diff --git a/bin/ps/ps.1 b/bin/ps/ps.1
index 2ea4db84e..4b99c1a9f 100644
--- a/bin/ps/ps.1
+++ b/bin/ps/ps.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ps.1,v 1.138 2024/10/10 10:24:14 claudio Exp $
+.\"	$OpenBSD: ps.1,v 1.139 2024/10/15 13:49:49 claudio Exp $
 .\"	$NetBSD: ps.1,v 1.16 1996/03/21 01:36:28 jtc Exp $
 .\"
 .\" Copyright (c) 1980, 1990, 1991, 1993, 1994
@@ -30,7 +30,7 @@
 .\"
 .\"     @(#)ps.1	8.3 (Berkeley) 4/18/94
 .\"
-.Dd $Mdocdate: October 10 2024 $
+.Dd $Mdocdate: October 15 2024 $
 .Dt PS 1
 .Os
 .Sh NAME
@@ -359,6 +359,7 @@ PS_CHROOT	0x01000000 process is chrooted
 PS_NOBTCFI	0x02000000 no Branch Target CFI
 PS_CONTINUED    0x20000000 process continued from stopped state
                            but has not been waited for yet
+PS_STOPPED      0x40000000 process is in stopped state
 .Ed
 .It Cm re
 Core residency time (in seconds; 127 = infinity).
diff --git a/distrib/i386/iso/Makefile b/distrib/i386/iso/Makefile
index fd288f3c8..19682e8f3 100644
--- a/distrib/i386/iso/Makefile
+++ b/distrib/i386/iso/Makefile
@@ -1,7 +1,7 @@
-#	$OpenBSD: Makefile,v 1.35 2024/06/09 17:24:19 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.36 2024/10/15 00:08:28 deraadt Exp $
 
 FS=		install${OSrev}.img
-FSSIZE=		921600
+FSSIZE=		931840
 FSDISKTYPE=	install360
 CDROM=		install${OSrev}.iso
 
diff --git a/etc/etc.i386/disktab b/etc/etc.i386/disktab
index d8ece31bd..21d0dcfd0 100644
--- a/etc/etc.i386/disktab
+++ b/etc/etc.i386/disktab
@@ -1,4 +1,4 @@
-#	$OpenBSD: disktab,v 1.35 2023/04/19 11:20:03 krw Exp $
+#	$OpenBSD: disktab,v 1.36 2024/10/15 00:08:27 deraadt Exp $
 
 mini34|gzip bsd.rd disk image 4.34375MB:\
 	:dt=rdroot:se#512:nt#1:ns#64:nc#132:\
@@ -7,8 +7,8 @@ mini34|gzip bsd.rd disk image 4.34375MB:\
 
 install360|install.img disk image 360MB:\
 	:dt=rdroot:se#512:nt#1:ns#64:nc#14400:\
-	:pa#921536:oa#64:ba#8192:fa#1024:ta=4.2BSD: \
-	:pc#921600:oc#0:
+	:pa#931776:oa#64:ba#8192:fa#1024:ta=4.2BSD: \
+	:pc#931840:oc#0:
 
 floppy288|3in|3.5in High Density Floppy, 2.88MB:\
 	:dt=floppy:se#512:nt#2:ns#36:nc#80:\
diff --git a/lib/libcrypto/ec/ec_asn1.c b/lib/libcrypto/ec/ec_asn1.c
index 0fe187aeb..02609606f 100644
--- a/lib/libcrypto/ec/ec_asn1.c
+++ b/lib/libcrypto/ec/ec_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_asn1.c,v 1.72 2024/10/14 18:17:11 tb Exp $ */
+/* $OpenBSD: ec_asn1.c,v 1.73 2024/10/15 06:35:59 tb Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -695,15 +695,11 @@ ec_asn1_group2parameters(const EC_GROUP *group)
 	int ok = 0;
 	size_t len = 0;
 	ECPARAMETERS *ret = NULL;
-	BIGNUM *tmp = NULL;
+	const BIGNUM *order, *cofactor;
 	unsigned char *buffer = NULL;
 	const EC_POINT *point = NULL;
 	point_conversion_form_t form;
 
-	if ((tmp = BN_new()) == NULL) {
-		ECerror(ERR_R_MALLOC_FAILURE);
-		goto err;
-	}
 	if ((ret = ECPARAMETERS_new()) == NULL) {
 		ECerror(ERR_R_MALLOC_FAILURE);
 		goto err;
@@ -750,19 +746,27 @@ ec_asn1_group2parameters(const EC_GROUP *group)
 		ECerror(ERR_R_ASN1_LIB);
 		goto err;
 	}
-	if (!EC_GROUP_get_order(group, tmp, NULL)) {
+	if ((order = EC_GROUP_get0_order(group)) == NULL) {
+		ECerror(ERR_R_EC_LIB);
+		goto err;
+	}
+	if (BN_is_zero(order)) {
 		ECerror(ERR_R_EC_LIB);
 		goto err;
 	}
 	ASN1_INTEGER_free(ret->order);
-	if ((ret->order = BN_to_ASN1_INTEGER(tmp, NULL)) == NULL) {
+	if ((ret->order = BN_to_ASN1_INTEGER(order, NULL)) == NULL) {
 		ECerror(ERR_R_ASN1_LIB);
 		goto err;
 	}
 	ASN1_INTEGER_free(ret->cofactor);
 	ret->cofactor = NULL;
-	if (EC_GROUP_get_cofactor(group, tmp, NULL)) {
-		if ((ret->cofactor = BN_to_ASN1_INTEGER(tmp, NULL)) == NULL) {
+	if ((cofactor = EC_GROUP_get0_cofactor(group)) == NULL) {
+		ECerror(ERR_R_EC_LIB);
+		goto err;
+	}
+	if (!BN_is_zero(cofactor)) {
+		if ((ret->cofactor = BN_to_ASN1_INTEGER(cofactor, NULL)) == NULL) {
 			ECerror(ERR_R_ASN1_LIB);
 			goto err;
 		}
@@ -774,7 +778,6 @@ ec_asn1_group2parameters(const EC_GROUP *group)
 		ECPARAMETERS_free(ret);
 		ret = NULL;
 	}
-	BN_free(tmp);
 	free(buffer);
 	return (ret);
 }
diff --git a/lib/libcrypto/ec/ec_lib.c b/lib/libcrypto/ec/ec_lib.c
index 85567a76c..11d09b65c 100644
--- a/lib/libcrypto/ec/ec_lib.c
+++ b/lib/libcrypto/ec/ec_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_lib.c,v 1.67 2024/04/23 10:52:08 tb Exp $ */
+/* $OpenBSD: ec_lib.c,v 1.69 2024/10/15 17:44:43 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -335,11 +335,11 @@ EC_GROUP_set_generator(EC_GROUP *group, const EC_POINT *generator,
 		return 0;
 	}
 
-	if (group->generator == NULL) {
+	if (group->generator == NULL)
 		group->generator = EC_POINT_new(group);
-		if (group->generator == NULL)
-			return 0;
-	}
+	if (group->generator == NULL)
+		return 0;
+
 	if (!EC_POINT_copy(group->generator, generator))
 		return 0;
 
@@ -393,6 +393,12 @@ EC_GROUP_get_cofactor(const EC_GROUP *group, BIGNUM *cofactor, BN_CTX *ctx)
 }
 LCRYPTO_ALIAS(EC_GROUP_get_cofactor);
 
+const BIGNUM *
+EC_GROUP_get0_cofactor(const EC_GROUP *group)
+{
+	return &group->cofactor;
+}
+
 void
 EC_GROUP_set_curve_name(EC_GROUP *group, int nid)
 {
diff --git a/lib/libcrypto/ec/ec_local.h b/lib/libcrypto/ec/ec_local.h
index c2befdede..ca55770ba 100644
--- a/lib/libcrypto/ec/ec_local.h
+++ b/lib/libcrypto/ec/ec_local.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_local.h,v 1.28 2024/10/03 06:24:07 tb Exp $ */
+/* $OpenBSD: ec_local.h,v 1.29 2024/10/15 06:27:43 tb Exp $ */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -356,6 +356,7 @@ int EC_POINT_get_Jprojective_coordinates(const EC_GROUP *group,
     const EC_POINT *p, BIGNUM *x, BIGNUM *y, BIGNUM *z, BN_CTX *ctx);
 
 /* Public API in OpenSSL */
+const BIGNUM *EC_GROUP_get0_cofactor(const EC_GROUP *group);
 const BIGNUM *EC_GROUP_get0_order(const EC_GROUP *group);
 
 __END_HIDDEN_DECLS
diff --git a/regress/lib/libssl/rust-openssl/Cargo.toml b/regress/lib/libssl/rust-openssl/Cargo.toml
index c33c3475a..63194cb3f 100644
--- a/regress/lib/libssl/rust-openssl/Cargo.toml
+++ b/regress/lib/libssl/rust-openssl/Cargo.toml
@@ -1,4 +1,5 @@
 [workspace]
+resolver = "2"
 members = [
     "openssl",
     "openssl-errors",
diff --git a/regress/sys/kern/signal/Makefile b/regress/sys/kern/signal/Makefile
index 751f5beca..c3fbfb03c 100644
--- a/regress/sys/kern/signal/Makefile
+++ b/regress/sys/kern/signal/Makefile
@@ -1,7 +1,8 @@
-#	$OpenBSD: Makefile,v 1.6 2020/09/16 14:02:23 mpi Exp $
+#	$OpenBSD: Makefile,v 1.7 2024/10/15 15:06:25 claudio Exp $
 
 SUBDIR+= sigfpe siginfo_addr fpsig earlysig cansig sigaltstack_fork
 SUBDIR+= sig-stop
+SUBDIR+= sig-stop3
 SUBDIR+= siginfo-fault
 SUBDIR+= sigio
 SUBDIR+= signal-stress
diff --git a/regress/usr.sbin/rpki-client/openssl/Makefile b/regress/usr.sbin/rpki-client/openssl/Makefile
index 2d5ce4cd6..0976c2b23 100644
--- a/regress/usr.sbin/rpki-client/openssl/Makefile
+++ b/regress/usr.sbin/rpki-client/openssl/Makefile
@@ -1,9 +1,10 @@
-# $OpenBSD: Makefile,v 1.1 2024/09/04 04:34:14 tb Exp $
+# $OpenBSD: Makefile,v 1.2 2024/10/15 21:03:10 tb Exp $
 
 EOPENSSL =	eopenssl32
 
 LDADD +=	-Wl,-rpath,/usr/local/lib/${EOPENSSL} -L/usr/local/lib/${EOPENSSL}
 CFLAGS +=	-I${.CURDIR}/ -I/usr/local/include/${EOPENSSL}/
+CFLAGS +=	-DOPENSSL_SUPPRESS_DEPRECATED
 
 .PATH:		${.CURDIR}/..
 
diff --git a/sys/arch/arm64/include/pcb.h b/sys/arch/arm64/include/pcb.h
index 968236180..12f44cd94 100644
--- a/sys/arch/arm64/include/pcb.h
+++ b/sys/arch/arm64/include/pcb.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: pcb.h,v 1.5 2022/01/01 18:52:37 kettenis Exp $ */
+/* $OpenBSD: pcb.h,v 1.6 2024/10/15 09:16:39 jsg Exp $ */
 /*
  * Copyright (c) 2016 Dale Rahn <drahn@dalerahn.com>
  *
@@ -18,8 +18,6 @@
 #define	_MACHINE_PCB_H_
 
 #include <machine/frame.h>
-
-#include <machine/pte.h>
 #include <machine/reg.h>
 
 struct trapframe;
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index dd9a124f7..d5dd1f387 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exit.c,v 1.237 2024/10/08 12:02:24 claudio Exp $	*/
+/*	$OpenBSD: kern_exit.c,v 1.239 2024/10/15 13:49:26 claudio Exp $	*/
 /*	$NetBSD: kern_exit.c,v 1.39 1996/04/22 01:38:25 christos Exp $	*/
 
 /*
@@ -172,7 +172,7 @@ exit1(struct proc *p, int xexit, int xsig, int flags)
 
 	/* proc is off ps_threads list so update accounting of process now */
 	tuagg_add_runtime();
-	tuagg_add_process(p->p_p, p);
+	tuagg_add_process(pr, p);
 
 	if ((p->p_flag & P_THREAD) == 0) {
 		/* main thread gotta wait because it has the pid, et al */
@@ -502,7 +502,6 @@ dowait6(struct proc *q, idtype_t idtype, id_t id, int *statusp, int options,
 {
 	int nfound;
 	struct process *pr;
-	struct proc *p;
 	int error;
 
 	if (info != NULL)
@@ -516,8 +515,6 @@ loop:
 		    (idtype == P_PGID && id != pr->ps_pgid))
 			continue;
 
-		p = pr->ps_mainproc;
-
 		nfound++;
 		if ((options & WEXITED) && (pr->ps_flags & PS_ZOMBIE)) {
 			*retval = pr->ps_pid;
@@ -571,11 +568,9 @@ loop:
 				memset(rusage, 0, sizeof(*rusage));
 			return (0);
 		}
-		if (p->p_stat == SSTOP &&
+		if (((pr->ps_flags & PS_TRACED) || (options & WUNTRACED)) &&
 		    (pr->ps_flags & PS_WAITED) == 0 &&
-		    (p->p_flag & P_SUSPSINGLE) == 0 &&
-		    ((pr->ps_flags & PS_TRACED) ||
-		    (options & WUNTRACED))) {
+		    (pr->ps_flags & PS_STOPPED)) {
 			if ((options & WNOWAIT) == 0)
 				atomic_setbits_int(&pr->ps_flags, PS_WAITED);
 
diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
index 7d6b90260..ab9f6c378 100644
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_proc.c,v 1.99 2024/07/08 13:17:12 claudio Exp $	*/
+/*	$OpenBSD: kern_proc.c,v 1.100 2024/10/15 13:49:26 claudio Exp $	*/
 /*	$NetBSD: kern_proc.c,v 1.14 1996/02/09 18:59:41 christos Exp $	*/
 
 /*
@@ -462,7 +462,7 @@ orphanpg(struct pgrp *pg)
 	struct process *pr;
 
 	LIST_FOREACH(pr, &pg->pg_members, ps_pglist) {
-		if (pr->ps_mainproc->p_stat == SSTOP) {
+		if (pr->ps_flags & PS_STOPPED) {
 			LIST_FOREACH(pr, &pg->pg_members, ps_pglist) {
 				prsignal(pr, SIGHUP);
 				prsignal(pr, SIGCONT);
diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
index bb3ac4b47..13b06bbd6 100644
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_resource.c,v 1.91 2024/10/08 11:57:59 claudio Exp $	*/
+/*	$OpenBSD: kern_resource.c,v 1.92 2024/10/15 12:26:53 claudio Exp $	*/
 /*	$NetBSD: kern_resource.c,v 1.38 1996/10/23 07:19:38 matthias Exp $	*/
 
 /*-
@@ -448,7 +448,7 @@ tuagg_add_runtime(void)
 {
 	struct schedstate_percpu *spc = &curcpu()->ci_schedstate;
 	struct proc *p = curproc;
-	struct timespec ts;
+	struct timespec ts, delta;
 
 	/*
 	 * Compute the amount of time during which the current
@@ -463,14 +463,14 @@ tuagg_add_runtime(void)
 		    (long long)spc->spc_runtime.tv_sec,
 		    spc->spc_runtime.tv_nsec);
 #endif
-		timespecclear(&ts);
+		timespecclear(&delta);
 	} else {
-		timespecsub(&ts, &spc->spc_runtime, &ts);
+		timespecsub(&ts, &spc->spc_runtime, &delta);
 	}
 	/* update spc_runtime */
 	spc->spc_runtime = ts;
 	tu_enter(&p->p_tu);
-	timespecadd(&p->p_tu.tu_runtime, &ts, &p->p_tu.tu_runtime);
+	timespecadd(&p->p_tu.tu_runtime, &delta, &p->p_tu.tu_runtime);
 	tu_leave(&p->p_tu);
 }
 
diff --git a/sys/kern/kern_sig.c b/sys/kern/kern_sig.c
index e3701d117..595fed1e2 100644
--- a/sys/kern/kern_sig.c
+++ b/sys/kern/kern_sig.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sig.c,v 1.341 2024/10/09 08:58:19 claudio Exp $	*/
+/*	$OpenBSD: kern_sig.c,v 1.342 2024/10/15 13:49:26 claudio Exp $	*/
 /*	$NetBSD: kern_sig.c,v 1.54 1996/04/22 01:38:32 christos Exp $	*/
 
 /*
@@ -1100,6 +1100,8 @@ ptsignal(struct proc *p, int signum, enum signal_type type)
 			 * Otherwise, process goes back to sleep state.
 			 */
 			atomic_setbits_int(&pr->ps_flags, PS_CONTINUED);
+			atomic_clearbits_int(&pr->ps_flags,
+			    PS_WAITED | PS_STOPPED);
 			atomic_clearbits_int(&p->p_flag, P_SUSPSIG);
 			wakeparent = 1;
 			if (action == SIG_DFL)
@@ -1512,6 +1514,7 @@ proc_stop_sweep(void *v)
 	LIST_FOREACH(pr, &allprocess, ps_list) {
 		if ((pr->ps_flags & PS_STOPPING) == 0)
 			continue;
+		atomic_setbits_int(&pr->ps_flags, PS_STOPPED);
 		atomic_clearbits_int(&pr->ps_flags, PS_STOPPING);
 
 		if ((pr->ps_pptr->ps_sigacts->ps_sigflags & SAS_NOCLDSTOP) == 0)
diff --git a/sys/net/if_arp.h b/sys/net/if_arp.h
index e43c559e9..c7d0811ef 100644
--- a/sys/net/if_arp.h
+++ b/sys/net/if_arp.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_arp.h,v 1.7 2017/01/24 10:08:30 krw Exp $	*/
+/*	$OpenBSD: if_arp.h,v 1.8 2024/10/15 00:41:40 jsg Exp $	*/
 /*	$NetBSD: if_arp.h,v 1.8 1995/03/08 02:56:52 cgd Exp $	*/
 
 /*
@@ -71,19 +71,4 @@ struct	arphdr {
 	u_int8_t  ar_tpa[];	/* target protocol address */
 #endif
 };
-
-/*
- * ARP ioctl request
- */
-struct arpreq {
-	struct	sockaddr arp_pa;		/* protocol address */
-	struct	sockaddr arp_ha;		/* hardware address */
-	int	arp_flags;			/* flags */
-};
-/*  arp_flags and at_flags field values */
-#define	ATF_INUSE	0x01	/* entry in use */
-#define ATF_COM		0x02	/* completed entry (enaddr valid) */
-#define	ATF_PERM	0x04	/* permanent entry */
-#define	ATF_PUBL	0x08	/* publish entry (respond for other host) */
-#define	ATF_USETRAILERS	0x10	/* has requested trailers */
 #endif /* _NET_IF_ARP_H_ */
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 465f9d3e5..0333a4697 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.h,v 1.374 2024/10/08 12:02:24 claudio Exp $	*/
+/*	$OpenBSD: proc.h,v 1.375 2024/10/15 13:49:26 claudio Exp $	*/
 /*	$NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $	*/
 
 /*-
@@ -304,15 +304,16 @@ struct process {
 #define	PS_NOBTCFI	0x02000000	/* No Branch Target CFI */
 #define	PS_ITIMER	0x04000000	/* Virtual interval timers running */
 #define	PS_CONTINUED	0x20000000	/* Continued proc not yet waited for */
+#define	PS_STOPPED	0x40000000	/* Stopped process */
 
 #define	PS_BITS \
     ("\20" "\01CONTROLT" "\02EXEC" "\03INEXEC" "\04EXITING" "\05SUGID" \
      "\06SUGIDEXEC" "\07PPWAIT" "\010ISPWAIT" "\011PROFIL" "\012TRACED" \
      "\013WAITED" "\014COREDUMP" "\015SINGLEEXIT" "\016SINGLEUNWIND" \
-     "\017NOZOMBIE" "\020STOPPED" "\021SYSTEM" "\022EMBRYO" "\023ZOMBIE" \
+     "\017NOZOMBIE" "\020STOPPING" "\021SYSTEM" "\022EMBRYO" "\023ZOMBIE" \
      "\024NOBROADCASTKILL" "\025PLEDGE" "\026WXNEEDED" "\027EXECPLEDGE" \
-     "\030ORPHAN" "\031CHROOT" "\032NOBTCFI" "\033ITIMER" "\034PIN" \
-     "\035LIBCPIN" "\036CONTINUED")
+     "\030ORPHAN" "\031CHROOT" "\032NOBTCFI" "\033ITIMER" "\036CONTINUED" \
+     "\037STOPPED")
 
 struct kcov_dev;
 struct lock_list_entry;
diff --git a/usr.bin/ssh/sshd_config.5 b/usr.bin/ssh/sshd_config.5
index 786dd08f2..62e4266e9 100644
--- a/usr.bin/ssh/sshd_config.5
+++ b/usr.bin/ssh/sshd_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.375 2024/10/06 23:37:17 djm Exp $
-.Dd $Mdocdate: October 6 2024 $
+.\" $OpenBSD: sshd_config.5,v 1.376 2024/10/14 23:53:34 naddy Exp $
+.Dd $Mdocdate: October 14 2024 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -1846,6 +1846,13 @@ via
 .Cm AcceptEnv
 or
 .Cm PermitUserEnvironment .
+.It Cm SshdAuthPath
+Overrides the default path to the
+.Cm sshd-auth
+binary that is invoked to complete user authentication.
+The default is
+.Pa /usr/libexec/sshd-auth .
+This option is intended for use by tests.
 .It Cm SshdSessionPath
 Overrides the default path to the
 .Cm sshd-session