diff --git a/etc/rpki/afrinic.constraints b/etc/rpki/afrinic.constraints
index 9801407b6..bab52909a 100644
--- a/etc/rpki/afrinic.constraints
+++ b/etc/rpki/afrinic.constraints
@@ -2,8 +2,47 @@
 allow 41.0.0.0/8
 allow 102.0.0.0/8
 allow 105.0.0.0/8
-allow 154.0.0.0/8
-allow 196.0.0.0/7
+
+allow 154.0.0.0/16
+allow 154.16.0.0/16
+allow 154.65.0.0 - 154.255.255.255
+allow 196.0.0.0 - 196.1.0.255
+allow 196.1.4.0/24
+allow 196.1.7.0 - 196.1.63.255
+allow 196.1.71.0/24
+allow 196.1.74.0 - 196.1.103.255
+allow 196.1.115.0 - 196.1.133.255
+allow 196.1.137.0/24
+allow 196.1.143.0 - 196.1.159.255
+allow 196.1.176.0 - 196.1.255.255
+allow 196.2.2.0/23
+allow 196.2.8.0 - 196.2.255.255
+allow 196.3.14.0/23
+allow 196.3.57.0 - 196.3.64.255
+allow 196.3.90.0/24
+allow 196.3.92.0 - 196.3.94.255
+allow 196.3.96.0/21
+allow 196.3.105.0/24
+allow 196.3.107.0 - 196.3.131.255
+allow 196.3.148.0/22
+allow 196.3.154.0 - 196.3.183.255
+allow 196.3.224.0 - 196.4.45.255
+allow 196.4.71.0 - 196.11.171.255
+allow 196.11.174.0 - 196.11.239.255
+allow 196.11.248.0/21
+allow 196.12.10.0 - 196.12.31.255
+allow 196.12.128.0/19
+allow 196.12.192.0 - 196.15.15.255
+allow 196.15.64.0 - 196.26.255.255
+allow 196.27.64.0 - 196.28.47.255
+allow 196.28.64.0 - 196.29.63.255
+allow 196.29.96.0 - 196.31.255.255
+allow 196.32.8.0 - 196.32.31.255
+allow 196.32.96.0/19
+allow 196.32.160.0 - 196.39.255.255
+allow 196.40.96.0 - 196.41.255.255
+allow 196.42.64.0 - 196.216.0.255
+allow 196.216.2.0 - 197.255.255.255
 
 # From https://www.iana.org/assignments/ipv6-address-space/
 allow 2001:4200::/23
@@ -14,43 +53,6 @@ allow 36864 - 37887
 allow 327680 - 328703
 allow 328704 - 329727
 
-# Holes
-deny 154.1.0.0/16                 # ARIN
-deny 154.2.0.0/15                 # ARIN
-deny 154.4.0.0/14                 # ARIN
-deny 154.8.0.0 - 154.8.47.255     # RIPE
-deny 154.8.48.0 - 154.8.255.255   # APNIC
-deny 154.9.0.0/16                 # ARIN
-deny 154.10.0.0/16                # APNIC
-deny 154.11.0.0/16                # ARIN
-deny 154.12.0.0/15                # ARIN
-deny 154.14.0.0/15                # RIPE
-deny 154.17.0.0/16                # ARIN
-deny 154.18.0.0/15                # ARIN
-deny 154.20.0.0/14                # ARIN
-deny 154.24.0.0/13                # ARIN
-deny 154.32.0.0/16                # RIPE
-deny 154.33.0.0 - 154.34.255.255  # APNIC
-deny 154.35.0.0/16                # ARIN
-deny 154.36.0.0/14                # ARIN
-deny 154.40.0.0/13                # ARIN
-deny 154.48.0.0/12                # ARIN
-deny 154.64.0.0/16                # ARIN
-deny 196.1.1.0/24                 # APNIC
-deny 196.1.68.0/24                # APNIC
-deny 196.1.104.0 - 196.1.106.255  # APNIC
-deny 196.1.108.0/22               # APNIC
-deny 196.1.113.0 - 196.1.114.255  # APNIC
-deny 196.1.134.0/24               # APNIC
-deny 196.3.65.0/24                # APNIC
-deny 196.3.72.0/24                # APNIC
-deny 196.12.32.0/19               # APNIC
-deny 196.15.16.0/20               # APNIC
-deny 196.29.64.0/19               # LACNIC
-deny 196.32.32.0/19               # LACNIC
-deny 196.32.64.0/19               # LACNIC
-deny 196.40.0.0 - 196.40.95.255   # LACNIC
-
 # From https://www.iana.org/assignments/ipv4-recovered-address-space
 allow 45.96.0.0 - 45.111.255.255
 allow 45.192.0.0 - 45.222.255.255
diff --git a/etc/rpki/apnic.constraints b/etc/rpki/apnic.constraints
index 420b86f0c..dd97bd48a 100644
--- a/etc/rpki/apnic.constraints
+++ b/etc/rpki/apnic.constraints
@@ -8,6 +8,9 @@ allow 2001:a000::/20
 allow 2001:b000::/20
 allow 2400::/12
 
+# IX Assignments
+allow 2001:7fa::/32
+
 # AFRINIC Internet Number Resources cannot be transferred
 # From https://www.iana.org/assignments/ipv4-address-space/
 deny 41.0.0.0/8
diff --git a/etc/skel/dot.version b/etc/skel/dot.version
index d1170351f..1386930a0 100644
--- a/etc/skel/dot.version
+++ b/etc/skel/dot.version
@@ -1 +1 @@
-# SecBSD 1.4-0445948: Tue Dec 12 20:24:48 UTC 2023 (Mictlantecuhtli)
+# SecBSD 1.4-990f2b2: Fri Dec 15 04:12:50 UTC 2023 (Mictlantecuhtli)
diff --git a/lib/libcrypto/cryptlib.c b/lib/libcrypto/cryptlib.c
index 18f40e544..28b50c2c1 100644
--- a/lib/libcrypto/cryptlib.c
+++ b/lib/libcrypto/cryptlib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cryptlib.c,v 1.46 2023/07/08 08:28:23 beck Exp $ */
+/* $OpenBSD: cryptlib.c,v 1.47 2023/12/14 15:31:22 tb Exp $ */
 /* ====================================================================
  * Copyright (c) 1998-2006 The OpenSSL Project.  All rights reserved.
  *
@@ -355,7 +355,7 @@ OPENSSL_showfatal(const char *fmta, ...)
 	va_list ap;
 
 	va_start(ap, fmta);
-	vsyslog_r(LOG_INFO|LOG_LOCAL2, &sdata, fmta, ap);
+	vsyslog_r(LOG_CONS|LOG_LOCAL2, &sdata, fmta, ap);
 	va_end(ap);
 }
 
diff --git a/lib/libcrypto/objects/obj_dat.c b/lib/libcrypto/objects/obj_dat.c
index 14da51645..e72598ef6 100644
--- a/lib/libcrypto/objects/obj_dat.c
+++ b/lib/libcrypto/objects/obj_dat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: obj_dat.c,v 1.65 2023/12/13 23:34:45 tb Exp $ */
+/* $OpenBSD: obj_dat.c,v 1.82 2023/12/15 01:51:23 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -279,89 +279,58 @@ OBJ_add_object(const ASN1_OBJECT *obj)
 LCRYPTO_ALIAS(OBJ_add_object);
 
 ASN1_OBJECT *
-OBJ_nid2obj(int n)
+OBJ_nid2obj(int nid)
 {
-	ADDED_OBJ ad, *adp;
-	ASN1_OBJECT ob;
+	if (nid >= 0 && nid < NUM_NID) {
+		if (nid == NID_undef || nid_objs[nid].nid != NID_undef)
+			return (ASN1_OBJECT *)&nid_objs[nid];
 
-	if ((n >= 0) && (n < NUM_NID)) {
-		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
-			OBJerror(OBJ_R_UNKNOWN_NID);
-			return (NULL);
-		}
-		return ((ASN1_OBJECT *)&(nid_objs[n]));
-	} else if (added == NULL)
-		return (NULL);
-	else {
-		ad.type = ADDED_NID;
-		ad.obj = &ob;
-		ob.nid = n;
-		adp = lh_ADDED_OBJ_retrieve(added, &ad);
-		if (adp != NULL)
-			return (adp->obj);
-		else {
-			OBJerror(OBJ_R_UNKNOWN_NID);
-			return (NULL);
-		}
+		goto unknown;
 	}
+
+	/* XXX - locking. */
+	if (added != NULL) {
+		ASN1_OBJECT aobj = {
+			.nid = nid,
+		};
+		ADDED_OBJ needle = {
+			.type = ADDED_NID,
+			.obj = &aobj,
+		};
+		ADDED_OBJ *found;
+
+		if ((found = lh_ADDED_OBJ_retrieve(added, &needle)) != NULL)
+			return found->obj;
+	}
+
+ unknown:
+	OBJerror(OBJ_R_UNKNOWN_NID);
+
+	return NULL;
 }
 LCRYPTO_ALIAS(OBJ_nid2obj);
 
 const char *
-OBJ_nid2sn(int n)
+OBJ_nid2sn(int nid)
 {
-	ADDED_OBJ ad, *adp;
-	ASN1_OBJECT ob;
+	ASN1_OBJECT *aobj;
 
-	if ((n >= 0) && (n < NUM_NID)) {
-		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
-			OBJerror(OBJ_R_UNKNOWN_NID);
-			return (NULL);
-		}
-		return (nid_objs[n].sn);
-	} else if (added == NULL)
-		return (NULL);
-	else {
-		ad.type = ADDED_NID;
-		ad.obj = &ob;
-		ob.nid = n;
-		adp = lh_ADDED_OBJ_retrieve(added, &ad);
-		if (adp != NULL)
-			return (adp->obj->sn);
-		else {
-			OBJerror(OBJ_R_UNKNOWN_NID);
-			return (NULL);
-		}
-	}
+	if ((aobj = OBJ_nid2obj(nid)) == NULL)
+		return NULL;
+
+	return aobj->sn;
 }
 LCRYPTO_ALIAS(OBJ_nid2sn);
 
 const char *
-OBJ_nid2ln(int n)
+OBJ_nid2ln(int nid)
 {
-	ADDED_OBJ ad, *adp;
-	ASN1_OBJECT ob;
+	ASN1_OBJECT *aobj;
 
-	if ((n >= 0) && (n < NUM_NID)) {
-		if ((n != NID_undef) && (nid_objs[n].nid == NID_undef)) {
-			OBJerror(OBJ_R_UNKNOWN_NID);
-			return (NULL);
-		}
-		return (nid_objs[n].ln);
-	} else if (added == NULL)
-		return (NULL);
-	else {
-		ad.type = ADDED_NID;
-		ad.obj = &ob;
-		ob.nid = n;
-		adp = lh_ADDED_OBJ_retrieve(added, &ad);
-		if (adp != NULL)
-			return (adp->obj->ln);
-		else {
-			OBJerror(OBJ_R_UNKNOWN_NID);
-			return (NULL);
-		}
-	}
+	if ((aobj = OBJ_nid2obj(nid)) == NULL)
+		return NULL;
+
+	return aobj->ln;
 }
 LCRYPTO_ALIAS(OBJ_nid2ln);
 
@@ -370,6 +339,8 @@ obj_objs_cmp(const void *aobj, const void *b)
 {
 	const unsigned int *nid = b;
 
+	OPENSSL_assert(*nid < NUM_NID);
+
 	return OBJ_cmp(aobj, &nid_objs[*nid]);
 }
 
@@ -405,89 +376,13 @@ OBJ_obj2nid(const ASN1_OBJECT *aobj)
 }
 LCRYPTO_ALIAS(OBJ_obj2nid);
 
-/* Convert an object name into an ASN1_OBJECT
- * if "noname" is not set then search for short and long names first.
- * This will convert the "dotted" form into an object: unlike OBJ_txt2nid
- * it can be used with any objects, not just registered ones.
- */
-
-ASN1_OBJECT *
-OBJ_txt2obj(const char *s, int no_name)
-{
-	int nid;
-
-	if (!no_name) {
-		if ((nid = OBJ_sn2nid(s)) != NID_undef ||
-		    (nid = OBJ_ln2nid(s)) != NID_undef)
-			return OBJ_nid2obj(nid);
-	}
-
-	return t2i_ASN1_OBJECT_internal(s);
-}
-LCRYPTO_ALIAS(OBJ_txt2obj);
-
-int
-OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *aobj, int no_name)
-{
-	return i2t_ASN1_OBJECT_internal(aobj, buf, buf_len, no_name);
-}
-LCRYPTO_ALIAS(OBJ_obj2txt);
-
-int
-OBJ_txt2nid(const char *s)
-{
-	ASN1_OBJECT *obj;
-	int nid;
-
-	obj = OBJ_txt2obj(s, 0);
-	nid = OBJ_obj2nid(obj);
-	ASN1_OBJECT_free(obj);
-	return nid;
-}
-LCRYPTO_ALIAS(OBJ_txt2nid);
-
-static int
-ln_objs_cmp(const void *ln, const void *b)
-{
-	const unsigned int *nid = b;
-
-	return strcmp(ln, nid_objs[*nid].ln);
-}
-
-int
-OBJ_ln2nid(const char *ln)
-{
-	const unsigned int *nid;
-
-	/* XXX - locking. OpenSSL 3 moved this after built-in object lookup. */
-	if (added != NULL) {
-		ASN1_OBJECT aobj = {
-			.ln = ln,
-		};
-		ADDED_OBJ needle = {
-			.type = ADDED_LNAME,
-			.obj = &aobj,
-		};
-		ADDED_OBJ *found;
-
-		if ((found = lh_ADDED_OBJ_retrieve(added, &needle)) != NULL)
-			return found->obj->nid;
-	}
-
-	/* ln_objs holds NIDs in ascending alphabetical order of LN. */
-	nid = bsearch(ln, ln_objs, NUM_LN, sizeof(unsigned int), ln_objs_cmp);
-	if (nid != NULL)
-		return *nid;
-
-	return NID_undef;
-}
-LCRYPTO_ALIAS(OBJ_ln2nid);
-
 static int
 sn_objs_cmp(const void *sn, const void *b)
 {
 	const unsigned int *nid = b;
 
+	OPENSSL_assert(*nid < NUM_NID);
+
 	return strcmp(sn, nid_objs[*nid].sn);
 }
 
@@ -520,6 +415,45 @@ OBJ_sn2nid(const char *sn)
 }
 LCRYPTO_ALIAS(OBJ_sn2nid);
 
+static int
+ln_objs_cmp(const void *ln, const void *b)
+{
+	const unsigned int *nid = b;
+
+	OPENSSL_assert(*nid < NUM_NID);
+
+	return strcmp(ln, nid_objs[*nid].ln);
+}
+
+int
+OBJ_ln2nid(const char *ln)
+{
+	const unsigned int *nid;
+
+	/* XXX - locking. OpenSSL 3 moved this after built-in object lookup. */
+	if (added != NULL) {
+		ASN1_OBJECT aobj = {
+			.ln = ln,
+		};
+		ADDED_OBJ needle = {
+			.type = ADDED_LNAME,
+			.obj = &aobj,
+		};
+		ADDED_OBJ *found;
+
+		if ((found = lh_ADDED_OBJ_retrieve(added, &needle)) != NULL)
+			return found->obj->nid;
+	}
+
+	/* ln_objs holds NIDs in ascending alphabetical order of LN. */
+	nid = bsearch(ln, ln_objs, NUM_LN, sizeof(unsigned int), ln_objs_cmp);
+	if (nid != NULL)
+		return *nid;
+
+	return NID_undef;
+}
+LCRYPTO_ALIAS(OBJ_ln2nid);
+
 const void *
 OBJ_bsearch_(const void *key, const void *base, int num, int size,
     int (*cmp)(const void *, const void *))
@@ -561,6 +495,47 @@ OBJ_bsearch_ex_(const void *key, const void *base_, int num, int size,
 	return (p);
 }
 
+/* Convert an object name into an ASN1_OBJECT
+ * if "noname" is not set then search for short and long names first.
+ * This will convert the "dotted" form into an object: unlike OBJ_txt2nid
+ * it can be used with any objects, not just registered ones.
+ */
+
+ASN1_OBJECT *
+OBJ_txt2obj(const char *s, int no_name)
+{
+	int nid;
+
+	if (!no_name) {
+		if ((nid = OBJ_sn2nid(s)) != NID_undef ||
+		    (nid = OBJ_ln2nid(s)) != NID_undef)
+			return OBJ_nid2obj(nid);
+	}
+
+	return t2i_ASN1_OBJECT_internal(s);
+}
+LCRYPTO_ALIAS(OBJ_txt2obj);
+
+int
+OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *aobj, int no_name)
+{
+	return i2t_ASN1_OBJECT_internal(aobj, buf, buf_len, no_name);
+}
+LCRYPTO_ALIAS(OBJ_obj2txt);
+
+int
+OBJ_txt2nid(const char *s)
+{
+	ASN1_OBJECT *obj;
+	int nid;
+
+	obj = OBJ_txt2obj(s, 0);
+	nid = OBJ_obj2nid(obj);
+	ASN1_OBJECT_free(obj);
+	return nid;
+}
+LCRYPTO_ALIAS(OBJ_txt2nid);
+
 int
 OBJ_create_objects(BIO *in)
 {
@@ -614,31 +589,33 @@ LCRYPTO_ALIAS(OBJ_create_objects);
 int
 OBJ_create(const char *oid, const char *sn, const char *ln)
 {
-	int ok = 0;
-	ASN1_OBJECT *op = NULL;
-	unsigned char *buf;
-	int i;
+	ASN1_OBJECT *aobj = NULL;
+	unsigned char *buf = NULL;
+	int len, nid;
+	int ret = 0;
 
-	i = a2d_ASN1_OBJECT(NULL, 0, oid, -1);
-	if (i <= 0)
-		return (0);
+	if ((len = a2d_ASN1_OBJECT(NULL, 0, oid, -1)) <= 0)
+		goto err;
 
-	if ((buf = malloc(i)) == NULL) {
+	if ((buf = calloc(1, len)) == NULL) {
 		OBJerror(ERR_R_MALLOC_FAILURE);
-		return (0);
+		goto err;
 	}
-	i = a2d_ASN1_OBJECT(buf, i, oid, -1);
-	if (i == 0)
+
+	if ((len = a2d_ASN1_OBJECT(buf, len, oid, -1)) == 0)
 		goto err;
-	op = (ASN1_OBJECT *)ASN1_OBJECT_create(OBJ_new_nid(1), buf, i, sn, ln);
-	if (op == NULL)
+
+	nid = OBJ_new_nid(1);
+	if ((aobj = ASN1_OBJECT_create(nid, buf, len, sn, ln)) == NULL)
 		goto err;
-	ok = OBJ_add_object(op);
+
+	ret = OBJ_add_object(aobj);
 
  err:
-	ASN1_OBJECT_free(op);
+	ASN1_OBJECT_free(aobj);
 	free(buf);
-	return (ok);
+
+	return ret;
 }
 LCRYPTO_ALIAS(OBJ_create);
 
diff --git a/lib/libcrypto/x509/x509_vpm.c b/lib/libcrypto/x509/x509_vpm.c
index 4ba697ead..662e3179a 100644
--- a/lib/libcrypto/x509/x509_vpm.c
+++ b/lib/libcrypto/x509/x509_vpm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vpm.c,v 1.40 2023/05/28 05:25:24 tb Exp $ */
+/* $OpenBSD: x509_vpm.c,v 1.41 2023/12/14 12:02:10 tb Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2004.
  */
@@ -84,41 +84,31 @@ str_free(char *s)
     free(s);
 }
 
-/*
- * Post 1.0.1 sk function "deep_copy".  For the moment we simply make
- * these take void * and use them directly without a glorious blob of
- * obfuscating macros of dubious value in front of them. All this in
- * preparation for a rototilling of safestack.h (likely inspired by
- * this).
- */
-static void *
-sk_deep_copy(void *sk_void, void *copy_func_void, void *free_func_void)
+static STACK_OF(OPENSSL_STRING) *
+sk_OPENSSL_STRING_deep_copy(const STACK_OF(OPENSSL_STRING) *sk)
 {
-	_STACK *sk = sk_void;
-	void *(*copy_func)(void *) = copy_func_void;
-	void (*free_func)(void *) = free_func_void;
-	_STACK *ret = sk_dup(sk);
-	size_t i;
+	STACK_OF(OPENSSL_STRING) *new;
+	char *copy = NULL;
+	int i;
 
-	if (ret == NULL)
-		return NULL;
+	if ((new = sk_OPENSSL_STRING_new_null()) == NULL)
+		goto err;
 
-	for (i = 0; i < ret->num; i++) {
-		if (ret->data[i] == NULL)
-			continue;
-		ret->data[i] = copy_func(ret->data[i]);
-		if (ret->data[i] == NULL) {
-			size_t j;
-			for (j = 0; j < i; j++) {
-				if (ret->data[j] != NULL)
-					free_func(ret->data[j]);
-			}
-			sk_free(ret);
-			return NULL;
-		}
+	for (i = 0; i < sk_OPENSSL_STRING_num(sk); i++) {
+		if ((copy = strdup(sk_OPENSSL_STRING_value(sk, i))) == NULL)
+			goto err;
+		if (sk_OPENSSL_STRING_push(new, copy) <= 0)
+			goto err;
+		copy = NULL;
 	}
 
-	return ret;
+	return new;
+
+ err:
+	sk_OPENSSL_STRING_pop_free(new, str_free);
+	free(copy);
+
+	return NULL;
 }
 
 static int
@@ -313,7 +303,7 @@ X509_VERIFY_PARAM_inherit(X509_VERIFY_PARAM *dest, const X509_VERIFY_PARAM *src)
 			dest->hosts = NULL;
 		}
 		if (src->hosts) {
-			dest->hosts = sk_deep_copy(src->hosts, strdup, str_free);
+			dest->hosts = sk_OPENSSL_STRING_deep_copy(src->hosts);
 			if (dest->hosts == NULL)
 				return 0;
 		}
diff --git a/sbin/dhcpleased/engine.c b/sbin/dhcpleased/engine.c
index d435850af..cc6610f2d 100644
--- a/sbin/dhcpleased/engine.c
+++ b/sbin/dhcpleased/engine.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: engine.c,v 1.40 2023/11/25 12:00:39 florian Exp $	*/
+/*	$OpenBSD: engine.c,v 1.41 2023/12/14 09:58:37 claudio Exp $	*/
 
 /*
  * Copyright (c) 2017, 2021 Florian Obser <florian@openbsd.org>
@@ -430,7 +430,7 @@ engine_dispatch_main(int fd, short event, void *bula)
 				fatalx("%s: received unexpected imsg fd "
 				    "to engine", __func__);
 
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg fd to "
 				   "engine but didn't receive any", __func__);
 
diff --git a/sbin/dhcpleased/frontend.c b/sbin/dhcpleased/frontend.c
index 3640f3bdb..74335b88e 100644
--- a/sbin/dhcpleased/frontend.c
+++ b/sbin/dhcpleased/frontend.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: frontend.c,v 1.31 2023/11/25 12:00:39 florian Exp $	*/
+/*	$OpenBSD: frontend.c,v 1.32 2023/12/14 09:58:37 claudio Exp $	*/
 
 /*
  * Copyright (c) 2017, 2021 Florian Obser <florian@openbsd.org>
@@ -269,7 +269,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 				fatalx("%s: received unexpected imsg fd "
 				    "to frontend", __func__);
 
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg fd to "
 				   "frontend but didn't receive any",
 				   __func__);
@@ -287,7 +287,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			event_add(&iev_engine->ev, NULL);
 			break;
 		case IMSG_BPFSOCK:
-			if ((bpfsock = imsg.fd) == -1)
+			if ((bpfsock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "bpf fd but didn't receive any",
 				    __func__);
@@ -298,7 +298,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			set_bpfsock(bpfsock, if_index);
 			break;
 		case IMSG_UDPSOCK:
-			if ((udpsock = imsg.fd) == -1)
+			if ((udpsock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "udpsocket fd but didn't receive any",
 				    __func__);
@@ -327,7 +327,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			}
 			break;
 		case IMSG_ROUTESOCK:
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "routesocket fd but didn't receive any",
 				    __func__);
@@ -430,7 +430,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			break;
 		}
 		case IMSG_CONTROLFD:
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "control fd but didn't receive any",
 				    __func__);
diff --git a/sbin/slaacd/engine.c b/sbin/slaacd/engine.c
index 07b818a69..18e716ee1 100644
--- a/sbin/slaacd/engine.c
+++ b/sbin/slaacd/engine.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: engine.c,v 1.85 2023/04/30 13:08:40 phessler Exp $	*/
+/*	$OpenBSD: engine.c,v 1.86 2023/12/14 09:58:59 claudio Exp $	*/
 
 /*
  * Copyright (c) 2017 Florian Obser <florian@openbsd.org>
@@ -661,7 +661,7 @@ engine_dispatch_main(int fd, short event, void *bula)
 				fatalx("%s: received unexpected imsg fd "
 				    "to engine", __func__);
 
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg fd to "
 				   "engine but didn't receive any", __func__);
 
diff --git a/sbin/slaacd/frontend.c b/sbin/slaacd/frontend.c
index 24cf5c71c..25b6fe2ce 100644
--- a/sbin/slaacd/frontend.c
+++ b/sbin/slaacd/frontend.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: frontend.c,v 1.64 2022/07/12 16:54:59 florian Exp $	*/
+/*	$OpenBSD: frontend.c,v 1.65 2023/12/14 09:58:59 claudio Exp $	*/
 
 /*
  * Copyright (c) 2017 Florian Obser <florian@openbsd.org>
@@ -314,7 +314,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 				fatalx("%s: received unexpected imsg fd "
 				    "to frontend", __func__);
 
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg fd to "
 				   "frontend but didn't receive any",
 				   __func__);
@@ -332,7 +332,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			event_add(&iev_engine->ev, NULL);
 			break;
 		case IMSG_ICMP6SOCK:
-			if ((icmp6sock = imsg.fd) == -1)
+			if ((icmp6sock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "ICMPv6 fd but didn't receive any",
 				    __func__);
@@ -343,7 +343,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			set_icmp6sock(icmp6sock, rdomain);
 			break;
 		case IMSG_ROUTESOCK:
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "routesocket fd but didn't receive any",
 				    __func__);
@@ -355,7 +355,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			break;
 #ifndef	SMALL
 		case IMSG_CONTROLFD:
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "control fd but didn't receive any",
 				    __func__);
diff --git a/sbin/unwind/frontend.c b/sbin/unwind/frontend.c
index ff59a38b2..bbcd03eba 100644
--- a/sbin/unwind/frontend.c
+++ b/sbin/unwind/frontend.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: frontend.c,v 1.79 2023/09/05 15:44:39 florian Exp $	*/
+/*	$OpenBSD: frontend.c,v 1.80 2023/12/14 09:59:27 claudio Exp $	*/
 
 /*
  * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
@@ -340,7 +340,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 				    "to frontend", __func__);
 				break;
 			}
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				fatalx("%s: expected to receive imsg fd to "
 				   "frontend but didn't receive any",
 				   __func__);
@@ -382,7 +382,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			if (udp6sock != -1)
 				fatalx("%s: received unexpected udp6sock",
 				    __func__);
-			if ((udp6sock = imsg.fd) == -1)
+			if ((udp6sock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "UDP6 fd but didn't receive any", __func__);
 			event_set(&udp6ev.ev, udp6sock, EV_READ | EV_PERSIST,
@@ -393,7 +393,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			if (udp4sock != -1)
 				fatalx("%s: received unexpected udp4sock",
 				    __func__);
-			if ((udp4sock = imsg.fd) == -1)
+			if ((udp4sock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "UDP4 fd but didn't receive any", __func__);
 			event_set(&udp4ev.ev, udp4sock, EV_READ | EV_PERSIST,
@@ -404,7 +404,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			if (tcp4sock != -1)
 				fatalx("%s: received unexpected tcp4sock",
 				    __func__);
-			if ((tcp4sock = imsg.fd) == -1)
+			if ((tcp4sock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "TCP4 fd but didn't receive any", __func__);
 			event_set(&tcp4ev.ev, tcp4sock, EV_READ | EV_PERSIST,
@@ -416,7 +416,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			if (tcp6sock != -1)
 				fatalx("%s: received unexpected tcp6sock",
 				    __func__);
-			if ((tcp6sock = imsg.fd) == -1)
+			if ((tcp6sock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "TCP6 fd but didn't receive any", __func__);
 			event_set(&tcp6ev.ev, tcp6sock, EV_READ | EV_PERSIST,
@@ -430,7 +430,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			if (routesock != -1)
 				fatalx("%s: received unexpected routesock",
 				    __func__);
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "routesocket fd but didn't receive any",
 				    __func__);
@@ -443,20 +443,20 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			frontend_startup();
 			break;
 		case IMSG_CONTROLFD:
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg control "
 				    "fd but didn't receive any", __func__);
 			/* Listen on control socket. */
 			control_listen(fd);
 			break;
 		case IMSG_TAFD:
-			if ((ta_fd = imsg.fd) != -1)
+			if ((ta_fd = imsg_get_fd(&imsg)) != -1)
 				parse_trust_anchor(&trust_anchors, ta_fd);
 			if (!TAILQ_EMPTY(&trust_anchors))
 				send_trust_anchors(&trust_anchors);
 			break;
 		case IMSG_BLFD:
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg block "
 				   "list fd but didn't receive any", __func__);
 			parse_blocklist(fd);
diff --git a/sbin/unwind/resolver.c b/sbin/unwind/resolver.c
index d017d3cf2..1596b3994 100644
--- a/sbin/unwind/resolver.c
+++ b/sbin/unwind/resolver.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: resolver.c,v 1.162 2023/09/12 15:38:32 tb Exp $	*/
+/*	$OpenBSD: resolver.c,v 1.163 2023/12/14 09:59:27 claudio Exp $	*/
 
 
 /*
@@ -641,7 +641,7 @@ resolver_dispatch_main(int fd, short event, void *bula)
 				fatalx("%s: received unexpected imsg fd "
 				    "to resolver", __func__);
 
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg fd to "
 				   "resolver but didn't receive any", __func__);
 
diff --git a/share/man/man4/options.4 b/share/man/man4/options.4
index f57b30573..3fdf8bd94 100644
--- a/share/man/man4/options.4
+++ b/share/man/man4/options.4
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: options.4,v 1.269 2022/09/11 06:38:11 jmc Exp $
+.\"	$OpenBSD: options.4,v 1.270 2023/12/14 13:34:23 claudio Exp $
 .\"	$NetBSD: options.4,v 1.21 1997/06/25 03:13:00 thorpej Exp $
 .\"
 .\" Copyright (c) 1998 Theo de Raadt
@@ -34,7 +34,7 @@
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .\"
-.Dd $Mdocdate: September 11 2022 $
+.Dd $Mdocdate: December 14 2023 $
 .Dt OPTIONS 4
 .Os
 .Sh NAME
@@ -461,7 +461,6 @@ The default value is machine dependent, often calculated as
 between 5% and 10% of total available RAM.
 .Pp
 .It Cd option NKMEMPAGES= Ns Ar value
-.It Cd option NKMEMPAGES_MAX= Ns Ar value
 Size of kernel malloc area in PAGE_SIZE-sized logical pages.
 This area is covered by the kernel submap
 .Em kmem_map .
@@ -472,15 +471,6 @@ which may be viewed with the
 .Xr sysctl 8
 variable
 .Em vm.nkmempages .
-See
-.Pa /usr/include/machine/param.h
-for the default upper bound.
-The related option
-.Sq NKMEMPAGES_MAX
-allows the bounds to be overridden in the kernel configuration file
-in the event the computed value is insufficient resulting in an
-.Dq out of space in kmem_map
-panic.
 .El
 .Sh SCSI SUBSYSTEM OPTIONS
 See
diff --git a/sys/arch/amd64/include/param.h b/sys/arch/amd64/include/param.h
index 2d2d5e66c..958c41ecb 100644
--- a/sys/arch/amd64/include/param.h
+++ b/sys/arch/amd64/include/param.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: param.h,v 1.28 2019/12/23 21:42:01 bluhm Exp $	*/
+/*	$OpenBSD: param.h,v 1.29 2023/12/14 13:26:49 claudio Exp $	*/
 
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
@@ -73,12 +73,6 @@
 #define	MSGBUFSIZE	(32 * PAGE_SIZE)	/* default message buffer size */
 #endif
 
-/*
- * Maximum size of the kernel malloc arena in PAGE_SIZE-sized
- * logical pages.
- */
-#define	NKMEMPAGES_MAX_DEFAULT	((128 * 1024 * 1024) >> PAGE_SHIFT)
-
 #define __HAVE_ACPI
 
 #endif /* _KERNEL */
diff --git a/sys/arch/arm/include/param.h b/sys/arch/arm/include/param.h
index ed06b9e5a..150c72ee6 100644
--- a/sys/arch/arm/include/param.h
+++ b/sys/arch/arm/include/param.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: param.h,v 1.24 2018/09/14 13:58:20 claudio Exp $	*/
+/*	$OpenBSD: param.h,v 1.25 2023/12/14 13:26:49 claudio Exp $	*/
 
 /*
  * Copyright (c) 1994,1995 Mark Brinicombe.
@@ -57,12 +57,6 @@
 
 #define	NMBCLUSTERS	(32 * 1024)		/* max cluster allocation */
 
-/*
- * Maximum size of the kernel malloc arena in PAGE_SIZE-sized
- * logical pages.
- */
-#define	NKMEMPAGES_MAX_DEFAULT	((64 * 1024 * 1024) >> PAGE_SHIFT)
-
 /* Constants used to divide the USPACE area */
 /*
  * The USPACE area contains :
diff --git a/sys/arch/arm64/include/param.h b/sys/arch/arm64/include/param.h
index 06eefdee8..74792d7c8 100644
--- a/sys/arch/arm64/include/param.h
+++ b/sys/arch/arm64/include/param.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: param.h,v 1.6 2018/09/14 13:58:20 claudio Exp $	*/
+/*	$OpenBSD: param.h,v 1.7 2023/12/14 13:26:49 claudio Exp $	*/
 
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
@@ -69,12 +69,6 @@
 #define	MSGBUFSIZE	(16 * PAGE_SIZE)	/* default message buffer size */
 #endif
 
-/*
- * Maximum size of the kernel malloc arena in PAGE_SIZE-sized
- * logical pages.
- */
-#define	NKMEMPAGES_MAX_DEFAULT	((128 * 1024 * 1024) >> PAGE_SHIFT)
-
 #define	STACKALIGNBYTES		(16 - 1)
 #define	STACKALIGN(p)		((u_long)(p) &~ STACKALIGNBYTES)
 
diff --git a/sys/arch/i386/include/param.h b/sys/arch/i386/include/param.h
index eabc86c62..d918f29ba 100644
--- a/sys/arch/i386/include/param.h
+++ b/sys/arch/i386/include/param.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: param.h,v 1.52 2023/11/08 18:59:01 mglocker Exp $	*/
+/*	$OpenBSD: param.h,v 1.53 2023/12/14 13:26:49 claudio Exp $	*/
 
 /*-
  * Copyright (c) 1990 The Regents of the University of California.
@@ -73,12 +73,6 @@
 #define	MSGBUFSIZE	(8 * PAGE_SIZE)		/* default message buffer size */
 #endif
 
-/*
- * Maximum size of the kernel malloc arena in PAGE_SIZE-sized
- * logical pages.
- */
-#define	NKMEMPAGES_MAX_DEFAULT	((128 * 1024 * 1024) >> PAGE_SHIFT)
-
 #define __HAVE_ACPI
 
 #endif /* _KERNEL */
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
index b8e56b1a8..a94682461 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_cs.c
@@ -201,7 +201,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,
 	}
 
 	for (i = 0; i < p->nchunks; i++) {
-		struct drm_amdgpu_cs_chunk __user **chunk_ptr = NULL;
+		struct drm_amdgpu_cs_chunk __user *chunk_ptr = NULL;
 		struct drm_amdgpu_cs_chunk user_chunk;
 		uint32_t __user *cdata;
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_display.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_display.c
index 184a234aa..231cb391c 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_display.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_display.c
@@ -90,7 +90,7 @@ static void amdgpu_display_flip_work_func(struct work_struct *__work)
 
 	struct drm_crtc *crtc = &amdgpu_crtc->base;
 	unsigned long flags;
-	unsigned i;
+	unsigned int i;
 	int vpos, hpos;
 
 	for (i = 0; i < work->shared_count; ++i)
@@ -167,7 +167,7 @@ int amdgpu_display_crtc_page_flip_target(struct drm_crtc *crtc,
 	u64 tiling_flags;
 	int i, r;
 
-	work = kzalloc(sizeof *work, GFP_KERNEL);
+	work = kzalloc(sizeof(*work), GFP_KERNEL);
 	if (work == NULL)
 		return -ENOMEM;
 
@@ -298,18 +298,17 @@ int amdgpu_display_crtc_set_config(struct drm_mode_set *set,
 
 	adev = drm_to_adev(dev);
 	/* if we have active crtcs and we don't have a power ref,
-	   take the current one */
+	 * take the current one
+	 */
 	if (active && !adev->have_disp_power_ref) {
 		adev->have_disp_power_ref = true;
 		return ret;
 	}
-	/* if we have no active crtcs, then drop the power ref
-	   we got before */
-	if (!active && adev->have_disp_power_ref) {
-		pm_runtime_put_autosuspend(dev->dev);
+	/* if we have no active crtcs, then go to
+	 * drop the power ref we got before
+	 */
+	if (!active && adev->have_disp_power_ref)
 		adev->have_disp_power_ref = false;
-	}
-
 out:
 	/* drop the power reference we got coming in here */
 	pm_runtime_put_autosuspend(dev->dev);
@@ -473,11 +472,10 @@ bool amdgpu_display_ddc_probe(struct amdgpu_connector *amdgpu_connector,
 	if (amdgpu_connector->router.ddc_valid)
 		amdgpu_i2c_router_select_ddc_port(amdgpu_connector);
 
-	if (use_aux) {
+	if (use_aux)
 		ret = i2c_transfer(&amdgpu_connector->ddc_bus->aux.ddc, msgs, 2);
-	} else {
+	else
 		ret = i2c_transfer(&amdgpu_connector->ddc_bus->adapter, msgs, 2);
-	}
 
 	if (ret != 2)
 		/* Couldn't find an accessible DDC on this connector */
@@ -486,10 +484,12 @@ bool amdgpu_display_ddc_probe(struct amdgpu_connector *amdgpu_connector,
 	 * EDID header starts with:
 	 * 0x00,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0x00.
 	 * Only the first 6 bytes must be valid as
-	 * drm_edid_block_valid() can fix the last 2 bytes */
+	 * drm_edid_block_valid() can fix the last 2 bytes
+	 */
 	if (drm_edid_header_is_valid(buf) < 6) {
 		/* Couldn't find an accessible EDID on this
-		 * connector */
+		 * connector
+		 */
 		return false;
 	}
 	return true;
@@ -1204,8 +1204,10 @@ amdgpu_display_user_framebuffer_create(struct drm_device *dev,
 
 	obj = drm_gem_object_lookup(file_priv, mode_cmd->handles[0]);
 	if (obj ==  NULL) {
-		drm_dbg_kms(dev, "No GEM object associated to handle 0x%08X, "
-			    "can't create framebuffer\n", mode_cmd->handles[0]);
+		drm_dbg_kms(dev,
+			    "No GEM object associated to handle 0x%08X, can't create framebuffer\n",
+			    mode_cmd->handles[0]);
+
 		return ERR_PTR(-ENOENT);
 	}
 
@@ -1398,6 +1400,7 @@ bool amdgpu_display_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
 	}
 	if (amdgpu_crtc->rmx_type != RMX_OFF) {
 		fixed20_12 a, b;
+
 		a.full = dfixed_const(src_v);
 		b.full = dfixed_const(dst_v);
 		amdgpu_crtc->vsc.full = dfixed_div(a, b);
@@ -1417,7 +1420,7 @@ bool amdgpu_display_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
  *
  * \param dev Device to query.
  * \param pipe Crtc to query.
- * \param flags Flags from caller (DRM_CALLED_FROM_VBLIRQ or 0).
+ * \param flags from caller (DRM_CALLED_FROM_VBLIRQ or 0).
  *              For driver internal use only also supports these flags:
  *
  *              USE_REAL_VBLANKSTART to use the real start of vblank instead
@@ -1493,8 +1496,8 @@ int amdgpu_display_get_crtc_scanoutpos(struct drm_device *dev,
 
 	/* Called from driver internal vblank counter query code? */
 	if (flags & GET_DISTANCE_TO_VBLANKSTART) {
-	    /* Caller wants distance from real vbl_start in *hpos */
-	    *hpos = *vpos - vbl_start;
+		/* Caller wants distance from real vbl_start in *hpos */
+		*hpos = *vpos - vbl_start;
 	}
 
 	/* Fudge vblank to start a few scanlines earlier to handle the
@@ -1516,7 +1519,7 @@ int amdgpu_display_get_crtc_scanoutpos(struct drm_device *dev,
 
 	/* In vblank? */
 	if (in_vbl)
-	    ret |= DRM_SCANOUTPOS_IN_VBLANK;
+		ret |= DRM_SCANOUTPOS_IN_VBLANK;
 
 	/* Called from driver internal vblank counter query code? */
 	if (flags & GET_DISTANCE_TO_VBLANKSTART) {
@@ -1622,6 +1625,7 @@ int amdgpu_display_suspend_helper(struct amdgpu_device *adev)
 
 		if (amdgpu_crtc->cursor_bo && !adev->enable_virtual_display) {
 			struct amdgpu_bo *aobj = gem_to_amdgpu_bo(amdgpu_crtc->cursor_bo);
+
 			r = amdgpu_bo_reserve(aobj, true);
 			if (r == 0) {
 				amdgpu_bo_unpin(aobj);
@@ -1629,9 +1633,9 @@ int amdgpu_display_suspend_helper(struct amdgpu_device *adev)
 			}
 		}
 
-		if (fb == NULL || fb->obj[0] == NULL) {
+		if (!fb || !fb->obj[0])
 			continue;
-		}
+
 		robj = gem_to_amdgpu_bo(fb->obj[0]);
 		if (!amdgpu_display_robj_is_fb(adev, robj)) {
 			r = amdgpu_bo_reserve(robj, true);
@@ -1658,6 +1662,7 @@ int amdgpu_display_resume_helper(struct amdgpu_device *adev)
 
 		if (amdgpu_crtc->cursor_bo && !adev->enable_virtual_display) {
 			struct amdgpu_bo *aobj = gem_to_amdgpu_bo(amdgpu_crtc->cursor_bo);
+
 			r = amdgpu_bo_reserve(aobj, true);
 			if (r == 0) {
 				r = amdgpu_bo_pin(aobj, AMDGPU_GEM_DOMAIN_VRAM);
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_eeprom.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_eeprom.c
index 4ff99326d..b567d4185 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_eeprom.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_eeprom.c
@@ -79,6 +79,8 @@
  * That is, for an I2C EEPROM driver everything is controlled by
  * the "eeprom_addr".
  *
+ * See also top of amdgpu_ras_eeprom.c.
+ *
  * P.S. If you need to write, lock and read the Identification Page,
  * (M24M02-DR device only, which we do not use), change the "7" to
  * "0xF" in the macro below, and let the client set bit 20 to 1 in
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_ras_eeprom.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_ras_eeprom.c
index 9c2ef59a5..444799557 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_ras_eeprom.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_ras_eeprom.c
@@ -33,12 +33,29 @@
 
 #include "amdgpu_reset.h"
 
-#define EEPROM_I2C_MADDR_VEGA20         0x0
-#define EEPROM_I2C_MADDR_ARCTURUS       0x40000
-#define EEPROM_I2C_MADDR_ARCTURUS_D342  0x0
-#define EEPROM_I2C_MADDR_SIENNA_CICHLID 0x0
-#define EEPROM_I2C_MADDR_ALDEBARAN      0x0
-#define EEPROM_I2C_MADDR_SMU_13_0_0     (0x54UL << 16)
+/* These are memory addresses as would be seen by one or more EEPROM
+ * chips strung on the I2C bus, usually by manipulating pins 1-3 of a
+ * set of EEPROM devices. They form a continuous memory space.
+ *
+ * The I2C device address includes the device type identifier, 1010b,
+ * which is a reserved value and indicates that this is an I2C EEPROM
+ * device. It also includes the top 3 bits of the 19 bit EEPROM memory
+ * address, namely bits 18, 17, and 16. This makes up the 7 bit
+ * address sent on the I2C bus with bit 0 being the direction bit,
+ * which is not represented here, and sent by the hardware directly.
+ *
+ * For instance,
+ *   50h = 1010000b => device type identifier 1010b, bits 18:16 = 000b, address 0.
+ *   54h = 1010100b => --"--, bits 18:16 = 100b, address 40000h.
+ *   56h = 1010110b => --"--, bits 18:16 = 110b, address 60000h.
+ * Depending on the size of the I2C EEPROM device(s), bits 18:16 may
+ * address memory in a device or a device on the I2C bus, depending on
+ * the status of pins 1-3. See top of amdgpu_eeprom.c.
+ *
+ * The RAS table lives either at address 0 or address 40000h of EEPROM.
+ */
+#define EEPROM_I2C_MADDR_0      0x0
+#define EEPROM_I2C_MADDR_4      0x40000
 
 /*
  * The 2 macros bellow represent the actual size in bytes that
@@ -90,37 +107,23 @@
 
 static bool __is_ras_eeprom_supported(struct amdgpu_device *adev)
 {
-	return  adev->asic_type == CHIP_VEGA20 ||
-		adev->asic_type == CHIP_ARCTURUS ||
-		adev->asic_type == CHIP_SIENNA_CICHLID ||
-		adev->asic_type == CHIP_ALDEBARAN;
-}
-
-static bool __get_eeprom_i2c_addr_arct(struct amdgpu_device *adev,
-				       struct amdgpu_ras_eeprom_control *control)
-{
-	STUB();
-	return false;
-#ifdef notyet
-	struct atom_context *atom_ctx = adev->mode_info.atom_context;
-
-	if (!control || !atom_ctx)
+	switch (adev->ip_versions[MP1_HWIP][0]) {
+	case IP_VERSION(11, 0, 2): /* VEGA20 and ARCTURUS */
+	case IP_VERSION(11, 0, 7): /* Sienna cichlid */
+	case IP_VERSION(13, 0, 0):
+	case IP_VERSION(13, 0, 2): /* Aldebaran */
+	case IP_VERSION(13, 0, 6):
+	case IP_VERSION(13, 0, 10):
+		return true;
+	default:
 		return false;
-
-	if (strnstr(atom_ctx->vbios_version,
-	            "D342",
-		    sizeof(atom_ctx->vbios_version)))
-		control->i2c_address = EEPROM_I2C_MADDR_ARCTURUS_D342;
-	else
-		control->i2c_address = EEPROM_I2C_MADDR_ARCTURUS;
-
-	return true;
-#endif
+	}
 }
 
 static bool __get_eeprom_i2c_addr(struct amdgpu_device *adev,
 				  struct amdgpu_ras_eeprom_control *control)
 {
+	struct atom_context *atom_ctx = adev->mode_info.atom_context;
 	u8 i2c_addr;
 
 	if (!control)
@@ -141,36 +144,57 @@ static bool __get_eeprom_i2c_addr(struct amdgpu_device *adev,
 		return true;
 	}
 
-	switch (adev->asic_type) {
-	case CHIP_VEGA20:
-		control->i2c_address = EEPROM_I2C_MADDR_VEGA20;
-		break;
-
-	case CHIP_ARCTURUS:
-		return __get_eeprom_i2c_addr_arct(adev, control);
-
-	case CHIP_SIENNA_CICHLID:
-		control->i2c_address = EEPROM_I2C_MADDR_SIENNA_CICHLID;
-		break;
-
-	case CHIP_ALDEBARAN:
-		control->i2c_address = EEPROM_I2C_MADDR_ALDEBARAN;
-		break;
-
+	switch (adev->ip_versions[MP1_HWIP][0]) {
+	case IP_VERSION(11, 0, 2):
+		/* VEGA20 and ARCTURUS */
+		if (adev->asic_type == CHIP_VEGA20)
+			control->i2c_address = EEPROM_I2C_MADDR_0;
+#ifdef notyet
+		else if (strnstr(atom_ctx->vbios_version,
+				 "D342",
+				 sizeof(atom_ctx->vbios_version)))
+			control->i2c_address = EEPROM_I2C_MADDR_0;
+		else
+			control->i2c_address = EEPROM_I2C_MADDR_4;
+#else
+		STUB();
+		control->i2c_address = EEPROM_I2C_MADDR_4;
+#endif
+		return true;
+	case IP_VERSION(11, 0, 7):
+		control->i2c_address = EEPROM_I2C_MADDR_0;
+		return true;
+	case IP_VERSION(13, 0, 2):
+#ifdef notyet
+		if (strnstr(atom_ctx->vbios_version, "D673",
+			    sizeof(atom_ctx->vbios_version)))
+			control->i2c_address = EEPROM_I2C_MADDR_4;
+		else
+			control->i2c_address = EEPROM_I2C_MADDR_0;
+#else
+		STUB();
+		control->i2c_address = EEPROM_I2C_MADDR_0;
+#endif
+		return true;
+	case IP_VERSION(13, 0, 0):
+#ifdef notyet
+		if (strnstr(atom_ctx->vbios_pn, "D707",
+			    sizeof(atom_ctx->vbios_pn)))
+			control->i2c_address = EEPROM_I2C_MADDR_0;
+		else
+			control->i2c_address = EEPROM_I2C_MADDR_4;
+#else
+		STUB();
+		control->i2c_address = EEPROM_I2C_MADDR_4;
+#endif
+		return true;
+	case IP_VERSION(13, 0, 6):
+	case IP_VERSION(13, 0, 10):
+		control->i2c_address = EEPROM_I2C_MADDR_4;
+		return true;
 	default:
 		return false;
 	}
-
-	switch (adev->ip_versions[MP1_HWIP][0]) {
-	case IP_VERSION(13, 0, 0):
-		control->i2c_address = EEPROM_I2C_MADDR_SMU_13_0_0;
-		break;
-
-	default:
-		break;
-	}
-
-	return true;
 }
 
 static void
diff --git a/sys/dev/pci/drm/amd/amdgpu/gfx_v11_0.c b/sys/dev/pci/drm/amd/amdgpu/gfx_v11_0.c
index f08f49974..7e1a632ec 100644
--- a/sys/dev/pci/drm/amd/amdgpu/gfx_v11_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/gfx_v11_0.c
@@ -397,7 +397,7 @@ static int gfx_v11_0_ring_test_ib(struct amdgpu_ring *ring, long timeout)
 		adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD);
 		cpu_ptr = &adev->wb.wb[index];
 
-		r = amdgpu_ib_get(adev, NULL, 16, AMDGPU_IB_POOL_DIRECT, &ib);
+		r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib);
 		if (r) {
 			DRM_ERROR("amdgpu: failed to get ib (%ld).\n", r);
 			goto err1;
diff --git a/sys/dev/pci/drm/amd/amdgpu/gfx_v8_0.c b/sys/dev/pci/drm/amd/amdgpu/gfx_v8_0.c
index f6d7381ac..c900a5a68 100644
--- a/sys/dev/pci/drm/amd/amdgpu/gfx_v8_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/gfx_v8_0.c
@@ -883,8 +883,8 @@ static int gfx_v8_0_ring_test_ib(struct amdgpu_ring *ring, long timeout)
 	gpu_addr = adev->wb.gpu_addr + (index * 4);
 	adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD);
 	memset(&ib, 0, sizeof(ib));
-	r = amdgpu_ib_get(adev, NULL, 16,
-					AMDGPU_IB_POOL_DIRECT, &ib);
+
+	r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib);
 	if (r)
 		goto err1;
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/gfx_v9_0.c b/sys/dev/pci/drm/amd/amdgpu/gfx_v9_0.c
index 9ec579476..277c766cc 100644
--- a/sys/dev/pci/drm/amd/amdgpu/gfx_v9_0.c
+++ b/sys/dev/pci/drm/amd/amdgpu/gfx_v9_0.c
@@ -1034,8 +1034,8 @@ static int gfx_v9_0_ring_test_ib(struct amdgpu_ring *ring, long timeout)
 	gpu_addr = adev->wb.gpu_addr + (index * 4);
 	adev->wb.wb[index] = cpu_to_le32(0xCAFEDEAD);
 	memset(&ib, 0, sizeof(ib));
-	r = amdgpu_ib_get(adev, NULL, 16,
-					AMDGPU_IB_POOL_DIRECT, &ib);
+
+	r = amdgpu_ib_get(adev, NULL, 20, AMDGPU_IB_POOL_DIRECT, &ib);
 	if (r)
 		goto err1;
 
diff --git a/sys/dev/pci/drm/i915/display/icl_dsi.c b/sys/dev/pci/drm/i915/display/icl_dsi.c
index 5767d3398..d5951688a 100644
--- a/sys/dev/pci/drm/i915/display/icl_dsi.c
+++ b/sys/dev/pci/drm/i915/display/icl_dsi.c
@@ -1500,6 +1500,13 @@ static void gen11_dsi_post_disable(struct intel_atomic_state *state,
 static enum drm_mode_status gen11_dsi_mode_valid(struct drm_connector *connector,
 						 struct drm_display_mode *mode)
 {
+	struct drm_i915_private *i915 = to_i915(connector->dev);
+	enum drm_mode_status status;
+
+	status = intel_cpu_transcoder_mode_valid(i915, mode);
+	if (status != MODE_OK)
+		return status;
+
 	/* FIXME: DSC? */
 	return intel_dsi_mode_valid(connector, mode);
 }
diff --git a/sys/dev/pci/drm/i915/display/intel_crt.c b/sys/dev/pci/drm/i915/display/intel_crt.c
index 4a8ff2f97..e60b2cf84 100644
--- a/sys/dev/pci/drm/i915/display/intel_crt.c
+++ b/sys/dev/pci/drm/i915/display/intel_crt.c
@@ -343,8 +343,13 @@ intel_crt_mode_valid(struct drm_connector *connector,
 	struct drm_device *dev = connector->dev;
 	struct drm_i915_private *dev_priv = to_i915(dev);
 	int max_dotclk = dev_priv->max_dotclk_freq;
+	enum drm_mode_status status;
 	int max_clock;
 
+	status = intel_cpu_transcoder_mode_valid(dev_priv, mode);
+	if (status != MODE_OK)
+		return status;
+
 	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
 		return MODE_NO_DBLESCAN;
 
diff --git a/sys/dev/pci/drm/i915/display/intel_display.c b/sys/dev/pci/drm/i915/display/intel_display.c
index 65de50781..a6bbf26c6 100644
--- a/sys/dev/pci/drm/i915/display/intel_display.c
+++ b/sys/dev/pci/drm/i915/display/intel_display.c
@@ -8229,6 +8229,16 @@ intel_mode_valid(struct drm_device *dev,
 	    mode->vtotal > vtotal_max)
 		return MODE_V_ILLEGAL;
 
+	return MODE_OK;
+}
+
+enum drm_mode_status intel_cpu_transcoder_mode_valid(struct drm_i915_private *dev_priv,
+						     const struct drm_display_mode *mode)
+{
+	/*
+	 * Additional transcoder timing limits,
+	 * excluding BXT/GLK DSI transcoders.
+	 */
 	if (DISPLAY_VER(dev_priv) >= 5) {
 		if (mode->hdisplay < 64 ||
 		    mode->htotal - mode->hdisplay < 32)
diff --git a/sys/dev/pci/drm/i915/display/intel_display.h b/sys/dev/pci/drm/i915/display/intel_display.h
index 6f98e5438..9d3f09f4f 100644
--- a/sys/dev/pci/drm/i915/display/intel_display.h
+++ b/sys/dev/pci/drm/i915/display/intel_display.h
@@ -556,6 +556,9 @@ enum drm_mode_status
 intel_mode_valid_max_plane_size(struct drm_i915_private *dev_priv,
 				const struct drm_display_mode *mode,
 				bool bigjoiner);
+enum drm_mode_status
+intel_cpu_transcoder_mode_valid(struct drm_i915_private *i915,
+				const struct drm_display_mode *mode);
 enum phy intel_port_to_phy(struct drm_i915_private *i915, enum port port);
 bool is_trans_port_sync_mode(const struct intel_crtc_state *state);
 bool intel_crtc_is_bigjoiner_slave(const struct intel_crtc_state *crtc_state);
diff --git a/sys/dev/pci/drm/i915/display/intel_dp.c b/sys/dev/pci/drm/i915/display/intel_dp.c
index 68c069279..767f5a996 100644
--- a/sys/dev/pci/drm/i915/display/intel_dp.c
+++ b/sys/dev/pci/drm/i915/display/intel_dp.c
@@ -973,8 +973,9 @@ intel_dp_mode_valid(struct drm_connector *_connector,
 	enum drm_mode_status status;
 	bool dsc = false, bigjoiner = false;
 
-	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
-		return MODE_NO_DBLESCAN;
+	status = intel_cpu_transcoder_mode_valid(dev_priv, mode);
+	if (status != MODE_OK)
+		return status;
 
 	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
 		return MODE_H_ILLEGAL;
diff --git a/sys/dev/pci/drm/i915/display/intel_dp_mst.c b/sys/dev/pci/drm/i915/display/intel_dp_mst.c
index 9a6822256..eec32f682 100644
--- a/sys/dev/pci/drm/i915/display/intel_dp_mst.c
+++ b/sys/dev/pci/drm/i915/display/intel_dp_mst.c
@@ -703,6 +703,10 @@ intel_dp_mst_mode_valid_ctx(struct drm_connector *connector,
 		return 0;
 	}
 
+	*status = intel_cpu_transcoder_mode_valid(dev_priv, mode);
+	if (*status != MODE_OK)
+		return 0;
+
 	if (mode->flags & DRM_MODE_FLAG_DBLSCAN) {
 		*status = MODE_NO_DBLESCAN;
 		return 0;
diff --git a/sys/dev/pci/drm/i915/display/intel_dvo.c b/sys/dev/pci/drm/i915/display/intel_dvo.c
index 5572e4302..511c58907 100644
--- a/sys/dev/pci/drm/i915/display/intel_dvo.c
+++ b/sys/dev/pci/drm/i915/display/intel_dvo.c
@@ -225,10 +225,16 @@ intel_dvo_mode_valid(struct drm_connector *connector,
 {
 	struct intel_connector *intel_connector = to_intel_connector(connector);
 	struct intel_dvo *intel_dvo = intel_attached_dvo(intel_connector);
+	struct drm_i915_private *i915 = to_i915(intel_connector->base.dev);
 	const struct drm_display_mode *fixed_mode =
 		intel_panel_fixed_mode(intel_connector, mode);
 	int max_dotclk = to_i915(connector->dev)->max_dotclk_freq;
 	int target_clock = mode->clock;
+	enum drm_mode_status status;
+
+	status = intel_cpu_transcoder_mode_valid(i915, mode);
+	if (status != MODE_OK)
+		return status;
 
 	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
 		return MODE_NO_DBLESCAN;
diff --git a/sys/dev/pci/drm/i915/display/intel_hdmi.c b/sys/dev/pci/drm/i915/display/intel_hdmi.c
index 3565da914..0f05f731f 100644
--- a/sys/dev/pci/drm/i915/display/intel_hdmi.c
+++ b/sys/dev/pci/drm/i915/display/intel_hdmi.c
@@ -1987,8 +1987,9 @@ intel_hdmi_mode_valid(struct drm_connector *connector,
 	bool has_hdmi_sink = intel_has_hdmi_sink(hdmi, connector->state);
 	bool ycbcr_420_only;
 
-	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
-		return MODE_NO_DBLESCAN;
+	status = intel_cpu_transcoder_mode_valid(dev_priv, mode);
+	if (status != MODE_OK)
+		return status;
 
 	if ((mode->flags & DRM_MODE_FLAG_3D_MASK) == DRM_MODE_FLAG_3D_FRAME_PACKING)
 		clock *= 2;
diff --git a/sys/dev/pci/drm/i915/display/intel_lvds.c b/sys/dev/pci/drm/i915/display/intel_lvds.c
index a749a5a66..40b5d3d3c 100644
--- a/sys/dev/pci/drm/i915/display/intel_lvds.c
+++ b/sys/dev/pci/drm/i915/display/intel_lvds.c
@@ -92,9 +92,9 @@ bool intel_lvds_port_enabled(struct drm_i915_private *dev_priv,
 
 	/* asserts want to know the pipe even if the port is disabled */
 	if (HAS_PCH_CPT(dev_priv))
-		*pipe = (val & LVDS_PIPE_SEL_MASK_CPT) >> LVDS_PIPE_SEL_SHIFT_CPT;
+		*pipe = REG_FIELD_GET(LVDS_PIPE_SEL_MASK_CPT, val);
 	else
-		*pipe = (val & LVDS_PIPE_SEL_MASK) >> LVDS_PIPE_SEL_SHIFT;
+		*pipe = REG_FIELD_GET(LVDS_PIPE_SEL_MASK, val);
 
 	return val & LVDS_PORT_EN;
 }
@@ -389,11 +389,16 @@ intel_lvds_mode_valid(struct drm_connector *connector,
 		      struct drm_display_mode *mode)
 {
 	struct intel_connector *intel_connector = to_intel_connector(connector);
+	struct drm_i915_private *i915 = to_i915(intel_connector->base.dev);
 	const struct drm_display_mode *fixed_mode =
 		intel_panel_fixed_mode(intel_connector, mode);
 	int max_pixclk = to_i915(connector->dev)->max_dotclk_freq;
 	enum drm_mode_status status;
 
+	status = intel_cpu_transcoder_mode_valid(i915, mode);
+	if (status != MODE_OK)
+		return status;
+
 	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
 		return MODE_NO_DBLESCAN;
 
diff --git a/sys/dev/pci/drm/i915/display/intel_sdvo.c b/sys/dev/pci/drm/i915/display/intel_sdvo.c
index fa7b47b37..83df7223f 100644
--- a/sys/dev/pci/drm/i915/display/intel_sdvo.c
+++ b/sys/dev/pci/drm/i915/display/intel_sdvo.c
@@ -115,7 +115,6 @@ struct intel_sdvo {
 
 	enum port port;
 
-	bool has_hdmi_monitor;
 	bool has_hdmi_audio;
 
 	/* DDC bus used by this SDVO encoder */
@@ -1278,10 +1277,13 @@ static void i9xx_adjust_sdvo_tv_clock(struct intel_crtc_state *pipe_config)
 	pipe_config->clock_set = true;
 }
 
-static bool intel_has_hdmi_sink(struct intel_sdvo *sdvo,
+static bool intel_has_hdmi_sink(struct intel_sdvo_connector *intel_sdvo_connector,
 				const struct drm_connector_state *conn_state)
 {
-	return sdvo->has_hdmi_monitor &&
+	struct drm_connector *connector = conn_state->connector;
+
+	return intel_sdvo_connector->is_hdmi &&
+		connector->display_info.is_hdmi &&
 		READ_ONCE(to_intel_digital_connector_state(conn_state)->force_audio) != HDMI_AUDIO_OFF_DVI;
 }
 
@@ -1360,7 +1362,7 @@ static int intel_sdvo_compute_config(struct intel_encoder *encoder,
 	pipe_config->pixel_multiplier =
 		intel_sdvo_get_pixel_multiplier(adjusted_mode);
 
-	pipe_config->has_hdmi_sink = intel_has_hdmi_sink(intel_sdvo, conn_state);
+	pipe_config->has_hdmi_sink = intel_has_hdmi_sink(intel_sdvo_connector, conn_state);
 
 	if (pipe_config->has_hdmi_sink) {
 		if (intel_sdvo_state->base.force_audio == HDMI_AUDIO_AUTO)
@@ -1871,13 +1873,19 @@ static enum drm_mode_status
 intel_sdvo_mode_valid(struct drm_connector *connector,
 		      struct drm_display_mode *mode)
 {
+	struct drm_i915_private *i915 = to_i915(connector->dev);
 	struct intel_sdvo *intel_sdvo = intel_attached_sdvo(to_intel_connector(connector));
 	struct intel_sdvo_connector *intel_sdvo_connector =
 		to_intel_sdvo_connector(connector);
-	int max_dotclk = to_i915(connector->dev)->max_dotclk_freq;
-	bool has_hdmi_sink = intel_has_hdmi_sink(intel_sdvo, connector->state);
+	bool has_hdmi_sink = intel_has_hdmi_sink(intel_sdvo_connector, connector->state);
+	int max_dotclk = i915->max_dotclk_freq;
+	enum drm_mode_status status;
 	int clock = mode->clock;
 
+	status = intel_cpu_transcoder_mode_valid(i915, mode);
+	if (status != MODE_OK)
+		return status;
+
 	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
 		return MODE_NO_DBLESCAN;
 
@@ -2064,7 +2072,6 @@ intel_sdvo_tmds_sink_detect(struct drm_connector *connector)
 		if (edid->input & DRM_EDID_INPUT_DIGITAL) {
 			status = connector_status_connected;
 			if (intel_sdvo_connector->is_hdmi) {
-				intel_sdvo->has_hdmi_monitor = drm_detect_hdmi_monitor(edid);
 				intel_sdvo->has_hdmi_audio = drm_detect_monitor_audio(edid);
 			}
 		} else
@@ -2116,7 +2123,6 @@ intel_sdvo_detect(struct drm_connector *connector, bool force)
 
 	intel_sdvo->attached_output = response;
 
-	intel_sdvo->has_hdmi_monitor = false;
 	intel_sdvo->has_hdmi_audio = false;
 
 	if ((intel_sdvo_connector->output_flag & response) == 0)
diff --git a/sys/dev/pci/drm/i915/display/intel_tv.c b/sys/dev/pci/drm/i915/display/intel_tv.c
index dcf89d701..fb25be800 100644
--- a/sys/dev/pci/drm/i915/display/intel_tv.c
+++ b/sys/dev/pci/drm/i915/display/intel_tv.c
@@ -956,8 +956,14 @@ static enum drm_mode_status
 intel_tv_mode_valid(struct drm_connector *connector,
 		    struct drm_display_mode *mode)
 {
+	struct drm_i915_private *i915 = to_i915(connector->dev);
 	const struct tv_mode *tv_mode = intel_tv_mode_find(connector->state);
-	int max_dotclk = to_i915(connector->dev)->max_dotclk_freq;
+	int max_dotclk = i915->max_dotclk_freq;
+	enum drm_mode_status status;
+
+	status = intel_cpu_transcoder_mode_valid(i915, mode);
+	if (status != MODE_OK)
+		return status;
 
 	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
 		return MODE_NO_DBLESCAN;
diff --git a/sys/dev/pci/drm/i915/display/vlv_dsi.c b/sys/dev/pci/drm/i915/display/vlv_dsi.c
index 963ab2e8f..cd234746b 100644
--- a/sys/dev/pci/drm/i915/display/vlv_dsi.c
+++ b/sys/dev/pci/drm/i915/display/vlv_dsi.c
@@ -1627,9 +1627,25 @@ static const struct drm_encoder_funcs intel_dsi_funcs = {
 	.destroy = intel_dsi_encoder_destroy,
 };
 
+static enum drm_mode_status vlv_dsi_mode_valid(struct drm_connector *connector,
+					       struct drm_display_mode *mode)
+{
+	struct drm_i915_private *i915 = to_i915(connector->dev);
+
+	if (IS_VALLEYVIEW(i915) || IS_CHERRYVIEW(i915)) {
+		enum drm_mode_status status;
+
+		status = intel_cpu_transcoder_mode_valid(i915, mode);
+		if (status != MODE_OK)
+			return status;
+	}
+
+	return intel_dsi_mode_valid(connector, mode);
+}
+
 static const struct drm_connector_helper_funcs intel_dsi_connector_helper_funcs = {
 	.get_modes = intel_dsi_get_modes,
-	.mode_valid = intel_dsi_mode_valid,
+	.mode_valid = vlv_dsi_mode_valid,
 	.atomic_check = intel_digital_connector_atomic_check,
 };
 
diff --git a/sys/dev/pci/drm/i915/i915_reg.h b/sys/dev/pci/drm/i915/i915_reg.h
index 25015996f..c67667043 100644
--- a/sys/dev/pci/drm/i915/i915_reg.h
+++ b/sys/dev/pci/drm/i915/i915_reg.h
@@ -2681,52 +2681,50 @@
  * Enables the LVDS port.  This bit must be set before DPLLs are enabled, as
  * the DPLL semantics change when the LVDS is assigned to that pipe.
  */
-#define   LVDS_PORT_EN			(1 << 31)
+#define   LVDS_PORT_EN			REG_BIT(31)
 /* Selects pipe B for LVDS data.  Must be set on pre-965. */
-#define   LVDS_PIPE_SEL_SHIFT		30
-#define   LVDS_PIPE_SEL_MASK		(1 << 30)
-#define   LVDS_PIPE_SEL(pipe)		((pipe) << 30)
-#define   LVDS_PIPE_SEL_SHIFT_CPT	29
-#define   LVDS_PIPE_SEL_MASK_CPT	(3 << 29)
-#define   LVDS_PIPE_SEL_CPT(pipe)	((pipe) << 29)
+#define   LVDS_PIPE_SEL_MASK		REG_BIT(30)
+#define   LVDS_PIPE_SEL(pipe)		REG_FIELD_PREP(LVDS_PIPE_SEL_MASK, (pipe))
+#define   LVDS_PIPE_SEL_MASK_CPT	REG_GENMASK(30, 29)
+#define   LVDS_PIPE_SEL_CPT(pipe)	REG_FIELD_PREP(LVDS_PIPE_SEL_MASK_CPT, (pipe))
 /* LVDS dithering flag on 965/g4x platform */
-#define   LVDS_ENABLE_DITHER		(1 << 25)
+#define   LVDS_ENABLE_DITHER		REG_BIT(25)
 /* LVDS sync polarity flags. Set to invert (i.e. negative) */
-#define   LVDS_VSYNC_POLARITY		(1 << 21)
-#define   LVDS_HSYNC_POLARITY		(1 << 20)
+#define   LVDS_VSYNC_POLARITY		REG_BIT(21)
+#define   LVDS_HSYNC_POLARITY		REG_BIT(20)
 
 /* Enable border for unscaled (or aspect-scaled) display */
-#define   LVDS_BORDER_ENABLE		(1 << 15)
+#define   LVDS_BORDER_ENABLE		REG_BIT(15)
 /*
  * Enables the A0-A2 data pairs and CLKA, containing 18 bits of color data per
  * pixel.
  */
-#define   LVDS_A0A2_CLKA_POWER_MASK	(3 << 8)
-#define   LVDS_A0A2_CLKA_POWER_DOWN	(0 << 8)
-#define   LVDS_A0A2_CLKA_POWER_UP	(3 << 8)
+#define   LVDS_A0A2_CLKA_POWER_MASK	REG_GENMASK(9, 8)
+#define   LVDS_A0A2_CLKA_POWER_DOWN	REG_FIELD_PREP(LVDS_A0A2_CLKA_POWER_MASK, 0)
+#define   LVDS_A0A2_CLKA_POWER_UP	REG_FIELD_PREP(LVDS_A0A2_CLKA_POWER_MASK, 3)
 /*
  * Controls the A3 data pair, which contains the additional LSBs for 24 bit
  * mode.  Only enabled if LVDS_A0A2_CLKA_POWER_UP also indicates it should be
  * on.
  */
-#define   LVDS_A3_POWER_MASK		(3 << 6)
-#define   LVDS_A3_POWER_DOWN		(0 << 6)
-#define   LVDS_A3_POWER_UP		(3 << 6)
+#define   LVDS_A3_POWER_MASK		REG_GENMASK(7, 6)
+#define   LVDS_A3_POWER_DOWN		REG_FIELD_PREP(LVDS_A3_POWER_MASK, 0)
+#define   LVDS_A3_POWER_UP		REG_FIELD_PREP(LVDS_A3_POWER_MASK, 3)
 /*
  * Controls the CLKB pair.  This should only be set when LVDS_B0B3_POWER_UP
  * is set.
  */
-#define   LVDS_CLKB_POWER_MASK		(3 << 4)
-#define   LVDS_CLKB_POWER_DOWN		(0 << 4)
-#define   LVDS_CLKB_POWER_UP		(3 << 4)
+#define   LVDS_CLKB_POWER_MASK		REG_GENMASK(5, 4)
+#define   LVDS_CLKB_POWER_DOWN		REG_FIELD_PREP(LVDS_CLKB_POWER_MASK, 0)
+#define   LVDS_CLKB_POWER_UP		REG_FIELD_PREP(LVDS_CLKB_POWER_MASK, 3)
 /*
  * Controls the B0-B3 data pairs.  This must be set to match the DPLL p2
  * setting for whether we are in dual-channel mode.  The B3 pair will
  * additionally only be powered up when LVDS_A3_POWER_UP is set.
  */
-#define   LVDS_B0B3_POWER_MASK		(3 << 2)
-#define   LVDS_B0B3_POWER_DOWN		(0 << 2)
-#define   LVDS_B0B3_POWER_UP		(3 << 2)
+#define   LVDS_B0B3_POWER_MASK		REG_GENMASK(3, 2)
+#define   LVDS_B0B3_POWER_DOWN		REG_FIELD_PREP(LVDS_B0B3_POWER_MASK, 0)
+#define   LVDS_B0B3_POWER_UP		REG_FIELD_PREP(LVDS_B0B3_POWER_MASK, 3)
 
 /* Video Data Island Packet control */
 #define VIDEO_DIP_DATA		_MMIO(0x61178)
@@ -6461,7 +6459,7 @@
 #define FDI_PLL_CTL_2           _MMIO(0xfe004)
 
 #define PCH_LVDS	_MMIO(0xe1180)
-#define  LVDS_DETECTED	(1 << 1)
+#define   LVDS_DETECTED	REG_BIT(1)
 
 #define _PCH_DP_B		0xe4100
 #define PCH_DP_B		_MMIO(_PCH_DP_B)
diff --git a/sys/kern/kern_malloc.c b/sys/kern/kern_malloc.c
index 104a6bda6..a2104b989 100644
--- a/sys/kern/kern_malloc.c
+++ b/sys/kern/kern_malloc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_malloc.c,v 1.149 2023/11/29 11:47:15 claudio Exp $	*/
+/*	$OpenBSD: kern_malloc.c,v 1.151 2023/12/14 14:04:57 claudio Exp $	*/
 /*	$NetBSD: kern_malloc.c,v 1.15.4.2 1996/06/13 17:10:56 cgd Exp $	*/
 
 /*
@@ -83,19 +83,10 @@ struct vm_map *kmem_map = NULL;
  * config file.
  */
 #ifndef NKMEMPAGES
-#define	NKMEMPAGES	0
+#define	NKMEMPAGES	-1
 #endif
 u_int	nkmempages = NKMEMPAGES;
 
-/*
- * Defaults for upper-bounds for the kmem_map page count.
- * Can be overridden by kernel config options.
- */
-#ifndef NKMEMPAGES_MAX
-#define	NKMEMPAGES_MAX	NKMEMPAGES_MAX_DEFAULT
-#endif
-u_int	nkmempages_max = NKMEMPAGES_MAX;
-
 struct mutex malloc_mtx = MUTEX_INITIALIZER(IPL_VM);
 struct kmembuckets bucket[MINBUCKET + 16];
 #ifdef KMEMSTATS
@@ -504,7 +495,7 @@ kmeminit_nkmempages(void)
 {
 	u_int npages;
 
-	if (nkmempages != 0) {
+	if (nkmempages != -1) {
 		/*
 		 * It's already been set (by us being here before, or
 		 * by patching or kernel config options), bail out now.
@@ -515,16 +506,26 @@ kmeminit_nkmempages(void)
 	/*
 	 * We use the following (simple) formula:
 	 *
-	 *	- Starting point is physical memory / 4.
+	 * Up to 1G physmem use physical memory / 4,
+	 * above 1G add an extra 16MB per 1G of memory.
 	 *
-	 *	- Clamp it down to nkmempages_max.
-	 *
-	 *	- Round it up to nkmempages_min.
+	 * Clamp it down depending on VM_KERNEL_SPACE_SIZE
+	 * - up and including 512M -> 64MB
+	 * - between 512M and 1024M -> 128MB
+	 * - over 1024M clamping to VM_KERNEL_SPACE_SIZE / 4
 	 */
-	npages = physmem / 4;
+	npages = MIN(physmem, atop(1024 * 1024 * 1024)) / 4;
+	if (physmem > atop(1024 * 1024 * 1024))
+		npages += (physmem - atop(1024 * 1024 * 1024)) / 64;
 
-	if (npages > nkmempages_max)
-		npages = nkmempages_max;
+	if (VM_KERNEL_SPACE_SIZE <= 512 * 1024 * 1024) {
+		if (npages > atop(64 * 1024 * 1024))
+			npages = atop(64 * 1024 * 1024);
+	} else if (VM_KERNEL_SPACE_SIZE <= 1024 * 1024 * 1024) {
+		if (npages > atop(128 * 1024 * 1024))
+			npages = atop(128 * 1024 * 1024);
+	} else if (npages > atop(VM_KERNEL_SPACE_SIZE) / 4)
+		npages = atop(VM_KERNEL_SPACE_SIZE) / 4;
 
 	nkmempages = npages;
 }
@@ -573,7 +574,8 @@ kmeminit(void)
 		bucket[indx].kb_highwat = 5 * bucket[indx].kb_elmpercl;
 	}
 	for (indx = 0; indx < M_LAST; indx++)
-		kmemstats[indx].ks_limit = nkmempages * PAGE_SIZE * 6 / 10;
+		kmemstats[indx].ks_limit =
+		    (long)nkmempages * PAGE_SIZE * 6 / 10;
 #endif
 }
 
diff --git a/sys/netinet/in_pcb.h b/sys/netinet/in_pcb.h
index 9c15b4138..b618a2e80 100644
--- a/sys/netinet/in_pcb.h
+++ b/sys/netinet/in_pcb.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in_pcb.h,v 1.143 2023/12/07 16:08:30 bluhm Exp $	*/
+/*	$OpenBSD: in_pcb.h,v 1.144 2023/12/15 00:24:56 bluhm Exp $	*/
 /*	$NetBSD: in_pcb.h,v 1.14 1996/02/13 23:42:00 christos Exp $	*/
 
 /*
@@ -107,14 +107,14 @@ struct inpcb {
 	TAILQ_ENTRY(inpcb) inp_queue;		/* [t] inet PCB queue */
 	SIMPLEQ_ENTRY(inpcb) inp_notify;	/* [y] notify or udp append */
 	struct	  inpcbtable *inp_table;	/* [I] inet queue/hash table */
-	union	  inpaddru inp_faddru;		/* Foreign address. */
-	union	  inpaddru inp_laddru;		/* Local address. */
+	union	  inpaddru inp_faddru;		/* [t] Foreign address. */
+	union	  inpaddru inp_laddru;		/* [t] Local address. */
 #define	inp_faddr	inp_faddru.iau_a4u.inaddr
 #define	inp_faddr6	inp_faddru.iau_addr6
 #define	inp_laddr	inp_laddru.iau_a4u.inaddr
 #define	inp_laddr6	inp_laddru.iau_addr6
-	u_int16_t inp_fport;		/* foreign port */
-	u_int16_t inp_lport;		/* local port */
+	u_int16_t inp_fport;		/* [t] foreign port */
+	u_int16_t inp_lport;		/* [t] local port */
 	struct	  socket *inp_socket;	/* [I] back pointer to socket */
 	caddr_t	  inp_ppcb;		/* pointer to per-protocol pcb */
 	union {				/* Route (notice increased size). */
@@ -159,7 +159,7 @@ struct inpcb {
 	struct	mbuf *(*inp_upcall)(void *, struct mbuf *,
 		    struct ip *, struct ip6_hdr *, void *, int);
 	void	*inp_upcall_arg;
-	u_int	inp_rtableid;
+	u_int	inp_rtableid;		/* [t] */
 	int	inp_pipex;		/* pipex indication */
 	uint16_t inp_flowid;
 };
diff --git a/sys/netinet/ip_gre.c b/sys/netinet/ip_gre.c
index 2da9deea7..9a27027be 100644
--- a/sys/netinet/ip_gre.c
+++ b/sys/netinet/ip_gre.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ip_gre.c,v 1.86 2023/04/08 13:50:22 mvs Exp $ */
+/*      $OpenBSD: ip_gre.c,v 1.87 2023/12/15 00:24:56 bluhm Exp $ */
 /*	$NetBSD: ip_gre.c,v 1.9 1999/10/25 19:18:11 drochner Exp $ */
 
 /*
@@ -85,7 +85,7 @@ gre_send(struct socket *so, struct mbuf *m, struct mbuf *nam,
 
 	if (inp->inp_pipex) {
 		struct sockaddr_in *sin4;
-		struct in_addr *ina_dst;
+		const struct in_addr *ina_dst;
 
 		ina_dst = NULL;
 		if ((so->so_state & SS_ISCONNECTED) != 0)
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 0dec3e000..05e13b135 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip.c,v 1.152 2023/11/26 22:08:10 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip.c,v 1.153 2023/12/15 00:24:56 bluhm Exp $	*/
 /*	$NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $	*/
 
 /*
@@ -545,7 +545,9 @@ rip_bind(struct socket *so, struct mbuf *nam, struct proc *p)
 	    ifa_ifwithaddr(sintosa(addr), inp->inp_rtableid)))
 		return (EADDRNOTAVAIL);
 
+	mtx_enter(&rawcbtable.inpt_mtx);
 	inp->inp_laddr = addr->sin_addr;
+	mtx_leave(&rawcbtable.inpt_mtx);
 
 	return (0);
 }
@@ -562,7 +564,9 @@ rip_connect(struct socket *so, struct mbuf *nam)
 	if ((error = in_nam2sin(nam, &addr)))
 		return (error);
 
+	mtx_enter(&rawcbtable.inpt_mtx);
 	inp->inp_faddr = addr->sin_addr;
+	mtx_leave(&rawcbtable.inpt_mtx);
 	soisconnected(so);
 
 	return (0);
@@ -579,7 +583,9 @@ rip_disconnect(struct socket *so)
 		return (ENOTCONN);
 
 	soisdisconnected(so);
+	mtx_enter(&rawcbtable.inpt_mtx);
 	inp->inp_faddr.s_addr = INADDR_ANY;
+	mtx_leave(&rawcbtable.inpt_mtx);
 
 	return (0);
 }
diff --git a/sys/netinet6/in6_src.c b/sys/netinet6/in6_src.c
index 2272c828c..88ec081e9 100644
--- a/sys/netinet6/in6_src.c
+++ b/sys/netinet6/in6_src.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: in6_src.c,v 1.89 2023/12/03 20:36:24 bluhm Exp $	*/
+/*	$OpenBSD: in6_src.c,v 1.90 2023/12/15 00:24:56 bluhm Exp $	*/
 /*	$KAME: in6_src.c,v 1.36 2001/02/06 04:08:17 itojun Exp $	*/
 
 /*
@@ -96,7 +96,7 @@ in6_pcbselsrc(const struct in6_addr **in6src, struct sockaddr_in6 *dstsock,
 {
 	struct ip6_moptions *mopts = inp->inp_moptions6;
 	struct route_in6 *ro = &inp->inp_route6;
-	struct in6_addr *laddr = &inp->inp_laddr6;
+	const struct in6_addr *laddr = &inp->inp_laddr6;
 	u_int rtableid = inp->inp_rtableid;
 	struct ifnet *ifp = NULL;
 	struct sockaddr	*ip6_source = NULL;
diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
index afbb6c737..6379e7947 100644
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip6.c,v 1.177 2023/12/03 20:36:24 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip6.c,v 1.178 2023/12/15 00:24:56 bluhm Exp $	*/
 /*	$KAME: raw_ip6.c,v 1.69 2001/03/04 15:55:44 itojun Exp $	*/
 
 /*
@@ -674,7 +674,10 @@ rip6_bind(struct socket *so, struct mbuf *nam, struct proc *p)
 	if ((error = in6_pcbaddrisavail(inp, addr, 0, p)))
 		return (error);
 
+	mtx_enter(&rawin6pcbtable.inpt_mtx);
 	inp->inp_laddr6 = addr->sin6_addr;
+	mtx_leave(&rawin6pcbtable.inpt_mtx);
+
 	return (0);
 }
 
@@ -696,9 +699,12 @@ rip6_connect(struct socket *so, struct mbuf *nam)
 	if (error)
 		return (error);
 
+	mtx_enter(&rawin6pcbtable.inpt_mtx);
 	inp->inp_laddr6 = *in6a;
 	inp->inp_faddr6 = addr->sin6_addr;
+	mtx_leave(&rawin6pcbtable.inpt_mtx);
 	soisconnected(so);
+
 	return (0);
 }
 
@@ -712,8 +718,11 @@ rip6_disconnect(struct socket *so)
 	if ((so->so_state & SS_ISCONNECTED) == 0)
 		return (ENOTCONN);
 
-	inp->inp_faddr6 = in6addr_any;
 	so->so_state &= ~SS_ISCONNECTED;	/* XXX */
+	mtx_enter(&rawin6pcbtable.inpt_mtx);
+	inp->inp_faddr6 = in6addr_any;
+	mtx_leave(&rawin6pcbtable.inpt_mtx);
+
 	return (0);
 }
 
diff --git a/usr.sbin/bgpd/rde.c b/usr.sbin/bgpd/rde.c
index ef631708a..b5ba5d720 100644
--- a/usr.sbin/bgpd/rde.c
+++ b/usr.sbin/bgpd/rde.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.c,v 1.612 2023/11/07 11:18:35 claudio Exp $ */
+/*	$OpenBSD: rde.c,v 1.613 2023/12/14 13:52:37 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
@@ -854,7 +854,7 @@ rde_dispatch_imsg_parent(struct imsgbuf *imsgbuf)
 		case IMSG_SOCKET_CONN:
 		case IMSG_SOCKET_CONN_CTL:
 		case IMSG_SOCKET_CONN_RTR:
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("expected to receive imsg fd "
 				    "but didn't receive any");
 				break;
@@ -1229,7 +1229,7 @@ rde_dispatch_imsg_parent(struct imsgbuf *imsgbuf)
 				break;
 			}
 			memcpy(&xmrt, imsg.data, sizeof(xmrt));
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				log_warnx("expected to receive fd for mrt dump "
 				    "but didn't receive any");
 			else if (xmrt.type == MRT_TABLE_DUMP ||
diff --git a/usr.sbin/bgpd/rtr.c b/usr.sbin/bgpd/rtr.c
index 0619e6a1f..8077e1094 100644
--- a/usr.sbin/bgpd/rtr.c
+++ b/usr.sbin/bgpd/rtr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtr.c,v 1.17 2023/11/07 11:18:35 claudio Exp $ */
+/*	$OpenBSD: rtr.c,v 1.18 2023/12/14 13:52:38 claudio Exp $ */
 
 /*
  * Copyright (c) 2020 Claudio Jeker <claudio@openbsd.org>
@@ -319,7 +319,7 @@ rtr_dispatch_imsg_parent(struct imsgbuf *imsgbuf)
 
 		switch (imsg.hdr.type) {
 		case IMSG_SOCKET_CONN_RTR:
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("expected to receive imsg fd "
 				    "but didn't receive any");
 				break;
@@ -335,7 +335,7 @@ rtr_dispatch_imsg_parent(struct imsgbuf *imsgbuf)
 			imsg_init(ibuf_rde, fd);
 			break;
 		case IMSG_SOCKET_CONN:
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("expected to receive imsg fd "
 				    "but didn't receive any");
 				break;
diff --git a/usr.sbin/bgpd/session.c b/usr.sbin/bgpd/session.c
index 7480937fc..c3029ac7f 100644
--- a/usr.sbin/bgpd/session.c
+++ b/usr.sbin/bgpd/session.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: session.c,v 1.455 2023/11/07 11:18:35 claudio Exp $ */
+/*	$OpenBSD: session.c,v 1.456 2023/12/14 13:52:38 claudio Exp $ */
 
 /*
  * Copyright (c) 2003, 2004, 2005 Henning Brauer <henning@openbsd.org>
@@ -2977,7 +2977,7 @@ session_dispatch_imsg(struct imsgbuf *imsgbuf, int idx, u_int *listener_cnt)
 		case IMSG_SOCKET_CONN_CTL:
 			if (idx != PFD_PIPE_MAIN)
 				fatalx("reconf request not from parent");
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("expected to receive imsg fd to "
 				    "RDE but didn't receive any");
 				break;
@@ -3037,7 +3037,7 @@ session_dispatch_imsg(struct imsgbuf *imsgbuf, int idx, u_int *listener_cnt)
 					fatalx("king bula sez: "
 					    "expected REINIT");
 
-				if ((nla->fd = imsg.fd) == -1)
+				if ((nla->fd = imsg_get_fd(&imsg)) == -1)
 					log_warnx("expected to receive fd for "
 					    "%s but didn't receive any",
 					    log_sockaddr((struct sockaddr *)
@@ -3066,17 +3066,17 @@ session_dispatch_imsg(struct imsgbuf *imsgbuf, int idx, u_int *listener_cnt)
 			    sizeof(restricted))
 				fatalx("RECONF_CTRL imsg with wrong len");
 			memcpy(&restricted, imsg.data, sizeof(restricted));
-			if (imsg.fd == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("expected to receive fd for control "
 				    "socket but didn't receive any");
 				break;
 			}
 			if (restricted) {
 				control_shutdown(rcsock);
-				rcsock = imsg.fd;
+				rcsock = fd;
 			} else {
 				control_shutdown(csock);
-				csock = imsg.fd;
+				csock = fd;
 			}
 			break;
 		case IMSG_RECONF_DRAIN:
@@ -3166,7 +3166,7 @@ session_dispatch_imsg(struct imsgbuf *imsgbuf, int idx, u_int *listener_cnt)
 			}
 
 			memcpy(&xmrt, imsg.data, sizeof(struct mrt));
-			if ((xmrt.wbuf.fd = imsg.fd) == -1)
+			if ((xmrt.wbuf.fd = imsg_get_fd(&imsg)) == -1)
 				log_warnx("expected to receive fd for mrt dump "
 				    "but didn't receive any");
 
diff --git a/usr.sbin/eigrpd/eigrpe.c b/usr.sbin/eigrpd/eigrpe.c
index ad5495df9..007ae6269 100644
--- a/usr.sbin/eigrpd/eigrpe.c
+++ b/usr.sbin/eigrpd/eigrpe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: eigrpe.c,v 1.40 2023/03/08 04:43:13 guenther Exp $ */
+/*	$OpenBSD: eigrpe.c,v 1.41 2023/12/14 11:09:56 claudio Exp $ */
 
 /*
  * Copyright (c) 2015 Renato Westphal <renato@openbsd.org>
@@ -289,7 +289,7 @@ eigrpe_dispatch_main(int fd, short event, void *bula)
 				    "to rde", __func__);
 				break;
 			}
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("%s: expected to receive imsg fd to "
 				    "rde but didn't receive any", __func__);
 				break;
diff --git a/usr.sbin/eigrpd/packet.c b/usr.sbin/eigrpd/packet.c
index 9a2e51789..dcf97cb42 100644
--- a/usr.sbin/eigrpd/packet.c
+++ b/usr.sbin/eigrpd/packet.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: packet.c,v 1.22 2023/07/03 10:34:31 claudio Exp $ */
+/*	$OpenBSD: packet.c,v 1.23 2023/12/14 10:02:27 claudio Exp $ */
 
 /*
  * Copyright (c) 2015 Renato Westphal <renato@openbsd.org>
@@ -24,6 +24,7 @@
 
 #include <arpa/inet.h>
 #include <errno.h>
+#include <stddef.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -160,26 +161,39 @@ send_packet(struct eigrp_iface *ei, struct nbr *nbr, uint32_t flags,
 {
 	struct eigrp		*eigrp = ei->eigrp;
 	struct iface		*iface = ei->iface;
-	struct eigrp_hdr	*eigrp_hdr;
+	struct ibuf		 ebuf;
+	struct eigrp_hdr	 eigrp_hdr;
 
 	if (!(iface->flags & IFF_UP) || !LINK_STATE_IS_UP(iface->linkstate))
 		return (-1);
 
 	/* update ack number, flags and checksum */
-	if ((eigrp_hdr = ibuf_seek(buf, 0, sizeof(*eigrp_hdr))) == NULL)
-                fatalx("send_packet: buf_seek failed");
 	if (nbr) {
-		eigrp_hdr->ack_num = htonl(nbr->recv_seq);
+		if (ibuf_set_n32(buf, offsetof(struct eigrp_hdr, ack_num),
+		    nbr->recv_seq) == -1)
+			fatalx("send_packet: set of ack_num failed");
 		rtp_ack_stop_timer(nbr);
 	}
-	if (flags)
-		eigrp_hdr->flags |= htonl(flags);
 
-	eigrp_hdr->chksum = 0;
-	eigrp_hdr->chksum = in_cksum(ibuf_data(buf), ibuf_size(buf));
+	ibuf_from_ibuf(buf, &ebuf);
+	if (ibuf_get(&ebuf, &eigrp_hdr, sizeof(eigrp_hdr)) == -1)
+		fatalx("send_packet: get hdr failed");
+
+	if (flags) {
+		flags |= ntohl(eigrp_hdr.flags);
+		if (ibuf_set_n32(buf, offsetof(struct eigrp_hdr, flags),
+		    flags) == -1)
+			fatalx("send_packet: set of flags failed");
+	}
+
+	if (ibuf_set_n16(buf, offsetof(struct eigrp_hdr, chksum), 0) == -1)
+		fatalx("send_packet: set of chksum failed");
+	if (ibuf_set_n16(buf, offsetof(struct eigrp_hdr, chksum),
+	    in_cksum(ibuf_data(buf), ibuf_size(buf))) == -1)
+		fatalx("send_packet: set of chksum failed");
 
 	/* log packet being sent */
-	if (eigrp_hdr->opcode != EIGRP_OPC_HELLO) {
+	if (eigrp_hdr.opcode != EIGRP_OPC_HELLO) {
 		char	buffer[64];
 
 		if (nbr)
@@ -189,9 +203,9 @@ send_packet(struct eigrp_iface *ei, struct nbr *nbr, uint32_t flags,
 			snprintf(buffer, sizeof(buffer), "(multicast)");
 
 		log_debug("%s: type %s iface %s %s AS %u seq %u ack %u",
-		    __func__, opcode_name(eigrp_hdr->opcode), iface->name,
-		    buffer, ntohs(eigrp_hdr->as), ntohl(eigrp_hdr->seq_num),
-		    ntohl(eigrp_hdr->ack_num));
+		    __func__, opcode_name(eigrp_hdr.opcode), iface->name,
+		    buffer, ntohs(eigrp_hdr.as), ntohl(eigrp_hdr.seq_num),
+		    ntohl(eigrp_hdr.ack_num));
 	}
 
 	switch (eigrp->af) {
@@ -207,9 +221,9 @@ send_packet(struct eigrp_iface *ei, struct nbr *nbr, uint32_t flags,
 		fatalx("send_packet: unknown af");
 	}
 
-	switch (eigrp_hdr->opcode) {
+	switch (eigrp_hdr.opcode) {
 	case EIGRP_OPC_HELLO:
-		if (ntohl(eigrp_hdr->ack_num) == 0)
+		if (ntohl(eigrp_hdr.ack_num) == 0)
 			ei->eigrp->stats.hellos_sent++;
 		else
 			ei->eigrp->stats.acks_sent++;
diff --git a/usr.sbin/eigrpd/rde.c b/usr.sbin/eigrpd/rde.c
index b14d967ba..383a3ee57 100644
--- a/usr.sbin/eigrpd/rde.c
+++ b/usr.sbin/eigrpd/rde.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde.c,v 1.25 2023/03/08 04:43:13 guenther Exp $ */
+/*	$OpenBSD: rde.c,v 1.26 2023/12/14 11:09:56 claudio Exp $ */
 
 /*
  * Copyright (c) 2015 Renato Westphal <renato@openbsd.org>
@@ -354,7 +354,7 @@ rde_dispatch_parent(int fd, short event, void *bula)
 				    "to eigrpe", __func__);
 				break;
 			}
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("%s: expected to receive imsg fd to "
 				    "eigrpe but didn't receive any", __func__);
 				break;
diff --git a/usr.sbin/ldpd/lde.c b/usr.sbin/ldpd/lde.c
index 4eb4c08f7..1f41a59d6 100644
--- a/usr.sbin/ldpd/lde.c
+++ b/usr.sbin/ldpd/lde.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lde.c,v 1.76 2023/03/08 04:43:13 guenther Exp $ */
+/*	$OpenBSD: lde.c,v 1.77 2023/12/14 11:10:19 claudio Exp $ */
 
 /*
  * Copyright (c) 2013, 2016 Renato Westphal <renato@openbsd.org>
@@ -452,7 +452,7 @@ lde_dispatch_parent(int fd, short event, void *bula)
 				    "to ldpe", __func__);
 				break;
 			}
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("%s: expected to receive imsg fd to "
 				    "ldpe but didn't receive any", __func__);
 				break;
diff --git a/usr.sbin/ldpd/ldpe.c b/usr.sbin/ldpd/ldpe.c
index 1e7fde783..b69ec6381 100644
--- a/usr.sbin/ldpd/ldpe.c
+++ b/usr.sbin/ldpd/ldpe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ldpe.c,v 1.81 2023/03/08 04:43:13 guenther Exp $ */
+/*	$OpenBSD: ldpe.c,v 1.82 2023/12/14 11:10:19 claudio Exp $ */
 
 /*
  * Copyright (c) 2013, 2016 Renato Westphal <renato@openbsd.org>
@@ -296,7 +296,7 @@ ldpe_dispatch_main(int fd, short event, void *bula)
 				    "to lde", __func__);
 				break;
 			}
-			if ((fd = imsg.fd) == -1) {
+			if ((fd = imsg_get_fd(&imsg)) == -1) {
 				log_warnx("%s: expected to receive imsg fd to "
 				    "lde but didn't receive any", __func__);
 				break;
@@ -340,13 +340,13 @@ ldpe_dispatch_main(int fd, short event, void *bula)
 
 			switch (*socket_type) {
 			case LDP_SOCKET_DISC:
-				disc_socket = imsg.fd;
+				disc_socket = imsg_get_fd(&imsg);
 				break;
 			case LDP_SOCKET_EDISC:
-				edisc_socket = imsg.fd;
+				edisc_socket = imsg_get_fd(&imsg);
 				break;
 			case LDP_SOCKET_SESSION:
-				session_socket = imsg.fd;
+				session_socket = imsg_get_fd(&imsg);
 				break;
 			}
 			break;
diff --git a/usr.sbin/rad/engine.c b/usr.sbin/rad/engine.c
index ceb11d574..1205509d6 100644
--- a/usr.sbin/rad/engine.c
+++ b/usr.sbin/rad/engine.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: engine.c,v 1.21 2022/10/15 13:26:15 florian Exp $	*/
+/*	$OpenBSD: engine.c,v 1.22 2023/12/14 11:09:34 claudio Exp $	*/
 
 /*
  * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
@@ -304,7 +304,7 @@ engine_dispatch_main(int fd, short event, void *bula)
 				fatalx("%s: received unexpected imsg fd "
 				    "to engine", __func__);
 
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg fd to "
 				   "engine but didn't receive any", __func__);
 
diff --git a/usr.sbin/rad/frontend.c b/usr.sbin/rad/frontend.c
index 66ebf0c8f..daeb49d05 100644
--- a/usr.sbin/rad/frontend.c
+++ b/usr.sbin/rad/frontend.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: frontend.c,v 1.42 2022/12/28 21:30:18 jmc Exp $	*/
+/*	$OpenBSD: frontend.c,v 1.43 2023/12/14 11:09:34 claudio Exp $	*/
 
 /*
  * Copyright (c) 2018 Florian Obser <florian@openbsd.org>
@@ -339,7 +339,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			if (iev_engine)
 				fatalx("%s: received unexpected imsg fd to "
 				    "frontend", __func__);
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg fd to "
 				   "frontend but didn't receive any",
 				   __func__);
@@ -465,7 +465,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			nconf = NULL;
 			break;
 		case IMSG_ICMP6SOCK:
-			if ((icmp6sock = imsg.fd) == -1)
+			if ((icmp6sock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "ICMPv6 fd but didn't receive any",
 				    __func__);
@@ -479,7 +479,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			if (routesock != -1)
 				fatalx("%s: received unexpected routesock fd",
 				    __func__);
-			if ((routesock = imsg.fd) == -1)
+			if ((routesock = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "routesocket fd but didn't receive any",
 				    __func__);
@@ -490,7 +490,7 @@ frontend_dispatch_main(int fd, short event, void *bula)
 			frontend_startup();
 			break;
 		case IMSG_CONTROLFD:
-			if ((fd = imsg.fd) == -1)
+			if ((fd = imsg_get_fd(&imsg)) == -1)
 				fatalx("%s: expected to receive imsg "
 				    "control fd but didn't receive any",
 				    __func__);
diff --git a/usr.sbin/rpki-client/cert.c b/usr.sbin/rpki-client/cert.c
index f9add47d3..f695f8370 100644
--- a/usr.sbin/rpki-client/cert.c
+++ b/usr.sbin/rpki-client/cert.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cert.c,v 1.120 2023/12/10 14:18:23 job Exp $ */
+/*	$OpenBSD: cert.c,v 1.121 2023/12/14 07:52:53 tb Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2021 Job Snijders <job@openbsd.org>
@@ -362,11 +362,20 @@ sbgp_parse_ipaddrblk(const char *fn, const IPAddrBlocks *addrblk,
 	enum afi		 afi;
 	struct cert_ip		*ips = NULL;
 	size_t			 ipsz = 0, sz;
-	int			 i, j;
+	int			 ipv4_seen = 0, ipv6_seen = 0;
+	int			 i, j, ipaddrblocksz;
 
 	assert(*out_ips == NULL && *out_ipsz == 0);
 
-	for (i = 0; i < sk_IPAddressFamily_num(addrblk); i++) {
+	ipaddrblocksz = sk_IPAddressFamily_num(addrblk);
+	if (ipaddrblocksz != 1 && ipaddrblocksz != 2) {
+		warnx("%s: RFC 6487 section 4.8.10: unexpected number of "
+		    "ipAddrBlocks (got %d, expected 1 or 2)",
+		    fn, ipaddrblocksz);
+		goto out;
+	}
+
+	for (i = 0; i < ipaddrblocksz; i++) {
 		af = sk_IPAddressFamily_value(addrblk, i);
 
 		switch (af->ipAddressChoice->type) {
@@ -400,6 +409,23 @@ sbgp_parse_ipaddrblk(const char *fn, const IPAddrBlocks *addrblk,
 			goto out;
 		}
 
+		switch(afi) {
+		case AFI_IPV4:
+			if (ipv4_seen++ > 0) {
+				warnx("%s: RFC 6487 section 4.8.10: "
+				    "IPv4 appears twice", fn);
+				goto out;
+			}
+			break;
+		case AFI_IPV6:
+			if (ipv6_seen++ > 0) {
+				warnx("%s: RFC 6487 section 4.8.10: "
+				    "IPv6 appears twice", fn);
+				goto out;
+			}
+			break;
+		}
+
 		if (aors == NULL) {
 			if (!sbgp_addr_inherit(fn, ips, &ipsz, afi))
 				goto out;
diff --git a/usr.sbin/rpki-client/roa.c b/usr.sbin/rpki-client/roa.c
index 93838d120..6e19ca7c5 100644
--- a/usr.sbin/rpki-client/roa.c
+++ b/usr.sbin/rpki-client/roa.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: roa.c,v 1.71 2023/10/13 12:06:49 job Exp $ */
+/*	$OpenBSD: roa.c,v 1.72 2023/12/14 07:52:53 tb Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -104,7 +104,7 @@ roa_parse_econtent(const unsigned char *d, size_t dsz, struct parse *p)
 	RouteOriginAttestation		*roa;
 	const ROAIPAddressFamily	*addrfam;
 	const STACK_OF(ROAIPAddress)	*addrs;
-	int				 addrsz;
+	int				 addrsz, ipv4_seen = 0, ipv6_seen = 0;
 	enum afi			 afi;
 	const ROAIPAddress		*addr;
 	uint64_t			 maxlen;
@@ -129,8 +129,8 @@ roa_parse_econtent(const unsigned char *d, size_t dsz, struct parse *p)
 	}
 
 	ipaddrblocksz = sk_ROAIPAddressFamily_num(roa->ipAddrBlocks);
-	if (ipaddrblocksz > 2) {
-		warnx("%s: draft-rfc6482bis: too many ipAddrBlocks "
+	if (ipaddrblocksz != 1 && ipaddrblocksz != 2) {
+		warnx("%s: draft-rfc6482bis: unexpected number of ipAddrBlocks "
 		    "(got %d, expected 1 or 2)", p->fn, ipaddrblocksz);
 		goto out;
 	}
@@ -146,6 +146,29 @@ roa_parse_econtent(const unsigned char *d, size_t dsz, struct parse *p)
 			goto out;
 		}
 
+		switch(afi) {
+		case AFI_IPV4:
+			if (ipv4_seen++ > 0) {
+				warnx("%s: RFC 6482bis section 4.3.2: "
+				    "IPv4 appears twice", p->fn);
+				goto out;
+			}
+			break;
+		case AFI_IPV6:
+			if (ipv6_seen++ > 0) {
+				warnx("%s: RFC 6482bis section 4.3.2: "
+				    "IPv6 appears twice", p->fn);
+				goto out;
+			}
+			break;
+		}
+
+		if (addrsz == 0) {
+			warnx("%s: RFC 6482bis, section 4.3.2: "
+			    "empty ROAIPAddressFamily", p->fn);
+			goto out;
+		}
+
 		if (p->res->ipsz + addrsz >= MAX_IP_SIZE) {
 			warnx("%s: too many ROAIPAddress entries: limit %d",
 			    p->fn, MAX_IP_SIZE);