Build date: 1787781603 - Wed Aug 26 22:00:03 UTC 2026 Build cvs date: 1787776653 - Wed Aug 26 20:37:33 UTC 2026 Build id: 2026-08-27.1 Build tags: amd64-regress ports sysupgrade Applied the following diff(s): /home/anton/tmp/robsd/src-sys-em.diff /home/anton/tmp/robsd/src-sys-uhidev-sispm.diff /home/anton/tmp/robsd/src-sysupgrade.diff P gnu/usr.bin/cvs/Makefile.bsd-wrapper P lib/libc/sys/recv.2 P lib/libcrypto/man/EC_GROUP_check.3 P lib/libcrypto/x509/x509_verify.c P regress/usr.bin/mandoc/db/makewhatis/Makefile P regress/usr.bin/mandoc/db/out/topt.dout P sbin/dhcpleased/engine.c P share/man/man4/man4.armv7/amdisplay.4 P share/man/man4/man4.powerpc64/opalcons.4 P share/man/man9/loadfirmware.9 P sys/arch/arm64/arm64/cpu.c M sys/dev/usb/uhidev.c P sys/kern/uipc_syscalls.c P usr.bin/find/ls.c P usr.sbin/bgpd/bgpd.conf.5 M usr.sbin/bgpd/session.c P usr.sbin/rpki-client/cms.c P usr.sbin/rpki-client/x509.c P usr.sbin/smtpd/mail.mboxfile.8 commit o6u0FDWXuXCT5KGh Author: daniel Date: 2026/08/26 20:37:33 the macintosh subdir was removed from cvs in 1999 ok jcs@ gnu/usr.bin/cvs/Makefile.bsd-wrapper commit qbfJQN5wlW5hoVAq Author: florian Date: 2026/08/26 17:25:13 Do not try to configure 0.0.0.0 (INADDR_ANY) on an interface. If we indicate a preference for IPv6-only (DHCP option 108), the server does not offer an IP address (indicated by INADDR_ANY), so we must first check if the server supported option 108 before checking if we received an IPv4 offer. Logic error pointed out and diff provided by acts1631@proton.me, thanks! sbin/dhcpleased/engine.c commit tj4HeK9GeF1NNjc4 Author: beck Date: 2026/08/26 16:25:12 Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1 While not the advised way of using the verify callback (either by OpenSSL or by us) in production, sometimes folks like to return 1 from everything in the callback and then check the error return and make decicions about things. This fix ensures that such callbacks will see the hostname mismatch and be able to act upon them. Reported by Alexander Aleksandrovic Klimov ok tb@ lib/libcrypto/x509/x509_verify.c commit VfTLlWMs7hkTTK8O Author: claudio Date: 2026/08/26 13:53:38 RTR sessions support tcp md5sig. Add the config bits to the manpage. Noticed by job@ OK tb@ usr.sbin/bgpd/bgpd.conf.5 commit qBvfe3IS1jHcFoOT Author: kettenis Date: 2026/08/26 13:13:16 Avoid potential null-pointer dereference in calculation of CPU "capacity". ok jsg@ sys/arch/arm64/arm64/cpu.c commit gEjp60ZFCLXiFa7u Author: jsg Date: 2026/08/26 11:36:06 sync config lines and use .Cd not .Nm share/man/man4/man4.armv7/amdisplay.4 commit XWXwkzc3jRbwpT5s Author: schwarze Date: 2026/08/26 10:26:21 Do not hardcode /usr/src/ in one of the files containing desired output. This is expected to fix a test failure that anton@ reported with BSDSRCDIR set. regress/usr.bin/mandoc/db/makewhatis/Makefile regress/usr.bin/mandoc/db/out/topt.dout commit JXxFEoJtl2KSSXKu Author: jsg Date: 2026/08/26 09:03:57 fix a double word; ok tb@ lib/libcrypto/man/EC_GROUP_check.3 commit ol9kZtlTENhjNiXn Author: claudio Date: 2026/08/26 08:26:30 Fix control message handling in recvit to avoid out of bounds write to userland Because of the use of a unsigned variable to track the length of the control buffer recvit can underflow that variable because of an unchecked ALIGN(). This can be triggered by passing a too short buffer that is not a multiple of _ALIGNBYTES + 1. In such a case the kernel copies out data past the provided buffer. On top of addding the missing overflow check this also uses the proper socklen_t type for the msg_controllen and uses an unsigned int for the still overloaded variable i. The security implications of this are mainly theoretical. The correct use of control message handling requires the use of CMSG_SPACE which ensures the buffer size is properly rounded. In base only dig uses a buffer that is not correctly rounded at the same time it is oversized enough to not matter. Reported by Acts1631 who also provided a fix OK millert@ deraadt@ sys/kern/uipc_syscalls.c commit lg6Rzump7mkph9Hs Author: jsg Date: 2026/08/26 07:30:58 MAIL.MDA -> MAIL.MBOXFILE usr.sbin/smtpd/mail.mboxfile.8 commit gQcTrB60i8PL14y3 Author: jsg Date: 2026/08/26 06:56:28 OPALSENS -> OPALCONS share/man/man4/man4.powerpc64/opalcons.4 commit 5oOR3GbfFraf7WPc Author: tb Date: 2026/08/26 06:47:59 find: check localtime() return before calling strftime on it landry saw "find dir -ls" crash with fs corruption. dgl reproduced with touch foo && perl -e'utime 2**63, 2**63, "foo"' && find foo -ls which could have been added to regress if there was any... ok deraadt usr.bin/find/ls.c commit k0kPJDiUdDEL7CiB Author: tb Date: 2026/08/26 05:57:47 rpki-client: reject some signed objects with BER encoding ARIN finally fixed their shit and no longer distributes malformed ROAs. Detect one symptom of their malformedness. This is a very unsatisfactory kludge since it only detects indefinite length encoding at the outermost layer, but this will hopefully help avoid regressions. libcrypto's ASN.1 parser is not going to help making the world a cleaner place. fine with claudio, ok job usr.sbin/rpki-client/cms.c commit lwsMkgK7uSFZETlP Author: tb Date: 2026/08/26 05:42:42 rpki-client: unconditionally warn about incorrect RSA parameters Now that ARIN have fixed their old ROAs, this encoding no longer occurs in the wild, so enabling this warning does no harm. Ideally we'd error, but a Postel-inspired MUST that has been sprinkled across numerous RFCs ensured that this had to be tolerated for more than a quarter of a century and will continue to be for at least another one. discussed with claudio job usr.sbin/rpki-client/x509.c commit qny42yMphfBRzpz3 Author: jsg Date: 2026/08/26 00:31:26 change iovec markup from .Fa to .Vt refers to a struct, not the name of a field ok schwarze@ lib/libc/sys/recv.2 commit FzSR4s7w391gXlVF Author: jsg Date: 2026/08/26 00:14:49 firmware is an uncountable noun, avoid indefinite article ok tb@ sobrado@ schwarze@ share/man/man9/loadfirmware.9