Hi tech@,

Attached is the diff for changelog for June 8th to July 5th.

benno@ is away so sending to tech@. Can somebody please ok and commit? (I don't have commit access).

Thanks!
Brett.

--- /home/brett/Downloads/oldplus.html	Wed Jul 15 12:57:36 2026
+++ /home/brett/Downloads/plus.html	Wed Jul 15 13:00:48 2026
@@ -106,6 +106,192 @@
 <p>
 
 <ul>
+<!-- 2026/07/05 -->
+<li>Retired the cpp.sh script and install the cpp binary directly in /usr/bin.
+<!-- 2026/07/04 -->
+<li>Improved Honor MagicBook Touchpad quirks.
+<!-- 2026/07/03 -->
+<li>Validate routing socket replies in <a href="https://man.openbsd.org/iked.8">iked(8)</a>.
+<li>Reworked how mbufs share references to external storage, to avoid global mutex.
+<!-- 2026/07/02 -->
+<li>Added support for wakeup interrupts to <a href="https://man.openbsd.org/bytgpio.4">bytgpio(4)</a>, fixes IdeaPad resuming from suspend.
+<!-- 2026/07/01 -->
+<li>Made <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> drain abort response via bufferevent to prevent errors being truncated.
+<!-- 2026/06/30 -->
+<li>Prevent unnecessary PLT entries when LLVM emits calls to <a href="https://man.openbsd.org/strlen.3">strlen(3)</a> and <a href="https://man.openbsd.org/wcslen.3">wcslen(3)</a>.
+<li>Fixed endless loop in <a href="https://man.openbsd.org/ypldap.8">ypldap(8)</a>, <a href="https://man.openbsd.org/login_ldap.8">login_ldap(8)</a>, and <a href="https://man.openbsd.org/ldap.1">ldap(1)</a>; check for <a href="https://man.openbsd.org/evbuffer_add.3">evbuffer_add(3)</a> errors.
+<li>Properly check vnode identity after <a href="https://man.openbsd.org/vget.9">vget(9)</a>.
+<li>Removed extraneous control socket objects in <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
+<!-- 2026/06/29 -->
+<li>Fixed the priority_len bounds check in <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a>.
+<li>Prevent <a href="https://man.openbsd.org/bus_dmamap_load.9">bus_dmamap_load(9)</a> failures on a dmamap in <a href="https://man.openbsd.org/acpi.4">acpi(4)</a>.
+<!-- 2026/06/28 -->
+<li>Avoid download to server-controlled path when performing <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> download via commandline.
+<li>Avoid possible NULL deref in <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>; sanitise filenames received via remote glob.
+<!-- 2026/06/27 -->
+<li>Restricted IMSG_CTL_PROCFD to parent and check process id/instance in <a href="https://man.openbsd.org/iked.8">iked(8)</a>, httpd8(), <a href="https://man.openbsd.org/relayd.8">relayd(8)</a>, and <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a>.
+<li>Switched the default TLS cipher in <a href="https://man.openbsd.org/httpd.conf.5">httpd.conf(5)</a> set from 'compat' to 'secure.'
+<li>Switched the default TLS cipher in <a href="https://man.openbsd.org/relayd.conf.5">relayd.conf(5)</a> set from 'HIGH:!aNULL' to 'secure.'
+<li>Updated libexpat to version 2.8.2, with many security fixes.
+<li>Removed double fclose in a success path in <a href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a>.
+<li>Update link state after new port attached via <a href="https://man.openbsd.org/trunk.4">trunk(4)</a>.
+<!-- 2026/06/26 -->
+<li><a href="https://man.openbsd.org/tsort.1">tsort(1)</a> will now print the file name when erroring out on invalid input.
+<li>Made <a href="https://man.openbsd.org/tsort.1">tsort(1)</a> abort early if input lines contain NUL bytes.
+<li>Added a coinflip to increase cycle-to-cycle jitter in <a href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a>.
+<li>Fixed OOB write in sysctl_ucominit with no <a href="https://man.openbsd.org/ucom.4">ucom(4)</a> devices.
+<li>In uvm_swap, don't bounce unless we're doing encrypted writes.
+<li>Added many new <a href="https://man.openbsd.org/awk.1">awk(1)</a> tests, adapted from upstream.
+<li>Merged <a href="https://man.openbsd.org/nsd.8">nsd(8)</a> 4.14.3.
+<li>Fixes for CVE-2026-12244, CVE-2026-12245, CVE-2026-12246 and CVE-2026-12490 in <a href="https://man.openbsd.org/nsd.8">nsd(8)</a>.
+<li>Fixed a null dereference in <a href="https://man.openbsd.org/radiusd.8">radiusd(8)</a> when authentication-filter configured and pap is used.
+<li>Made resolver return statically built addresses (bot IPv4 and IPv6) when hostname == NULL.
+<li>Sync get_crl_sk() in <a href="https://man.openbsd.org/X509_verify.3">X509_verify(3)</a> with BoringSSL and OpenSSL.
+<!-- 2026/06/25 -->
+<li>Prevent authenticated RADIUS CP attribute mapping overflowing rr_cfg in <a href="https://man.openbsd.org/iked.8">iked(8)</a>.
+<li>Made <a href="https://man.openbsd.org/getaddrinfo.3">getaddrinfo(3)</a> check hnok_lenient() earlier, for special handling for localhost names.
+<li>Prevent OOB reads by <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> in 32 and 64-bit <a href="https://man.openbsd.org/elf.5">elf(5)</a> loaders with malformed <a href="https://man.openbsd.org/elf.5">elf(5)</a> files.
+<li>Stopped the resolver from silently truncate result of dname_expand.
+<li>Prevent virtio scsi DoS from bad descriptor length passed by guest to <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
+<li>Reject invalid PIT periods in <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
+<li>Fixed fw_cfg leak of file directory buffer in <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
+<li>Ensure <a href="https://man.openbsd.org/ospfd.8">ospfd(8)</a> does not leak information on memory address layout from process.
+<li>Reset ar_datalen and ar_data after <a href="https://man.openbsd.org/free.3">free(3)</a> like everywhere else.
+<li>Major rework of <a href="https://man.openbsd.org/tmux.1">tmux(1)</a> prompts.
+<li>Made <a href="https://man.openbsd.org/mount.8">mount(8)</a> support DUIDs with -u; preserve DUID when updating file system
+<li>Stop kernel pmap growing to its maximum and consuming all memory on small memory machines.
+<li>Untrace traced children even when they're exiting to prevent triggering a KASSERT.
+<!-- 2026/06/24 -->
+<li>Fixed broken -mfix-loongson2f-btb with Clang on loongson.
+<li>Allow sparc64 Enterprise 4000 and similar with dead batteries to correctly attach clocks.
+<li>Additional preparation for 52 disk partitions.
+<li>Made divert-packet / <a href="https://man.openbsd.org/divert.4">divert(4)</a> properly rdomain aware.
+<li>Use midi_in() not midi_send() to generate <a href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> MIDI messages.
+<li>Extended multicast router counter, made it MP-safe.
+<li>Fixed FIFO handling to avoid overflowing sc_imess in ncr53c9x.c.
+<li>Fixed kernel memory leaks in IPC_STAT and KERN_SYSVIPC_SHM_INFO.
+<li>Attach <a href="https://man.openbsd.org/aplmbox.4">aplmbox(4)</a> early in RAMDISK kernels.
+<li>Properly clear <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a> key material; clear sensitive data with freezero().
+<li>In <a href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a>, added a backoff retry mechanism for non-functional CAs.
+<li>Stopped <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a> leaking peer data to <a href="https://man.openbsd.org/bgpctl.8">bgpctl(8)</a>.
+<!-- 2026/06/23 -->
+<li>Made <a href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> ensure strings received from the network are 0-terminated.
+<li>Cleanup <a href="https://man.openbsd.org/write.1">write(1)</a> and <a href="https://man.openbsd.org/pledge.2">pledge(2)</a> it on startup.
+<li>Removed current directory from default <a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a> search path.
+<li>Made <a href="https://man.openbsd.org/pstat.8">pstat(8)</a> -d work for static kernel variables.
+<li>Check for IPv6 scope truncation in <a href="https://man.openbsd.org/getnameinfo.3">getnameinfo(3)</a>.
+<li>Removed IPv6 source routing from output path (deprecated by RFC 5095).
+<li>For network interfaces, allocate mbufs in high memory if only 64 bit DMA interfaces exist.
+<li>Stopped leaking transport in <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a> error paths of udp_encap_handle_message().
+<li>Enforce per-type ID payload size in <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a> ipsec_validate_id_information().
+<li>Avoid shift overflows in <a href="https://man.openbsd.org/memmem.3">memmem(3)</a> and <a href="https://man.openbsd.org/strstr.3">strstr(3)</a>.
+<li>Multiple additional bounds checks in <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>.
+<li>Implemented ch_meta_locate() in <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>.
+<li>Mitigate CVE-2025-10263 (arm64).
+<li>Properly check for DNS errors returned by <a href="https://man.openbsd.org/ASN1_item_unpack.3">ASN1_item_unpack(3)</a> and <a href="https://man.openbsd.org/ASN1_item_pack.3">ASN1_item_pack(3)</a>.
+<li>Imported clang-scan-deps for <a href="https://man.openbsd.org/clang.1">clang(1)</a>.
+<li>Made msg_copyout() check the remaining space within userland buffer to avoid overflows.
+<li>Fixed EXFLAG_CRITICAL mishandling of unsupported asn1 extensions.
+<li>Fixed <a href="https://man.openbsd.org/tsort.1">tsort(1)</a> heap buffer overread with embedded null bytes in input.
+<li>Fixed <a href="https://man.openbsd.org/drm.7">drm(7)</a> vmap_pfn() by using ptoa() to get the physical address.
+<!-- 2026/06/22 -->
+<li>Reverted scatterlist dma_length changes from <a href="https://man.openbsd.org/drm.7">drm(7)</a> which caused blank screen on meteor lake.
+<li><a href="https://man.openbsd.org/cpp.1">cpp(1)</a> no longer default to -traditional.
+<li>Implemented bus DMA constraints from 'dma-ranges' properties in riscv device tree.
+<li>llvm-readobj now recognises OpenBSD PAC mask notes in (arm64) coredumps.
+<li>Discard vfs buffers after vclean error.
+<li>Added bounds check for <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a> priority_len.
+<li>Added server.thru control to <a href="https://man.openbsd.org/sndiod.8">sndiod(8)</a> midithru/N ports.
+<li>Implemented control of midithru ports with <a href="https://man.openbsd.org/sndioctl.1">sndioctl(1)</a>.
+<li>Fixed overflow in <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a> priority_list.
+<li>Switch to <a href="https://man.openbsd.org/timingsafe_memcmp.3">timingsafe_memcmp(3)</a> in <a href="https://man.openbsd.org/iked.8">iked(8)</a> dsa_verify_final() and ikev2_msg_decrypt().
+<li>Fixed <a href="https://man.openbsd.org/mwx.4">mwx(4)</a> panic on interface down.
+<li>Made <a href="https://man.openbsd.org/iked.8">iked(8)</a> reject all-zero curve25519 shared secrets.
+<li>Limit <a href="https://man.openbsd.org/iked.8">iked(8)</a> sa_eapmsk length.
+<li>Avoid a 'Data modified on freelist' panic on boot with <a href="https://man.openbsd.org/inteldrm.4">inteldrm(4)</a> discrete cards (DG2).
+<li>Harden <a href="https://man.openbsd.org/mainbus.4">mainbus(4)</a> bus_dma_tag (no longer writable).
+<li>Fixed leak of new SA on <a href="https://man.openbsd.org/iked.8">iked(8)</a> rekey error; clear csa_rekey on error.
+<li>No longer forward packets with a source ip of 0.0.0.0.
+<li>Implemented support for HW crypto and wpakey in <a href="https://man.openbsd.org/mwx.4">mwx(4)</a>.
+<li>Enforce unique IKE spi in <a href="https://man.openbsd.org/iked.8">iked(8)</a> rekeying.
+<li>Reject empty CNAMEs in <a href="https://man.openbsd.org/gethostbyname.3">gethostbyname(3)</a> / <a href="https://man.openbsd.org/getaddrinfo.3">getaddrinfo(3)</a>.
+<li>Rework non-functional CA statistics accounting in (8).
+<!-- 2026/06/21 -->
+<li>No longer deactivate the whole usb device if <a href="https://man.openbsd.org/umsm.4">umsm(4)</a> attach can't find endpoints.
+<li>When setting <a href="https://man.openbsd.org/fuse_lowlevel_new.3">fuse_lowlevel_new(3)</a> file attributes, set correct signal for invalid file handle.
+<li>Raised the size of amd64 kernel virtual address space from 4G to 512G.
+<li>Avoid access to uninitialised data in <a href="https://man.openbsd.org/ip.4">ip(4)</a> at boot time.
+<li>Skip aliases that are not valid hostnames in <a href="https://man.openbsd.org/gethostbyname.3">gethostbyname(3)</a>.
+<li>Improved error check for timegm() and mktime() in <a href="https://man.openbsd.org/touch.1">touch(1)</a> and <a href="https://man.openbsd.org/date.1">date(1)</a>.
+<li>Removed netlock dance in <a href="https://man.openbsd.org/cad.4">cad(4)</a> ioctl.
+<!-- 2026/06/20 -->
+<li>Avoid a NULL deref when <a href="https://man.openbsd.org/radeon.4">radeon(4)</a> wscons screen burner is enabled.
+<li>Fixed incorrect path checking in <a href="https://man.openbsd.org/ypbind.8">ypbind(8)</a> ypbindproc_domain_2x.
+<!-- 2026/06/19 -->
+<li>Made <a href="https://man.openbsd.org/httpd.8">httpd(8)</a> and <a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a> correctly error check <a href="https://man.openbsd.org/timegm.3">timegm(3)</a>.
+<li>Allocate a buffer for the <a href="https://man.openbsd.org/vi.1">vi(1)</a> line cache instead of reaching into db data.
+<li>Made <a href="https://man.openbsd.org/ksh.1">ksh(1)</a> restore source after interactive error recovery before continuing to prompt.
+<!-- 2026/06/18 -->
+<li>Avoid stack exhaustion by unbounded recursion in <a href="https://man.openbsd.org/iked.8">iked(8)</a>.
+<li>Fixed uvm amap lock order when disabling swap.
+<li>Made <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a> drop recvfd pledge; send data to peers immediately.
+<li>Properly align receive buffers on <a href="https://man.openbsd.org/vio.4">vio(4)</a>.
+<li>Drop incoming packets containing 16 MPLS labels with no BoS bit.
+<!-- 2026/06/17 -->
+<li>Allow <a href="https://man.openbsd.org/xen.4">xen(4)</a> to work with bounce buffers.
+<li>Allow <a href="https://man.openbsd.org/pppoe.4">pppoe(4)</a> to use 'mtu 1500' without requiring MTU manipulation on parent interface.
+<li>Improved <a href="https://man.openbsd.org/mwx.4">mwx(4)</a> down/up recovery; made suspend/resume work.
+<li>Kernel can support ports that talk directly to /dev/fuse0 rather than libfuse for <a href="https://man.openbsd.org/fuse.4">fuse(4)</a>.
+<!-- 2026/06/16 -->
+<li>Made the behaviour of the '(' command match the ')' command in <a href="https://man.openbsd.org/vi.1">vi(1)</a>.
+<li>Fixed <a href="https://man.openbsd.org/btrace.8">btrace(8)</a> crash caused by incorrect refcounting in <a href="https://man.openbsd.org/dt.4">dt(4)</a> backend.
+<li>Fixed NULL dereference in <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a> message_validate_sa().
+<!-- 2026/06/15 -->
+<li>In <a href="https://man.openbsd.org/vi.1">vi(1)</a>, fixed behaviour of ')' used in a range when sentence reaches EOF.
+<li>Stop extra line being printed by <a href="https://man.openbsd.org/ex.1">ex(1)</a> when the 'number' command is given the 'l flag.
+<li><a href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a> now rejects certs with duplicate extension OIDs.
+<li>Prevent the <a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a> engine from sending us a negative amount of routes.
+<li>Made <a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a> accept correct amount of routes from the engine process.
+<li>Make sure <a href="https://man.openbsd.org/dhcpleased.8">dhcpleased(8)</a> UDP header length field at least covers the UDP header.
+<li>Let sparc64 accept ide nodes in IDE bootpaths for better interop with QEMU.
+<li>Clear last_modified after each response on a persistent HTTP <a href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a> connection.
+<!-- 2026/06/14 -->
+<li>Corrected <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> secondary key share handling for HelloRetryRequests.
+<li>Improved <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> TLSv1.3 server handling of no shared groups.
+<li>Send illegal parameter alerts for various HelloRetryRequest violations in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
+<li>Removed SSL_OP_LEGACY_SERVER_CONNECT from default options in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
+<li>Switched <a href="https://man.openbsd.org/relayd.8">relayd(8)</a> to new imsg API.
+<!-- 2026/06/13 -->
+<li>Added experimental <a href="https://man.openbsd.org/ssh.1">ssh(1)</a> support for composite post-quantum mldsa44-ed25519 signature scheme.
+<li>Provide a small SHA-1 implementation in <a href="https://man.openbsd.org/hash.3">hash(3)</a>.
+<li>Fixed build without INET6 option set for <a href="https://man.openbsd.org/ogx.4">ogx(4/octeon)</a>.
+<!-- 2026/06/12 -->
+<li>In vfs, properly wake vclean after failed vnode lock attempts.
+<!-- 2026/06/11 -->
+<li>Backed out <a href="https://man.openbsd.org/sdmmc.4">sdmmc(4)</a> arm64 hibernate fix, due to memory side effects.
+<li>Fixed race condition during uipc_socket socket unsplicing.
+<li>Preparation work for <a href="https://man.openbsd.org/sdmmc.4">sdmmc(4)</a> hibernation on arm64.
+<li>Fixed LLVM crashes when using scalable TypeSizes (github issue 175868).
+<li>Provide a separate executable file for <a href="https://man.openbsd.org/syslogd.8">syslogd(8)</a> parent, for privilege separation.
+<li>Implemented <a href="https://man.openbsd.org/mwx.4">mwx(4)</a> mwx_mac_tx_free() for MT7921. Allows MT7921 to connect to an open wifi.
+<li>Fixed NULL dereference in <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a> message_alloc_reply() callers.
+<li>Fixed possible unaligned 32 bit read by <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>.
+<li>Validate <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a> DELETE payload SPI array size.
+<li>Validate proposal and transform sizes in <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>.
+<!-- 2026/06/10 -->
+<li>Added length checks for the Port-Message and State attributes in <a href="https://man.openbsd.org/login_radius.8">login_radius(8)</a> Access-Challenge.
+<li>Improved channel setup in mwx_preinit(); mark channels as passive in the DFS range.
+<!-- 2026/06/09 -->
+<li>Fixed incorrect purpose check in the non-legacy x509_verify path in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a>.
+<li>Fixed a vulnerability of integer overflow in <a href="https://man.openbsd.org/amdgpu.4">amdgpu(4)</a> kfd debugger.
+<li>Removed the uvm buffer flipper, so the buffer cache has only one clean cache.
+<li>Require <a href="https://man.openbsd.org/lpd.8">lpd(8)</a> data file path name to be in the spool dir.
+<li>Ensure that buffer passed to mwx_mcu_send_firmware() does not overflow <a href="https://man.openbsd.org/mwx.4">mwx(4)</a> firmware image.
+<li>Stopped incorrectly freeing a caller-owned buffer in PKCS7_verify().
+<li>Added some missing bounds checks to <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> ASN1_mbstring_copy().
+<li>Avoid out-of-bounds read in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> CMS password-based decryption
+<li>Avoid NULL dereference in <a href="https://man.openbsd.org/ssl.8">ssl(8)</a> password-based CMS decryption; fixes crash.
+<li>Fixed <a href="https://man.openbsd.org/intel.4">intel(4)</a> screen glitches when resuming from hibernate.
 <!-- 2026/06/07 -->
 <li>Fixed <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tmux&manpath=OpenBSD%20Current&sektion=1&format=html">tmux(1)</a> cursor calculation when the status line is at the top.
 <li>Added -H flag to <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tmux&manpath=OpenBSD%20Current&sektion=1&format=html">tmux(1)</a> capture-pane to show hyperlinks.

• plus.html_diff (19K)