Build date: 1777240803 - Sun Apr 26 22:00:03 UTC 2026
Build cvs date: 1777231508 - Sun Apr 26 19:25:08 UTC 2026
Build id: 2026-04-27.1
Build tags: amd64-regress ports sysupgrade

Applied the following diff(s):
/home/anton/tmp/robsd/src-sys-em.diff
/home/anton/tmp/robsd/src-sys-uhidev-sispm.diff
/home/anton/tmp/robsd/src-sysupgrade.diff

P lib/libcrypto/pkcs7/pk7_doit.c
P lib/libcrypto/x509/x509_addr.c
P sys/dev/ic/com.c
P sys/dev/ic/qwz.c
P sys/dev/ic/qwzreg.h
P sys/dev/ic/qwzvar.h
P sys/dev/pci/if_qwz_pci.c
M sys/dev/usb/uhidev.c
M usr.sbin/bgpd/session.c

commit eaukg5IImE4YhAJ8
Author: mglocker
Date: 2026/04/26 19:25:08

  Bring the qwz driver up to WPA2 association on the Qualcomm WCN7850
  chip.

  Major changes:

  1. Fix the RX path.
  2. Fix the TX path.
  3. Fix MSI interrupt routing.
  4. Make the WPA2 4-way handshake complete.
  5. Add bus_dmamap_sync() barriers on RX and TX.
  6. Update register/descriptor defines from ath11k to ath12k WiFi7.

  Known limitations:

  - DHCP does not yet complete on most setups: TX of DISCOVER works
  (the DHCP server sees it), but the OFFER does not reach the host.
  Likely an RX-path or post-handshake GTK state issue.  Reported by
  kettenis@ with an athn(4) AP on a Vivobook.
  - Some hardware (e.g. Honor laptop) hits a firmware page fault
  during association.  RDDM dump shows a fault in dlpager_main.c
  inside the firmware; likely a memory addressing issue specific to
  that silicon stepping or IOMMU configuration.  Reported by kirill@.
  - On APs with PMF (Protected Management Frames) enabled, the
  association flaps continuously; on APs without PMF (Apple
  hotspot, athn(4)) the connection reaches a stable "active" state
  and survives subsequent firmware crashes via the recovery path.
  - Firmware occasionally crashes after sustained traffic on some APs
  (FritzBox in particular can drive the device into an
  unrecoverable "tx credits timeout" state); the driver normally
  recovers via the existing RDDM path in if_qwz_pci.c without a
  system reboot.
  - One PN-replay loop in qwz_dp_peer_rx_pn_replay_config doesn't
  iterate the non-QoS TID slot.  Cosmetic for normal use; will
  land as a separate small commit.

  This is a foundation commit: enough to associate and exchange some
  frames, but not yet a usable network connection.  Further work is
  required.

  OK kettenis@, kirill@

  sys/dev/ic/qwz.c
  sys/dev/ic/qwzreg.h
  sys/dev/ic/qwzvar.h
  sys/dev/pci/if_qwz_pci.c

commit ML0EyFXCUkaiRpoa
Author: tb
Date: 2026/04/26 17:58:58

  make_addressRange: unused bits in max must be zero

  X509v3_addr_add_range() requires that min and max of an address range
  have network encoding. In the RFC 3779 encoding of an actual address
  range (as opposed to a prefix) as a SEQUENCE OF two ASN.1 BIT STRINGs,
  the trailing one bits of the maximum become unused bits and therefore
  must be DER encoded as zeroes. The DER encoder will clear them via i2d
  but these trailing ones are annoying. Make a copy in which the unused
  bits are cleared.

  ok kenjiro

  lib/libcrypto/x509/x509_addr.c

commit mAH2NPrEhfOoDNTU
Author: kettenis
Date: 2026/04/26 09:27:15

  Attempt to drain the transmit FIFO before resetting or disabling it such
  that output that is currently in the FIFO makes it out.  We already do
  this when attaching as a console by using a fixed delay, but not in
  compwroff() which runs when userland closes the associated tty.  Instead
  of using a fixed delay, look at the LSR_TSRE bit which should get set
  if the FIFO (or the itransmit shift register if the FIFO is disabled) is
  empty.  Use a fixed timeout such that on hardware with a non-functional
  LSR_TSRE bit the loops still terminate.

  This should fix issues where we lose serial output when userland closes
  a tty or when com(4) attaches to the port that is used as the console.

  ok deraadt@

  sys/dev/ic/com.c

commit MMCyUYW0amZr3KkC
Author: tb
Date: 2026/04/26 04:19:11

  Fix PKCS7_set_{un,}signed_attributes()

  In both these functions, if the X509_ATTRIBUTE_dup() fails, the
  remainder of the sk stack is shared with p7si->{un,}auth_attr and
  the caller will likely end up freeing it twice.

  Fix this by writing another sk_deep_copy() patterned after the existing
  ones in x509_lu.c and x509_vpm.c. PKCS7_set_{un,}signed_attributes()
  become trivial wrappers of that.

  ok jsing kenjiro

  lib/libcrypto/pkcs7/pk7_doit.c