Build date: 1781215203 - Thu Jun 11 22:00:03 UTC 2026
Build cvs date: 1781207423 - Thu Jun 11 19:50:23 UTC 2026
Build id: 2026-06-12.1
Build tags: amd64-regress ports sysupgrade

Applied the following diff(s):
/home/anton/tmp/robsd/src-sys-em.diff
/home/anton/tmp/robsd/src-sys-uhidev-sispm.diff
/home/anton/tmp/robsd/src-sysupgrade.diff

P distrib/sets/lists/base/mi
P etc/rc.d/syslogd
P gnu/llvm/llvm/lib/CodeGen/SafeStack.cpp
P libexec/login_radius/login_radius.c
P libexec/login_radius/login_radius.h
P libexec/login_radius/raddauth.c
P regress/usr.sbin/syslogd/Syslogd.pm
P regress/usr.sbin/syslogd/args-privsep.pl
P regress/usr.sbin/syslogd/args-sighup-config.pl
P regress/usr.sbin/syslogd/args-sighup-privsep.pl
P regress/usr.sbin/syslogd/args-sighup-tcp.pl
P regress/usr.sbin/syslogd/args-sighup-tls.pl
P regress/usr.sbin/syslogd/args-sighup.pl
P regress/usr.sbin/syslogd/args-sigpipe.pl
P regress/usr.sbin/syslogd/args-sigterm.pl
P regress/usr.sbin/syslogd/logflush.c
P regress/usr.sbin/syslogd/ttylog.c
P sbin/isakmpd/exchange.c
P sbin/isakmpd/ipsec.c
P sbin/isakmpd/message.c
P sys/dev/pci/if_mwx.c
P sys/dev/pci/if_mwxreg.h
P sys/dev/pci/drm/i915/i915_driver.c
P sys/dev/pci/drm/i915/display/intel_fbdev.c
P sys/dev/pci/drm/include/drm/drm_fb_helper.h
P sys/dev/pci/drm/include/linux/fb.h
P sys/dev/sdmmc/sdmmc_mem.c
M sys/dev/usb/uhidev.c
P sys/kern/uipc_socket.c
P sys/sys/socketvar.h
P usr.bin/sndiod/dev.c
P usr.bin/tmux/cmd-resize-pane.c
P usr.bin/tmux/cmd-send-keys.c
P usr.bin/tmux/key-bindings.c
P usr.bin/tmux/layout.c
P usr.bin/tmux/screen-write.c
P usr.bin/tmux/server-client.c
P usr.bin/tmux/tmux.1
P usr.bin/tmux/tmux.h
P usr.bin/tmux/window.c
M usr.sbin/bgpd/session.c
U usr.sbin/syslogd/Makefile
U usr.sbin/syslogd/Makefile.inc
U usr.sbin/syslogd/parent.c
P usr.sbin/syslogd/privsep.c
P usr.sbin/syslogd/syslogd.c
P usr.sbin/syslogd/syslogd.h
U usr.sbin/syslogd/syslogd/Makefile
U usr.sbin/syslogd/syslogd-parent/Makefile

commit QxP0LYJjpa6Sb9Fo
Author: nicm
Date: 2026/06/11 19:50:23

  When MODE_SYNC is on, all terminal updates need to deferred, not just
  scrolling. Check the flag before each one. GitHub issue 4983.

  usr.bin/tmux/screen-write.c
  usr.bin/tmux/server-client.c

commit iMozlozWn96DRa7V
Author: bluhm
Date: 2026/06/11 19:21:51

  Fix race during socket unsplicing.

  Problem was that splicing holds the socket lock when it writes
  so_sp, but unsplicing does not when it reads so_sp.  So it may get
  the new pointer, but PR_ZERO is not visible due to reordering.  Then
  so->so_sp->ssp_socket is garbage.  Crash happend on octeon/mips64
  during regress/sys/netinet/udpthread test run-unsplice.
  When creating a splice from socket 1 to socket 2, kernel holds
  socket buffer lock on so1->so_rcv and so2->so_snd and socket lock
  on both while installing so_sp on so1 and so2.  Concurrent sosplice()
  on socket 2 has the opposite order, we hold sblock on so2->so_rcv,
  sblock on so1->so_snd and solock on both sockets.
  The unsplice thread of the source socket did hold sblock on so->so_rcv
  only.  So we did lockless so_sp check while concurrent sosplice()
  thread installs so_sp on the same socket as drain, holding sblock
  on so->so_snd.
  Grabbing sblock on both so->so_srv and so->so_snd fixes the crash.

  with and OK mvs@

  sys/kern/uipc_socket.c

commit SFPKaQOfkppz7pmW
Author: nicm
Date: 2026/06/11 19:13:34

  Change send-keys -K to insert keys in the right place in the queue, like
  we already do for key bindings. GitHub issue 3476.

  usr.bin/tmux/cmd-send-keys.c
  usr.bin/tmux/server-client.c
  usr.bin/tmux/tmux.h

commit 54fWio9ohtzltNN9
Author: mglocker
Date: 2026/06/11 18:55:13

  Prepare sdmmc(4) for hibernation on arm64:
  arm64 doesn't know about "struct bus_dmamap"; use bus_dmamap_t instead.

  ok deraadt@

  sys/dev/sdmmc/sdmmc_mem.c

commit 1hzXhq2WaMkPd4fV
Author: bluhm
Date: 2026/06/11 18:28:46

  Move syslogd-parent to /usr/libexec/ to avoid access by $PATH.
  suggested by deraadt@

  distrib/sets/lists/base/mi
  usr.sbin/syslogd/Makefile
  usr.sbin/syslogd/Makefile.inc
  usr.sbin/syslogd/privsep.c
  usr.sbin/syslogd/syslogd/Makefile
  usr.sbin/syslogd/syslogd-parent/Makefile

commit cQqsB1SqoT405PF5
Author: bluhm
Date: 2026/06/11 16:51:14

  Adapt regress tests for separate syslogd parent.

  regress/usr.sbin/syslogd/Syslogd.pm
  regress/usr.sbin/syslogd/args-privsep.pl
  regress/usr.sbin/syslogd/args-sighup-config.pl
  regress/usr.sbin/syslogd/args-sighup-privsep.pl
  regress/usr.sbin/syslogd/args-sighup-tcp.pl
  regress/usr.sbin/syslogd/args-sighup-tls.pl
  regress/usr.sbin/syslogd/args-sighup.pl
  regress/usr.sbin/syslogd/args-sigpipe.pl
  regress/usr.sbin/syslogd/args-sigterm.pl
  regress/usr.sbin/syslogd/logflush.c
  regress/usr.sbin/syslogd/ttylog.c

commit NV9l0xn2S7XSKQfO
Author: robert
Date: 2026/06/11 16:46:20

  fir crashing with scalable TypeSizes

  From 537f3d3a7588d226b86590f97c4401107585e1ce Mon Sep 17 00:00:00 2001
  From: Jakob Koschel <jakobkoschel@google.com>
  Date: Thu, 5 Mar 2026 01:11:44 +0100
  Subject: [PATCH] [SafeStack] Fix crashing with scalable TypeSizes (#180547)

  On e.g. aarch64 the TypeSize of scalar types can have a size that is not
  known at compile time.
  Currently when safestack occurs those it simply crashes as described in
  https://github.com/llvm/llvm-project/issues/175868.

  gnu/llvm/llvm/lib/CodeGen/SafeStack.cpp

commit LFDiTZ5IGKhB8tG0
Author: bluhm
Date: 2026/06/11 15:41:33

  Provide a separate executable file for syslogd parent.

  syslogd(8) forks and execs its parent process to keep privileged
  parts separated.  This parent process can be easily implemented as
  a separate program.  It gets its own main() and minimal debug logging
  functions.  The splitted parent process image is smaller, especially
  without additional libs.
  Use additional directories to build both parts.  The rcctl script
  has to be adopted, as the parent process has a different name.

  OK deraadt@

  etc/rc.d/syslogd
  usr.sbin/syslogd/Makefile
  usr.sbin/syslogd/Makefile.inc
  usr.sbin/syslogd/parent.c
  usr.sbin/syslogd/privsep.c
  usr.sbin/syslogd/syslogd.c
  usr.sbin/syslogd/syslogd.h
  usr.sbin/syslogd/syslogd/Makefile

commit ouNMuQzG9Fv5CARt
Author: nicm
Date: 2026/06/11 14:19:59

  Add a helper to free the list of pending resizes.

  usr.bin/tmux/screen-write.c
  usr.bin/tmux/server-client.c
  usr.bin/tmux/tmux.h
  usr.bin/tmux/window.c

commit 0M2SWDnuQdrUEv30
Author: claudio
Date: 2026/06/11 13:52:45

  Implement mwx_mac_tx_free() for MT7921 and add some extra bits to
  mwx_txwi_put(). With this MT7921 is able to connect to an open WIFI.

  This commit was done over mwx(4) with a MT7921

  sys/dev/pci/if_mwx.c
  sys/dev/pci/if_mwxreg.h

commit OYEUlmiQQksxC1nP
Author: bluhm
Date: 2026/06/11 12:50:52

  Fix typo in locking comment.
  OK mvs@

  sys/sys/socketvar.h

commit 3qOAlM9rCCjrXfKt
Author: nicm
Date: 2026/06/11 10:16:19

  Add support for floating panes to resize-pane, from Dane Jensen.

  usr.bin/tmux/cmd-resize-pane.c
  usr.bin/tmux/layout.c
  usr.bin/tmux/tmux.1
  usr.bin/tmux/tmux.h

commit 8VJXfZrrfY6t3amP
Author: hshoexer
Date: 2026/06/11 09:55:17

  isakmpd(8): Fix NULL dereference in message_alloc_reply() callers

  message_alloc_reply() dereferences the returned pointer of
  message_alloc() without a NULL check.  Add one so callers can handle
  the failure.

  Also add NULL checks at both call sites in exchange.c.

  test & ok sthen

  sbin/isakmpd/exchange.c
  sbin/isakmpd/message.c

commit 6XEWzH2q0HphyK38
Author: hshoexer
Date: 2026/06/11 09:50:49

  isakmpd(8): Fix possible unaligned 32 bit read

  When validating IPsec SPIs in a DELETE message, access to the
  32 bit SPI value might be unaligned.  On platforms requiring strict
  alignment, this would cause termination of isakmpd by signal.

  To avoid this, memcpy(3) the SPI value to a local variable.

  test & ok sthen

  sbin/isakmpd/message.c

commit wrBzdctQ3reZoXKx
Author: hshoexer
Date: 2026/06/11 09:46:59

  isakmpd(8): Validate DELETE payload SPI array size [2/2]

  Similar to message_validate_delete() also validate in
  ipsec_handle_leftover_payload() that the provided number of SPIs
  actually fit in the payload. This is redundant as we already would
  bail out in message_validate_delete().

  test & ok sthen

  sbin/isakmpd/ipsec.c

commit 11AHrrUioE4skF6o
Author: hshoexer
Date: 2026/06/11 09:44:07

  isakmpd(8): Validate DELETE payload SPI array size [1/2]

  The number of SPIs provided in a DELETE message is not properly
  validated. This might cause a read beyond the message end. However,
  the outside read is limited to 4 bytes for IPsec SAs and 16 bytes
  for ISAKMP SAs. A crash is possible, but seems unlikely to me.

  test & ok sthen

  sbin/isakmpd/message.c

commit EgAIWIOm2ZAMmL25
Author: hshoexer
Date: 2026/06/11 09:40:20

  isakmpd(8): Validate proposal and transform sizes

  Check
  - that a proposal payload fits within the outer SA payload,
  - that the provided SPI and the following transform header fit within
  the proposal, and
  - transforms fit within the outer proposal payload.

  It's already ensured that we never read outside the message.  However,
  within the message the mentioned payloads might be misinterpreted due
  to malformed size values.

  test & ok sthen

  sbin/isakmpd/message.c

commit DXdPKxncJXTMcBis
Author: nicm
Date: 2026/06/11 07:52:17

  Hide Swap Marked also since floating panes cannot be swapped yet.

  usr.bin/tmux/key-bindings.c

commit rbKmZqeKpD1N7IuP
Author: ratchov
Date: 2026/06/11 06:56:44

  sndiod: Drop extra 
 in debug printf

  usr.bin/sndiod/dev.c

commit 2K7Qf53FtjW2KkDf
Author: yasuoka
Date: 2026/06/11 04:55:12

  Add length checks for the Port-Message and State attributes in the
  handling of Access-Challenge.  The problem reported by Steve Caffrey.

  ok sthen@

  libexec/login_radius/login_radius.c
  libexec/login_radius/login_radius.h
  libexec/login_radius/raddauth.c

commit ymso7od9LTvxdBQ5
Author: jsg
Date: 2026/06/11 03:45:17

  in inteldrm_burner_cb() call fb_blank() instead of drm_fb_helper_blank()

  this indirectly calls intel_fbdev_blank(), which does
  drm_fb_helper_blank() followed by intel_fbdev_invalidate()

  avoids on screen garbage when wscons screen blanking is enabled on
  mvs' Alder Lake and Gemini Lake machines.

  sys/dev/pci/drm/i915/i915_driver.c

commit Bji1IEvgixI02i09
Author: jsg
Date: 2026/06/11 03:36:13

  Add fb_blank function pointer to struct fb_ops and enable paths that
  set it.  Also add fb_blank() which uses it, for use in inteldrm(4).

  sys/dev/pci/drm/i915/display/intel_fbdev.c
  sys/dev/pci/drm/include/drm/drm_fb_helper.h
  sys/dev/pci/drm/include/linux/fb.h