Build date: 1783548003 - Wed Jul 8 22:00:03 UTC 2026 Build cvs date: 1783539573 - Wed Jul 8 19:39:33 UTC 2026 Build id: 2026-07-09.1 Build tags: amd64-regress ports sysupgrade Applied the following diff(s): /home/anton/tmp/robsd/src-sys-em.diff /home/anton/tmp/robsd/src-sys-ptrace-revert.diff /home/anton/tmp/robsd/src-sys-uhidev-sispm.diff /home/anton/tmp/robsd/src-sysupgrade.diff P sbin/iked/radius.c M sys/dev/usb/uhidev.c P sys/kern/sysv_msg.c P sys/sys/msg.h P usr.bin/tmux/cmd-copy-mode.c P usr.bin/tmux/cmd-new-window.c P usr.bin/tmux/cmd-split-window.c P usr.bin/tmux/layout.c P usr.bin/tmux/regsub.c P usr.bin/tmux/screen-redraw.c P usr.bin/tmux/server-fn.c P usr.bin/tmux/tmux.1 P usr.bin/tmux/window.c M usr.sbin/bgpd/session.c P usr.sbin/rpki-client/extern.h P usr.sbin/rpki-client/main.c P usr.sbin/rpki-client/nca.c P usr.sbin/rpki-client/repo.c commit wUAiEv5PEa8Js2ry Author: mvs Date: 2026/07/08 19:39:33 Make concurrent sys_msgrcv() wait until we finish message delivery. We left acquired message in the queue while we are sleeping in msg_copyout(). Concurrent sys_msgrcv() could acquire and delete this message. Reported-by: syzbot+c80235d951da9769a00f@syzkaller.appspotmail.com sys/kern/sysv_msg.c sys/sys/msg.h commit EQwr3WWRScXjjwTp Author: tb Date: 2026/07/08 18:27:02 nca_plan_retries: fix previous by dropping a break from/ok job usr.sbin/rpki-client/nca.c commit WLWfaYGdfaIJZFqe Author: job Date: 2026/07/08 17:49:04 Deduplicate skiplist, shortlist, and NCA retry handling Introduce helpers functions for manipulating lists of strings, such as the FQDNs in skiplist & shortlist, and rpkiNotify URLs used for batching NCA retries. OK tb@ usr.sbin/rpki-client/extern.h usr.sbin/rpki-client/main.c usr.sbin/rpki-client/nca.c commit QHgVspUgJwFJi0Cs Author: mvs Date: 2026/07/08 17:33:19 Restore msgrcv(2) MSG_NOERROR/E2BIG error path. Silently truncate message is not a good idea. msgrcv(2) man page has E2BIG error description, no need for update. ok millert sys/kern/sysv_msg.c commit wM0RwaSiTKYlPZwb Author: claudio Date: 2026/07/08 13:59:26 Don't remove other elements in a RB_FOREACH_SAFE walk since that is not safe. repo_move_valid() walks the tree with RB_FOREACH_SAFE() but it also calls RB_REMOVE() via filepath_put() on an other element in a case where a conflict is resolved. This results in a use-after-free if that element is the next one in the tree (nfp). Instead of removing the present conflicting node (ofp), replace the contents of it, free fp and swap fp with ofp. With and OK tb@ usr.sbin/rpki-client/repo.c commit GI4XkgcMqYNHqmCs Author: claudio Date: 2026/07/08 13:53:16 Remove no longer needed cast for the free argument. From tb@ usr.sbin/rpki-client/repo.c commit hSfS28PfJjkdVUid Author: claudio Date: 2026/07/08 11:42:45 Rework the special case for CRL files when it comes to the entity_queue. CRL are not accounted in the entity_queue, they are loaded together with MFT files and passed back together as well. Instead of increasing entity_queue skip the entity_queue decrease at the end of the function for CRL files. This way goto done cases will account CRLs correctly as well. OK tb@ usr.sbin/rpki-client/main.c commit OMy3tPce2LgeXwqv Author: nicm Date: 2026/07/08 11:04:51 Fix regsub with anchor at start of pattern, GitHub issue 5341. usr.bin/tmux/regsub.c commit 8HGVIhbZefY4h60V Author: hshoexer Date: 2026/07/08 10:57:33 iked: Store RADIUS-assigned IPv6 address in the IPv6 slot The IPv6 branch of iked_radius_config() stored the address in the IPv4 slot sa_rad_addr and tagged it AF_INET. Use sa_rad_addr6 and AF_INET6 instead. Also exempt IKEV2_CFG_INTERNAL_IP6_ADDRESS from the "use config rather than radius" check, as already done for IPv4. ok yasuoka@ sbin/iked/radius.c commit SxGh3SWQG22GJVXQ Author: nicm Date: 2026/07/08 09:23:10 Keep all modes except cursor during redraw, GitHub issue 5337 from Ayman Bagabas. usr.bin/tmux/screen-redraw.c commit Um4gwGg9P7y5hqGJ Author: nicm Date: 2026/07/08 08:21:53 Report the terminal's own theme to panes rather than guessing from the background. GitHub issue 5343 from Ayman Bagabas. usr.bin/tmux/window.c commit E7QZIseEICewA33Q Author: nicm Date: 2026/07/08 08:15:49 Do not crash looking for next or previous session. GitHub issue 5344. usr.bin/tmux/server-fn.c commit Vp3ZSTP0dgoXbIUW Author: nicm Date: 2026/07/08 08:07:42 Fix empty argument to splitw/newp and add -k to copy-mode. usr.bin/tmux/cmd-copy-mode.c usr.bin/tmux/cmd-new-window.c usr.bin/tmux/cmd-split-window.c usr.bin/tmux/tmux.1 commit 1EByWMMxEGBURqG9 Author: nicm Date: 2026/07/08 07:55:17 Fix a typo (use right var), from Dane Jensen. usr.bin/tmux/layout.c commit ExH2VGZOiIPAIpcA Author: tb Date: 2026/07/08 05:33:28 rpki-client: avoid bad free in nca_hist_load() If the first getline() call fails with a file error, nca_hist remains uninitialized and will be passed to nca_hist_free() in the error path. Initialize nca_hist to NULL to avoid this. ok claudio usr.sbin/rpki-client/nca.c P MODULES P lib/libXfont2/src/bitmap/bitscale.c P lib/libXfont2/src/bitmap/pcfread.c P xserver/Xi/xichangecursor.c P xserver/fb/fbglyph.c P xserver/glamor/glamor_font.c P xserver/glamor/glamor_glyphblt.c P xserver/glx/vndcmds.c P xserver/mi/miglblt.c commit y4SHtEN86k5FACFM Author: matthieu Date: 2026/07/08 06:31:12 update MODULES commit Hvd9rEqec2VsaksE Author: matthieu Date: 2026/07/08 06:05:06 Merge fixes from upstream for following issues: * BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow (CVE-2026-56001) * PCF Font Parsing Heap Buffer Overflow (CVE-2026-56002) * computeProps Property Buffer Heap Buffer Overflow (CVE-2026-56003) lib/libXfont2/src/bitmap/bitscale.c lib/libXfont2/src/bitmap/pcfread.c commit g6CqSlXjVVN5D8Rf Author: matthieu Date: 2026/07/08 06:01:13 Merge fixes from upstream for Xserver issues: * glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999) * GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000) xserver/Xi/xichangecursor.c xserver/fb/fbglyph.c xserver/glamor/glamor_font.c xserver/glamor/glamor_glyphblt.c xserver/glx/vndcmds.c xserver/mi/miglblt.c