lock as esp_input_cb() does.

Reported by:            llm-postcr
Reviewed by:            kib
Fixes:                  https://cgit.freebsd.org/src/commit/?id=183513d15f22 ("sys/netipsec: ensure sah stability during input callback processing")
MFC after:              1 week
Sponsored by:           Rubicon Communications, LLC ("Netgate")
Differential Revision:  https://reviews.freebsd.org/D61399

Add sanity checks for corrupt UFS directory blocks.  Don't allow bad
data to cause buffer overflows or infinite loops.

Reviewed by:    dab, imp (previous version)
Differential Revision:  https://reviews.freebsd.org/D59378

Reviewed by:  imp, jhb
Differential Revision:  https://reviews.freebsd.org/D59379

When no -p or -l arguments are given, the nvformat subcommand fills
in the protection information type and location from the
namespace's current settings.  The two were swapped: pi was taken
from the DPS metadata location bit and pil from the protection
information type field.  Formatting a namespace with protection
information enabled would therefore silently change its PI
settings, and before the Format NVM command builder masked its
fields, a namespace with PI type 2 enabled would set bit 9 of
cdw10, turning the format into a user data erase.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=80f090111ae4
MFC after:      1 week
Sponsored by:   Spectra Logic
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

res_type was initialized to 0, but the checks that enforce the -T
argument for the reserve, preempt and release reservation actions
compare it against -1, so they could never fire and camcontrol
silently sent a reservation type of 0, which is invalid.
Initialize res_type to -1 so the checks work, and default the
reservation type to 0 for the release action's clear variant,
which does not take -T and ignores the field.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=ba75cf05727e
MFC after:      1 week
Sponsored by:   Spectra Logic
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

nvme_get_data() closed the supplied CAM device on every error
path, but its callers either pass the device that main() opened
and closes, or close the device themselves, so an error resulted
in a double cam_close_device() and a double free.  Move the error
path close into print_dev_nvme(), the one caller that opens its
own device, and leave the device alone in nvme_get_data().

This predates the recent camcontrol NVMe additions, but they added
more callers.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=6ee13c54dad0
MFC after:      1 week
Sponsored by:   Spectra Logic
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

pw_checkname() already refuses $ ( ) and freinds, but backtick and
single quote slipped thru, so `pw useradd 'foo`id`'` went in just
fine. Thats command substitution in any unquoted context. Add both
to badchars, plus a test.

Reported by:    Harry Sintonen (Reversec)
Sponsored by:   Entersekt
MFC after:      2 weeks
Approved by:    bapt
Differential Revision:  https://reviews.freebsd.org/D61392

Add to the suite of ATF tests for hwpmc(4).  Vendor-neutral tests go in
tests/sys/pmc; tests that depend on AMD hardware interfaces go in
tests/sys/pmc/amd, which is only built on amd64.

tests/sys/pmc:
  pmc_pidtrack_test      process-mode PMCs follow their PID: a live
                         self-read counts the process' own work, an idle
                         process sharing the CPU with a busy one does not
                         pick up its work, and the count survives a
                         context switch
  pmc_callchain_ur_test  pmcstat -U collects user callchains through the
                         PMC_UR ring; regression test for the KASSERTs
                         fixed in rGaf3929c5152b and rG66118c3f1011
  pmc_cli_test           pmc(8): missing log, list-events, record/info
                         round trip with the "instructions" alias
  pmcstat_tsc_test       (amd64) tsc_freq in the initlog record, TSC
                         column of pmcstat -R, tsc in pmc filter -j,
                         pmcstat -G callgraph
  pmc_rapl_test          (amd64) RAPL class: 64-bit counters, system
                         mode only, PKG and CORES energy increase under
                         load

tests/sys/pmc/amd:
  pmu_detect_test        K8 class with 48-bit counters, at least six core
                         counters, TSC class alongside it
  pmu_event_test         pmu-events lookup and EventSelect/UnitMask/OS/USR
                         encoding checked against the amdzen1..amdzen6
                         tables; ex_ret_instr counts a known loop
  pmu_event_neg_test     raw PMCALLOCATE rejects an otherwise valid config
                         word with HOST, GUEST, HOST|GUEST, reserved bit
                         44 or PRECISERETIRE without PMC_CAP_PRECISE
                         (pmc_exterr_test covers an all-ones config word)
  pmu_mux_test           every core counter that CPUID reports can be
                         held at once, one more is refused, a released
                         one is reusable
  rapl_domains_test      AMD RAPL has at most PKG and CORES rows and no
                         DRAM domain
  pmc_frontend_test      pmc(8) frontend study on IBS fetch samples
  amd_pmc_test_common.h  CPUID-based Zen generation detection and helpers

Reviewed by:    mhorne
Discussed with: netchild
MFC after:      1 month
Sponsored by:   Advanced Micro Devices, Inc.
Signed-off-by:  Osvaldo Janeri Filho <ojanerif@amd.com>
Differential Revision:  https://reviews.freebsd.org/D59549

The FreeBSD-base repository (aka "pkgbase") is now created using 'pkg
repo -l' in order to make 'pkg rwhich' work.  Unfortunately this makes
the data.pkg file considerably larger, and FreeBSD 15.2-BETA1 fails to
install using a remote repository since the installer has a small /tmp
(20 MB).

Run pkg commands with 'env TMPDIR=<chrootdir>/tmp' since the /tmp in
the system being installed is considerably larger than the tmpfs which
the installer runs with.  Create <chrootdir>/tmp first so we can ensure
it has 1777 permissions.

Reviewed by:    bapt
MFC after:      1 day
Differential Revision:  https://reviews.freebsd.org/D61380

nvmecontrol: Mask the fields in the Format NVM command

The format command composed cdw10 by hand without masking any of
the fields and with no support for the LBAFU field.  Since commit
2c41f7d8a034 the LBA format index defaulted from FLBAS can exceed
15 on an NVMe 2.0 namespace using FIDXU, and such an index would
bleed into the MSET and PI fields.  An out of range index supplied
with -f for a whole-controller format was not caught either.

Build the command with nvme_admin_format_cmd(), which masks all of
the fields and encodes LBA format indexes above 15 in LBAFU, and
reject LBA format indexes greater than 63 for whole-controller
formats.  Per-namespace formats already validate the index against
NLBAF.

This is the same problem that llm-postcr reported in camcontrol's
copy of this code, fixed in 3892a6453fc6; the unmasked composition
originated here (635c517ae9ca).

Reported by:    llm-postcr
Reviewed by:    imp
Fixes:          https://cgit.freebsd.org/src/commit/?id=2c41f7d8a034
MFC after:      1 week
Sponsored by:   Spectra Logic
Assisted-by:    Claude Fable 5 <noreply@anthropic.com>
Differential Revision:  https://reviews.freebsd.org/D61356

nvmecontrol: Range-check the format command's field values

The format command accepted any 32-bit value for -m, -p, -l and
--ses and passed it into the Format NVM command.  Before
eae727676169 an out-of-range value spilled into the adjacent cdw10
fields, which usually drew an error from the controller; after it,
the value is masked to the field width, so a mistyped value is
silently accepted with a different meaning.  Most seriously,
--ses 8 masked to SES=0 and performed a plain format with no erase
at all, exiting 0.  A value like --ses 10 masked to a cryptographic
erase while bypassing the FNA cryptographic erase capability check,
which compares the unmasked value.

Reject values outside the ranges nvmecontrol.8 documents, which are
the values the spec defines: 0-1 for -m and -l, 0-3 for -p, and
0-2 for --ses.  The checks run at option validation time, before
the device is opened, and the capability check now only ever sees
valid values.

While here, document --ses in nvmecontrol.8; it was missing from the
format subcommand's option list.

Reported by:    llm-postcr
Reviewed by:    imp
Fixes:          https://cgit.freebsd.org/src/commit/?id=eae727676169
MFC after:      1 week
Sponsored by:   Spectra Logic
Assisted-by:    Claude Fable 5 <noreply@anthropic.com>
Differential Revision:  https://reviews.freebsd.org/D61406

`ipcp_ValidateReq()` appended `IP-Address ack/nak/reject` records to the fixed `fsm_decode` buffers without a bound check. A `Config-Request` with ~17 or more `IP-Address` options overran a buffer into its own end pointer, so later writes could go wherever the peer chose.

Emit the option through `fsm_ack()/fsm_nak()/fsm_rej()` like the other options.

Reviewed by:    markj
Approved by:    adrian (mentor)
Signed-off-by:  Nick Price <nprice@FreeBSD.org>
Differential Revision:  https://reviews.freebsd.org/D61326

Commit bd9d7cdd1420 ("OpenSSH: Update to 10.5p1") introduced support for
ML-DSA44/Ed25519 host keys.

Generate these keys by default when the sshd service is first started.

Reported by:    Herbert J. Skuhra
Reviewed by:    emaste
Differential Revision:  https://reviews.freebsd.org/D61433

Adds support for specifying an explicit UID when creating users through nuageinit. Both numeric and string UID values are supported. Invalid or negative UIDs are rejected. The new uid option is documented in nuageinit(7). Existing automatic UID allocation remains unchanged when no UID is specified. A UID already in use or out of range is left to pw(8) to reject.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=293716
Reported by:    Einar Bjarni Halldórsson <einar@isnic.is>
Reviewed by:    dtxdf, bapt
Signed-off-by:  Kushagra Chauhan <zenzesama@gmail.com>
Differential Revision:  https://reviews.freebsd.org/D61174

rfb_init()'s error path tests pixfmt_mtx against NULL, which only
compiles where pthread_mutex_t is a pointer, and destroys it.  Every
jump to that label is before the mutex is initialized, so there is
nothing to destroy.  The test and the destroy came in with the
SetPixelFormat support (D46402).

Signed-off-by:  Wanpeng Qian <wanpengqian@gmail.com>

Fixes:          https://cgit.freebsd.org/src/commit/?id=dda0f9837b1c ("bhyve: support noVNC SetPixelFormat request")
Reviewed by:    markj
MFC after:      1 week
Sponsored by:   keelos.dev
Differential Revision:  https://reviews.freebsd.org/D61425

aen_cond is used with pthread_cond_wait() and pthread_cond_signal() but
never initialized.  That works where a zeroed pthread_cond_t is
initialized on first use; elsewhere pthread_cond_wait() fails at once
and aen_thr() spins with aen_mtx held.

Signed-off-by:  Wanpeng Qian <wanpengqian@gmail.com>

Reviewed by:    markj
MFC after:      1 week
Sponsored by:   keelos.dev
Differential Revision:  https://reviews.freebsd.org/D61424

Upstream links every dynamic engine with a version script,
engines/<name>.ld, that exports bind_engine and v_check and makes
everything else local.  FreeBSD's engines had no version script, so
they exported every global symbol, including _init and _fini.
loader_attic.so compiles its own copy of crypto/pem/pvkfmt.c and so
also exported 21 of its functions; 14 of them (b2i_*, i2b_*) have the
same names as public libcrypto functions.

Add one Version.map for all engines, the same as upstream's, and use it
from engines/Makefile.inc.

The engines are loaded only with dlopen(), and libcrypto looks up only
bind_engine and v_check, so hiding the other symbols does not affect
any consumer.

Tested via tinderbox: capi.so, devcrypto.so and loader_attic.so link
with --no-undefined-version and export only bind_engine and v_check.
devcrypto lists the same ciphers as before, and loader_attic loads and
reads a PVK RSA key through "openssl storeutl -engine loader_attic".

Reviewed by:            ngie
MFC after:              1 week
MFC to:                 stable/15
Event:                  FreeBSD Vendor Summit 2026
Differential Revision:  https://reviews.freebsd.org/D61273

libcasper: Use pdfork() for the zygote

Use pdfork(2) rather than fork(2) to fork the zygote, and close the
descriptor when the main loop terminates.

MFC after:      1 week
Sponsored by:   Klara, Inc.
Sponsored by:   Qualys, Inc.
Reviewed by:    oshogbo
Differential Revision:  https://reviews.freebsd.org/D60176

libcasper: Use casper_pdfork()

Fixes:          https://cgit.freebsd.org/src/commit/?id=425e4c102f8a ("libcasper: Use pdfork() for the zygote")

__thr_pshared_offpage() is used by pthread functions that must not be
cancellation points according to POSIX.  Use direct __sys_close() instead
of interposed close() there.

Fixes:  https://cgit.freebsd.org/src/commit/?id=1bdbd705993e ("Implement process-shared locks support ...")
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61343

Reviewed by:  markj, aokblast
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61343

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Otherwise they are rejected by kernel in do_wait(), reached through
_thr_sleep()/UMTX_OP_WAIT_UINT_PRIVATE on the user-mode path. Then,
since cond_wait_user() only leaves its loop on a wakeup, a cancellation
or ETIMEDOUT, the EINVAL from do_wait() results in a loop.

If hit, this indicates a bug in user code, but the system library
must be resilient to such misuse.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

for ERRORCHECK and ADAPTIVE_NP mutexes, instead of ETIMEDOUT. This is
explicitly specified by POSIX.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Relocking an owned NORMAL mutex with an absolute timeout has two issues:
- nanosleep(2) is never restarted, so any caught signal causes
  an early ETIMEDOUT.
- If CLOCK_REALTIME or CLOCK_TAI are stepped backward during the sleep,
  the call also returns ETIMEDOUT before the clock reaches the deadline.

The kernel already polls CPU-time clocks and handles realtime steps.
Use _thr_umtx_timedwait_uint() in a loop to handle both issues.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61381

* Always use libmd's MD5 since it's deprecated in OpenSSL.

* Use ASN1_STRING_get_length() instead of ASN1_STRING_length().

The /dev/crypto cipher and MAC keys are copied from userland and
released with free(), leaving the key bytes in freed kernel memory.
Use zfree() so the key material is cleared on session teardown and on
the setup error path.

Reviewed by:    markj
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D61324

linux_getdents() and linux_getdents64() round their native read size up
to DEV_BSIZE before converting entries. For an unaligned caller buffer,
the native batch can contain more entries than fit in the Linux buffer.
Conversion then returns EINVAL even after copying complete entries,
and the native read has already advanced the directory position.

For counts of at least DEV_BSIZE, use min(args->count, MAXBSIZE) instead.
A 768-byte request, such as rustix's initial directory read, now uses a
768-byte native buffer rather than 1024. The converted Linux dirent and
dirent64 records are no larger than their native counterparts, so the
whole translated batch fits. Returning a short batch is allowed, and
consuming the whole native batch avoids needing to rewind the directory
position.

Keep the existing sizing for counts below DEV_BSIZE. This fixes the
oversized-batch case in both getdents interfaces, including legacy
getdents for 32-bit and 64-bit callers. The remaining small-buffer,
copyout-failure and old single-entry readdir problems are outside the
scope of this change.

Fixes:  https://cgit.freebsd.org/src/commit/?id=110f2567cb51 ("linux_file.c: Fix handling of NFS [...]")
MFC after:      3 days
Sponsored by:   Alchemilla Ventures Private Limited
Reviewed by:    kevans, markj
Differential Revision:  https://reviews.freebsd.org/D60760

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

sys_wait6 is a little more complicated than typical as compat layers
need to translate siginfo_t.

Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

kldsym(2) is more complex than typical because it requires translation
of struct kld_sym_lookup which is a weird in/out structure.  Out of
paranoia we avoid copying out the symname pointer in the capability
version to eliminate the possiblity of leaking a capability (but not
invalidating a pointer userspace might be using via copyout()).

Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Linux allows connect() with destination port 0, but FreeBSD returns
EADDRNOTAVAIL in in_pcbconnect() and in6_pcbladdr(). Some Linux programs
(e.g. the new Android CLI tool) rely on this for routability checks,
however.

Add an SV_CONN_PORT0 flag to sv_flags which is set in the Linux sysvecs,
allowing the port 0 guard in the connect paths to be bypassed.

Reviewed by:    glebius, kib
Differential Revision:  https://reviews.freebsd.org/D60659

e_shstrndx is used to index the section header array after only being
checked against zero, so a malformed object can make the linker read up
to about 64K entries past the end of shdr[].  Reject such a file with
ENOEXEC, as link_elf_link_preload() already does.

Reported by:    llm-postcr
Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D61321

A symbol name offset (st_name) indexes the string table in several
places without being checked against ddbstrcnt, so a corrupt object
causes an out-of-bounds read.  Check that the string table is
NUL-terminated and that every st_name lies within it, in both the
preload and file paths, and reject the object with ENOEXEC.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D61322

parse_dynamic() builds the symbol hash table at ef->address + d_ptr
without checking that d_ptr lies within the mapped image, so a crafted
DT_HASH entry causes an out-of-bounds read of the hash header.  Reject
the object with ENOEXEC when the header does not fit in the image.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D61323

A section name offset (sh_name) indexes the section name string table
without being checked against shstrcnt, and the result is passed to
strcmp(), so a corrupt object causes an out-of-bounds read.  Check that
the table is NUL-terminated and that every sh_name lies within it, in
both the preload and file paths, and reject the object with ENOEXEC.

Reviewed by:    kib
MFC after:      1 week
Differential Revision:  https://reviews.freebsd.org/D61338

namei() might restart for altroot or for ERESTART from
nameicap_tracker_add().

vfs_lookup() consumes the reference on ni_startdir and clears it, so
a restarted NDINIT_ATVP() lookup started from the current directory
instead of the vnode passed by the caller.

Save the starting vnode in a local variable, hold it while the lookup
can be restarted, and reference it before the restarted pass. Do not
assert NAMEI_DBG_HADSTARTDIR on the internal restart.

Noted and reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61315

NDINIT_ATVP() initializes dirfd to AT_FDCWD, which is denied for a
process already in cap mode.  Since NDINIT_ATVP() is a special lookup
operation performed by the kernel, it should be allowed to proceed for
the paths beneath vp.

Fabricate a pseudo dirfd value that is an unused placeholder,
which fails the AT_FDCWD comparison and allows the lookup to proceed in
cap mode.

Note that failed cap-mode NDINIT_ATVP lookup returned ECAPMODE without
releasing the caller reference on ni_startdir, which is fixed by this
change.

Reported by:    ivy
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61315

Only allow clocks that make sense for the umtx_sleep().

While there, do not ignore errors from kern_clock_gettime(). The invalid
clock ids are filtered, but if the clock can't be read (CLOCK_TAI before
the TAI-UTC offset is known), the functions operate on uninitialized
memory.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

For msleep(), zero sbt means no timeout. If the timeout was specified as
absolute {0, 0} on MONOTONIC/UPTIME clocks, consider the call timed out
immediately, instead of sleeping until a signal is delivered.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Sponsored by: DARPA, AFRL, Innovate UK

Reviewed by:    kevans
Differential Revision:  https://reviews.freebsd.org/D61342

In the case of modstat(2) use a cast to access the name member of the
old struct version so the compiler see the right array size.  This
addresses a sub-object bounds bug.

Effort:         CHERI upstreaming
Sponsored by:   DARPA, AFRL, Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

The containers (arrays) will not be modified during runtime.

Reviewed by:    kib, imp
MFC after:      2 weeks
Differential Revision:  https://reviews.freebsd.org/D61297

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

The flags argument will be used by compat impelementations.

Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Expose user_clock_nanosleep globally.

Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

namei() leaks the caller's ni_startdir reference on the empty-path
ENOENT return and on namei_getpath() failure.

On ZFS with the default zfs_xattr_compat=1, an empty user-namespace
extattr name on a file that has an xattr directory leaks one reference
on that directory per call.

Reported by:    llm-postcr
Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61366

vn_open_cred() returns EINVAL before calling namei() for
O_CREAT|O_EXCL|O_DIRECTORY and for O_CREAT|O_EMPTY_PATH.
That leaks an NDINIT_ATVP() start directory.

Reviewed by:    markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61366

Reviewed by:  bcr, jhb, olce
Approved by:    jhb, olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60002

Reviewed by:  bcr, jhb, olce
Approved by:    jhb, olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60002

If a module is unloaded after the module is looked up in kern_modstat,
but before one of the copyout's occurs, then the memory being copied
might be freed and reused leading to an information disclosure.

The LLM was particularly concerned about a TOCTOU issue in the length
of the name, but it seems likely that there are issues with all the
copyout's.  As such, hold the shared lock throughout.

Reviewed by:    markj
Reported by:    llm-postcr
MFC after:      3 days
Sponsored by:   Innovate UK
Fixes:          https://cgit.freebsd.org/src/commit/?id=9b3851e9e3b1 ("- Lock down the ``module'' structure...")
Differential Revision:  https://reviews.freebsd.org/D61398

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate, UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Rename accept1 and sendit to user_accept and user_sendit.

Effort:         CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

Effort:               CHERI upstreaming
Sponsored by:   Innovate UK
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2284

In the CAMIOQUEUE ioctl, a queued CCB completes through passdone(),
which moves it to the done queue and calls selwakeuppri() and
KNOTE_LOCKED() so that a consumer blocked in select(2), poll(2) or
kevent(2) wakes up and collects the CCB with CAMIOGET.  An immediate
CCB (e.g. XPT_DEV_ADVINFO or XPT_DEV_MATCH) is instead executed
synchronously in the ioctl and moved to the done queue directly,
with no notification, so a consumer sleeping while waiting for its
completion never wakes up until some other queued I/O completes.

Send the same notification that passdone() sends.  The peripheral
lock is held at this point and backs the knlist, so KNOTE_LOCKED()
is the correct variant.

A version of this fix has been in production use at Spectra Logic
since 2024.

Co-authored-by: Dave Baukus <daveb@spectralogic.com>
Reviewed by:    imp
MFC after:      1 week
Sponsored by:   Spectra Logic
Assisted-by:    Claude Fable 5 <noreply@anthropic.com>
Differential Revision:  https://reviews.freebsd.org/D61416

passpoll() checked the done queue while holding the peripheral lock,
dropped the lock, and only then called selrecord().  A CCB completing
in the window between the unlock and the selrecord() call sent its
selwakeuppri() before the polling thread was on the selinfo list, so
the wakeup was lost and select(2) or poll(2) slept until another
completion arrived or the timeout expired.

Call selrecord() before dropping the lock.  This lock order is
already established: passdone() calls selwakeuppri(), which takes
the selinfo lock, while holding the peripheral lock.

kqueue is not affected, since the knlist is backed by the peripheral
mutex.

Reported by:    llm-postcr
Fixes:          https://cgit.freebsd.org/src/commit/?id=a9934668aa13
MFC after:      1 week
Sponsored by:   Spectra Logic
Assisted-by:    Claude Fable 5 <noreply@anthropic.com>

In the original adaptation of connect/connectat to use user_connectat in
CheriBSD, I failed to pass the fd through in the connectat case and
always passed AT_FDCWD.  This did trigger failures in the unix_connectat
test which I somehow missed in prior test runs.

Reported by:    llm-postcr

The sched_* syscalls can operate either on the calling process (by
setting pid = 0) or by specifying a pid.  They are allowed in capability
mode, but previously were not scoped to only operating on the calling
process.

Reviewed by:    olce
Sponsored by:   The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D57346

Leaking this pointer isn't harmful, but other places take care to clear
it, so handle this in SEM_STAT too.

Reviewed by:    imp, kib
MFC after:      1 week
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D61396

The SysV message queue code has the same problem that we fixed in the
semaphore code in SA-26:54.sysvsem and SA-26:64.sysvsem.  That is,
kern_msgrcv() and kern_msgsnd() are susceptible to TOCTOU races when
they sleep waiting for messages and queue space, respectively.  Unlike
the semaphore code, however, the message queue array is never resized
and there is no notion of message queue sets, so such races do not open
up any memory safety bugs.

Fix the races, following the pattern from the SysV semaphore changes:
use a global sequence number array with wide counters, to avoid changing
the KBI which is embedded in userspace tools.  Fix kern_msgsnd(), which
did not validate the sequence number at all after sleeping.  Use a
msgvalid() helper to factor out some duplicated checks.  Convert a
couple of local flag variables to bools.

Reported by:    Apex Security Research
Reviewed by:    kib
MFC after:      2 weeks
Sponsored by:   The FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D61397

link_elf: bounds-check the dynamic section's tables

parse_dynamic() only checks the DT_HASH header.  nbuckets, nchains and
the other DT_* tables come from the module unchecked.  Check them
against the mapping, and reject a size without its table.

Reported by:    llm-postcr
MFC after:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D61387

link_elf: validate symbol name offsets

st_name isn't checked against the string table size, for any of the
symbol tables used here.  Do what link_elf_obj.c does since 4e2c2842e.

Reported by:    llm-postcr
MFC after:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D61388

link_elf: validate the section headers in link_elf_load_file()

e_shentsize isn't checked, and e_shstrndx, sh_link and sh_name are used
unchecked.  Do what link_elf_obj.c does.

MFC after:      1 week
Reviewed by:    kib
Differential Revision:  https://reviews.freebsd.org/D61389

Two engine Makefiles define different macros from upstream's
engines/build.info:

- padlock: engines/e_padlock.c builds the engine only when PADLOCK_ASM
  is defined.  Upstream defines it on x86 and x86_64, but our Makefile
  never did, so padlock.so has been a stub whose bind_engine() returns
  0 and the e_padlock-x86*.S code it links was never called.  Define
  PADLOCK_ASM on amd64 and i386, where that asm is built.

- loader_attic: upstream defines OPENSSL_NO_PROVIDER_CODE; the Makefile
  had OPENSSL_NO_PROVIDER_CORE.  No source tests either name, so the
  build does not change; this only follows upstream.

Found by comparing per-file compile flags against an upstream 3.5.9
build.  Checked by preprocessing e_padlock.c for amd64 and i386:
COMPILE_PADLOCKENG is now defined.

Reviewed by:            ngie
MFC after:              1 week
MFC to:                 stable/15
Event:                  FreeBSD Vendor Summit 2026
Differential Revision:  https://reviews.freebsd.org/D61271

Obtained from:        CheriBSD
Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D60723

This has the curious effect of placing libsys before libc in the link
order even though libc links against libsys.  While this happens to
work currently, it is fragile and fails to link properly in some edge
cases.

Sponsored by:   AFRL, DARPA
Differential Revision:  https://reviews.freebsd.org/D60724

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  markj
Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

Reviewed by:  bcr, jhb, olce
Approved by:    jhb, olce (mentor)
MFC after:      2 weeks
Sponsored by:   FreeBSD Foundation
Differential Revision:  https://reviews.freebsd.org/D60002

version 4 raises warnings when run as the runners force it to use Node
24 instead of Node 20.  version 5 defaults to Node 24, but version 7
is the current version.

Reviewed by:    emaste
Pull Request:   https://github.com/freebsd/freebsd-src/pull/2477

The project under the .../ghpr subdirectory is an earlier version of the
tool. A newer/supported iteration of the tool can be found on
[GitHub][ghpr-repo].

`ghpr` can be installed via `pkg`, e.g., `pkg install py312-ghpr-5`.

Please see the [README.md][readme] for further details.

MFC after:      1 month

[ghpr-repo]: https://github.com/bsdimp/ghpr/
[readme]: https://github.com/bsdimp/ghpr/blob/main/README.md

Reviewed by:    dteske
Differential Revision:  https://reviews.freebsd.org/D61086

This too has been superseded by `git-arc`, located in the same directory as
`arcgit`.

Differential Revision:  https://reviews.freebsd.org/D61379

Sometimes ICMP echo packets get lost, so send more than one during
the sanity check. This should resolve the intermittent failure of the
return.py:TestReturn::test_tcp test.

PR:             https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=300511
Sponsored by:   Rubicon Communications, LLC ("Netgate")

capsicum-test: make the code WARNS=6 clean

Make the code WARNS=6 clean by doing the following:
- Renaming variables (-Wshadow).
- Use memcpy instead of assigning the result of CMSG_DATA to a variable
  (-Wcast-align).
- Wrap some macros with do-while(0) to avoid variable collisions
  (-Wshadow).
- Push one of the TRACE statements up by 1 layer to avoid a collision
  between 2 calls of TRACE via the same overarching macro.

This was needed in order for the code to build properly with D61066,
since the code was not compiling with WARNS set to 3 at the testcase
level.

MFC after: 1 week
Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D61080

capsicum-test: Disable `HAVE_SEND_RECV_MMSG` again

04c4b2084eb9 accidentally added some changes from another WIP commit into that
diff. Instead of wholesale reverting the change, just revert the part that's
currently broken (`HAVE_SEND_RECV_MMSG`). While some of the related tests pass,
one of the testcases (`capmode.cc:AllowedMmsgSendRecv`) doesn't currently pass.

Revert the change to make the CI run more green again.

MFC after:      1 week
Fixes:  https://cgit.freebsd.org/src/commit/?id=04c4b2084eb9 ("capsicum-test: make the code WARNS=6 clean")

tests/sys/capsicum: Fix -Wshadow issue with `fd_set`

`fd_set` is defined in `sys/select.h`, and prior to this change, was in fcntl.cc as well.

This change renames `fd_set` to `fd_set_` to avoid the name collision.

MFC after:      1 week
Reported by:    gcc 14
Fixes:          https://cgit.freebsd.org/src/commit/?id=04c4b2084eb9 ("capsicum-test: make the code WARNS=6 clean")

This change builds capsicum_test and installs/runs it as an unprivileged
user ("tests" in vanilla FreeBSD) and root.

This required adjusting logic in the Makefile in order to build two
binaries with the same sources and running them as separate binaries.

Moreover, in order to restore coverage and ensure that some tests which
require `other_uid` (typically specified via `-u` on the CLI with the
test program) don't fail, become the "tests" user when run as root. This
technically doesn't honor unprivileged_user property in kyua.conf: the
property needs to be passed via a command-line parameter to the test
program.

MFC after:      1 week
Reported by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=3fb03fb35b20 ("[tests] switch GoogleTest tests ...")

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D61066

fix operator and comma spacing and three long lines

MFC After: 1 Week
Approved-by: ngie (co-mentor)

Reviewed by:    ngie, imp
Differential Revision:  https://reviews.freebsd.org/D61302

Use similar spacing on adjacent lines, for readability. No functional
change.

MFC after:    3 days

This release contains security fixes and small bugfixes.

Full release notes are available at
https://www.openssh.com/txt/release-10.5.

Selected items from the release notes:

Security
========

 * ssh-agent(1): fix an interaction between agent locking and the
   session-bind@openssh.com extension that is used to identify
   forwarded agents. These binding requests were refused when the
   agent was locked, with the result that operations that were
   intended to be limited to local use only could be performed
   remotely, including the ability to add PKCS#11 tokens and make
   use of keys that had destination restrictions applied.
   Reported by sn0x-sharma

 * ssh(1): avoid potential realloc use-after-free in the client if a
   remote forwarding is added via the local session multiplexing
   socket while a remote forwarding open request is pending with the
   server. Report and fix from Brian Mingus of Cognatory

 * sshd(8): make the authorized_keys "restrict" keyword apply
   correctly to tunnel forwarding too (which is administratively
   disabled by default). Reported by Erichen, Institute of Computing
   Technology, Chinese Academy of Sciences
    
New features
------------

 * ssh-keygen(1): add ability to set or clear the touch-required and
   verify-required flags on FIDO private keys when resetting a
   private key's passphrase.

 * ssh(1): tweak ordering of certificates tried during pubkey
    authentication to prefer FIDO keys that do not require user
    presence (touch) first, and FIDO keys that require user
    verification via PIN or biometrics last. This effectively tries
    low-friction authenticators before higher friction ones.

 * ssh(1): add a "ssh -Z user@host" mode that prints the keys that
   will be tried for public key authentication in the order that
   they will be used.
    
 * sshd(8) use setproctitle(3) to identify sshd-session when its
   acting as a post-authentication monitor.
    
Sponsored by:   The FreeBSD Foundation

Instead of hoping that the page after sbrk(0) is unmapped, map a page
with mmap and then munmap it.  This won't work with CheriABI and heap
temporal safety, but it's an easy fix for now and works on all
architectures.

Reviewed by:    ngie
Sponsored by:   DARPA, AFRL
Differential Revision:  https://reviews.freebsd.org/D46954

It uses sbrk to attempt to detect memory leaks in telldir, but we're not
going to export sbrk in the future and this is unreliable for mmap-based
mallocs.  It's also a regression test for a specific NetBSD bug.

Reviewed by:    ngie
Sponsored by:   DARPA, AFRL
Differential Revision:  https://reviews.freebsd.org/D46955

to follow the POSIX specification.

Sponsored by:   The FreeBSD Foundation
MFC after:      1 week
Differential revision:  https://reviews.freebsd.org/D61253

  [SLPVectorizer] Check std::optional coming out of getPointersDiff (#175784)

  Fixes https://github.com/llvm/llvm-project/issues/175768
  There are other unchecked uses std::optional in this pass but I couldn't
  figure out a test that triggers them

This fixes a clang crash in the SLP vectorizer, hit when building
audio/csound on powerpc64le. The hardened libc++ traps on the disengaged
optional, so clang dies with exit code 133. The second hunk is adapted to
llvm 21, where analyzeConstantStrideCandidate() is still isStridedLoad().

Reviewed by:    dim
MFC after:      3 days

Differential Revision:  https://reviews.freebsd.org/D61354

This release contains security fixes and small bugfixes.

Full release notes are available at
https://www.openssh.com/txt/release-10.6 .

Selected items from the upstream release notes:

Security
========

 * ssh-agent(1): fix an interaction between agent locking and the
   session-bind@openssh.com extension that is used to identify
   forwarded agents. These binding requests were refused when the
   agent was locked, with the result that operations that were
   intended to be limited to local use only could be performed
   remotely, including the ability to add PKCS#11 tokens and make
   use of keys that had destination restrictions applied.
   Reported by sn0x-sharma

 * ssh(1): avoid potential realloc use-after-free in the client if a
   remote forwarding is added via the local session multiplexing
   socket while a remote forwarding open request is pending with the
   server. Report and fix from Brian Mingus of Cognatory

 * sshd(8): make the authorized_keys "restrict" keyword apply
   correctly to tunnel forwarding too (which is administratively
   disabled by default). Reported by Erichen, Institute of Computing
   Technology, Chinese Academy of Sciences

New features
------------

 * ssh-keygen(1): add ability to set or clear the touch-required and
   verify-required flags on FIDO private keys when resetting a
   private key's passphrase.

 * ssh(1): tweak ordering of certificates tried during pubkey
    authentication to prefer FIDO keys that do not require user
    presence (touch) first, and FIDO keys that require user
    verification via PIN or biometrics last. This effectively tries
    low-friction authenticators before higher friction ones.

 * ssh(1): add a "ssh -Z user@host" mode that prints the keys that
   will be tried for public key authentication in the order that
   they will be used.

 * sshd(8) use setproctitle(3) to identify sshd-session when its
   acting as a post-authentication monitor.

Sponsored by:   The FreeBSD Foundation

Full release notes are available at
https://www.openssh.org/txt/release-10.6p2 .

Selected items from the upstream release notes:

Future deprecation notice
-------------------------

 * scp(1): begin deprecating the -R flag, which is used to perform a
   remote-to-remote copy by executing scp on a remote host. This
   option is a fragile optimisation that is difficult to use because
   it requires credentials on the remote host. It also creates
   security risks if the shell quoting rules on the remote system
   where the copy is performed differ from the client's expectations.

   From OpenSSH 10.6, this option will continue to work but will
   cause a deprecation warning to be emitted to standard error. In
   a future release, the option will be ignored and will leave in
   place the default remote-to-remote copy behaviour (copy via the
   host running scp).

Reviewed by:    jlduran
Sponsored by:   The FreeBSD Foundation

capsicum-test: make the code WARNS=6 clean

Make the code WARNS=6 clean by doing the following:
- Renaming variables (-Wshadow).
- Use memcpy instead of assigning the result of CMSG_DATA to a variable
  (-Wcast-align).
- Wrap some macros with do-while(0) to avoid variable collisions
  (-Wshadow).
- Push one of the TRACE statements up by 1 layer to avoid a collision
  between 2 calls of TRACE via the same overarching macro.

This was needed in order for the code to build properly with D61066,
since the code was not compiling with WARNS set to 3 at the testcase
level.

MFC after: 1 week

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D61080

Revert "capsicum-test: make the code WARNS=6 clean"

The wrong patch got committed somehow from one of my git clones. Revert the
change so I can reapply the correct patch >:(.

This reverts commit 5bae837f316ca96b69c61bae15bd61da76e7f3ea.

tests/sys/capsicum: restore test coverage with root user

This change builds capsicum_test and installs/runs it as an unprivileged
user ("tests" in vanilla FreeBSD) and root.

This required adjusting logic in the Makefile in order to build two
binaries with the same sources and running them as separate binaries.

Moreover, in order to restore coverage and ensure that some tests which
require `other_uid` (typically specified via `-u` on the CLI with the
test program) don't fail, become the "tests" user when run as root. This
technically doesn't honor unprivileged_user property in kyua.conf: the
property needs to be passed via a command-line parameter to the test
program.

MFC after:      1 week
Reported by:    markj
Fixes:          https://cgit.freebsd.org/src/commit/?id=3fb03fb35b20 ("[tests] switch GoogleTest tests ...")

Reviewed by:    markj
Differential Revision:  https://reviews.freebsd.org/D61066

Revert "tests/sys/capsicum: restore test coverage with root user"

The wrong patch was applied for D61080. Both changes must go.

This reverts commit dda15b669d021346682009f38acc6db2639fb99f.

Remove {ATF,PLAIN}_REQUIRE_KERNEL_MODULE macros

These macros predated the `require.kmod` (ATF) and `required_kmods`
(kyua) test metadata and are no longer needed.

Add a hint to freebsd_test_suite/macros.h about the `*FEATURE*` macros
going away soon. See [this kyua issue][kyua-issue] for more details.

MFC after:      1 month
Differential Revision:  https://reviews.freebsd.org/D61082

[kyua-issue]: https://github.com/freebsd/kyua/issues/346

Revert "Remove {ATF,PLAIN}_REQUIRE_KERNEL_MODULE macros"

The change breaks the build of tests/sys/net/routing/test_rtsock_l3.c.

This reverts commit e34b159d4c64575aa45763968b6ad01dfd7c2337.