Build date: 1788300002 - Tue Sep  1 22:00:02 UTC 2026
Build cvs date: 1788296635 - Tue Sep  1 21:03:55 UTC 2026
Build id: 2026-09-02.1
Build tags: amd64-regress ports sysupgrade

Applied the following diff(s):
/home/anton/tmp/robsd/src-sys-em.diff
/home/anton/tmp/robsd/src-sys-uhidev-sispm.diff
/home/anton/tmp/robsd/src-sysupgrade.diff

P distrib/sets/lists/comp/mi
P lib/libc/gen/posix_spawn_file_actions_init.3
P lib/libc/gen/posix_spawnattr_init.3
P lib/libcrypto/man/BN_generate_prime.3
P lib/libexpat/Changes
P lib/libexpat/README.md
P lib/libexpat/doc/reference.html
P lib/libexpat/lib/expat.h
P lib/libexpat/lib/internal.h
P lib/libexpat/lib/xmlparse.c
P lib/libexpat/lib/xmltok.h
P lib/libexpat/tests/basic_tests.c
P lib/libexpat/tests/misc_tests.c
P lib/libssl/man/Makefile
P lib/libssl/man/SSL_CTX_set_keylog_callback.3
P lib/libssl/man/SSL_CTX_set_num_tickets.3
P sys/arch/amd64/amd64/vmm_machdep.c
P sys/arch/amd64/include/specialreg.h
P sys/dev/pci/drm/apple/apple_drv.c
P sys/dev/usb/uaudio.c
M sys/dev/usb/uhidev.c
P sys/nfs/nfs_subs.c
P sys/nfs/nfs_vfsops.c
P usr.bin/mandoc/cgi.c
P usr.bin/tmux/grid.c
P usr.bin/tmux/options-table.c
P usr.bin/tmux/screen-redraw.c
P usr.bin/tmux/server-client.c
P usr.bin/tmux/tmux.1
P usr.bin/tmux/tmux.h
P usr.bin/tmux/utf8.c
P usr.bin/tmux/window-copy.c
P usr.bin/tmux/window-switch.c
M usr.sbin/bgpd/session.c
P usr.sbin/httpd/server.c
P usr.sbin/tcpdump/print-gtp.c
P usr.sbin/tcpdump/print-ofp.c

commit qbV78Ewx8wzApByb
Author: nicm
Date: 2026/09/01 21:03:55

  Create screen before zoom may need to use it.

  usr.bin/tmux/window-switch.c

commit MpbvVbEXD9vCCJ5r
Author: nicm
Date: 2026/09/01 19:50:58

  Do not allow cursor on/off to escape synchronized updates.

  usr.bin/tmux/screen-redraw.c
  usr.bin/tmux/server-client.c

commit OyOV0BANDtptabXQ
Author: tobhe
Date: 2026/09/01 19:46:08

  drm: apple: Switch back to drm_atomic_helper_commit_tail_rpm()

  From Janne Grunau
  bd8ce96f6e76b98940352b18fe735a7943471ed7 in AsahiLinux/linux

  This implictly gets rid of drm_atomic_helper_wait_for_flip_done()
  and makes graphical output on Apple Silicon machines noticably
  snappier.

  ok kettenis@ jsg@

  sys/dev/pci/drm/apple/apple_drv.c

commit uAU578lLshFz3f2a
Author: bluhm
Date: 2026/09/01 14:58:54

  Update libexpat to version 2.8.4

  Relevant for OpenBSD are security fixes #1321 #1331 #1322, other
  changes #1315 #1325 #1334 #1340 #1319 #1320.  Library bump is not
  necessary.
  CVE-2026-66046 CVE-2026-76641 CVE-2026-76957

  OK tb@

  lib/libexpat/Changes
  lib/libexpat/README.md
  lib/libexpat/doc/reference.html
  lib/libexpat/lib/expat.h
  lib/libexpat/lib/internal.h
  lib/libexpat/lib/xmlparse.c
  lib/libexpat/lib/xmltok.h
  lib/libexpat/tests/basic_tests.c
  lib/libexpat/tests/misc_tests.c

commit 8n0XnX32i9bYxrro
Author: schwarze
Date: 2026/09/01 13:56:12

  Use unveil(2) and clamp down on pledge(2).
  The main() program establishes a baseline, allowing the maximum
  that might ever be needed: stdio rpath and read access to the MAN_DIR.
  The top level page generators (pg_show, pg_search) narrow unveil(2)
  to the specific manual page tree selected by the user.
  When the selected manual page file has been opened, the pledge is narrowed
  to just stdio (in resp_catman, resp_format, pg_searchres, pg_index).
  Except for internal errors and bad requests, which error out early,
  exactly one of these narrowing codepaths is always trodden.

  usr.bin/mandoc/cgi.c

commit TWWsMSY2iffhp0pa
Author: nicm
Date: 2026/09/01 13:04:29

  When changing selection-mode to line, set up the selection start and end
  correctly, GitHub issue 5545.

  usr.bin/tmux/window-copy.c

commit k103sDHCyCscw0vD
Author: nicm
Date: 2026/09/01 12:49:49

  Extend word commands to use any Unicode whitespace character, GitHub
  issue 5562 from Hongyi Zhao.

  usr.bin/tmux/grid.c
  usr.bin/tmux/options-table.c
  usr.bin/tmux/tmux.1
  usr.bin/tmux/tmux.h
  usr.bin/tmux/utf8.c

commit Uv1qrvJfvg5iVxfb
Author: ratchov
Date: 2026/09/01 12:02:37

  uaudio: Factor duplicate tests of UAC version in uaudio_open_stream()

  No behavior change

  sys/dev/usb/uaudio.c

commit nlpDJ2UntCor5Dy4
Author: ratchov
Date: 2026/09/01 12:01:43

  uaudio: Fix NULL pointer dereference triggered by specific hardware bug

  Analysed and reported by Acts1631 <acts1631kjv at proton.me>, thanks!

  sys/dev/usb/uaudio.c

commit nbxI3gOFDFnwJhOk
Author: ratchov
Date: 2026/09/01 11:59:32

  uaudio: Set the rate before the alternate setting of UAC2 devices

  Unlike UAC1 devices, UAC2 devices set their sample rate with their
  clock unit which is independent of the alternate setting. The Neural
  DSP Quad Cortex Mini (and probably others) requires the sample rate to
  be set before the alternate setting is switched.

  From Laurence Tratt <laurie at tratt.net>, thanks!

  sys/dev/usb/uaudio.c

commit iaur8EfR1TFqh1VY
Author: ratchov
Date: 2026/09/01 11:58:28

  uaudio: Append the implicit feedback capability to the dmesg attach line

  sys/dev/usb/uaudio.c

commit mpBVE302tRzKpDdl
Author: ratchov
Date: 2026/09/01 11:56:36

  uaudio: Enable implicit feedback on devices that claim to support it

  The Behringer UMC204HD appears to have broken explicit feedback (the
  sync endpoint sends always zeros) resulting in periodic drops.
  Enabling implicit feedback (i.e. adjust play-direction data rate to
  record-direction one) fixes this device.

  From Artem Sheldyaev <artem at sheldyaev.org>, thanks!

  sys/dev/usb/uaudio.c

commit 7xdx7g4hFJBRzA2q
Author: jsg
Date: 2026/09/01 07:15:47

  Activiation -> Activation

  usr.sbin/tcpdump/print-gtp.c

commit 8FSeXUQiWbF3hfKS
Author: tb
Date: 2026/09/01 07:15:29

  sync

  distrib/sets/lists/comp/mi

commit XKZnFBGEGKuBDleK
Author: jsg
Date: 2026/09/01 07:07:10

  trucanted -> truncated

  usr.sbin/tcpdump/print-ofp.c

commit IUy6Y0OolpVnyEeL
Author: jsg
Date: 2026/09/01 06:48:34

  install SSL_CTX_set_num_tickets.3; ok tb@

  lib/libssl/man/Makefile

commit 5HMyfrIoo8mMQQqH
Author: jsg
Date: 2026/09/01 05:51:25

  These function -> These functions

  lib/libc/gen/posix_spawn_file_actions_init.3
  lib/libc/gen/posix_spawnattr_init.3
  lib/libcrypto/man/BN_generate_prime.3
  lib/libssl/man/SSL_CTX_set_keylog_callback.3
  lib/libssl/man/SSL_CTX_set_num_tickets.3

commit sdRThqfnJ7kKvU8O
Author: rsadowski
Date: 2026/09/01 05:22:00

  httpd: reject shared TLS listeners with different client CA or CRL

  Virtual hosts on the same address and port share one TLS context, and
  only the first hosts client CA and CRL are used. A client certificate
  accepted there reaches every host on the listener, including one meant
  to be restricted to a different CA. Such a configuration is now rejected
  instead of silently ignored.

  Bug report and diff by Acts1631

  OK kirill@ claudio@

  usr.sbin/httpd/server.c

commit 1l4ktNqrPK5roxiX
Author: jsg
Date: 2026/09/01 02:33:27

  only allow an NFS server to set file type on a new vnode

  Otherwise, a malicous server could aid a local user in avoiding access
  controls.

  This reverts nfs_subs.c rev 1.3.  Which was part of a commit to fix the
  use of automount with direct maps.

  reported by Andrew Griffiths

  sys/nfs/nfs_subs.c

commit B6wCYIilIlJKVIde
Author: dv
Date: 2026/09/01 01:13:27

  Save CET state on Intel vmm(4) hosts before vm entry.

  On Intel hosts with CET support, vmm must set the host CET related
  state in the VMCS so VMX will restore it on vm exit. vmm was not
  setting this before vm entry resulting in VMX disabling CET on host
  cpus when returning to the kernel.

  Additionally, vmm should explicitly zero the initial guest state
  related to CET and supervisor shadow stacks instead of relying on
  the memory backing the VMCS to have been zeroed.

  ok mlarkin@

  sys/arch/amd64/amd64/vmm_machdep.c
  sys/arch/amd64/include/specialreg.h

commit kXnp15DCrS2Bz1Ha
Author: dv
Date: 2026/09/01 00:55:13

  Prevent a vmm(4) vcpu getting stuck if copyin(9) fails.

  The VMM_IOC_RUN handler performed copyin after toggling the vcpu
  state to running and didn't properly reset it if copyin fails. This
  would prevent any subsequent attempt by a caller to issue VMM_IOC_RUN
  for the vcpu.

  Instead of adding complexity to the error handling path, perform
  the copyin first before toggling the state.

  ok mlarkin@

  sys/arch/amd64/amd64/vmm_machdep.c

commit ZjxOxhJNKoyxJhrM
Author: dv
Date: 2026/09/01 00:51:14

  Fix a kernel memory leak in vmm(4) VMX deinit.

  On Intel VMX hosts, the page of kernel memory allocated for the MSR
  bitmap wasn't being freed when deinitializing a vm. (AMD SVM deinit
  unaffected.)

  ok mlarkin@

  sys/arch/amd64/amd64/vmm_machdep.c

commit Qk9u2DuZvPzRnccX
Author: jsg
Date: 2026/08/31 22:37:09

  NULL kernel pointers in nfs statfs(2) mount_info

  nfs differs from other filesystems in that mount arguments can come from
  both user and kernel space.

  nfs_mount() sets args->fh to a kernel pointer.  When root is on nfs,
  nfs_boot_getfh() also sets addr and hostname to kernel pointers.

  problem found and changes suggested by Andrew Griffiths
  ok miod@ millert@ deraadt@

  sys/nfs/nfs_vfsops.c