diff --git a/etc/skel/dot.version b/etc/skel/dot.version
index 5abf50e3b..1458bded3 100644
--- a/etc/skel/dot.version
+++ b/etc/skel/dot.version
@@ -1 +1 @@
-# SecBSD 1.4-4ca0067: Tue Nov 21 07:49:44 UTC 2023 (Mictlantecuhtli)
+# SecBSD 1.4-f3e820c: Wed Nov 22 20:09:10 UTC 2023 (Mictlantecuhtli)
diff --git a/gnu/usr.sbin/mkhybrid/src/defaults.h b/gnu/usr.sbin/mkhybrid/src/defaults.h
index 41f74616f..5939224b6 100644
--- a/gnu/usr.sbin/mkhybrid/src/defaults.h
+++ b/gnu/usr.sbin/mkhybrid/src/defaults.h
@@ -2,7 +2,7 @@
  * Header file defaults.h - assorted default values for character strings in
  * the volume descriptor.
  *
- * 	$Id: defaults.h,v 1.1 2000/10/10 20:40:13 beck Exp $
+ * 	$Id: defaults.h,v 1.2 2023/11/21 08:46:06 jmatthew Exp $
  */
 
 #define  PREPARER_DEFAULT 	NULL
@@ -17,6 +17,7 @@
 #define  VOLUME_ID_DEFAULT 	"CDROM"
 #define  BOOT_CATALOG_DEFAULT   "boot.catalog"
 #define  BOOT_IMAGE_DEFAULT     NULL
+#define  EFI_BOOT_IMAGE_DEFAULT NULL
 #ifdef APPLE_HYB
 #define	 DEFTYPE		"TEXT"  /* default Apple TYPE */
 #define  DEFCREATOR		"unix"  /* default Apple CREATOR */
diff --git a/gnu/usr.sbin/mkhybrid/src/eltorito.c b/gnu/usr.sbin/mkhybrid/src/eltorito.c
index ccb445421..4526d98c4 100644
--- a/gnu/usr.sbin/mkhybrid/src/eltorito.c
+++ b/gnu/usr.sbin/mkhybrid/src/eltorito.c
@@ -44,6 +44,8 @@
 static struct eltorito_validation_entry valid_desc;
 static struct eltorito_defaultboot_entry default_desc;
 static struct eltorito_boot_descriptor gboot_desc;
+static struct eltorito_sectionheader_entry shdr_desc;
+static struct eltorito_defaultboot_entry efi_desc;
 
 static int tvd_write	__PR((FILE * outfile));
 
@@ -120,8 +122,9 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
     int				bootcat;
     int				checksum;
     unsigned char		      * checksum_ptr;
-    struct directory_entry      * de;
+    struct directory_entry      * de = NULL;
     struct directory_entry      * de2;
+    struct directory_entry      * efi_de = NULL;
     int				i;
     int				nsectors;
     
@@ -149,8 +152,12 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
      * now adjust boot catalog
      * lets find boot image first 
      */
-    de=search_tree_file(root, boot_image);
-    if (!de) 
+    if (boot_image != NULL)
+	de=search_tree_file(root, boot_image);
+    if (efi_boot_image != NULL)
+        efi_de=search_tree_file(root, efi_boot_image);
+
+    if (de == NULL && efi_boot_image == NULL)
     {
 	fprintf(stderr,"Uh oh, I cant find the boot image!\n");
 	exit(1);
@@ -162,7 +169,8 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
      */
     memset(&valid_desc, 0, sizeof(valid_desc));
     valid_desc.headerid[0] = 1;
-    valid_desc.arch[0] = EL_TORITO_ARCH_x86;
+    valid_desc.arch[0] =
+	(boot_image != NULL)? EL_TORITO_ARCH_x86 : EL_TORITO_ARCH_EFI;
     
     /*
      * we'll shove start of publisher id into id field, may get truncated
@@ -198,6 +206,8 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
     checksum = -checksum;
     set_721(valid_desc.cksum, (unsigned int) checksum);
     
+    if (de == NULL)
+	goto skip_x86;
     /*
      * now make the initial/default entry for boot catalog 
      */
@@ -279,7 +289,28 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
 #endif
     set_731(default_desc.bootoff, 
 	    (unsigned int) get_733(de->isorec.extent));
-    
+ skip_x86:
+    /*
+     * add the EFI boot image, if specified
+     */
+    if (efi_de != NULL) {
+	if (de != NULL) {
+	    memset(&shdr_desc, 0, sizeof(shdr_desc));
+	    shdr_desc.header_id[0] = EL_TORITO_SHDR_ID_LAST_SHDR;
+	    shdr_desc.platform_id[0] = EL_TORITO_ARCH_EFI;
+	    set_721(shdr_desc.entry_count, 1);
+	}
+
+	memset(&efi_desc, 0, sizeof(efi_desc));
+	efi_desc.boot_id[0] = EL_TORITO_BOOTABLE;
+	set_721(efi_desc.loadseg, 0);
+	efi_desc.arch[0] = EL_TORITO_ARCH_EFI;
+
+	nsectors = ((efi_de->size + 511) & ~(511))/512;
+	set_721(efi_desc.nsect, nsectors);
+	set_731(efi_desc.bootoff, (unsigned int)get_733(efi_de->isorec.extent));
+    }
+
     /*
      * now write it to disk 
      */
@@ -295,7 +326,14 @@ void FDECL1(get_torito_desc, struct eltorito_boot_descriptor *, boot_desc)
      * write out 
      */
     write(bootcat, &valid_desc, 32);
-    write(bootcat, &default_desc, 32);
+    if (de != NULL)
+    {
+	write(bootcat, &default_desc, 32);
+	if (efi_de != NULL)
+	    write(bootcat, &shdr_desc, sizeof(shdr_desc));
+    }
+    if (efi_de != NULL)
+	write(bootcat, &efi_desc, sizeof(efi_desc));
     close(bootcat);
 } /* get_torito_desc(... */
 
diff --git a/gnu/usr.sbin/mkhybrid/src/iso9660.h b/gnu/usr.sbin/mkhybrid/src/iso9660.h
index 622727037..e8561101a 100644
--- a/gnu/usr.sbin/mkhybrid/src/iso9660.h
+++ b/gnu/usr.sbin/mkhybrid/src/iso9660.h
@@ -21,7 +21,7 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
 
 /*
- * 	$Id: iso9660.h,v 1.1 2000/10/10 20:40:16 beck Exp $
+ * 	$Id: iso9660.h,v 1.2 2023/11/21 08:46:06 jmatthew Exp $
  */
 
 #ifndef _ISOFS_FS_H
@@ -52,6 +52,7 @@ struct iso_volume_descriptor {
 #define EL_TORITO_ARCH_x86 0
 #define EL_TORITO_ARCH_PPC 1
 #define EL_TORITO_ARCH_MAC 2
+#define EL_TORITO_ARCH_EFI 0xEF
 #define EL_TORITO_BOOTABLE 0x88
 #define EL_TORITO_MEDIA_NOEMUL 0
 #define EL_TORITO_MEDIA_12FLOP  1
@@ -129,6 +130,16 @@ struct eltorito_defaultboot_entry {
         char pad2                       [ISODCL ( 13,   32)];
 };
 
+/* El Torito section header entry in boot catalog */
+struct eltorito_sectionheader_entry {
+#define EL_TORITO_SHDR_ID_SHDR		0x90
+#define EL_TORITO_SHDR_ID_LAST_SHDR	0x91
+	char header_id			[ISODCL (  1,    1)]; /* 711 */
+	char platform_id		[ISODCL (  2,    2)];
+	char entry_count		[ISODCL (  3,    4)]; /* 721 */
+	char id				[ISODCL (  5,   32)];
+};
+
 
 /* We use this to help us look up the parent inode numbers. */
 
diff --git a/gnu/usr.sbin/mkhybrid/src/mkhybrid.8 b/gnu/usr.sbin/mkhybrid/src/mkhybrid.8
index 884b3127f..33b0a82b5 100644
--- a/gnu/usr.sbin/mkhybrid/src/mkhybrid.8
+++ b/gnu/usr.sbin/mkhybrid/src/mkhybrid.8
@@ -2,7 +2,7 @@
 .\" To print, first run through tbl
 .\" -*- nroff -*-
 .\"
-.\" $Id: mkhybrid.8,v 1.4 2022/07/11 03:11:49 daniel Exp $
+.\" $Id: mkhybrid.8,v 1.5 2023/11/21 08:46:06 jmatthew Exp $
 .\"
 .TH MKHYBRID 8 "7 April 1999" "Version 1.12b5.1"
 .SH NAME
@@ -46,6 +46,10 @@ mkhybrid \- create an hybrid ISO9660/JOLIET/HFS filesystem with optional Rock Ri
 .B \-D
 ]
 [
+.B \-e
+.I efi_boot_image
+]
+[
 .B \-hide
 .I glob
 ]
@@ -474,6 +478,18 @@ Do not use deep directory relocation, and instead just pack them in the
 way we see them.  This violates the ISO9660 standard, but it works on many
 systems.  Use with caution.
 .TP
+.BI \-e " efi_boot_image
+Specifies the path and filename of the EFI boot image to be used when making
+an "El Torito" bootable CD.
+The pathname must be relative to the source path specified to
+.B mkhybrid.
+The file should contain an EFI system partition image.
+The
+.B \-e
+option can be used with or without the
+.B \-b
+option.
+.TP
 .B \-f
 Follow symbolic links when generating the filesystem.  When this option is not
 in use, symbolic links will be entered using Rock Ridge if enabled, otherwise
diff --git a/gnu/usr.sbin/mkhybrid/src/mkisofs.c b/gnu/usr.sbin/mkhybrid/src/mkisofs.c
index 7d44564ca..5959ae2b3 100644
--- a/gnu/usr.sbin/mkhybrid/src/mkisofs.c
+++ b/gnu/usr.sbin/mkhybrid/src/mkisofs.c
@@ -110,6 +110,7 @@ char * volume_id = VOLUME_ID_DEFAULT;
 char * system_id = SYSTEM_ID_DEFAULT;
 char * boot_catalog = BOOT_CATALOG_DEFAULT;
 char * boot_image = BOOT_IMAGE_DEFAULT;
+char * efi_boot_image = EFI_BOOT_IMAGE_DEFAULT;
 int volume_set_size = 1;
 int volume_sequence_number = 1;
 
@@ -274,6 +275,8 @@ static const struct ld_option ld_options[] =
       'd', NULL, "Omit trailing periods from filenames", ONE_DASH },
   { {"disable-deep-relocation", no_argument, NULL, 'D'},
       'D', NULL, "Disable deep directory relocation", ONE_DASH },
+  { {"eltorito-boot-efi", required_argument, NULL, 'e' },
+      'e', "FILE", "Set El Torito EFI boot image name" , ONE_DASH },
   { {"follow-links", no_argument, NULL, 'f'},
       'f', NULL, "Follow symbolic links", ONE_DASH },
   { {"help", no_argument, NULL, OPTION_HELP},
@@ -865,6 +868,14 @@ int FDECL2(main, int, argc, char **, argv){
 		exit(1);
 	}
 	break;
+      case 'e':
+	use_eltorito++;
+	efi_boot_image = optarg;
+	if (efi_boot_image == NULL) {
+		fprintf(stderr,"Required EFI boot image pathname missing\n");
+		exit(1);
+	}
+	break;
       case 'c':
 	use_eltorito++;
 	boot_catalog = optarg;  /* pathname of the boot image on cd */
diff --git a/gnu/usr.sbin/mkhybrid/src/mkisofs.h b/gnu/usr.sbin/mkhybrid/src/mkisofs.h
index ce01e2b2e..5a3e7e577 100644
--- a/gnu/usr.sbin/mkhybrid/src/mkisofs.h
+++ b/gnu/usr.sbin/mkhybrid/src/mkisofs.h
@@ -20,7 +20,7 @@
    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
 
 /*
- * 	$Id: mkisofs.h,v 1.4 2015/09/09 20:02:31 miod Exp $
+ * 	$Id: mkisofs.h,v 1.5 2023/11/21 08:46:06 jmatthew Exp $
  */
 
 /* APPLE_HYB James Pearson j.pearson@ge.ucl.ac.uk 12/3/99 */
@@ -462,6 +462,7 @@ extern char * system_id;
 extern char * volume_id;
 extern char * boot_catalog;
 extern char * boot_image;
+extern char * efi_boot_image;
 extern int volume_set_size;
 extern int volume_sequence_number;
 
diff --git a/lib/libc/asr/getaddrinfo_async.c b/lib/libc/asr/getaddrinfo_async.c
index d5a9561fa..a1282e711 100644
--- a/lib/libc/asr/getaddrinfo_async.c
+++ b/lib/libc/asr/getaddrinfo_async.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: getaddrinfo_async.c,v 1.60 2023/11/20 12:15:16 florian Exp $	*/
+/*	$OpenBSD: getaddrinfo_async.c,v 1.61 2023/11/21 15:26:56 florian Exp $	*/
 /*
  * Copyright (c) 2012 Eric Faurot <eric@openbsd.org>
  *
@@ -115,7 +115,7 @@ getaddrinfo_async_run(struct asr_query *as, struct asr_result *ar)
 	char		 fqdn[MAXDNAME];
 	const char	*str;
 	struct addrinfo	*ai;
-	int		 i, family, r, is_localhost;
+	int		 i, family, r, is_localhost = 0;
 	FILE		*f;
 	union {
 		struct sockaddr		sa;
@@ -228,7 +228,8 @@ getaddrinfo_async_run(struct asr_query *as, struct asr_result *ar)
 
 		ar->ar_gai_errno = 0;
 
-		is_localhost = _asr_is_localhost(as->as.ai.hostname);
+		if (!(ai->ai_flags & AI_NUMERICHOST))
+			is_localhost = _asr_is_localhost(as->as.ai.hostname);
 		/*
 		 * If hostname is NULL, "localhost" or falls within the
 		 * ".localhost." domain, use local address.
diff --git a/lib/libc/asr/gethostnamadr_async.c b/lib/libc/asr/gethostnamadr_async.c
index ed998cfde..c570be34d 100644
--- a/lib/libc/asr/gethostnamadr_async.c
+++ b/lib/libc/asr/gethostnamadr_async.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: gethostnamadr_async.c,v 1.48 2023/11/20 12:15:16 florian Exp $	*/
+/*	$OpenBSD: gethostnamadr_async.c,v 1.49 2023/11/22 13:19:31 florian Exp $	*/
 /*
  * Copyright (c) 2012 Eric Faurot <eric@openbsd.org>
  *
@@ -205,7 +205,8 @@ gethostnamadr_async_run(struct asr_query *as, struct asr_result *ar)
 			}
 
 			if (!hnok_lenient(as->as.hostnamadr.name)) {
-				ar->ar_gai_errno = EAI_FAIL;
+				ar->ar_h_errno = NETDB_INTERNAL;
+				ar->ar_errno = EINVAL;
 				async_set_state(as, ASR_STATE_HALT);
 				break;
 			}
diff --git a/lib/libcrypto/ec/ec_print.c b/lib/libcrypto/ec/ec_print.c
index 312770f66..fcd157049 100644
--- a/lib/libcrypto/ec/ec_print.c
+++ b/lib/libcrypto/ec/ec_print.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ec_print.c,v 1.13 2023/07/07 13:54:45 beck Exp $ */
+/* $OpenBSD: ec_print.c,v 1.14 2023/11/21 22:17:15 tb Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
  *
@@ -63,8 +63,7 @@ EC_POINT_point2bn(const EC_GROUP *group, const EC_POINT *point,
 	size_t buf_len = 0;
 	unsigned char *buf;
 
-	buf_len = EC_POINT_point2oct(group, point, form,
-	    NULL, 0, ctx);
+	buf_len = EC_POINT_point2oct(group, point, form, NULL, 0, ctx);
 	if (buf_len == 0)
 		return NULL;
 
diff --git a/lib/libcrypto/ec/eck_prn.c b/lib/libcrypto/ec/eck_prn.c
index 6e89bfa73..2798d53d0 100644
--- a/lib/libcrypto/ec/eck_prn.c
+++ b/lib/libcrypto/ec/eck_prn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: eck_prn.c,v 1.28 2023/07/07 13:54:45 beck Exp $ */
+/* $OpenBSD: eck_prn.c,v 1.30 2023/11/21 22:05:33 tb Exp $ */
 /*
  * Written by Nils Larsch for the OpenSSL project.
  */
@@ -160,10 +160,6 @@ ECParameters_print(BIO *bp, const EC_KEY *x)
 }
 LCRYPTO_ALIAS(ECParameters_print);
 
-static int
-print_bin(BIO *fp, const char *str, const unsigned char *num,
-    size_t len, int off);
-
 static int
 ecpk_print_asn1_parameters(BIO *bp, const EC_GROUP *group, int off)
 {
@@ -289,8 +285,33 @@ ecpk_print_explicit_parameters(BIO *bp, const EC_GROUP *group, int off)
 	if (!bn_printf(bp, cofactor, off, "Cofactor: "))
 		goto err;
 	if ((seed = EC_GROUP_get0_seed(group)) != NULL) {
+		size_t i;
+
 		seed_len = EC_GROUP_get_seed_len(group);
-		if (!print_bin(bp, "Seed:", seed, seed_len, off))
+
+		/* XXX - ecx_buf_print() has a CBS version of this - dedup. */
+		if (!BIO_indent(bp, off, 128))
+			goto err;
+		if (BIO_printf(bp, "Seed:") <= 0)
+			goto err;
+
+		for (i = 0; i < seed_len; i++) {
+			const char *sep = ":";
+
+			if (i % 15 == 0) {
+				if (BIO_printf(bp, "\n") <= 0)
+					goto err;
+				if (!BIO_indent(bp, off + 4, 128))
+					goto err;
+			}
+
+			if (i + 1 == seed_len)
+				sep = "";
+			if (BIO_printf(bp, "%02x%s", seed[i], sep) <= 0)
+				goto err;
+		}
+
+		if (BIO_printf(bp, "\n") <= 0)
 			goto err;
 	}
 
@@ -316,38 +337,3 @@ ECPKParameters_print(BIO *bp, const EC_GROUP *group, int off)
 	return ecpk_print_explicit_parameters(bp, group, off);
 }
 LCRYPTO_ALIAS(ECPKParameters_print);
-
-static int
-print_bin(BIO *fp, const char *name, const unsigned char *buf,
-    size_t len, int off)
-{
-	size_t i;
-	char str[128];
-
-	if (buf == NULL)
-		return 1;
-	if (off) {
-		if (off > 128)
-			off = 128;
-		memset(str, ' ', off);
-		if (BIO_write(fp, str, off) <= 0)
-			return 0;
-	}
-	if (BIO_printf(fp, "%s", name) <= 0)
-		return 0;
-
-	for (i = 0; i < len; i++) {
-		if ((i % 15) == 0) {
-			str[0] = '\n';
-			memset(&(str[1]), ' ', off + 4);
-			if (BIO_write(fp, str, off + 1 + 4) <= 0)
-				return 0;
-		}
-		if (BIO_printf(fp, "%02x%s", buf[i], ((i + 1) == len) ? "" : ":") <= 0)
-			return 0;
-	}
-	if (BIO_write(fp, "\n", 1) <= 0)
-		return 0;
-
-	return 1;
-}
diff --git a/lib/libssl/Makefile b/lib/libssl/Makefile
index 9783885cd..38e5ba30e 100644
--- a/lib/libssl/Makefile
+++ b/lib/libssl/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.80 2023/07/06 07:56:32 beck Exp $
+# $OpenBSD: Makefile,v 1.81 2023/11/22 15:55:28 tb Exp $
 
 .include <bsd.own.mk>
 .ifndef NOMAN
@@ -44,7 +44,6 @@ SRCS= \
 	pqueue.c \
 	s3_cbc.c \
 	s3_lib.c \
-	ssl_algs.c \
 	ssl_asn1.c \
 	ssl_both.c \
 	ssl_cert.c \
diff --git a/lib/libssl/ssl.h b/lib/libssl/ssl.h
index 4ef6f6df7..8d65a1ec0 100644
--- a/lib/libssl/ssl.h
+++ b/lib/libssl/ssl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl.h,v 1.231 2023/11/19 15:51:49 tb Exp $ */
+/* $OpenBSD: ssl.h,v 1.232 2023/11/22 15:43:42 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1395,8 +1395,6 @@ void SSL_set_accept_state(SSL *s);
 
 long SSL_get_default_timeout(const SSL *s);
 
-int SSL_library_init(void );
-
 char *SSL_CIPHER_description(const SSL_CIPHER *, char *buf, int size);
 STACK_OF(X509_NAME) *SSL_dup_CA_list(const STACK_OF(X509_NAME) *sk);
 
@@ -2352,6 +2350,7 @@ void ERR_load_SSL_strings(void);
 #define OPENSSL_INIT_SSL_DEFAULT	_OPENSSL_INIT_FLAG_NOOP
 
 int OPENSSL_init_ssl(uint64_t opts, const void *settings);
+int SSL_library_init(void);
 
 #ifdef  __cplusplus
 }
diff --git a/lib/libssl/ssl_algs.c b/lib/libssl/ssl_algs.c
deleted file mode 100644
index 684697df5..000000000
--- a/lib/libssl/ssl_algs.c
+++ /dev/null
@@ -1,125 +0,0 @@
-/* $OpenBSD: ssl_algs.c,v 1.32 2023/07/08 16:40:13 beck Exp $ */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- *
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- *
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- *
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-
-#include <openssl/lhash.h>
-#include <openssl/objects.h>
-#include <openssl/opensslconf.h>
-
-#include "ssl_local.h"
-
-int
-SSL_library_init(void)
-{
-
-#ifndef OPENSSL_NO_DES
-	EVP_add_cipher(EVP_des_cbc());
-	EVP_add_cipher(EVP_des_ede3_cbc());
-#endif
-#ifndef OPENSSL_NO_RC4
-	EVP_add_cipher(EVP_rc4());
-#if !defined(OPENSSL_NO_MD5) && (defined(__x86_64) || defined(__x86_64__))
-	EVP_add_cipher(EVP_rc4_hmac_md5());
-#endif
-#endif
-#ifndef OPENSSL_NO_RC2
-	EVP_add_cipher(EVP_rc2_cbc());
-	/* Not actually used for SSL/TLS but this makes PKCS#12 work
-	 * if an application only calls SSL_library_init().
-	 */
-	EVP_add_cipher(EVP_rc2_40_cbc());
-#endif
-	EVP_add_cipher(EVP_aes_128_cbc());
-	EVP_add_cipher(EVP_aes_192_cbc());
-	EVP_add_cipher(EVP_aes_256_cbc());
-	EVP_add_cipher(EVP_aes_128_gcm());
-	EVP_add_cipher(EVP_aes_256_gcm());
-	EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1());
-	EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1());
-#ifndef OPENSSL_NO_CAMELLIA
-	EVP_add_cipher(EVP_camellia_128_cbc());
-	EVP_add_cipher(EVP_camellia_256_cbc());
-#endif
-#ifndef OPENSSL_NO_GOST
-	EVP_add_cipher(EVP_gost2814789_cfb64());
-	EVP_add_cipher(EVP_gost2814789_cnt());
-#endif
-
-	EVP_add_digest(EVP_md5());
-	EVP_add_digest(EVP_md5_sha1());
-	EVP_add_digest_alias(SN_md5, "ssl2-md5");
-	EVP_add_digest_alias(SN_md5, "ssl3-md5");
-
-	EVP_add_digest(EVP_sha1()); /* RSA with sha1 */
-	EVP_add_digest_alias(SN_sha1, "ssl3-sha1");
-	EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA);
-	EVP_add_digest(EVP_sha224());
-	EVP_add_digest(EVP_sha256());
-	EVP_add_digest(EVP_sha384());
-	EVP_add_digest(EVP_sha512());
-#ifndef OPENSSL_NO_GOST
-	EVP_add_digest(EVP_gostr341194());
-	EVP_add_digest(EVP_gost2814789imit());
-	EVP_add_digest(EVP_streebog256());
-	EVP_add_digest(EVP_streebog512());
-#endif
-
-	return (1);
-}
-LSSL_ALIAS(SSL_library_init);
diff --git a/lib/libssl/ssl_init.c b/lib/libssl/ssl_init.c
index a8646cc09..b314e714c 100644
--- a/lib/libssl/ssl_init.c
+++ b/lib/libssl/ssl_init.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_init.c,v 1.4 2023/07/08 16:40:13 beck Exp $ */
+/* $OpenBSD: ssl_init.c,v 1.6 2023/11/22 15:53:53 tb Exp $ */
 /*
  * Copyright (c) 2018 Bob Beck <beck@openbsd.org>
  *
@@ -26,12 +26,18 @@
 
 static pthread_t ssl_init_thread;
 
+int
+SSL_library_init(void)
+{
+	return OPENSSL_init_ssl(0, NULL);
+}
+LSSL_ALIAS(SSL_library_init);
+
 static void
 OPENSSL_init_ssl_internal(void)
 {
 	ssl_init_thread = pthread_self();
 	SSL_load_error_strings();
-	SSL_library_init();
 }
 
 int
diff --git a/lib/libtls/tls_verify.c b/lib/libtls/tls_verify.c
index c588f027c..a35ebe025 100644
--- a/lib/libtls/tls_verify.c
+++ b/lib/libtls/tls_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_verify.c,v 1.28 2023/06/01 07:32:25 tb Exp $ */
+/* $OpenBSD: tls_verify.c,v 1.29 2023/11/22 18:23:09 op Exp $ */
 /*
  * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
  *
@@ -244,7 +244,7 @@ tls_check_common_name(struct tls *ctx, X509 *cert, const char *name,
 		 * certificate as hostile.
 		 */
 		tls_set_errorx(ctx, "error verifying name '%s': "
-		    "Certificate subject contains mutiple Common Name fields, "
+		    "Certificate subject contains multiple Common Name fields, "
 		    "probably a malicious or malformed certificate", name);
 		goto err;
 	}
diff --git a/libexec/snmpd/snmpd_metrics/mib.c b/libexec/snmpd/snmpd_metrics/mib.c
index 94fbbfe48..1aa48cb15 100644
--- a/libexec/snmpd/snmpd_metrics/mib.c
+++ b/libexec/snmpd/snmpd_metrics/mib.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mib.c,v 1.6 2023/10/24 18:27:26 martijn Exp $	*/
+/*	$OpenBSD: mib.c,v 1.7 2023/11/21 08:49:08 martijn Exp $	*/
 
 /*
  * Copyright (c) 2022 Martijn van Duren <martijn@openbsd.org>
@@ -3270,7 +3270,11 @@ main(int argc, char *argv[])
 		switch (ch) {
 		case 'C':
 			if (strcmp(optarg, "filter-routes") == 0) {
-				conf.sc_rtfilter = 1;
+				conf.sc_rtfilter = ROUTE_FILTER(RTM_NEWADDR) |
+				    ROUTE_FILTER(RTM_DELADDR) |
+				    ROUTE_FILTER(RTM_IFINFO) |
+				    ROUTE_FILTER(RTM_IFANNOUNCE);
+
 			}
 			break;
 		case 'c':
diff --git a/sys/arch/amd64/amd64/cpu.c b/sys/arch/amd64/amd64/cpu.c
index d5dbec334..bd88aab3e 100644
--- a/sys/arch/amd64/amd64/cpu.c
+++ b/sys/arch/amd64/amd64/cpu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.c,v 1.176 2023/10/24 13:20:09 claudio Exp $	*/
+/*	$OpenBSD: cpu.c,v 1.177 2023/11/22 18:50:10 bluhm Exp $	*/
 /* $NetBSD: cpu.c,v 1.1 2003/04/26 18:39:26 fvdl Exp $ */
 
 /*-
@@ -1023,10 +1023,11 @@ cpu_hatch(void *v)
 
 		identifycpu(ci);
 
-		/* Signal we're done */
-		atomic_clearbits_int(&ci->ci_flags, CPUF_IDENTIFY);
 		/* Prevent identifycpu() from running again */
 		atomic_setbits_int(&ci->ci_flags, CPUF_IDENTIFIED);
+
+		/* Signal we're done */
+		atomic_clearbits_int(&ci->ci_flags, CPUF_IDENTIFY);
 	}
 
 	/* These have to run after identifycpu() */
diff --git a/sys/conf/files b/sys/conf/files
index 2a05c7cd0..57a6f6a9b 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -1,4 +1,4 @@
-#	$OpenBSD: files,v 1.725 2023/08/07 01:59:38 dlg Exp $
+#	$OpenBSD: files,v 1.726 2023/11/21 14:00:13 bluhm Exp $
 #	$NetBSD: files,v 1.87 1996/05/19 17:17:50 jonathan Exp $
 
 #	@(#)files.newconf	7.5 (Berkeley) 5/10/93
@@ -752,7 +752,7 @@ file kern/subr_xxx.c
 file kern/sys_futex.c
 file kern/sys_generic.c
 file kern/sys_pipe.c
-file kern/sys_process.c			ptrace
+file kern/sys_process.c			ptrace | dt
 file kern/sys_socket.c
 file kern/syscalls.c			syscall_debug
 file kern/sysv_ipc.c			sysvshm | sysvsem | sysvmsg
diff --git a/sys/dev/hid/hidkbd.c b/sys/dev/hid/hidkbd.c
index ef57b4f16..5f14fa576 100644
--- a/sys/dev/hid/hidkbd.c
+++ b/sys/dev/hid/hidkbd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hidkbd.c,v 1.9 2023/07/09 08:02:13 tobhe Exp $	*/
+/*	$OpenBSD: hidkbd.c,v 1.10 2023/11/22 18:19:25 tobhe Exp $	*/
 /*      $NetBSD: ukbd.c,v 1.85 2003/03/11 16:44:00 augustss Exp $        */
 
 /*
@@ -143,6 +143,9 @@ static const struct hidkbd_translation apple_fn_trans[] = {
 	{ 60, 127 },	/* F3 -> audio mute */
 	{ 61, 129 },	/* F4 -> audio lower */
 	{ 62, 128 },	/* F5 -> audio raise */
+	{ 65, 234 },	/* F8 -> backlight toggle */
+	{ 66, 236 },	/* F9 -> backlight lower */
+	{ 67, 235 },	/* F10 -> backlight raise */
 #else
 	{ 63, 102 },	/* F6 -> sleep */
 	{ 67, 127 },	/* F10 -> audio mute */
@@ -569,6 +572,9 @@ hidkbd_decode(struct hidkbd *kbd, struct hidkbd_data *ud)
 			case 129:
 			case 232:
 			case 233:
+			case 234:
+			case 235:
+			case 236:
 				wskbd_input(kbd->sc_wskbddev,
 				    key & RELEASE ?  WSCONS_EVENT_KEY_UP :
 				      WSCONS_EVENT_KEY_DOWN, key & CODEMASK);
diff --git a/sys/dev/usb/makemap.awk b/sys/dev/usb/makemap.awk
index 547f19bfa..e749fa490 100644
--- a/sys/dev/usb/makemap.awk
+++ b/sys/dev/usb/makemap.awk
@@ -1,5 +1,5 @@
 #! /usr/bin/awk -f
-#	$OpenBSD: makemap.awk,v 1.16 2023/07/09 08:02:13 tobhe Exp $
+#	$OpenBSD: makemap.awk,v 1.17 2023/11/22 18:19:25 tobhe Exp $
 #
 # Copyright (c) 2005, Miodrag Vallat
 #
@@ -31,7 +31,7 @@
 #
 
 BEGIN {
-	rcsid = "$OpenBSD: makemap.awk,v 1.16 2023/07/09 08:02:13 tobhe Exp $"
+	rcsid = "$OpenBSD: makemap.awk,v 1.17 2023/11/22 18:19:25 tobhe Exp $"
 	ifdepth = 0
 	ignore = 0
 	declk = 0
@@ -343,6 +343,9 @@ $1 == "#define" || $1 == "#undef" {
 			lines[126] = "    KC(126),\tKS_Find,"
 			lines[232] = "    KC(232),\tKS_Cmd_BrightnessUp,"
 			lines[233] = "    KC(233),\tKS_Cmd_BrightnessDown,"
+			lines[234] = "    KC(234),\tKS_Cmd_KbdBacklightToggle,"
+			lines[235] = "    KC(235),\tKS_Cmd_KbdBacklightUp,"
+			lines[236] = "    KC(236),\tKS_Cmd_KbdBacklightDown,"
 		}
 
 		for (i = 0; i < 256; i++)
diff --git a/sys/dev/usb/ukbdmap.c b/sys/dev/usb/ukbdmap.c
index e7e51f99e..f17f9a7f6 100644
--- a/sys/dev/usb/ukbdmap.c
+++ b/sys/dev/usb/ukbdmap.c
@@ -1,10 +1,10 @@
-/*	$OpenBSD: ukbdmap.c,v 1.48 2023/07/09 08:04:09 tobhe Exp $	*/
+/*	$OpenBSD: ukbdmap.c,v 1.49 2023/11/22 18:22:53 tobhe Exp $	*/
 
 /*
  * THIS FILE IS AUTOMAGICALLY GENERATED.  DO NOT EDIT.
  *
  * generated by:
- *	OpenBSD: makemap.awk,v 1.16 2023/07/09 08:02:13 tobhe Exp 
+ *	OpenBSD: makemap.awk,v 1.17 2023/11/22 18:19:25 tobhe Exp 
  * generated from:
  */
 /*	OpenBSD: wskbdmap_mfii.c,v 1.48 2023/01/23 09:36:40 nicm Exp  */
@@ -187,6 +187,9 @@ static const keysym_t ukbd_keydesc_us[] = {
     KC(231),	KS_Meta_R,
     KC(232),	KS_Cmd_BrightnessUp,
     KC(233),	KS_Cmd_BrightnessDown,
+    KC(234),	KS_Cmd_KbdBacklightToggle,
+    KC(235),	KS_Cmd_KbdBacklightUp,
+    KC(236),	KS_Cmd_KbdBacklightDown,
 };
 
 #if !defined(WSKBD_NO_INTL_LAYOUTS)
diff --git a/sys/dev/wscons/wskbd.c b/sys/dev/wscons/wskbd.c
index 23a0744b0..cf9ac177e 100644
--- a/sys/dev/wscons/wskbd.c
+++ b/sys/dev/wscons/wskbd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: wskbd.c,v 1.115 2023/07/09 08:02:14 tobhe Exp $ */
+/* $OpenBSD: wskbd.c,v 1.116 2023/11/22 18:19:25 tobhe Exp $ */
 /* $NetBSD: wskbd.c,v 1.80 2005/05/04 01:52:16 augustss Exp $ */
 
 /*
@@ -177,12 +177,21 @@ struct wskbd_softc {
 #if NAUDIO > 0
 	void	*sc_audiocookie;
 #endif
+	struct task sc_kbd_backlight_task;
+	u_int	sc_kbd_backlight_cmd;
 #if NWSDISPLAY > 0
 	struct task sc_brightness_task;
 	int	sc_brightness_steps;
 #endif
 };
 
+enum wskbd_kbd_backlight_cmds {
+	KBD_BACKLIGHT_NONE,
+	KBD_BACKLIGHT_UP,
+	KBD_BACKLIGHT_DOWN,
+	KBD_BACKLIGHT_TOGGLE,
+};
+
 #define MOD_SHIFT_L		(1 << 0)
 #define MOD_SHIFT_R		(1 << 1)
 #define MOD_SHIFTLOCK		(1 << 2)
@@ -249,6 +258,8 @@ void	wskbd_set_keymap(struct wskbd_softc *, struct wscons_keymap *, int);
 
 int	(*wskbd_get_backlight)(struct wskbd_backlight *);
 int	(*wskbd_set_backlight)(struct wskbd_backlight *);
+
+void	wskbd_kbd_backlight_task(void *);
 #if NWSDISPLAY > 0
 void	wskbd_brightness_task(void *);
 #endif
@@ -406,6 +417,7 @@ wskbd_attach(struct device *parent, struct device *self, void *aux)
 		bcopy(ap->keymap, &sc->id->t_keymap, sizeof(sc->id->t_keymap));
 	}
 
+	task_set(&sc->sc_kbd_backlight_task, wskbd_kbd_backlight_task, sc);
 #if NWSDISPLAY > 0
 	timeout_set(&sc->sc_repeat_ch, wskbd_repeat, sc);
 	task_set(&sc->sc_brightness_task, wskbd_brightness_task, sc);
@@ -1544,6 +1556,21 @@ internal_command(struct wskbd_softc *sc, u_int *type, keysym_t ksym,
 #endif
 #endif
 
+	switch (ksym) {
+	case KS_Cmd_KbdBacklightUp:
+		atomic_store_int(&sc->sc_kbd_backlight_cmd, KBD_BACKLIGHT_UP);
+		task_add(systq, &sc->sc_kbd_backlight_task);
+		return (1);
+	case KS_Cmd_KbdBacklightDown:
+		atomic_store_int(&sc->sc_kbd_backlight_cmd, KBD_BACKLIGHT_DOWN);
+		task_add(systq, &sc->sc_kbd_backlight_task);
+		return (1);
+	case KS_Cmd_KbdBacklightToggle:
+		atomic_store_int(&sc->sc_kbd_backlight_cmd, KBD_BACKLIGHT_TOGGLE);
+		task_add(systq, &sc->sc_kbd_backlight_task);
+		return (1);
+	}
+
 #if NWSDISPLAY > 0
 	switch(ksym) {
 	case KS_Cmd_BrightnessUp:
@@ -1899,6 +1926,32 @@ wskbd_set_keymap(struct wskbd_softc *sc, struct wscons_keymap *map, int maplen)
 	sc->sc_maplen = maplen;
 }
 
+void
+wskbd_kbd_backlight_task(void *arg)
+{
+	struct wskbd_softc *sc = arg;
+	struct wskbd_backlight data;
+	int step, val;
+	u_int cmd;
+
+	if (wskbd_get_backlight == NULL || wskbd_set_backlight == NULL)
+		return;
+
+	cmd  = atomic_swap_uint(&sc->sc_kbd_backlight_cmd, 0);
+	if (cmd != KBD_BACKLIGHT_UP &&
+	    cmd != KBD_BACKLIGHT_DOWN &&
+	    cmd != KBD_BACKLIGHT_TOGGLE)
+		return;
+
+	(*wskbd_get_backlight)(&data);
+	step = (data.max - data.min + 1) / 8;
+	val = (cmd == KBD_BACKLIGHT_UP) ?  data.curval + step :
+	    (cmd == KBD_BACKLIGHT_DOWN) ?  data.curval - step :
+	    (data.curval) ?  0 : (data.max - data.min + 1) / 2;
+	data.curval = (val > 0xff) ?  0xff : (val < 0) ? 0 : val;
+	(*wskbd_set_backlight)(&data);
+}
+
 #if NWSDISPLAY > 0
 void
 wskbd_brightness_task(void *arg)
diff --git a/sys/dev/wscons/wsksymdef.h b/sys/dev/wscons/wsksymdef.h
index 69cc685d9..759f805c5 100644
--- a/sys/dev/wscons/wsksymdef.h
+++ b/sys/dev/wscons/wsksymdef.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: wsksymdef.h,v 1.41 2023/07/09 08:02:14 tobhe Exp $	*/
+/*	$OpenBSD: wsksymdef.h,v 1.42 2023/11/22 18:19:25 tobhe Exp $	*/
 /*	$NetBSD: wsksymdef.h,v 1.34.4.1 2000/07/07 09:49:54 hannken Exp $ */
 
 /*-
@@ -668,6 +668,9 @@
 #define KS_Cmd_ScrollFwd	0xf42d
 #define KS_Cmd_KbdReset		0xf42e
 #define KS_Cmd_Sleep		0xf42f
+#define KS_Cmd_KbdBacklightToggle		0xf430
+#define KS_Cmd_KbdBacklightUp		0xf431
+#define KS_Cmd_KbdBacklightDown		0xf432
 
 /*
  * Group 5 (internal)
diff --git a/sys/kern/sys_process.c b/sys/kern/sys_process.c
index 8e7566092..bb44ccfb3 100644
--- a/sys/kern/sys_process.c
+++ b/sys/kern/sys_process.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sys_process.c,v 1.94 2023/06/10 19:30:48 kettenis Exp $	*/
+/*	$OpenBSD: sys_process.c,v 1.95 2023/11/21 14:00:13 bluhm Exp $	*/
 /*	$NetBSD: sys_process.c,v 1.55 1996/05/15 06:17:47 tls Exp $	*/
 
 /*-
@@ -818,6 +818,7 @@ process_checktracestate(struct process *curpr, struct process *tr,
 	return 0;
 }
 
+#endif /* PTRACE */
 
 /*
  * Check if a process is allowed to fiddle with the memory of another.
@@ -886,4 +887,3 @@ process_domem(struct proc *curp, struct process *tr, struct uio *uio, int req)
 
 	return error;
 }
-#endif
diff --git a/usr.bin/awk/FIXES b/usr.bin/awk/FIXES
index a13ca50cc..5d2b45959 100644
--- a/usr.bin/awk/FIXES
+++ b/usr.bin/awk/FIXES
@@ -25,6 +25,18 @@ THIS SOFTWARE.
 This file lists all bug fixes, changes, etc., made since the 
 second edition of the AWK book was published in September 2023.
 
+Nov 20, 2023
+	rewrite of fnematch to fix a number of issues, including
+	extraneous output, out-of-bounds access, number of bytes
+	to push back after a failed match etc.
+	thanks to Miguel Pineiro Jr.
+
+Nov 15, 2023
+	Man page edit, regression test fixes. thanks to Arnold Robbins
+	consolidation of sub and gsub into dosub, removing duplicate
+	code. thanks to Miguel Pineiro Jr.
+	gcc replaced with cc everywhere.
+
 Oct 30, 2023:
 	multiple fixes and a minor code cleanup.
 	disabled utf-8 for non-multibyte locales, such as C or POSIX.
diff --git a/usr.bin/awk/b.c b/usr.bin/awk/b.c
index 543fbf798..09548d7e5 100644
--- a/usr.bin/awk/b.c
+++ b/usr.bin/awk/b.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: b.c,v 1.47 2023/11/15 18:56:53 millert Exp $	*/
+/*	$OpenBSD: b.c,v 1.48 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -770,59 +770,6 @@ int nematch(fa *f, const char *p0)	/* non-empty match, for sub */
 
 #define MAX_UTF_BYTES	4	// UTF-8 is up to 4 bytes long
 
-// Read one rune at a time from the given FILE*. Return both
-// the bytes and the actual rune.
-
-struct runedata {
-	int rune;
-	size_t len;
-	char bytes[6];
-};
-
-struct runedata getrune(FILE *fp)
-{
-	struct runedata result;
-	int c, i, next;
-
-	memset(&result, 0, sizeof(result));
-
-	c = getc(fp);
-	if (c == EOF)
-		return result;	// result.rune == 0 --> EOF
-	else if (c < 128 || awk_mb_cur_max == 1) {
-		result.bytes[0] = c;
-		result.len = 1;
-		result.rune = c;
-
-		return result;
-	}
-
-	// need to get bytes and fill things in
-	result.bytes[0] = c;
-	result.len = 1;
-
-	next = 1;
-	for (i = 1; i < MAX_UTF_BYTES; i++) {
-		c = getc(fp);
-		if (c == EOF)
-			break;
-		result.bytes[next++] = c;
-		result.len++;
-	}
-
-	// put back any extra input bytes
-	int actual_len = u8_nextlen(result.bytes);
-	while (result.len > actual_len) {
-		ungetc(result.bytes[--result.len], fp);
-	}
-
-	result.bytes[result.len] = '\0';
-	(void) u8_rune(& result.rune, (uschar *) result.bytes);
-
-	return result;
-}
-
-
 /*
  * NAME
  *     fnematch
@@ -840,60 +787,76 @@ struct runedata getrune(FILE *fp)
 
 bool fnematch(fa *pfa, FILE *f, char **pbuf, int *pbufsize, int quantum)
 {
-	char *buf = *pbuf;
+	char *i, *j, *k, *buf = *pbuf;
 	int bufsize = *pbufsize;
-	int i, j, k, ns, s;
-	struct runedata r;
+	int c, n, ns, s;
 
 	s = pfa->initstat;
 	patlen = 0;
 
 	/*
-	 * All indices relative to buf.
-	 * i <= j <= k <= bufsize
+	 * buf <= i <= j <= k <= buf+bufsize
 	 *
-	 * i: origin of active substring (first byte of first character)
-	 * j: current character		(last byte of current character)
-	 * k: destination of next getc()
+	 * i: origin of active substring
+	 * j: current character
+	 * k: destination of the next getc
 	 */
-	i = -1, k = 0;
-        do {
-		j = i++;
-		do {
-			r = getrune(f);
-			if (r.len == 0) {
-				r.len = 1;	// store NUL byte for EOF
-			}
-			j += r.len;
-			if (j >= bufsize) {
-				if (!adjbuf(&buf, &bufsize, j+1, quantum, 0, "fnematch"))
-					FATAL("stream '%.30s...' too long", buf);
-			}
-			memcpy(buf + k, r.bytes, r.len);
-			k += r.len;
 
-			if ((ns = get_gototab(pfa, s, r.rune)) != 0)
-				s = ns;
-			else
-				s = cgoto(pfa, s, r.rune);
+	i = j = k = buf;
 
-			if (pfa->out[s]) {	/* final state */
-				patlen = j - i + 1;
-				if (r.rune == 0)	/* don't count $ */
-					patlen--;
+	do {
+		/*
+		 * Call u8_rune with at least MAX_UTF_BYTES ahead in
+		 * the buffer until EOF interferes.
+		 */
+		if (k - j < MAX_UTF_BYTES) {
+			if (k + MAX_UTF_BYTES > buf + bufsize) {
+				adjbuf(&buf, &bufsize,
+				    bufsize + MAX_UTF_BYTES,
+				    quantum, 0, "fnematch");
 			}
-		} while (buf[j] && s != 1);
+			for (n = MAX_UTF_BYTES ; n > 0; n--) {
+				*k++ = (c = getc(f)) != EOF ? c : 0;
+				if (c == EOF) {
+					if (ferror(f))
+						FATAL("fnematch: getc error");
+					break;
+				}
+			}
+		}
+
+		j += u8_rune(&c, (uschar *)j);
+
+		if ((ns = get_gototab(pfa, s, c)) != 0)
+			s = ns;
+		else
+			s = cgoto(pfa, s, c);
+
+		if (pfa->out[s]) {	/* final state */
+			patbeg = i;
+			patlen = j - i;
+			if (c == 0)	/* don't count $ */
+				patlen--;
+		}
+
+		if (c && s != 1)
+			continue;  /* origin i still viable, next j */
+		if (patlen)
+			break;     /* best match found */
+
+		/* no match at origin i, next i and start over */
+		i += u8_rune(&c, (uschar *)i);
+		if (c == 0)
+			break;    /* no match */
+		j = i;
 		s = 2;
-		if (r.len > 1)
-			i += r.len - 1;	// i incremented around the loop
-	} while (buf[i] && !patlen);
+	} while (1);
 
 	/* adjbuf() may have relocated a resized buffer. Inform the world. */
 	*pbuf = buf;
 	*pbufsize = bufsize;
 
 	if (patlen) {
-		patbeg = buf + i;
 		/*
 		 * Under no circumstances is the last character fed to
 		 * the automaton part of the match. It is EOF's nullbyte,
@@ -905,10 +868,11 @@ bool fnematch(fa *pfa, FILE *f, char **pbuf, int *pbufsize, int quantum)
 		 * (except for EOF's nullbyte, if present) and null
 		 * terminate the buffer.
 		 */
-		for (; r.len > 0; r.len--)
-			if (buf[--k] && ungetc(buf[k], f) == EOF)
-				FATAL("unable to ungetc '%c'", buf[k]);
-		buf[k-patlen] = '\0';
+		do
+			if (*--k && ungetc(*k, f) == EOF)
+				FATAL("unable to ungetc '%c'", *k);
+		while (k > patbeg + patlen);
+		*k = '\0';
 		return true;
 	}
 	else
diff --git a/usr.bin/awk/main.c b/usr.bin/awk/main.c
index d5acca836..ddec8e820 100644
--- a/usr.bin/awk/main.c
+++ b/usr.bin/awk/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.64 2023/10/31 01:08:51 millert Exp $	*/
+/*	$OpenBSD: main.c,v 1.65 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -23,7 +23,7 @@ ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
 THIS SOFTWARE.
 ****************************************************************/
 
-const char	*version = "version 20231030";
+const char	*version = "version 20231120";
 
 #define DEBUG
 #include <stdio.h>
diff --git a/usr.bin/awk/maketab.c b/usr.bin/awk/maketab.c
index 2c4adf72c..4f2756b4b 100644
--- a/usr.bin/awk/maketab.c
+++ b/usr.bin/awk/maketab.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: maketab.c,v 1.21 2023/10/30 17:52:54 millert Exp $	*/
+/*	$OpenBSD: maketab.c,v 1.22 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -53,8 +53,8 @@ struct xx
 	{ ARRAY, "array", NULL },
 	{ INDIRECT, "indirect", "$(" },
 	{ SUBSTR, "substr", "substr" },
-	{ SUB, "sub", "sub" },
-	{ GSUB, "gsub", "gsub" },
+	{ SUB, "dosub", "sub" },
+	{ GSUB, "dosub", "gsub" },
 	{ INDEX, "sindex", "sindex" },
 	{ SPRINTF, "awksprintf", "sprintf " },
 	{ ADD, "arith", " + " },
diff --git a/usr.bin/awk/proto.h b/usr.bin/awk/proto.h
index 7d9aa3c24..4c2fafd08 100644
--- a/usr.bin/awk/proto.h
+++ b/usr.bin/awk/proto.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proto.h,v 1.22 2023/09/17 14:49:44 millert Exp $	*/
+/*	$OpenBSD: proto.h,v 1.23 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -199,8 +199,7 @@ extern	FILE	*openfile(int, const char *, bool *);
 extern	const char	*filename(FILE *);
 extern	Cell	*closefile(Node **, int);
 extern	void	closeall(void);
-extern	Cell	*sub(Node **, int);
-extern	Cell	*gsub(Node **, int);
+extern	Cell	*dosub(Node **, int);
 extern	Cell	*gensub(Node **, int);
 
 extern	FILE	*popen(const char *, const char *);
diff --git a/usr.bin/awk/run.c b/usr.bin/awk/run.c
index bf81763de..e240a9da9 100644
--- a/usr.bin/awk/run.c
+++ b/usr.bin/awk/run.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: run.c,v 1.80 2023/10/28 22:38:22 millert Exp $	*/
+/*	$OpenBSD: run.c,v 1.81 2023/11/22 01:01:21 millert Exp $	*/
 /****************************************************************
 Copyright (C) Lucent Technologies 1997
 All Rights Reserved
@@ -2518,169 +2518,143 @@ static void flush_all(void)
 
 void backsub(char **pb_ptr, const char **sptr_ptr);
 
-Cell *sub(Node **a, int nnn)	/* substitute command */
+Cell *dosub(Node **a, int subop)        /* sub and gsub */
 {
-	const char *sptr, *q;
-	Cell *x, *y, *result;
-	char *t, *buf, *pb;
 	fa *pfa;
+	int tempstat;
+	char *repl;
+	Cell *x;
+
+	char *buf = NULL;
+	char *pb = NULL;
 	int bufsz = recsize;
 
-	if ((buf = (char *) malloc(bufsz)) == NULL)
-		FATAL("out of memory in sub");
-	x = execute(a[3]);	/* target string */
-	t = getsval(x);
-	if (a[0] == NULL)	/* 0 => a[1] is already-compiled regexpr */
-		pfa = (fa *) a[1];	/* regular expression */
-	else {
-		y = execute(a[1]);
-		pfa = makedfa(getsval(y), 1);
-		tempfree(y);
-	}
-	y = execute(a[2]);	/* replacement string */
-	result = False;
-	if (pmatch(pfa, t)) {
-		sptr = t;
-		adjbuf(&buf, &bufsz, 1+patbeg-sptr, recsize, 0, "sub");
-		pb = buf;
-		while (sptr < patbeg)
-			*pb++ = *sptr++;
-		sptr = getsval(y);
-		while (*sptr != '\0') {
-			adjbuf(&buf, &bufsz, 5+pb-buf, recsize, &pb, "sub");
-			if (*sptr == '\\') {
-				backsub(&pb, &sptr);
-			} else if (*sptr == '&') {
-				sptr++;
-				adjbuf(&buf, &bufsz, 1+patlen+pb-buf, recsize, &pb, "sub");
-				for (q = patbeg; q < patbeg+patlen; )
-					*pb++ = *q++;
-			} else
-				*pb++ = *sptr++;
-		}
-		*pb = '\0';
-		if (pb > buf + bufsz)
-			FATAL("sub result1 %.30s too big; can't happen", buf);
-		sptr = patbeg + patlen;
-		if ((patlen == 0 && *patbeg) || (patlen && *(sptr-1))) {
-			adjbuf(&buf, &bufsz, 1+strlen(sptr)+pb-buf, 0, &pb, "sub");
-			while ((*pb++ = *sptr++) != '\0')
-				continue;
-		}
-		if (pb > buf + bufsz)
-			FATAL("sub result2 %.30s too big; can't happen", buf);
-		setsval(x, buf);	/* BUG: should be able to avoid copy */
-		result = True;
+	const char *r, *s;
+	const char *start;
+	const char *noempty = NULL;      /* empty match disallowed here */
+	size_t m = 0;                    /* match count */
+	size_t whichm;                   /* which match to select, 0 = global */
+	int mtype;                       /* match type */
+
+	if (a[0] == NULL) {	/* 0 => a[1] is already-compiled regexpr */
+		pfa = (fa *) a[1];
+	} else {
+		x = execute(a[1]);
+		pfa = makedfa(getsval(x), 1);
+		tempfree(x);
 	}
+
+	x = execute(a[2]);	/* replacement string */
+	repl = tostring(getsval(x));
 	tempfree(x);
-	tempfree(y);
-	free(buf);
-	return result;
-}
 
-Cell *gsub(Node **a, int nnn)	/* global substitute */
-{
-	Cell *x, *y;
-	char *rptr, *pb;
-	const char *q, *t, *sptr;
-	char *buf;
-	fa *pfa;
-	int mflag, tempstat, num;
-	int bufsz = recsize;
-	int charlen = 0;
-
-	if ((buf = (char *) malloc(bufsz)) == NULL)
-		FATAL("out of memory in gsub");
-	mflag = 0;	/* if mflag == 0, can replace empty string */
-	num = 0;
-	x = execute(a[3]);	/* target string */
-	t = getsval(x);
-	if (a[0] == NULL)	/* 0 => a[1] is already-compiled regexpr */
-		pfa = (fa *) a[1];	/* regular expression */
-	else {
-		y = execute(a[1]);
-		pfa = makedfa(getsval(y), 1);
-		tempfree(y);
+	switch (subop) {
+	case SUB:
+		whichm = 1;
+		x = execute(a[3]);    /* source string */
+		break;
+	case GSUB:
+		whichm = 0;
+		x = execute(a[3]);    /* source string */
+		break;
+	default:
+		FATAL("dosub: unrecognized subop: %d", subop);
 	}
-	y = execute(a[2]);	/* replacement string */
-	if (pmatch(pfa, t)) {
-		tempstat = pfa->initstat;
-		pfa->initstat = 2;
-		pb = buf;
-		rptr = getsval(y);
-		do {
-			if (patlen == 0 && *patbeg != '\0') {	/* matched empty string */
-				if (mflag == 0) {	/* can replace empty */
-					num++;
-					sptr = rptr;
-					while (*sptr != '\0') {
-						adjbuf(&buf, &bufsz, 5+pb-buf, recsize, &pb, "gsub");
-						if (*sptr == '\\') {
-							backsub(&pb, &sptr);
-						} else if (*sptr == '&') {
-							sptr++;
-							adjbuf(&buf, &bufsz, 1+patlen+pb-buf, recsize, &pb, "gsub");
-							for (q = patbeg; q < patbeg+patlen; )
-								*pb++ = *q++;
-						} else
-							*pb++ = *sptr++;
-					}
-				}
-				if (*t == '\0')	/* at end */
-					goto done;
-				adjbuf(&buf, &bufsz, 2+pb-buf, recsize, &pb, "gsub");
-				charlen = u8_nextlen(t);
-				while (charlen-- > 0)
-					*pb++ = *t++;
-				if (pb > buf + bufsz)	/* BUG: not sure of this test */
-					FATAL("gsub result0 %.30s too big; can't happen", buf);
-				mflag = 0;
+
+	start = getsval(x);
+	while (pmatch(pfa, start)) {
+		if (buf == NULL) {
+			if ((pb = buf = malloc(bufsz)) == NULL)
+				FATAL("out of memory in dosub");
+			tempstat = pfa->initstat;
+			pfa->initstat = 2;
+		}
+
+		/* match types */
+		#define	MT_IGNORE  0  /* unselected or invalid */
+		#define MT_INSERT  1  /* selected, empty */
+		#define MT_REPLACE 2  /* selected, not empty */
+
+		/* an empty match just after replacement is invalid */
+
+		if (patbeg == noempty && patlen == 0) {
+			mtype = MT_IGNORE;    /* invalid, not counted */
+		} else if (whichm == ++m || whichm == 0) {
+			mtype = patlen ? MT_REPLACE : MT_INSERT;
+		} else {
+			mtype = MT_IGNORE;    /* unselected, but counted */
+		}
+
+		/* leading text: */
+		if (patbeg > start) {
+			adjbuf(&buf, &bufsz, (pb - buf) + (patbeg - start),
+				recsize, &pb, "dosub");
+			s = start;
+			while (s < patbeg)
+				*pb++ = *s++;
+		}
+
+		if (mtype == MT_IGNORE)
+			goto matching_text;  /* skip replacement text */
+
+		r = repl;
+		while (*r != 0) {
+			adjbuf(&buf, &bufsz, 5+pb-buf, recsize, &pb, "dosub");
+			if (*r == '\\') {
+				backsub(&pb, &r);
+			} else if (*r == '&') {
+				r++;
+				adjbuf(&buf, &bufsz, 1+patlen+pb-buf, recsize,
+					&pb, "dosub");
+				for (s = patbeg; s < patbeg+patlen; )
+					*pb++ = *s++;
+			} else {
+				*pb++ = *r++;
 			}
-			else {	/* matched nonempty string */
-				num++;
-				sptr = t;
-				adjbuf(&buf, &bufsz, 1+(patbeg-sptr)+pb-buf, recsize, &pb, "gsub");
-				while (sptr < patbeg)
-					*pb++ = *sptr++;
-				sptr = rptr;
-				while (*sptr != '\0') {
-					adjbuf(&buf, &bufsz, 5+pb-buf, recsize, &pb, "gsub");
-					if (*sptr == '\\') {
-						backsub(&pb, &sptr);
-					} else if (*sptr == '&') {
-						sptr++;
-						adjbuf(&buf, &bufsz, 1+patlen+pb-buf, recsize, &pb, "gsub");
-						for (q = patbeg; q < patbeg+patlen; )
-							*pb++ = *q++;
-					} else
-						*pb++ = *sptr++;
-				}
-				t = patbeg + patlen;
-				if (patlen == 0 || *t == '\0' || *(t-1) == '\0')
-					goto done;
-				if (pb > buf + bufsz)
-					FATAL("gsub result1 %.30s too big; can't happen", buf);
-				mflag = 1;
-			}
-		} while (pmatch(pfa,t));
-		sptr = t;
-		adjbuf(&buf, &bufsz, 1+strlen(sptr)+pb-buf, 0, &pb, "gsub");
-		while ((*pb++ = *sptr++) != '\0')
-			continue;
-	done:	if (pb < buf + bufsz)
-			*pb = '\0';
-		else if (*(pb-1) != '\0')
-			FATAL("gsub result2 %.30s truncated; can't happen", buf);
-		setsval(x, buf);	/* BUG: should be able to avoid copy + free */
+		}
+
+matching_text:
+		if (mtype == MT_REPLACE || *patbeg == '\0')
+			goto next_search;  /* skip matching text */
+		
+		if (patlen == 0)
+			patlen = u8_nextlen(patbeg);
+		adjbuf(&buf, &bufsz, (pb-buf) + patlen, recsize, &pb, "dosub");
+		s = patbeg;
+		while (s < patbeg + patlen)
+			*pb++ = *s++;
+
+next_search:
+		start = patbeg + patlen;
+		if (m == whichm || *patbeg == '\0')
+			break;
+		if (mtype == MT_REPLACE)
+			noempty = start;
+
+		#undef MT_IGNORE
+		#undef MT_INSERT
+		#undef MT_REPLACE
+	}
+
+	xfree(repl);
+
+	if (buf != NULL) {
 		pfa->initstat = tempstat;
+
+		/* trailing text */
+		adjbuf(&buf, &bufsz, 1+strlen(start)+pb-buf, 0, &pb, "dosub");
+		while ((*pb++ = *start++) != '\0')
+			;
+
+		setsval(x, buf);
+		free(buf);
 	}
+
 	tempfree(x);
-	tempfree(y);
 	x = gettemp();
 	x->tval = NUM;
-	x->fval = num;
-	free(buf);
-	return(x);
+	x->fval = m;
+	return x;
 }
 
 Cell *gensub(Node **a, int nnn)	/* global selective substitute */
diff --git a/usr.bin/ftp/main.c b/usr.bin/ftp/main.c
index 2d6265bd1..75d184e41 100644
--- a/usr.bin/ftp/main.c
+++ b/usr.bin/ftp/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.139 2023/11/09 18:18:59 kn Exp $	*/
+/*	$OpenBSD: main.c,v 1.141 2023/11/22 02:20:54 kn Exp $	*/
 /*	$NetBSD: main.c,v 1.24 1997/08/18 10:20:26 lukem Exp $	*/
 
 /*
@@ -618,7 +618,7 @@ main(volatile int argc, char *argv[])
 			if (pipeout) {
 #ifndef SMALL
 			    if (!resume) {
-				if (pledge("stdio rpath dns tty inet proc exec fattr",
+				if (pledge("stdio rpath dns tty inet fattr",
 				    NULL) == -1)
 					err(1, "pledge");
 			    } else
@@ -640,7 +640,7 @@ main(volatile int argc, char *argv[])
 			}
 
 			rval = auto_fetch(argc, argv, outfile);
-			if (rval >= 0)		/* -1 == connected and cd-ed */
+			if (rval >= 0 || pipeout) /* -1 == connected and cd-ed */
 				exit(rval);
 		} else {
 #ifndef SMALL
diff --git a/usr.bin/openssl/apps.c b/usr.bin/openssl/apps.c
index 70857e042..6ffbe6f0c 100644
--- a/usr.bin/openssl/apps.c
+++ b/usr.bin/openssl/apps.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: apps.c,v 1.66 2023/07/23 11:39:29 tb Exp $ */
+/* $OpenBSD: apps.c,v 1.67 2023/11/21 17:56:19 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -1716,7 +1716,7 @@ args_verify(char ***pargs, int *pargc, int *badarg, BIO *err,
 		}
 		(*pargs)++;
 	} else if (strcmp(arg, "-purpose") == 0) {
-		X509_PURPOSE *xptmp;
+		const X509_PURPOSE *xptmp;
 		if (!argn)
 			*badarg = 1;
 		else {
diff --git a/usr.bin/openssl/cms.c b/usr.bin/openssl/cms.c
index 121a413a2..b94e14675 100644
--- a/usr.bin/openssl/cms.c
+++ b/usr.bin/openssl/cms.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cms.c,v 1.34 2023/04/14 15:27:13 tb Exp $ */
+/* $OpenBSD: cms.c,v 1.35 2023/11/21 17:56:19 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -1140,7 +1140,7 @@ cms_usage(void)
 
 	fprintf(stderr, "\nValid purposes:\n\n");
 	for (i = 0; i < X509_PURPOSE_get_count(); i++) {
-		X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
+		const X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
 		fprintf(stderr, "  %-18s%s\n", X509_PURPOSE_get0_sname(ptmp),
 		    X509_PURPOSE_get0_name(ptmp));
 	}
diff --git a/usr.bin/openssl/verify.c b/usr.bin/openssl/verify.c
index b4e0f33f6..a87d5d47d 100644
--- a/usr.bin/openssl/verify.c
+++ b/usr.bin/openssl/verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: verify.c,v 1.17 2023/04/14 15:27:13 tb Exp $ */
+/* $OpenBSD: verify.c,v 1.18 2023/11/21 17:56:19 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -251,7 +251,7 @@ verify_usage(void)
 
 	fprintf(stderr, "\nValid purposes:\n\n");
 	for (i = 0; i < X509_PURPOSE_get_count(); i++) {
-		X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
+		const X509_PURPOSE *ptmp = X509_PURPOSE_get0(i);
 		fprintf(stderr, "  %-18s%s\n", X509_PURPOSE_get0_sname(ptmp),
 		    X509_PURPOSE_get0_name(ptmp));
 	}
diff --git a/usr.bin/openssl/x509.c b/usr.bin/openssl/x509.c
index 8e8a9f2dc..7f60110c4 100644
--- a/usr.bin/openssl/x509.c
+++ b/usr.bin/openssl/x509.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509.c,v 1.34 2023/11/13 11:50:36 tb Exp $ */
+/* $OpenBSD: x509.c,v 1.35 2023/11/21 17:56:19 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -86,7 +86,7 @@ static int x509_certify(X509_STORE *ctx, char *CAfile, const EVP_MD *digest,
     X509 *x, X509 *xca, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *sigopts,
     char *serial, int create, int days, int clrext, CONF *conf, char *section,
     ASN1_INTEGER *sno);
-static int purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt);
+static int purpose_print(BIO *bio, X509 *cert, const X509_PURPOSE *pt);
 
 static struct {
 	char *alias;
@@ -1022,7 +1022,7 @@ x509_main(int argc, char **argv)
 			}
 #endif
 			else if (cfg.pprint == i) {
-				X509_PURPOSE *ptmp;
+				const X509_PURPOSE *ptmp;
 				int j;
 
 				BIO_printf(STDout, "Certificate purposes:\n");
@@ -1534,10 +1534,10 @@ sign(X509 *x, EVP_PKEY *pkey, int days, int clrext, const EVP_MD *digest,
 }
 
 static int
-purpose_print(BIO *bio, X509 *cert, X509_PURPOSE *pt)
+purpose_print(BIO *bio, X509 *cert, const X509_PURPOSE *pt)
 {
 	int id, i, idret;
-	char *pname;
+	const char *pname;
 
 	id = X509_PURPOSE_get_id(pt);
 	pname = X509_PURPOSE_get0_name(pt);
diff --git a/usr.sbin/dhcpd/dhcp-options.5 b/usr.sbin/dhcpd/dhcp-options.5
index 25b168fdb..80e9fe258 100644
--- a/usr.sbin/dhcpd/dhcp-options.5
+++ b/usr.sbin/dhcpd/dhcp-options.5
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: dhcp-options.5,v 1.32 2022/03/31 17:27:29 naddy Exp $
+.\"	$OpenBSD: dhcp-options.5,v 1.33 2023/11/22 18:06:44 florian Exp $
 .\"
 .\" Copyright (c) 1995, 1996, 1997, 1998 The Internet Software Consortium.
 .\" All rights reserved.
@@ -36,7 +36,7 @@
 .\" see ``http://www.isc.org/isc''.  To learn more about Vixie
 .\" Enterprises, see ``http://www.vix.com''.
 .\"
-.Dd $Mdocdate: March 31 2022 $
+.Dd $Mdocdate: November 22 2023 $
 .Dt DHCP-OPTIONS 5
 .Os
 .Sh NAME
@@ -346,6 +346,10 @@ This option specifies whether the client should configure its IP layer
 for packet forwarding.
 A value of 0 means disable IP forwarding, and a value of 1 means enable
 IP forwarding.
+.It Ic option ipv6-only-preferred Ar uint32 ;
+This option specifies that a NAT64 is available and the pool is IPv6-mostly
+capable.
+This option is specified in RFC 8925.
 .It Ic option irc-server Ar ip-address Oo , Ar ip-address ... Oc ;
 The
 .Ic irc-server
diff --git a/usr.sbin/dhcpd/tables.c b/usr.sbin/dhcpd/tables.c
index 6735a332a..d9364cc7b 100644
--- a/usr.sbin/dhcpd/tables.c
+++ b/usr.sbin/dhcpd/tables.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tables.c,v 1.14 2019/05/08 22:00:55 krw Exp $	*/
+/*	$OpenBSD: tables.c,v 1.15 2023/11/22 18:06:44 florian Exp $	*/
 
 /* Tables of information... */
 
@@ -184,7 +184,7 @@ struct option dhcp_options[256] = {
 	{ "option-105", "X",				&dhcp_universe, 105 },
 	{ "option-106", "X",				&dhcp_universe, 106 },
 	{ "option-107", "X",				&dhcp_universe, 107 },
-	{ "option-108", "X",				&dhcp_universe, 108 },
+	{ "ipv6-only-preferred", "L",			&dhcp_universe, 108 },
 	{ "option-109", "X",				&dhcp_universe, 109 },
 	{ "option-110", "X",				&dhcp_universe, 110 },
 	{ "option-111", "X",				&dhcp_universe, 111 },
diff --git a/usr.sbin/pkg_add/OpenBSD/PackingElement.pm b/usr.sbin/pkg_add/OpenBSD/PackingElement.pm
index f7ec3292b..82bdd7e79 100644
--- a/usr.sbin/pkg_add/OpenBSD/PackingElement.pm
+++ b/usr.sbin/pkg_add/OpenBSD/PackingElement.pm
@@ -1,5 +1,5 @@
 # ex:ts=8 sw=4:
-# $OpenBSD: PackingElement.pm,v 1.289 2023/07/04 14:41:26 espie Exp $
+# $OpenBSD: PackingElement.pm,v 1.290 2023/11/22 11:18:37 espie Exp $
 #
 # Copyright (c) 2003-2014 Marc Espie <espie@openbsd.org>
 #
@@ -828,6 +828,8 @@ sub new($class, $args)
 		return OpenBSD::PackingElement::AlwaysUpdate->new_with_hash($1);
 	} elsif ($args eq 'always-update') {
 		return OpenBSD::PackingElement::AlwaysUpdate->new;
+	} elsif ($args eq 'updatedb') {
+		return OpenBSD::PackingElement::UpdateDB->new;
 	} elsif ($args eq 'is-branch') {
 		return OpenBSD::PackingElement::IsBranch->new;
 	} else {
@@ -867,6 +869,13 @@ package OpenBSD::PackingElement::Firmware;
 our @ISA=qw(OpenBSD::PackingElement::ManualInstallation);
 sub category($) { 'firmware' }
 
+package OpenBSD::PackingElement::UpdateDB;
+our @ISA=qw(OpenBSD::PackingElement::UniqueOption);
+sub category($)
+{
+	'updatedb';
+}
+
 package OpenBSD::PackingElement::AlwaysUpdate;
 our @ISA=qw(OpenBSD::PackingElement::UniqueOption);
 
diff --git a/usr.sbin/snmpd/parse.y b/usr.sbin/snmpd/parse.y
index da51d238b..849277557 100644
--- a/usr.sbin/snmpd/parse.y
+++ b/usr.sbin/snmpd/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.82 2023/11/12 20:04:35 martijn Exp $	*/
+/*	$OpenBSD: parse.y,v 1.83 2023/11/21 08:47:04 martijn Exp $	*/
 
 /*
  * Copyright (c) 2007, 2008, 2012 Reyk Floeter <reyk@openbsd.org>
@@ -331,13 +331,7 @@ main		: LISTEN ON listen_udptcp
 			free($2);
 		}
 		| RTFILTER yesno		{
-			if ($2 == 1)
-				conf->sc_rtfilter = ROUTE_FILTER(RTM_NEWADDR) |
-				    ROUTE_FILTER(RTM_DELADDR) |
-				    ROUTE_FILTER(RTM_IFINFO) |
-				    ROUTE_FILTER(RTM_IFANNOUNCE);
-			else
-				conf->sc_rtfilter = 0;
+			conf->sc_rtfilter = $2;
 		}
 		| seclevel {
 			conf->sc_min_seclevel = $1;