Build date: 1766444402 - Mon Dec 22 23:00:02 UTC 2025
Build cvs date: 1766435089 - Mon Dec 22 20:24:49 UTC 2025
Build id: 2025-12-23.1
Build tags: amd64-regress ports sysupgrade

Applied the following diff(s):
/home/anton/tmp/robsd/src-sys-em.diff
/home/anton/tmp/robsd/src-sys-uhidev-sispm.diff
/home/anton/tmp/robsd/src-sysupgrade.diff

P regress/usr.bin/ssh/cert-hostkey.sh
P regress/usr.bin/ssh/cert-userkey.sh
P regress/usr.bin/ssh/test-exec.sh
P sys/arch/arm64/dev/smmu.c
P sys/dev/fdt/virtio_mmio.c
P sys/dev/pci/virtio_pci.c
P sys/dev/pv/if_vio.c
M sys/dev/usb/uhidev.c
P sys/uvm/uvm_map.c
P sys/uvm/uvm_page.c
P usr.bin/ssh/auth2-hostbased.c
P usr.bin/ssh/auth2-pubkey.c
P usr.bin/ssh/auth2-pubkeyfile.c
P usr.bin/ssh/clientloop.h
P usr.bin/ssh/gss-serv.c
P usr.bin/ssh/mux.c
P usr.bin/ssh/sftp-client.c
P usr.bin/ssh/ssh-agent.c
P usr.bin/ssh/ssh-keygen.1
P usr.bin/ssh/ssh-keygen.c
P usr.bin/ssh/ssh.1
P usr.bin/ssh/ssh.c
P usr.bin/ssh/sshconnect.c
P usr.bin/ssh/sshkey.c
P usr.bin/ssh/sshkey.h
P usr.bin/ssh/sshsig.c
P usr.bin/tmux/cmd-find.c
P usr.bin/tmux/key-bindings.c
P usr.bin/tmux/options-table.c
P usr.bin/tmux/status.c
P usr.bin/tmux/tmux.1
M usr.sbin/bgpd/session.c

commit mEOUdIQXgbkNBYln
Author: sf
Date: 2025/12/22 20:24:49

  virtio: Fix condition for buffer chaining, negotiate VIRTIO_F_ANY_LAYOUT

  In 0.9-only time, the VIO_HAVE_MRG_RXBUF macro checked just for the
  VIRTIO_NET_F_MRG_RXBUF feature. The meaning was later changed to
  (version_1 || VIRTIO_NET_F_MRG_RXBUF), but the new meaning is only
  correct for one use of the macro. The buffer chaining must check for the
  MRG_RXBUF feature exclusively.

  On the other hand, the check if we have to split the header from the
  rest of the buffer in the rx queue is a workaround for old kvm versions.
  The standard has since then gained the ANY_LAYOUT feature flag to turn
  off this workaround. According to the virtio 1.x standard, we should
  accept VIRTIO_F_ANY_LAYOUT if it is offered for transitional devices.
  ANY_LAYOUT is implicit if VERSION_1 has been negotiated.

  Since accepting ANY_LAYOUT only relaxes the requirements for us, we can
  simply accept it globally for all virtio device types. vioblk(4) and
  vioscsi(4) unconditionally use the strict buffer layout required for
  legacy devices without ANY_LAYOUT, anyway.

  Problem noticed by helg@

  ok helg@

  sys/dev/fdt/virtio_mmio.c
  sys/dev/pci/virtio_pci.c
  sys/dev/pv/if_vio.c

commit nlerqRoQ7H05eD6H
Author: patrick
Date: 2025/12/22 11:07:51

  Inherit the DMA tag from the device itself and only override what
  is necessary.  Whether a device is DMA coherent or not depends on
  the device, the SMMU does not influence DMA coherency attributes.
  I assume we have been lucky so far that our machines that have an
  SMMUv2 usually have devices with DMA coherency.  On the RK3588
  this is not the case, and us always adding the COHERENT flag makes
  devices fail to work when used with smmu(4) enabled.

  ok kettenis@

  sys/arch/arm64/dev/smmu.c

commit KAwbW9qxZZUzckNc
Author: mpi
Date: 2025/12/22 10:57:14

  Assert that `wire_count' doesn't wrap around.

  sys/uvm/uvm_page.c

commit 5iadI5PebeXccCbB
Author: mpi
Date: 2025/12/22 10:55:07

  Remove unhelpful XXXs in comments.

  sys/uvm/uvm_map.c

commit ZMfA12nDaFfmKCwh
Author: nicm
Date: 2025/12/22 08:41:01

  Add prompt-command-cursor-style, from Joshua Cooper in GitHub issue 4765.

  usr.bin/tmux/options-table.c
  usr.bin/tmux/status.c
  usr.bin/tmux/tmux.1

commit A8YTgOsGsTRT7DHe
Author: nicm
Date: 2025/12/22 08:39:35

  With status-keys vi, move the cursor left by one when pressing Escape to
  enter command mode, like vi. GitHub issue 4767 from Joshua Cooper.

  usr.bin/tmux/status.c

commit 5fBQRi98cpETqrJE
Author: nicm
Date: 2025/12/22 08:35:04

  Add {current}/{active} for -t for current window or active pane, from
  Manuel Einfalt in GitHub issue 4766.

  usr.bin/tmux/cmd-find.c
  usr.bin/tmux/key-bindings.c
  usr.bin/tmux/tmux.1

commit bian0Las7HXZaZEn
Author: djm
Date: 2025/12/22 03:36:43

  correctly quote wildcard host certificate principal name, lest it
  expand to an unrelated filename in the working directory

  regress/usr.bin/ssh/cert-hostkey.sh

commit AzdyjqO4eedi3uOt
Author: djm
Date: 2025/12/22 03:12:05

  return 0 in void function; spotted by clang -Wextra

  usr.bin/ssh/gss-serv.c

commit dcLqG4RFATrjMKBE
Author: djm
Date: 2025/12/22 01:50:46

  regression tests for certificates with empty principals sections
  (which are now unconditionally refused) and for certificates with
  wildcard principals (which should only be accepted in host certs)

  regress/usr.bin/ssh/cert-hostkey.sh
  regress/usr.bin/ssh/cert-userkey.sh

commit dexYzICaJqxjiAJf
Author: djm
Date: 2025/12/22 01:49:03

  When certificate support was added to OpenSSH, certificates were
  originally specified to represent any principal if the principals
  list was empty.

  This was, in retrospect, a mistake as it created a fail-open
  situation if a CA could be convinced to accidentally sign a
  certificate with no principals. This actually happened in a 3rd-
  party CA product (CVE-2024-7594).

  Somewhat fortunately, the main pathway for using certificates in
  sshd (TrustedUserCAKeys) never supported empty-principals
  certificates, so the blast radius of such mistakes was
  substantially reduced.

  This change removes this footcannon and requires all certificates
  include principals sections. It also fixes interpretation of
  wildcard principals, and properly enables them for host
  certificates only.

  This is a behaviour change that will permanently break uses of
  certificates with empty principals sections.

  ok markus@

  usr.bin/ssh/auth2-hostbased.c
  usr.bin/ssh/auth2-pubkey.c
  usr.bin/ssh/auth2-pubkeyfile.c
  usr.bin/ssh/ssh-agent.c
  usr.bin/ssh/ssh-keygen.1
  usr.bin/ssh/ssh-keygen.c
  usr.bin/ssh/sshconnect.c
  usr.bin/ssh/sshkey.c
  usr.bin/ssh/sshkey.h
  usr.bin/ssh/sshsig.c

commit 3rXbcJfmCp5WobVY
Author: djm
Date: 2025/12/22 01:31:07

  don't try to test webauthn signatures.
  Nothing in OpenSSH generates these (yet)

  regress/usr.bin/ssh/test-exec.sh

commit GoS0nWOQcYRPWC4z
Author: djm
Date: 2025/12/22 01:20:39

  Don't misuse the sftp limits extension's open-handles field.
  This value is supposed to be the number of handles a server will allow
  to be opened and not a number of outstanding read/write requests
  that can be sent during an upload/download.

  ok markus@

  usr.bin/ssh/sftp-client.c

commit 2P0s6mnfORN9CyZD
Author: djm
Date: 2025/12/22 01:17:31

  add a "ssh -O channels user@host" multiplexing command to get a
  running mux process to show information about what channels are
  currently open; ok dtucker@ markus@

  usr.bin/ssh/clientloop.h
  usr.bin/ssh/mux.c
  usr.bin/ssh/ssh.1
  usr.bin/ssh/ssh.c


commit jmcX9i7qBxKWkALl
Author: matthieu
Date: 2025/12/21 17:10:39

  update

  3RDPARTY
  MODULES