From 492219ffd1dcd53b3806e9a1e8a4f2559d6eaaaa Mon Sep 17 00:00:00 2001
From: purplerain <purplerain@secbsd.org>
Date: Fri, 10 May 2024 01:59:48 +0000
Subject: [PATCH] sync with OpenBSD -current

---
 lib/libcrypto/dh/dh_key.c                    |  69 ++-
 lib/libcrypto/dsa/dsa_ossl.c                 |  42 +-
 lib/libcrypto/x509/x509_req.c                |  97 ++--
 lib/libssl/man/ssl.3                         |   6 +-
 lib/libssl/ssl_ciph.c                        |  11 +-
 lib/libssl/ssl_seclevel.c                    |  19 +-
 libexec/ftpd/ftpd.c                          |   8 +-
 libexec/mail.local/mail.local.c              |   7 +-
 libexec/spamd/spamd.c                        |   3 +-
 sbin/dump/itime.c                            |  33 +-
 sbin/dump/main.c                             |  16 +-
 sbin/dump/optr.c                             |   9 +-
 sbin/dump/tape.c                             |  11 +-
 sbin/dumpfs/dumpfs.c                         |  46 +-
 sbin/fsck_ext2fs/inode.c                     |   7 +-
 sbin/fsck_ext2fs/pass1.c                     |  10 +-
 sbin/fsck_ffs/inode.c                        |   7 +-
 sbin/fsdb/fsdbutil.c                         |  24 +-
 sbin/fsirand/fsirand.c                       |  11 +-
 sbin/mount/mount.c                           |   9 +-
 sbin/pfctl/pfctl_table.c                     |  36 +-
 sbin/restore/tape.c                          |  31 +-
 sbin/route/route.c                           |   9 +-
 sbin/savecore/savecore.c                     |  10 +-
 sbin/scan_ffs/scan_ffs.c                     |  48 +-
 sbin/sysctl/sysctl.c                         |  18 +-
 sbin/unwind/libunbound/validator/autotrust.c |   6 +-
 share/man/man3/intro.3                       |  10 +-
 sys/arch/amd64/conf/GENERIC                  |   3 +-
 sys/arch/amd64/conf/RAMDISK_CD               |   3 +-
 sys/dev/ic/ufshci.c                          | 444 ++++++++++---------
 sys/dev/ic/ufshcireg.h                       |  15 +-
 sys/dev/ic/ufshcivar.h                       |   8 +-
 usr.bin/ssh/clientloop.c                     |  49 +-
 usr.sbin/acme-client/key.c                   |  77 ++--
 35 files changed, 666 insertions(+), 546 deletions(-)

diff --git a/lib/libcrypto/dh/dh_key.c b/lib/libcrypto/dh/dh_key.c
index 296050ba7..6e2ecf51d 100644
--- a/lib/libcrypto/dh/dh_key.c
+++ b/lib/libcrypto/dh/dh_key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dh_key.c,v 1.40 2023/08/03 18:53:55 tb Exp $ */
+/* $OpenBSD: dh_key.c,v 1.42 2024/05/09 20:43:36 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -65,43 +65,6 @@
 #include "bn_local.h"
 #include "dh_local.h"
 
-static int generate_key(DH *dh);
-static int compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh);
-static int dh_bn_mod_exp(const DH *dh, BIGNUM *r, const BIGNUM *a,
-	    const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
-static int dh_init(DH *dh);
-static int dh_finish(DH *dh);
-
-int
-DH_generate_key(DH *dh)
-{
-	return dh->meth->generate_key(dh);
-}
-LCRYPTO_ALIAS(DH_generate_key);
-
-int
-DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
-{
-	return dh->meth->compute_key(key, pub_key, dh);
-}
-LCRYPTO_ALIAS(DH_compute_key);
-
-static DH_METHOD dh_ossl = {
-	.name = "OpenSSL DH Method",
-	.generate_key = generate_key,
-	.compute_key = compute_key,
-	.bn_mod_exp = dh_bn_mod_exp,
-	.init = dh_init,
-	.finish = dh_finish,
-};
-
-const DH_METHOD *
-DH_OpenSSL(void)
-{
-	return &dh_ossl;
-}
-LCRYPTO_ALIAS(DH_OpenSSL);
-
 static int
 generate_key(DH *dh)
 {
@@ -245,3 +208,33 @@ dh_finish(DH *dh)
 	BN_MONT_CTX_free(dh->method_mont_p);
 	return 1;
 }
+
+int
+DH_generate_key(DH *dh)
+{
+	return dh->meth->generate_key(dh);
+}
+LCRYPTO_ALIAS(DH_generate_key);
+
+int
+DH_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh)
+{
+	return dh->meth->compute_key(key, pub_key, dh);
+}
+LCRYPTO_ALIAS(DH_compute_key);
+
+static const DH_METHOD dh_ossl = {
+	.name = "OpenSSL DH Method",
+	.generate_key = generate_key,
+	.compute_key = compute_key,
+	.bn_mod_exp = dh_bn_mod_exp,
+	.init = dh_init,
+	.finish = dh_finish,
+};
+
+const DH_METHOD *
+DH_OpenSSL(void)
+{
+	return &dh_ossl;
+}
+LCRYPTO_ALIAS(DH_OpenSSL);
diff --git a/lib/libcrypto/dsa/dsa_ossl.c b/lib/libcrypto/dsa/dsa_ossl.c
index b92d0b8ce..943d03879 100644
--- a/lib/libcrypto/dsa/dsa_ossl.c
+++ b/lib/libcrypto/dsa/dsa_ossl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa_ossl.c,v 1.53 2023/08/03 18:53:55 tb Exp $ */
+/* $OpenBSD: dsa_ossl.c,v 1.55 2024/05/09 20:57:49 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -69,30 +69,6 @@
 #include "bn_local.h"
 #include "dsa_local.h"
 
-static DSA_SIG *dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
-static int dsa_sign_setup(DSA *dsa, BN_CTX *ctx_in, BIGNUM **kinvp,
-    BIGNUM **rp);
-static int dsa_do_verify(const unsigned char *dgst, int dgst_len, DSA_SIG *sig,
-    DSA *dsa);
-static int dsa_init(DSA *dsa);
-static int dsa_finish(DSA *dsa);
-
-static DSA_METHOD openssl_dsa_meth = {
-	.name = "OpenSSL DSA method",
-	.dsa_do_sign = dsa_do_sign,
-	.dsa_sign_setup = dsa_sign_setup,
-	.dsa_do_verify = dsa_do_verify,
-	.init = dsa_init,
-	.finish = dsa_finish,
-};
-
-const DSA_METHOD *
-DSA_OpenSSL(void)
-{
-	return &openssl_dsa_meth;
-}
-LCRYPTO_ALIAS(DSA_OpenSSL);
-
 /*
  * Since DSA parameters are entirely arbitrary and checking them to be
  * consistent is very expensive, we cannot do so on every sign operation.
@@ -436,6 +412,22 @@ dsa_finish(DSA *dsa)
 	return 1;
 }
 
+static const DSA_METHOD openssl_dsa_meth = {
+	.name = "OpenSSL DSA method",
+	.dsa_do_sign = dsa_do_sign,
+	.dsa_sign_setup = dsa_sign_setup,
+	.dsa_do_verify = dsa_do_verify,
+	.init = dsa_init,
+	.finish = dsa_finish,
+};
+
+const DSA_METHOD *
+DSA_OpenSSL(void)
+{
+	return &openssl_dsa_meth;
+}
+LCRYPTO_ALIAS(DSA_OpenSSL);
+
 DSA_SIG *
 DSA_SIG_new(void)
 {
diff --git a/lib/libcrypto/x509/x509_req.c b/lib/libcrypto/x509/x509_req.c
index 34e052341..a21542c3b 100644
--- a/lib/libcrypto/x509/x509_req.c
+++ b/lib/libcrypto/x509/x509_req.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_req.c,v 1.36 2024/05/08 08:20:08 tb Exp $ */
+/* $OpenBSD: x509_req.c,v 1.41 2024/05/09 14:29:08 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -70,54 +70,52 @@
 #include <openssl/pem.h>
 #include <openssl/x509.h>
 
+#include "asn1_local.h"
 #include "evp_local.h"
 #include "x509_local.h"
 
 X509_REQ *
-X509_to_X509_REQ(X509 *x, EVP_PKEY *pkey, const EVP_MD *md)
+X509_to_X509_REQ(X509 *x509, EVP_PKEY *signing_key, const EVP_MD *signing_md)
 {
-	X509_REQ *ret;
-	int i;
-	EVP_PKEY *pktmp;
+	X509_REQ *req;
+	X509_NAME *subject;
+	EVP_PKEY *public_key;
 
-	ret = X509_REQ_new();
-	if (ret == NULL) {
+	if ((req = X509_REQ_new()) == NULL) {
 		X509error(ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
 
-	if (!X509_REQ_set_version(ret, 0))
+	if ((subject = X509_get_subject_name(x509)) == NULL)
+		goto err;
+	if (!X509_REQ_set_subject_name(req, subject))
 		goto err;
 
-	if (!X509_REQ_set_subject_name(ret, X509_get_subject_name(x)))
+	if ((public_key = X509_get0_pubkey(x509)) == NULL)
+		goto err;
+	if (!X509_REQ_set_pubkey(req, public_key))
 		goto err;
 
-	if ((pktmp = X509_get_pubkey(x)) == NULL)
-		goto err;
-
-	i = X509_REQ_set_pubkey(ret, pktmp);
-	EVP_PKEY_free(pktmp);
-	if (!i)
-		goto err;
-
-	if (pkey != NULL) {
-		if (!X509_REQ_sign(ret, pkey, md))
+	if (signing_key != NULL) {
+		if (!X509_REQ_sign(req, signing_key, signing_md))
 			goto err;
 	}
-	return (ret);
 
-err:
-	X509_REQ_free(ret);
-	return (NULL);
+	return req;
+
+ err:
+	X509_REQ_free(req);
+
+	return NULL;
 }
 LCRYPTO_ALIAS(X509_to_X509_REQ);
 
 EVP_PKEY *
 X509_REQ_get_pubkey(X509_REQ *req)
 {
-	if ((req == NULL) || (req->req_info == NULL))
-		return (NULL);
-	return (X509_PUBKEY_get(req->req_info->pubkey));
+	if (req == NULL || req->req_info == NULL)
+		return NULL;
+	return X509_PUBKEY_get(req->req_info->pubkey);
 }
 LCRYPTO_ALIAS(X509_REQ_get_pubkey);
 
@@ -131,42 +129,43 @@ X509_REQ_get0_pubkey(X509_REQ *req)
 LCRYPTO_ALIAS(X509_REQ_get0_pubkey);
 
 int
-X509_REQ_check_private_key(X509_REQ *x, EVP_PKEY *k)
+X509_REQ_check_private_key(X509_REQ *req, EVP_PKEY *pkey)
 {
-	EVP_PKEY *xk = NULL;
-	int ok = 0;
+	EVP_PKEY *req_pubkey = NULL;
+	int ret;
 
-	if ((xk = X509_REQ_get0_pubkey(x)) == NULL)
+	if ((req_pubkey = X509_REQ_get0_pubkey(req)) == NULL)
 		return 0;
 
-	switch (EVP_PKEY_cmp(xk, k)) {
-	case 1:
-		ok = 1;
-		break;
+	if ((ret = EVP_PKEY_cmp(req_pubkey, pkey)) == 1)
+		return 1;
+
+	switch (ret) {
 	case 0:
 		X509error(X509_R_KEY_VALUES_MISMATCH);
-		break;
+		return 0;
 	case -1:
 		X509error(X509_R_KEY_TYPE_MISMATCH);
-		break;
+		return 0;
 	case -2:
 #ifndef OPENSSL_NO_EC
-		if (k->type == EVP_PKEY_EC) {
+		if (pkey->type == EVP_PKEY_EC) {
 			X509error(ERR_R_EC_LIB);
-			break;
+			return 0;
 		}
 #endif
 #ifndef OPENSSL_NO_DH
-		if (k->type == EVP_PKEY_DH) {
+		if (pkey->type == EVP_PKEY_DH) {
 			/* No idea */
 			X509error(X509_R_CANT_CHECK_DH_KEY);
-			break;
+			return 0;
 		}
 #endif
 		X509error(X509_R_UNKNOWN_KEY_TYPE);
+		return 0;
 	}
 
-	return (ok);
+	return 0;
 }
 LCRYPTO_ALIAS(X509_REQ_check_private_key);
 
@@ -183,7 +182,6 @@ X509_REQ_get_extensions(X509_REQ *req)
 	X509_ATTRIBUTE *attr;
 	ASN1_TYPE *ext = NULL;
 	int idx;
-	const unsigned char *p;
 
 	if (req == NULL || req->req_info == NULL)
 		return NULL;
@@ -197,10 +195,8 @@ X509_REQ_get_extensions(X509_REQ *req)
 		return NULL;
 	if ((ext = X509_ATTRIBUTE_get0_type(attr, 0)) == NULL)
 		return NULL;
-	if (ext->type != V_ASN1_SEQUENCE)
-		return NULL;
-	p = ext->value.sequence->data;
-	return d2i_X509_EXTENSIONS(NULL, &p, ext->value.sequence->length);
+
+	return ASN1_TYPE_unpack_sequence(&X509_EXTENSIONS_it, ext);
 }
 LCRYPTO_ALIAS(X509_REQ_get_extensions);
 
@@ -215,16 +211,15 @@ X509_REQ_add_extensions_nid(X509_REQ *req, STACK_OF(X509_EXTENSION) *exts,
 {
 	unsigned char *ext = NULL;
 	int extlen;
-	int rv;
+	int ret;
 
-	extlen = i2d_X509_EXTENSIONS(exts, &ext);
-	if (extlen <= 0)
+	if ((extlen = i2d_X509_EXTENSIONS(exts, &ext)) <= 0)
 		return 0;
 
-	rv = X509_REQ_add1_attr_by_NID(req, nid, V_ASN1_SEQUENCE, ext, extlen);
+	ret = X509_REQ_add1_attr_by_NID(req, nid, V_ASN1_SEQUENCE, ext, extlen);
 	free(ext);
 
-	return rv;
+	return ret;
 }
 LCRYPTO_ALIAS(X509_REQ_add_extensions_nid);
 
diff --git a/lib/libssl/man/ssl.3 b/lib/libssl/man/ssl.3
index eb4e7b8a9..0c793d780 100644
--- a/lib/libssl/man/ssl.3
+++ b/lib/libssl/man/ssl.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssl.3,v 1.23 2024/05/08 09:41:33 tb Exp $
+.\" $OpenBSD: ssl.3,v 1.24 2024/05/09 17:57:36 jmc Exp $
 .\" full merge up to: OpenSSL e330f55d Nov 11 00:51:04 2016 +0100
 .\" selective merge up to: OpenSSL 322755cc Sep 1 08:40:51 2018 +0800
 .\"
@@ -51,7 +51,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: May 8 2024 $
+.Dd $Mdocdate: May 9 2024 $
 .Dt SSL 3
 .Os
 .Sh NAME
@@ -61,7 +61,7 @@
 The
 .Nm ssl
 library implements the Transport Layer Security (TLS) protocol,
-the successor to the secure sockets layer (SSL) protocol.
+the successor to the Secure Sockets Layer (SSL) protocol.
 .Pp
 An
 .Vt SSL_CTX
diff --git a/lib/libssl/ssl_ciph.c b/lib/libssl/ssl_ciph.c
index 45d7889b9..a01465d9e 100644
--- a/lib/libssl/ssl_ciph.c
+++ b/lib/libssl/ssl_ciph.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_ciph.c,v 1.140 2024/03/02 11:45:51 tb Exp $ */
+/* $OpenBSD: ssl_ciph.c,v 1.142 2024/05/09 07:55:48 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -522,8 +522,7 @@ ssl_get_handshake_evp_md(SSL *s, const EVP_MD **md)
 	if (s->s3->hs.cipher == NULL)
 		return 0;
 
-	handshake_mac = s->s3->hs.cipher->algorithm2 &
-	    SSL_HANDSHAKE_MAC_MASK;
+	handshake_mac = s->s3->hs.cipher->algorithm2 & SSL_HANDSHAKE_MAC_MASK;
 
 	/* For TLSv1.2 we upgrade the default MD5+SHA1 MAC to SHA256. */
 	if (SSL_USE_SHA256_PRF(s) && handshake_mac == SSL_HANDSHAKE_MAC_DEFAULT)
@@ -1344,7 +1343,7 @@ ssl_create_cipher_list(const SSL_METHOD *ssl_method,
 char *
 SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
 {
-	unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl, alg2;
+	unsigned long alg_mkey, alg_auth, alg_enc, alg_mac, alg_ssl;
 	const char *ver, *kx, *au, *enc, *mac;
 	char *ret;
 	int l;
@@ -1355,8 +1354,6 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
 	alg_mac = cipher->algorithm_mac;
 	alg_ssl = cipher->algorithm_ssl;
 
-	alg2 = cipher->algorithm2;
-
 	if (alg_ssl & SSL_SSLV3)
 		ver = "SSLv3";
 	else if (alg_ssl & SSL_TLSV1_2)
@@ -1409,7 +1406,7 @@ SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
 		enc = "3DES(168)";
 		break;
 	case SSL_RC4:
-		enc = alg2 & SSL2_CF_8_BYTE_ENC ? "RC4(64)" : "RC4(128)";
+		enc = "RC4(128)";
 		break;
 	case SSL_eNULL:
 		enc = "None";
diff --git a/lib/libssl/ssl_seclevel.c b/lib/libssl/ssl_seclevel.c
index 1869c8108..6a5d16bfa 100644
--- a/lib/libssl/ssl_seclevel.c
+++ b/lib/libssl/ssl_seclevel.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ssl_seclevel.c,v 1.27 2022/11/26 16:08:56 tb Exp $ */
+/*	$OpenBSD: ssl_seclevel.c,v 1.28 2024/05/09 07:12:03 tb Exp $ */
 /*
  * Copyright (c) 2020-2022 Theo Buehler <tb@openbsd.org>
  *
@@ -445,19 +445,26 @@ ssl_security_group(const SSL *ssl, uint16_t group_id, int secop)
 	int bits, nid;
 	uint8_t group[2];
 
+	memset(&cbb, 0, sizeof(cbb));
+
 	if (!tls1_ec_group_id2bits(group_id, &bits))
-		return 0;
+		goto err;
 	if (!tls1_ec_group_id2nid(group_id, &nid))
-		return 0;
+		goto err;
 
 	if (!CBB_init_fixed(&cbb, group, sizeof(group)))
-		return 0;
+		goto err;
 	if (!CBB_add_u16(&cbb, group_id))
-		return 0;
+		goto err;
 	if (!CBB_finish(&cbb, NULL, NULL))
-		return 0;
+		goto err;
 
 	return ssl_security(ssl, secop, bits, nid, group);
+
+ err:
+	CBB_cleanup(&cbb);
+
+	return 0;
 }
 
 int
diff --git a/libexec/ftpd/ftpd.c b/libexec/ftpd/ftpd.c
index 810933525..e77a4efcc 100644
--- a/libexec/ftpd/ftpd.c
+++ b/libexec/ftpd/ftpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ftpd.c,v 1.233 2023/03/08 04:43:05 guenther Exp $	*/
+/*	$OpenBSD: ftpd.c,v 1.234 2024/05/09 08:35:03 florian Exp $	*/
 /*	$NetBSD: ftpd.c,v 1.15 1995/06/03 22:46:47 mycroft Exp $	*/
 
 /*
@@ -2739,7 +2739,10 @@ logxfer(const char *name, off_t size, time_t start)
 	int len;
 
 	if ((statfd >= 0) && (getcwd(dir, sizeof(dir)) != NULL)) {
+		char *cnow;
+
 		time(&now);
+		cnow = ctime(&now);
 
 		vpw = malloc(strlen(guest ? guestpw : pw->pw_name) * 4 + 1);
 		if (vpw == NULL)
@@ -2755,7 +2758,8 @@ logxfer(const char *name, off_t size, time_t start)
 
 		len = snprintf(buf, sizeof(buf),
 		    "%.24s %lld %s %lld %s %c %s %c %c %s ftp %d %s %s\n",
-		    ctime(&now), (long long)(now - start + (now == start)),
+		    cnow ? cnow : "?",
+		    (long long)(now - start + (now == start)),
 		    vremotehost, (long long)size, vpath,
 		    ((type == TYPE_A) ? 'a' : 'b'), "*" /* none yet */,
 		    'o', ((guest) ? 'a' : 'r'),
diff --git a/libexec/mail.local/mail.local.c b/libexec/mail.local/mail.local.c
index 7d0dfb4ab..8289dad5d 100644
--- a/libexec/mail.local/mail.local.c
+++ b/libexec/mail.local/mail.local.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mail.local.c,v 1.42 2023/06/05 08:07:18 op Exp $	*/
+/*	$OpenBSD: mail.local.c,v 1.43 2024/05/09 08:35:03 florian Exp $	*/
 
 /*-
  * Copyright (c) 1996-1998 Theo de Raadt <deraadt@theos.com>
@@ -112,7 +112,7 @@ storemail(char *from)
 	FILE *fp = NULL;
 	time_t tval;
 	int fd, eline = 1;
-	char *tbuf, *line = NULL;
+	char *tbuf, *line = NULL, *cnow;
 	size_t linesize = 0;
 	ssize_t linelen;
 
@@ -124,7 +124,8 @@ storemail(char *from)
 	free(tbuf);
 
 	(void)time(&tval);
-	(void)fprintf(fp, "From %s %s", from, ctime(&tval));
+	cnow = ctime(&tval);
+	(void)fprintf(fp, "From %s %s", from, cnow ? cnow : "?\n");
 
 	while ((linelen = getline(&line, &linesize, stdin)) != -1) {
 		if (line[linelen - 1] == '\n')
diff --git a/libexec/spamd/spamd.c b/libexec/spamd/spamd.c
index 1be4c4b55..53fbc7297 100644
--- a/libexec/spamd/spamd.c
+++ b/libexec/spamd/spamd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: spamd.c,v 1.162 2024/04/01 21:09:44 millert Exp $	*/
+/*	$OpenBSD: spamd.c,v 1.163 2024/05/09 08:35:03 florian Exp $	*/
 
 /*
  * Copyright (c) 2015 Henning Brauer <henning@openbsd.org>
@@ -730,6 +730,7 @@ initcon(struct con *cp, int fd, struct sockaddr *sa)
 	    NI_NUMERICHOST);
 	if (error)
 		strlcpy(cp->addr, "<unknown>", sizeof(cp->addr));
+	memset(ctimebuf, 0, sizeof(ctimebuf));
 	ctime_r(&t, ctimebuf);
 	ctimebuf[sizeof(ctimebuf) - 2] = '\0'; /* nuke newline */
 	snprintf(cp->obuf, cp->osize, "220 %s ESMTP %s; %s\r\n",
diff --git a/sbin/dump/itime.c b/sbin/dump/itime.c
index 4498d91b1..a8713d96c 100644
--- a/sbin/dump/itime.c
+++ b/sbin/dump/itime.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: itime.c,v 1.26 2023/12/21 08:01:21 otto Exp $	*/
+/*	$OpenBSD: itime.c,v 1.27 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: itime.c,v 1.4 1997/04/15 01:09:50 lukem Exp $	*/
 
 /*-
@@ -162,7 +162,7 @@ putdumptime(void)
 	FILE *df;
 	struct dumpdates *dtwalk;
 	int fd, i;
-	char *fname;
+	char *fname, *ct;
 	time_t t;
 
 	if(uflag == 0)
@@ -213,12 +213,21 @@ putdumptime(void)
 		quit("ftruncate (%s): %s\n", dumpdates, strerror(errno));
 	(void) fclose(df);
 	t = (time_t)spcl.c_date;
-	msg("level %c dump on %s", level, t == 0 ? "the epoch\n" : ctime(&t));
+	if (t == 0)
+		ct = "the epoch\n";
+	else if ((ct = ctime(&t)) == NULL)
+		ct = "?\n";
+	msg("level %c dump on %s", level, ct);
 }
 
 static void
 dumprecout(FILE *file, struct dumpdates *what)
 {
+	char *ct;
+
+	ct = ctime(&what->dd_ddate);
+	if (ct == NULL)
+		quit("Cannot convert date\n");
 
 	if (fprintf(file, DUMPOUTFMT,
 		    what->dd_name,
@@ -243,8 +252,22 @@ getrecord(FILE *df, struct dumpdates *ddatep)
 			dumpdates, recno);
 
 #ifdef FDEBUG
-	msg("getrecord: %s %c %s", ddatep->dd_name, ddatep->dd_level,
-	    ddatep->dd_ddate == 0 ? "the epoch\n" : ctime(&ddatep->dd_ddate));
+	{
+		char *ct;
+
+		if (ddatep->dd_ddate == 0)
+			ct = "the epoch\n";
+		else
+			ct = ctime(&ddatep->dd_ddate);
+
+		if (ct)
+			msg("getrecord: %s %c %s", ddatep->dd_name,
+			    ddatep->dd_level, ct);
+		else
+			msg("getrecord: %s %c %lld seconds after the epoch\n",
+			    ddatep->dd_name, ddatep->dd_level,
+			    ddatep->dd_ddate);
+	}
 #endif
 	return(0);
 }
diff --git a/sbin/dump/main.c b/sbin/dump/main.c
index 336e29495..dabc77e4e 100644
--- a/sbin/dump/main.c
+++ b/sbin/dump/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.65 2024/01/09 03:16:00 guenther Exp $	*/
+/*	$OpenBSD: main.c,v 1.66 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: main.c,v 1.14 1997/06/05 11:13:24 lukem Exp $	*/
 
 /*-
@@ -117,7 +117,7 @@ main(int argc, char *argv[])
 	ino_t maxino;
 	time_t t;
 	int dirlist;
-	char *toplevel, *str, *mount_point = NULL, *realpath;
+	char *toplevel, *str, *mount_point = NULL, *realpath, *ct;
 	int just_estimate = 0;
 	u_int64_t zero_uid = 0;
 
@@ -423,11 +423,13 @@ main(int argc, char *argv[])
 	        getdumptime();		/* /etc/dumpdates snarfed */
 
 	t = (time_t)spcl.c_date;
+	ct = ctime(&t);
 	msg("Date of this level %c dump: %s", level,
-		t == 0 ? "the epoch\n" : ctime(&t));
+	    t == 0 ? "the epoch\n" : ct ? ct : "?\n");
 	t = (time_t)spcl.c_ddate;
+	ct = ctime(&t);
  	msg("Date of last level %c dump: %s", lastlevel,
-		t == 0 ? "the epoch\n" : ctime(&t));
+	    t == 0 ? "the epoch\n" : ct ? ct : "?\n");
 	msg("Dumping %s ", disk);
 	if (mount_point != NULL)
 		msgtail("(%s) ", mount_point);
@@ -589,10 +591,12 @@ main(int argc, char *argv[])
 		    spcl.c_tapea, spcl.c_volume,
 		    (spcl.c_volume == 1) ? "" : "s");
 	t = (time_t)spcl.c_date;
+	ct = ctime(&t);
 	msg("Date of this level %c dump: %s", level,
-	    t == 0 ? "the epoch\n" : ctime(&t));
+	    t == 0 ? "the epoch\n" : ct ? ct : "?\n");
 	t = do_stats();
-	msg("Date this dump completed:  %s", ctime(&t));
+	ct = ctime(&t);
+	msg("Date this dump completed:  %s", ct ? ct : "?\n");
 	msg("Average transfer rate: %ld KB/s\n", xferrate / tapeno);
 	putdumptime();
 	trewind();
diff --git a/sbin/dump/optr.c b/sbin/dump/optr.c
index 43f11d584..2a8f34ec5 100644
--- a/sbin/dump/optr.c
+++ b/sbin/dump/optr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: optr.c,v 1.41 2023/03/08 04:43:06 guenther Exp $	*/
+/*	$OpenBSD: optr.c,v 1.42 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: optr.c,v 1.11 1997/05/27 08:34:36 mrg Exp $	*/
 
 /*-
@@ -394,8 +394,11 @@ lastdump(int arg)
 		if (strncmp(lastname, dtwalk->dd_name,
 		    sizeof(dtwalk->dd_name)) == 0)
 			continue;
-		date = (char *)ctime(&dtwalk->dd_ddate);
-		date[16] = '\0';	/* blast away seconds and year */
+		date = ctime(&dtwalk->dd_ddate);
+		if (date)
+			date[16] = '\0'; /* blast away seconds and year */
+		else
+			date = "?";
 		lastname = dtwalk->dd_name;
 		dt = fstabsearch(dtwalk->dd_name);
 		dumpme = (dt != NULL &&
diff --git a/sbin/dump/tape.c b/sbin/dump/tape.c
index 835fd2238..ad964c763 100644
--- a/sbin/dump/tape.c
+++ b/sbin/dump/tape.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tape.c,v 1.48 2023/03/08 04:43:06 guenther Exp $	*/
+/*	$OpenBSD: tape.c,v 1.49 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: tape.c,v 1.11 1997/06/05 11:13:26 lukem Exp $	*/
 
 /*-
@@ -231,11 +231,13 @@ do_stats(void)
 {
 	time_t tnow, ttaken;
 	int64_t blocks;
+	char *ct;
 
 	(void)time(&tnow);
 	ttaken = tnow - tstart_volume;
 	blocks = spcl.c_tapea - tapea_volume;
-	msg("Volume %d completed at: %s", tapeno, ctime(&tnow));
+	ct = ctime(&tnow);
+	msg("Volume %d completed at: %s", tapeno, ct ? ct : "?\n");
 	if (ttaken > 0) {
 		msg("Volume %d took %lld:%02lld:%02lld\n", tapeno,
 		    (long long)ttaken / 3600, ((long long)ttaken % 3600) / 60,
@@ -565,7 +567,7 @@ startnewtape(int top)
 	pid_t	childpid;
 	int	status;
 	pid_t	waitingpid;
-	char	*p;
+	char	*p, *ct;
 	sig_t	interrupt_save;
 
 	interrupt_save = signal(SIGINT, SIG_IGN);
@@ -688,7 +690,8 @@ restore_check_point:
 		writeheader((ino_t)slp->inode);
 		if (sblock->fs_magic != FS_UFS2_MAGIC)
 			spcl.c_flags &=~ DR_NEWHEADER;
-		msg("Volume %d started at: %s", tapeno, ctime(&tstart_volume));
+		ct = ctime(&tstart_volume);
+		msg("Volume %d started at: %s", tapeno, ct ? ct : "?\n");
 		if (tapeno > 1)
 			msg("Volume %d begins with blocks from inode %llu\n",
 			    tapeno, (unsigned long long)slp->inode);
diff --git a/sbin/dumpfs/dumpfs.c b/sbin/dumpfs/dumpfs.c
index bd9d9ca69..220c5c603 100644
--- a/sbin/dumpfs/dumpfs.c
+++ b/sbin/dumpfs/dumpfs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dumpfs.c,v 1.38 2024/02/03 18:51:57 beck Exp $	*/
+/*	$OpenBSD: dumpfs.c,v 1.39 2024/05/09 08:35:40 florian Exp $	*/
 
 /*
  * Copyright (c) 2002 Networks Associates Technology, Inc.
@@ -163,13 +163,19 @@ dumpfs(int fd, const char *name)
 	off_t off;
 	int i, j;
 	u_int cg;
+	char *ct;
 
 	switch (afs.fs_magic) {
 	case FS_UFS2_MAGIC:
 		fssize = afs.fs_size;
 		fstime = afs.fs_time;
-		printf("magic\t%x (FFS2)\ttime\t%s",
-		    afs.fs_magic, ctime(&fstime));
+		ct = ctime(&fstime);
+		if (ct)
+			printf("magic\t%x (FFS2)\ttime\t%s",
+			    afs.fs_magic, ctime(&fstime));
+		else
+			printf("magic\t%x (FFS2)\ttime\t%lld\n",
+			    afs.fs_magic, fstime);
 		printf("superblock location\t%jd\tid\t[ %x %x ]\n",
 		    (intmax_t)afs.fs_sblockloc, afs.fs_id[0], afs.fs_id[1]);
 		printf("ncg\t%u\tsize\t%jd\tblocks\t%jd\n",
@@ -178,8 +184,13 @@ dumpfs(int fd, const char *name)
 	case FS_UFS1_MAGIC:
 		fssize = afs.fs_ffs1_size;
 		fstime = afs.fs_ffs1_time;
-		printf("magic\t%x (FFS1)\ttime\t%s",
-		    afs.fs_magic, ctime(&fstime));
+		ct = ctime(&fstime);
+		if (ct)
+			printf("magic\t%x (FFS1)\ttime\t%s",
+			    afs.fs_magic, ctime(&fstime));
+		else
+			printf("magic\t%x (FFS1)\ttime\t%lld\n",
+			    afs.fs_magic, fstime);
 		printf("id\t[ %x %x ]\n", afs.fs_id[0], afs.fs_id[1]);
 		i = 0;
 		if (afs.fs_postblformat != FS_42POSTBLFMT) {
@@ -325,6 +336,7 @@ dumpcg(const char *name, int fd, u_int c)
 	time_t cgtime;
 	off_t cur;
 	int i, j;
+	char *ct;
 
 	printf("\ncg %u:\n", c);
 	cur = (off_t)fsbtodb(&afs, cgtod(&afs, c)) * DEV_BSIZE;
@@ -335,18 +347,30 @@ dumpcg(const char *name, int fd, u_int c)
 	switch (afs.fs_magic) {
 	case FS_UFS2_MAGIC:
 		cgtime = acg.cg_ffs2_time;
-		printf("magic\t%x\ttell\t%jx\ttime\t%s",
-		    acg.cg_magic, (intmax_t)cur, ctime(&cgtime));
+		ct = ctime(&cgtime);
+		if (ct)
+			printf("magic\t%x\ttell\t%jx\ttime\t%s",
+			    acg.cg_magic, (intmax_t)cur, ct);
+		else
+			printf("magic\t%x\ttell\t%jx\ttime\t%lld\n",
+			    acg.cg_magic, (intmax_t)cur, cgtime);
 		printf("cgx\t%u\tndblk\t%u\tniblk\t%u\tinitiblk %u\n",
 		    acg.cg_cgx, acg.cg_ndblk, acg.cg_ffs2_niblk,
 		    acg.cg_initediblk);
 		break;
 	case FS_UFS1_MAGIC:
 		cgtime = acg.cg_time;
-		printf("magic\t%x\ttell\t%jx\ttime\t%s",
-		    afs.fs_postblformat == FS_42POSTBLFMT ?
-		    ((struct ocg *)&acg)->cg_magic : acg.cg_magic,
-		    (intmax_t)cur, ctime(&cgtime));
+		ct = ctime(&cgtime);
+		if (ct)
+			printf("magic\t%x\ttell\t%jx\ttime\t%s",
+			    afs.fs_postblformat == FS_42POSTBLFMT ?
+			    ((struct ocg *)&acg)->cg_magic : acg.cg_magic,
+			    (intmax_t)cur, ct);
+		else
+			printf("magic\t%x\ttell\t%jx\ttime\t%lld\n",
+			    afs.fs_postblformat == FS_42POSTBLFMT ?
+			    ((struct ocg *)&acg)->cg_magic : acg.cg_magic,
+			    (intmax_t)cur, cgtime);
 		printf("cgx\t%u\tncyl\t%d\tniblk\t%d\tndblk\t%u\n",
 		    acg.cg_cgx, acg.cg_ncyl, acg.cg_niblk, acg.cg_ndblk);
 		break;
diff --git a/sbin/fsck_ext2fs/inode.c b/sbin/fsck_ext2fs/inode.c
index a1861b086..d8aeb5d7b 100644
--- a/sbin/fsck_ext2fs/inode.c
+++ b/sbin/fsck_ext2fs/inode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inode.c,v 1.30 2024/04/23 13:34:50 jsg Exp $	*/
+/*	$OpenBSD: inode.c,v 1.31 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: inode.c,v 1.8 2000/01/28 16:01:46 bouyer Exp $	*/
 
 /*
@@ -581,7 +581,10 @@ pinode(ino_t ino)
 	printf("SIZE=%llu ", (long long)inosize(dp));
 	t = (time_t) letoh32(dp->e2di_mtime);
 	p = ctime(&t);
-	printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+	if (p)
+		printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+	else
+		printf("MTIME=%lld ", t);
 }
 
 void
diff --git a/sbin/fsck_ext2fs/pass1.c b/sbin/fsck_ext2fs/pass1.c
index 377852c1c..ae31836e7 100644
--- a/sbin/fsck_ext2fs/pass1.c
+++ b/sbin/fsck_ext2fs/pass1.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pass1.c,v 1.18 2019/07/01 07:13:44 kevlo Exp $	*/
+/*	$OpenBSD: pass1.c,v 1.19 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: pass1.c,v 1.9 2000/01/31 11:40:12 bouyer Exp $	*/
 
 /*
@@ -167,8 +167,12 @@ checkinode(ino_t inumber, struct inodesc *idesc)
 	if (dp->e2di_dtime != 0) {
 		time_t t = letoh32(dp->e2di_dtime);
 		char *p = ctime(&t);
-		pwarn("INODE I=%llu HAS DTIME=%12.12s %4.4s",
-		    (unsigned long long)inumber, &p[4], &p[20]);
+		if (p)
+			pwarn("INODE I=%llu HAS DTIME=%12.12s %4.4s",
+			    (unsigned long long)inumber, &p[4], &p[20]);
+		else
+			pwarn("INODE I=%llu HAS DTIME=%lld",
+			    (unsigned long long)inumber, t);
 		if (preen) {
 			printf(" (CORRECTED)\n");
 		}
diff --git a/sbin/fsck_ffs/inode.c b/sbin/fsck_ffs/inode.c
index ebda1d4a1..9a2679e3c 100644
--- a/sbin/fsck_ffs/inode.c
+++ b/sbin/fsck_ffs/inode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inode.c,v 1.51 2024/01/09 03:16:00 guenther Exp $	*/
+/*	$OpenBSD: inode.c,v 1.52 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: inode.c,v 1.23 1996/10/11 20:15:47 thorpej Exp $	*/
 
 /*
@@ -544,7 +544,10 @@ pinode(ino_t ino)
 	printf("SIZE=%llu ", (unsigned long long)DIP(dp, di_size));
 	t = DIP(dp, di_mtime);
 	p = ctime(&t);
-	printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+	if (p)
+		printf("MTIME=%12.12s %4.4s ", &p[4], &p[20]);
+	else
+		printf("MTIME=%lld ", t);
 }
 
 void
diff --git a/sbin/fsdb/fsdbutil.c b/sbin/fsdb/fsdbutil.c
index cb6e842a7..362211a25 100644
--- a/sbin/fsdb/fsdbutil.c
+++ b/sbin/fsdb/fsdbutil.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fsdbutil.c,v 1.20 2019/02/05 02:17:32 deraadt Exp $	*/
+/*	$OpenBSD: fsdbutil.c,v 1.21 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: fsdbutil.c,v 1.5 1996/09/28 19:30:37 christos Exp $	*/
 
 /*-
@@ -127,17 +127,25 @@ printstat(const char *cp, ino_t inum, union dinode *dp)
 	    DIP(dp, di_mode), DIP(dp, di_size));
 	t = DIP(dp, di_mtime);
 	p = ctime(&t);
-	printf("\n\tMTIME=%15.15s %4.4s [%d nsec]", &p[4], &p[20],
-	    DIP(dp, di_mtimensec));
+	if (p)
+		printf("\n\tMTIME=%15.15s %4.4s [%d nsec]", &p[4], &p[20],
+		    DIP(dp, di_mtimensec));
+	else
+		printf("\n\tMTIME=%lld [%d nsec]", t, DIP(dp, di_mtimensec));
 	t = DIP(dp, di_ctime);
 	p = ctime(&t);
-	printf("\n\tCTIME=%15.15s %4.4s [%d nsec]", &p[4], &p[20],
-	    DIP(dp, di_ctimensec));
+	if (p)
+		printf("\n\tCTIME=%15.15s %4.4s [%d nsec]", &p[4], &p[20],
+		    DIP(dp, di_ctimensec));
+	else
+		printf("\n\tCTIME=%lld [%d nsec]", t, DIP(dp, di_ctimensec));
 	t = DIP(dp, di_atime);
 	p = ctime(&t);
-	printf("\n\tATIME=%15.15s %4.4s [%d nsec]\n", &p[4], &p[20],
-	    DIP(dp, di_atimensec));
-
+	if (p)
+		printf("\n\tATIME=%15.15s %4.4s [%d nsec]\n", &p[4], &p[20],
+		    DIP(dp, di_atimensec));
+	else
+		printf("\n\tATIME=%lld [%d nsec]\n", t, DIP(dp, di_atimensec));
 	if ((name = user_from_uid(DIP(dp, di_uid), 1)) != NULL)
 		printf("OWNER=%s ", name);
 	else
diff --git a/sbin/fsirand/fsirand.c b/sbin/fsirand/fsirand.c
index 8aef979ae..2ccc85ce7 100644
--- a/sbin/fsirand/fsirand.c
+++ b/sbin/fsirand/fsirand.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fsirand.c,v 1.43 2020/06/20 07:49:04 otto Exp $	*/
+/*	$OpenBSD: fsirand.c,v 1.44 2024/05/09 08:35:40 florian Exp $	*/
 
 /*
  * Copyright (c) 1997 Todd C. Miller <millert@openbsd.org>
@@ -226,8 +226,13 @@ fsirand(char *device)
 	if (printonly && (sblock->fs_id[0] || sblock->fs_id[1])) {
 		if (sblock->fs_inodefmt >= FS_44INODEFMT && sblock->fs_id[0]) {
 			time_t t = sblock->fs_id[0];	/* XXX 2038 */
-			(void)printf("%s was randomized on %s", devpath,
-			    ctime(&t));
+			char *ct = ctime(&t);
+			if (ct)
+				(void)printf("%s was randomized on %s", devpath,
+				    ct);
+			else
+				(void)printf("%s was randomized on %lld\n",
+				    devpath, t);
 		}
 		(void)printf("fsid: %x %x\n", sblock->fs_id[0],
 		    sblock->fs_id[1]);
diff --git a/sbin/mount/mount.c b/sbin/mount/mount.c
index 7de836360..57bbcd0af 100644
--- a/sbin/mount/mount.c
+++ b/sbin/mount/mount.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mount.c,v 1.77 2023/07/23 23:21:19 kn Exp $	*/
+/*	$OpenBSD: mount.c,v 1.78 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: mount.c,v 1.24 1995/11/18 03:34:29 cgd Exp $	*/
 
 /*
@@ -503,9 +503,10 @@ prmount(struct statfs *sf)
 		char buf[26];
 		time_t t = sf->f_ctime;
 
-		ctime_r(&t, buf);
-		buf[24] = '\0';
-		printf(", ctime=%s", buf);
+		if (ctime_r(&t, buf))
+			printf(", ctime=%.24s", buf);
+		else
+			printf(", ctime=%lld", t);
 	}
 
 	/*
diff --git a/sbin/pfctl/pfctl_table.c b/sbin/pfctl/pfctl_table.c
index ba2140294..644312690 100644
--- a/sbin/pfctl/pfctl_table.c
+++ b/sbin/pfctl/pfctl_table.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfctl_table.c,v 1.87 2024/01/15 07:23:32 sashan Exp $ */
+/*	$OpenBSD: pfctl_table.c,v 1.88 2024/05/09 08:35:40 florian Exp $ */
 
 /*
  * Copyright (c) 2002 Cedric Berger
@@ -389,14 +389,19 @@ print_table(struct pfr_table *ta, int verbose, int debug)
 void
 print_tstats(struct pfr_tstats *ts, int debug)
 {
-	time_t	time = ts->pfrts_tzero;
-	int	dir, op;
+	time_t	 time = ts->pfrts_tzero;
+	int	 dir, op;
+	char	*ct;
 
 	if (!debug && !(ts->pfrts_flags & PFR_TFLAG_ACTIVE))
 		return;
+	ct = ctime(&time);
 	print_table(&ts->pfrts_t, 1, debug);
 	printf("\tAddresses:   %d\n", ts->pfrts_cnt);
-	printf("\tCleared:     %s", ctime(&time));
+	if (ct)
+		printf("\tCleared:     %s", ct);
+	else
+		printf("\tCleared:     %lld\n", time);
 	printf("\tReferences:  [ Anchors: %-18d Rules: %-18d ]\n",
 	    ts->pfrts_refcnt[PFR_REFCNT_ANCHOR],
 	    ts->pfrts_refcnt[PFR_REFCNT_RULE]);
@@ -487,11 +492,16 @@ print_addrx(struct pfr_addr *ad, struct pfr_addr *rad, int dns)
 void
 print_astats(struct pfr_astats *as, int dns)
 {
-	time_t	time = as->pfras_tzero;
-	int	dir, op;
+	time_t	 time = as->pfras_tzero;
+	int	 dir, op;
+	char	*ct;
 
+	ct = ctime(&time);
 	print_addrx(&as->pfras_a, NULL, dns);
-	printf("\tCleared:     %s", ctime(&time));
+	if (ct)
+		printf("\tCleared:     %s", ctime(&time));
+	else
+		printf("\tCleared:     %lld\n", time);
 	if (as->pfras_a.pfra_states)
 		printf("\tActive States:      %d\n", as->pfras_a.pfra_states);
 	if (as->pfras_a.pfra_type == PFRKE_COST)
@@ -603,8 +613,9 @@ pfctl_show_ifaces(const char *filter, int opts)
 void
 print_iface(struct pfi_kif *p, int opts)
 {
-	time_t	tzero = p->pfik_tzero;
-	int	i, af, dir, act;
+	time_t	 tzero = p->pfik_tzero;
+	int	 i, af, dir, act;
+	char	*ct;
 
 	printf("%s", p->pfik_name);
 	if (opts & PF_OPT_VERBOSE) {
@@ -615,7 +626,12 @@ print_iface(struct pfi_kif *p, int opts)
 
 	if (!(opts & PF_OPT_VERBOSE2))
 		return;
-	printf("\tCleared:     %s", ctime(&tzero));
+
+	ct = ctime(&tzero);
+	if (ct)
+		printf("\tCleared:     %s", ct);
+	else
+		printf("\tCleared:     %lld\n", tzero);
 	printf("\tReferences:  [ States:  %-18d Rules: %-18d ]\n",
 	    p->pfik_states, p->pfik_rules);
 	for (i = 0; i < 8; i++) {
diff --git a/sbin/restore/tape.c b/sbin/restore/tape.c
index 4288c79e1..fc7f28023 100644
--- a/sbin/restore/tape.c
+++ b/sbin/restore/tape.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tape.c,v 1.53 2023/03/08 04:43:07 guenther Exp $	*/
+/*	$OpenBSD: tape.c,v 1.54 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: tape.c,v 1.26 1997/04/15 07:12:25 lukem Exp $	*/
 
 /*
@@ -387,8 +387,18 @@ gethdr:
 	}
 	if (tmpbuf.c_date != dumpdate || tmpbuf.c_ddate != dumptime) {
 		time_t t = (time_t)tmpbuf.c_date;
-		fprintf(stderr, "Wrong dump date\n\tgot: %s", ctime(&t));
-		fprintf(stderr, "\twanted: %s", ctime(&dumpdate));
+		char ct1buf[26], ct2buf[26];
+		char *ct1, *ct2;
+
+		ct1 = ctime_r(&t, ct1buf);
+		ct2 = ctime_r(&dumpdate, ct2buf);
+		if (ct1 && ct2) {
+			fprintf(stderr, "Wrong dump date\n\tgot: %s", ct1);
+			fprintf(stderr, "\twanted: %s", ct2);
+		} else {
+			fprintf(stderr, "Wrong dump date\n\tgot: %lld\n", t);
+			fprintf(stderr, "\twanted: %lld\n", dumpdate);
+		}
 		volno = 0;
 		goto again;
 	}
@@ -488,12 +498,21 @@ void
 printdumpinfo(void)
 {
 	time_t t;
+	char *ct;
 
 	t = (time_t)spcl.c_date;
-	fprintf(stdout, "Dump   date: %s", ctime(&t));
+	ct = ctime(&t);
+	if (ct)
+		fprintf(stdout, "Dump   date: %s", ct);
+	else
+		fprintf(stdout, "Dump   date: %lld\n", t);
 	t = (time_t)spcl.c_ddate;
-	fprintf(stdout, "Dumped from: %s",
-	    (spcl.c_ddate == 0) ? "the epoch\n" : ctime(&t));
+	ct = ctime(&t);
+	if (ct)
+		fprintf(stdout, "Dumped from: %s",
+		    (spcl.c_ddate == 0) ? "the epoch\n" : ct);
+	else
+		fprintf(stdout, "Dumped from: %lld\n", t);
 	if (spcl.c_host[0] == '\0')
 		return;
 	fprintf(stderr, "Level %d dump of %s on %s:%s\n",
diff --git a/sbin/route/route.c b/sbin/route/route.c
index 4228114ed..490d29ace 100644
--- a/sbin/route/route.c
+++ b/sbin/route/route.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: route.c,v 1.266 2024/04/28 16:43:42 florian Exp $	*/
+/*	$OpenBSD: route.c,v 1.267 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: route.c,v 1.16 1996/04/15 18:27:05 cgd Exp $	*/
 
 /*
@@ -1140,6 +1140,7 @@ monitor(int argc, char *argv[])
 	int n;
 	char msg[2048];
 	time_t now;
+	char *ct;
 
 	verbose = 1;
 	for (;;) {
@@ -1149,7 +1150,11 @@ monitor(int argc, char *argv[])
 			err(1, "read");
 		}
 		now = time(NULL);
-		printf("got message of size %d on %s", n, ctime(&now));
+		ct = ctime(&now);
+		if (ct)
+			printf("got message of size %d on %s", n, ct);
+		else
+			printf("got message of size %d on %lld\n", n, now);
 		print_rtmsg((struct rt_msghdr *)msg, n);
 	}
 }
diff --git a/sbin/savecore/savecore.c b/sbin/savecore/savecore.c
index 1503c3193..2e0e277d5 100644
--- a/sbin/savecore/savecore.c
+++ b/sbin/savecore/savecore.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: savecore.c,v 1.65 2022/12/04 23:50:47 cheloha Exp $	*/
+/*	$OpenBSD: savecore.c,v 1.66 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: savecore.c,v 1.26 1996/03/18 21:16:05 leo Exp $	*/
 
 /*-
@@ -608,6 +608,7 @@ int
 get_crashtime(void)
 {
 	time_t dumptime;			/* Time the dump was taken. */
+	char *ct;
 
 	(void)KREAD(kd_dump, dump_nl[X_TIME].n_value, &dumptime);
 	if (dumptime == 0) {
@@ -615,7 +616,12 @@ get_crashtime(void)
 			syslog(LOG_ERR, "dump time is zero");
 		return (0);
 	}
-	(void)printf("savecore: system went down at %s", ctime(&dumptime));
+	ct = ctime(&dumptime);
+	if (ct)
+		printf("savecore: system went down at %s", ct);
+	else
+		printf("savecore: system went down %lld seconds after the"
+		    " epoch\n", dumptime);
 #define	SECSPERDAY	(24 * 60 * 60)
 #define	LEEWAY		(7 * SECSPERDAY)
 	if (dumptime < now - LEEWAY || dumptime > now + LEEWAY) {
diff --git a/sbin/scan_ffs/scan_ffs.c b/sbin/scan_ffs/scan_ffs.c
index d1b673c4d..2a731bec5 100644
--- a/sbin/scan_ffs/scan_ffs.c
+++ b/sbin/scan_ffs/scan_ffs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: scan_ffs.c,v 1.23 2019/06/28 13:32:46 deraadt Exp $	*/
+/*	$OpenBSD: scan_ffs.c,v 1.24 2024/05/09 08:35:40 florian Exp $	*/
 
 /*
  * Copyright (c) 1998 Niklas Hallqvist, Tobias Weingartner
@@ -47,6 +47,28 @@
 
 static void usage(void);
 
+static void
+print_info(int flags, struct fs *sb, long long at, char* lastmount)
+{
+	if (flags & FLAG_LABELS ) {
+		printf("X: %lld %lld 4.2BSD %d %d %d # %s\n",
+		    ((off_t)sb->fs_ffs1_size * sb->fs_fsize / 512), at,
+		    sb->fs_fsize, sb->fs_bsize, sb->fs_cpg, lastmount);
+	} else {
+		/* XXX 2038 */
+		time_t t = sb->fs_ffs1_time;
+		char *ct = ctime(&t);
+		if (ct)
+			printf("ffs at %lld size %lld mount %s time %s", at,
+			    (long long)(off_t) sb->fs_ffs1_size * sb->fs_fsize,
+			    lastmount, ct);
+		else
+			printf("ffs at %lld size %lld mount %s time %lld\n", at,
+			    (long long)(off_t) sb->fs_ffs1_size * sb->fs_fsize,
+			    lastmount, t);
+	}
+}
+
 static int
 ufsscan(int fd, daddr_t beg, daddr_t end, int flags)
 {
@@ -76,27 +98,9 @@ ufsscan(int fd, daddr_t beg, daddr_t end, int flags)
 					    sb->fs_ffs1_size);
 
 				if (((blk+(n/512)) - lastblk) == (SBSIZE/512)) {
-					if (flags & FLAG_LABELS ) {
-						printf("X: %lld %lld 4.2BSD %d %d %d # %s\n",
-						    ((off_t)sb->fs_ffs1_size *
-						    sb->fs_fsize / 512),
-						    (long long)(blk + (n/512) -
-						    (2*SBSIZE/512)),
-						    sb->fs_fsize, sb->fs_bsize,
-						    sb->fs_cpg, lastmount);
-					} else {
-						/* XXX 2038 */
-						time_t t = sb->fs_ffs1_time;
-
-						printf("ffs at %lld size %lld "
-						    "mount %s time %s",
-						    (long long)(blk+(n/512) -
-						    (2*SBSIZE/512)),
-						    (long long)(off_t)sb->fs_ffs1_size *
-						    sb->fs_fsize,
-						    lastmount, ctime(&t));
-					}
-
+					print_info(flags, sb,
+					    (long long)(blk + (n/512) -
+					    (2*SBSIZE/512)),  lastmount);
 					if (flags & FLAG_SMART) {
 						off_t size = (off_t)sb->fs_ffs1_size *
 						    sb->fs_fsize;
diff --git a/sbin/sysctl/sysctl.c b/sbin/sysctl/sysctl.c
index a6c23140a..7ac6c0b8d 100644
--- a/sbin/sysctl/sysctl.c
+++ b/sbin/sysctl/sysctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sysctl.c,v 1.260 2024/02/11 21:29:12 bluhm Exp $	*/
+/*	$OpenBSD: sysctl.c,v 1.261 2024/05/09 08:35:40 florian Exp $	*/
 /*	$NetBSD: sysctl.c,v 1.9 1995/09/30 07:12:50 thorpej Exp $	*/
 
 /*
@@ -937,8 +937,14 @@ parse(char *string, int flags)
 		struct timeval *btp = (struct timeval *)buf;
 
 		if (!nflag) {
+			char *ct;
 			boottime = btp->tv_sec;
-			(void)printf("%s%s%s", string, equ, ctime(&boottime));
+			ct = ctime(&boottime);
+			if (ct)
+				(void)printf("%s%s%s", string, equ, ct);
+			else
+				(void)printf("%s%s%lld\n", string, equ,
+				    boottime);
 		} else
 			(void)printf("%lld\n", (long long)btp->tv_sec);
 		return;
@@ -2855,9 +2861,11 @@ print_sensor(struct sensor *s)
 		time_t t = s->tv.tv_sec;
 		char ct[26];
 
-		ctime_r(&t, ct);
-		ct[19] = '\0';
-		printf(", %s.%03ld", ct, s->tv.tv_usec / 1000);
+		if (ctime_r(&t, ct)) {
+			ct[19] = '\0';
+			printf(", %s.%03ld", ct, s->tv.tv_usec / 1000);
+		} else
+			printf(", %lld.%03ld", t, s->tv.tv_usec / 1000);
 	}
 }
 
diff --git a/sbin/unwind/libunbound/validator/autotrust.c b/sbin/unwind/libunbound/validator/autotrust.c
index 96d4d6df7..88171bb9f 100644
--- a/sbin/unwind/libunbound/validator/autotrust.c
+++ b/sbin/unwind/libunbound/validator/autotrust.c
@@ -1084,7 +1084,11 @@ trustanchor_state2str(autr_state_type s)
 /** ctime r for autotrust */
 static char* autr_ctime_r(time_t* t, char* s)
 {
-	ctime_r(t, s);
+	if (ctime_r(t, s) == NULL) {
+		s[0] = '?';
+		s[1] = '\n';
+		s[2] = '\0';
+	}
 #ifdef USE_WINSOCK
 	if(strlen(s) > 10 && s[7]==' ' && s[8]=='0')
 		s[8]=' '; /* fix error in windows ctime */
diff --git a/share/man/man3/intro.3 b/share/man/man3/intro.3
index 6ea81903e..ee0c5eaf7 100644
--- a/share/man/man3/intro.3
+++ b/share/man/man3/intro.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: intro.3,v 1.98 2024/05/08 08:24:23 tb Exp $
+.\"	$OpenBSD: intro.3,v 1.100 2024/05/09 17:57:36 jmc Exp $
 .\"	$NetBSD: intro.3,v 1.5 1995/05/10 22:46:24 jtc Exp $
 .\"
 .\" Copyright (c) 1980, 1991, 1993
@@ -30,7 +30,7 @@
 .\"
 .\"     @(#)intro.3	8.1 (Berkeley) 6/5/93
 .\"
-.Dd $Mdocdate: May 8 2024 $
+.Dd $Mdocdate: May 9 2024 $
 .Dt INTRO 3
 .Os
 .Sh NAME
@@ -86,8 +86,6 @@ and more.
 .Pp
 .It libc++ Pq Fl lc++
 LLVM standard C++ library.
-See
-.Xr clang 1 .
 Note: users do not normally have to explicitly link with this library.
 .Pp
 .It libc++abi Pq Fl lc++abi
@@ -339,14 +337,12 @@ See
 .It libssl Pq Fl lssl
 Implements the Transport Layer Security
 .Pq TLS
-protocol, the successor to the Secure Sockets Layer protocol.
+protocol, the successor to the Secure Sockets Layer (SSL) protocol.
 See
 .Xr ssl 3 .
 .Pp
 .It libstdc++ Pq Fl lstdc++
 GNU standard C++ library.
-See
-.Xr g++ 1 .
 Note: users do not normally have to explicitly link with this library.
 .Pp
 .It libsupc++ Pq Fl lsupc++
diff --git a/sys/arch/amd64/conf/GENERIC b/sys/arch/amd64/conf/GENERIC
index 72202e234..3a90d3527 100644
--- a/sys/arch/amd64/conf/GENERIC
+++ b/sys/arch/amd64/conf/GENERIC
@@ -1,4 +1,4 @@
-#	$OpenBSD: GENERIC,v 1.522 2024/02/15 16:33:56 deraadt Exp $
+#	$OpenBSD: GENERIC,v 1.523 2024/05/09 17:05:22 mglocker Exp $
 #
 # For further information on compiling SecBSD kernels, see the config(8)
 # man page.
@@ -463,6 +463,7 @@ pcscp*	at pci?				# AMD 53c974 PCscsi-PCI SCSI
 #trm*	at pci?				# Tekram DC-3x5U SCSI Controllers
 vmwpvs*	at pci?				# VMware ParaVirtual SCSI
 nvme*	at pci?				# NVMe controllers
+ufshci*	at pci?				# UFSHCI controllers
 
 scsibus* at scsi?
 sd*	at scsibus?			# SCSI disk drives
diff --git a/sys/arch/amd64/conf/RAMDISK_CD b/sys/arch/amd64/conf/RAMDISK_CD
index cf08e0d75..61362361b 100644
--- a/sys/arch/amd64/conf/RAMDISK_CD
+++ b/sys/arch/amd64/conf/RAMDISK_CD
@@ -1,4 +1,4 @@
-#	$OpenBSD: RAMDISK_CD,v 1.205 2024/02/15 16:33:56 deraadt Exp $
+#	$OpenBSD: RAMDISK_CD,v 1.206 2024/05/09 17:05:22 mglocker Exp $
 
 machine		amd64
 maxusers	4
@@ -187,6 +187,7 @@ adw*		at pci?			# AdvanSys ULTRA WIDE SCSI
 pcscp*		at pci?			# AMD 53c974 PCscsi-PCI SCSI
 vmwpvs*		at pci?			# VMware ParaVirtual SCSI
 nvme*		at pci?			# NVMe controllers
+ufshci*		at pci?			# UFSHCI controllers
 softraid0	at root
 
 scsibus*	at scsi?
diff --git a/sys/dev/ic/ufshci.c b/sys/dev/ic/ufshci.c
index da2b2aaba..7cd2aad1c 100644
--- a/sys/dev/ic/ufshci.c
+++ b/sys/dev/ic/ufshci.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufshci.c,v 1.9 2024/01/06 17:47:43 mglocker Exp $ */
+/*	$OpenBSD: ufshci.c,v 1.19 2024/05/09 08:24:09 mglocker Exp $ */
 
 /*
  * Copyright (c) 2022 Marcus Glocker <mglocker@openbsd.org>
@@ -61,12 +61,11 @@ struct ufshci_dmamem	*ufshci_dmamem_alloc(struct ufshci_softc *, size_t);
 void			 ufshci_dmamem_free(struct ufshci_softc *,
 			     struct ufshci_dmamem *);
 int			 ufshci_init(struct ufshci_softc *);
-int			 ufshci_doorbell_get_free(struct ufshci_softc *);
 int			 ufshci_doorbell_read(struct ufshci_softc *);
+void			 ufshci_doorbell_write(struct ufshci_softc *, int);
 int			 ufshci_doorbell_poll(struct ufshci_softc *, int);
-void			 ufshci_doorbell_set(struct ufshci_softc *, int);
-uint8_t			 ufshci_get_taskid(struct ufshci_softc *);
-int			 ufshci_utr_cmd_nop(struct ufshci_softc *);
+int			 ufshci_utr_cmd_nop(struct ufshci_softc *,
+			     struct ufshci_ccb *, struct scsi_xfer *);
 int			 ufshci_utr_cmd_lun(struct ufshci_softc *,
 			     struct ufshci_ccb *, struct scsi_xfer *);
 int			 ufshci_utr_cmd_inquiry(struct ufshci_softc *,
@@ -127,11 +126,12 @@ ufshci_intr(void *arg)
 	if (status & UFSHCI_REG_IS_UTRCS) {
 	  	DPRINTF("%s: UTRCS interrupt\n", __func__);
 
-		ufshci_xfer_complete(sc);
-
 		/* Reset Interrupt Aggregation Counter and Timer. */
 		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
 		    UFSHCI_REG_UTRIACR_IAEN | UFSHCI_REG_UTRIACR_CTR);
+		sc->sc_intraggr_enabled = 0;
+
+		ufshci_xfer_complete(sc);
 
 		handled = 1;
 	}
@@ -152,6 +152,7 @@ ufshci_attach(struct ufshci_softc *sc)
 {
 	struct scsibus_attach_args saa;
 
+	mtx_init(&sc->sc_cmd_mtx, IPL_BIO);
 	mtx_init(&sc->sc_ccb_mtx, IPL_BIO);
 	SIMPLEQ_INIT(&sc->sc_ccb_list);
 	scsi_iopool_init(&sc->sc_iopool, sc, ufshci_ccb_get, ufshci_ccb_put);
@@ -169,7 +170,9 @@ ufshci_attach(struct ufshci_softc *sc)
 	sc->sc_hcmid = UFSHCI_READ_4(sc, UFSHCI_REG_HCMID);
 	sc->sc_nutmrs = UFSHCI_REG_CAP_NUTMRS(sc->sc_cap) + 1;
 	sc->sc_rtt = UFSHCI_REG_CAP_RTT(sc->sc_cap) + 1;
-	sc->sc_nutrs = UFSHCI_REG_CAP_NUTRS(sc->sc_cap) + 1;
+	//sc->sc_nutrs = UFSHCI_REG_CAP_NUTRS(sc->sc_cap) + 1;
+	/* XXX: Using more than one slot currently causes OCS errors */
+	sc->sc_nutrs = 1;
 
 #if UFSHCI_DEBUG
 	printf("Capabilities (0x%08x):\n", sc->sc_cap);
@@ -192,7 +195,12 @@ ufshci_attach(struct ufshci_softc *sc)
 		printf("%s: NUTRS can't be >32 (is %d)!\n",
 		    sc->sc_dev.dv_xname, sc->sc_nutrs);
 		return 1;
+	} else if (sc->sc_nutrs == 1) {
+		sc->sc_iacth = sc->sc_nutrs;
+	} else if (sc->sc_nutrs > 1) {
+		sc->sc_iacth = sc->sc_nutrs - 1;
 	}
+	DPRINTF("IACTH=%d\n", sc->sc_iacth);
 
 	ufshci_init(sc);
 
@@ -370,24 +378,6 @@ ufshci_init(struct ufshci_softc *sc)
 	/* 7.1.1 Host Controller Initialization: 11) */
 	reg = UFSHCI_READ_4(sc, UFSHCI_REG_UTRIACR);
 	DPRINTF("%s: UTRIACR=0x%08x\n", __func__, reg);
-	/*
-	 * Only enable interrupt aggregation when interrupts are available.
-	 * Otherwise, the interrupt aggregation counter already starts to
-	 * count completed commands, and will keep interrupts disabled once
-	 * reaching the threshold.  We only issue the interrupt aggregation
-	 * counter reset in the interrupt handler during runtime, so we would
-	 * have a kind of chicken/egg problem.
-	 */
-	if (!cold) {
-		DPRINTF("%s: Enable interrupt aggregation\n", __func__);
-		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
-		    UFSHCI_REG_UTRIACR_IAEN |
-		    UFSHCI_REG_UTRIACR_IAPWEN |
-		    UFSHCI_REG_UTRIACR_CTR |
-		    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
-		    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
-		sc->sc_intraggr_enabled = 1;
-	}
 
 	/*
 	 * 7.1.1 Host Controller Initialization: 12)
@@ -446,22 +436,6 @@ ufshci_init(struct ufshci_softc *sc)
 	return 0;
 }
 
-int
-ufshci_doorbell_get_free(struct ufshci_softc *sc)
-{
-	int slot;
-	uint32_t reg;
-
-	reg = UFSHCI_READ_4(sc, UFSHCI_REG_UTRLDBR);
-
-	for (slot = 0; slot < sc->sc_nutrs; slot++) {
-		if ((reg & (1 << slot)) == 0)
-			return slot;
-	}
-
-	return -1;
-}
-
 int
 ufshci_doorbell_read(struct ufshci_softc *sc)
 {
@@ -472,6 +446,16 @@ ufshci_doorbell_read(struct ufshci_softc *sc)
 	return reg;
 }
 
+void
+ufshci_doorbell_write(struct ufshci_softc *sc, int slot)
+{
+	uint32_t reg;
+
+	reg = (1U << slot);
+
+	UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRLDBR, reg);
+}
+
 int
 ufshci_doorbell_poll(struct ufshci_softc *sc, int slot)
 {
@@ -482,7 +466,7 @@ ufshci_doorbell_poll(struct ufshci_softc *sc, int slot)
 
 	for (i = 0; i < retry; i++) {
 		reg = UFSHCI_READ_4(sc, UFSHCI_REG_UTRLDBR);
-		if ((reg & (1 << slot)) == 0)
+		if ((reg & (1U << slot)) == 0)
 			break;
 		delay(10);
 	}
@@ -494,29 +478,9 @@ ufshci_doorbell_poll(struct ufshci_softc *sc, int slot)
 	return 0;
 }
 
-void
-ufshci_doorbell_set(struct ufshci_softc *sc, int slot)
-{
-	uint32_t reg;
-
-	reg = (1 << slot);
-
-	UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRLDBR, reg);
-}
-
-uint8_t
-ufshci_get_taskid(struct ufshci_softc *sc)
-{
-	if (sc->sc_taskid == 255)
-		sc->sc_taskid = 0;
-	else
-		sc->sc_taskid++;
-
-	return sc->sc_taskid;
-}
-
 int
-ufshci_utr_cmd_nop(struct ufshci_softc *sc)
+ufshci_utr_cmd_nop(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
+    struct scsi_xfer *xs)
 {
 	int slot, off, len;
 	uint64_t dva;
@@ -524,8 +488,9 @@ ufshci_utr_cmd_nop(struct ufshci_softc *sc)
 	struct ufshci_ucd *ucd;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 1) */
-	slot = ufshci_doorbell_get_free(sc);
-	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd) + (sizeof(*utrd) * slot);
+	slot = ccb->ccb_slot;
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += slot;
 	memset(utrd, 0, sizeof(*utrd));
 	DPRINTF("%s: slot=%d\n", __func__, slot);
 
@@ -536,20 +501,21 @@ ufshci_utr_cmd_nop(struct ufshci_softc *sc)
 	utrd->dw0 |= UFSHCI_UTRD_DW0_DD_NO;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2c) */
-	utrd->dw0 |= UFSHCI_UTRD_DW0_I_INT;
+	utrd->dw0 |= UFSHCI_UTRD_DW0_I_REG;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2d) */
 	utrd->dw2 = UFSHCI_UTRD_DW2_OCS_IOV;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2e) */
-	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd) + (sizeof(*ucd) * slot);
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += slot;
 	memset(ucd, 0, sizeof(*ucd));
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2f) */
 	ucd->cmd.hdr.tc = UPIU_TC_I2T_NOP_OUT;
 	ucd->cmd.hdr.flags = 0;
 	ucd->cmd.hdr.lun = 0;
-	ucd->cmd.hdr.taskid = ufshci_get_taskid(sc);
+	ucd->cmd.hdr.taskid = 0;
 	ucd->cmd.hdr.cmd_set_type = 0; /* SCSI command */
 	ucd->cmd.hdr.query = 0;
 	ucd->cmd.hdr.response = 0;
@@ -589,18 +555,14 @@ ufshci_utr_cmd_nop(struct ufshci_softc *sc)
 		return -1;
 	}
 
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 10) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 11) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 12) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 13) */
-	UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
-	    UFSHCI_REG_UTRIACR_IAEN |
-	    UFSHCI_REG_UTRIACR_IAPWEN |
-	    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
-	    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * slot, sizeof(*utrd), BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * slot, sizeof(*ucd), BUS_DMASYNC_PREWRITE);
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 14) */
-	ufshci_doorbell_set(sc, slot);
+	ccb->ccb_status = CCB_STATUS_INPROGRESS;
+	ufshci_doorbell_write(sc, slot);
 
 	return 0;
 }
@@ -616,8 +578,9 @@ ufshci_utr_cmd_lun(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	bus_dmamap_t dmap = ccb->ccb_dmamap;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 1) */
-	slot = ufshci_doorbell_get_free(sc);
-	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd) + (sizeof(*utrd) * slot);
+	slot = ccb->ccb_slot;
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += slot;
 	memset(utrd, 0, sizeof(*utrd));
 	DPRINTF("%s: slot=%d\n", __func__, slot);
 
@@ -634,14 +597,15 @@ ufshci_utr_cmd_lun(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	utrd->dw2 = UFSHCI_UTRD_DW2_OCS_IOV;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2e) */
-	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd) + (sizeof(*ucd) * slot);
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += slot;
 	memset(ucd, 0, sizeof(*ucd));
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2f) */
 	ucd->cmd.hdr.tc = UPIU_TC_I2T_COMMAND;
 	ucd->cmd.hdr.flags = (1 << 6); /* Bit-5 = Write, Bit-6 = Read */
 	ucd->cmd.hdr.lun = 0;
-	ucd->cmd.hdr.taskid = ufshci_get_taskid(sc);
+	ucd->cmd.hdr.taskid = 0;
 	ucd->cmd.hdr.cmd_set_type = 0; /* SCSI command */
 	ucd->cmd.hdr.query = 0;
 	ucd->cmd.hdr.response = 0;
@@ -698,18 +662,14 @@ ufshci_utr_cmd_lun(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 		return -1;
 	}
 
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 10) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 11) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 12) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 13) */
-	UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
-	    UFSHCI_REG_UTRIACR_IAEN |
-	    UFSHCI_REG_UTRIACR_IAPWEN |
-	    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
-	    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * slot, sizeof(*utrd), BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * slot, sizeof(*ucd), BUS_DMASYNC_PREWRITE);
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 14) */
-	ufshci_doorbell_set(sc, slot);
+	ccb->ccb_status = CCB_STATUS_INPROGRESS;
+	ufshci_doorbell_write(sc, slot);
 
 	return 0;
 }
@@ -725,8 +685,9 @@ ufshci_utr_cmd_inquiry(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	bus_dmamap_t dmap = ccb->ccb_dmamap;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 1) */
-	slot = ufshci_doorbell_get_free(sc);
-	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd) + (sizeof(*utrd) * slot);
+	slot = ccb->ccb_slot;
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += slot;
 	memset(utrd, 0, sizeof(*utrd));
 	DPRINTF("%s: slot=%d\n", __func__, slot);
 
@@ -743,14 +704,15 @@ ufshci_utr_cmd_inquiry(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	utrd->dw2 = UFSHCI_UTRD_DW2_OCS_IOV;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2e) */
-	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd) + (sizeof(*ucd) * slot);
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += slot;
 	memset(ucd, 0, sizeof(*ucd));
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2f) */
 	ucd->cmd.hdr.tc = UPIU_TC_I2T_COMMAND;
 	ucd->cmd.hdr.flags = (1 << 6); /* Bit-5 = Write, Bit-6 = Read */
 	ucd->cmd.hdr.lun = 0;
-	ucd->cmd.hdr.taskid = ufshci_get_taskid(sc);
+	ucd->cmd.hdr.taskid = 0;
 	ucd->cmd.hdr.cmd_set_type = 0; /* SCSI command */
 	ucd->cmd.hdr.query = 0;
 	ucd->cmd.hdr.response = 0;
@@ -805,20 +767,14 @@ ufshci_utr_cmd_inquiry(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 		return -1;
 	}
 
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 10) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 11) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 12) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 13) */
-	if (!ISSET(xs->flags, SCSI_POLL)) {
-		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
-		    UFSHCI_REG_UTRIACR_IAEN |
-		    UFSHCI_REG_UTRIACR_IAPWEN |
-		    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
-		    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
-	}
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * slot, sizeof(*utrd), BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * slot, sizeof(*ucd), BUS_DMASYNC_PREWRITE);
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 14) */
-	ufshci_doorbell_set(sc, slot);
+	ccb->ccb_status = CCB_STATUS_INPROGRESS;
+	ufshci_doorbell_write(sc, slot);
 
 	return slot;
 }
@@ -834,8 +790,9 @@ ufshci_utr_cmd_capacity16(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	bus_dmamap_t dmap = ccb->ccb_dmamap;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 1) */
-	slot = ufshci_doorbell_get_free(sc);
-	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd) + (sizeof(*utrd) * slot);
+	slot = ccb->ccb_slot;
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += slot;
 	memset(utrd, 0, sizeof(*utrd));
 	DPRINTF("%s: slot=%d\n", __func__, slot);
 
@@ -852,14 +809,15 @@ ufshci_utr_cmd_capacity16(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	utrd->dw2 = UFSHCI_UTRD_DW2_OCS_IOV;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2e) */
-	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd) + (sizeof(*ucd) * slot);
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += slot;
 	memset(ucd, 0, sizeof(*ucd));
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2f) */
 	ucd->cmd.hdr.tc = UPIU_TC_I2T_COMMAND;
 	ucd->cmd.hdr.flags = (1 << 6); /* Bit-5 = Write, Bit-6 = Read */
 	ucd->cmd.hdr.lun = 0;
-	ucd->cmd.hdr.taskid = ufshci_get_taskid(sc);
+	ucd->cmd.hdr.taskid = 0;
 	ucd->cmd.hdr.cmd_set_type = 0; /* SCSI command */
 	ucd->cmd.hdr.query = 0;
 	ucd->cmd.hdr.response = 0;
@@ -918,20 +876,14 @@ ufshci_utr_cmd_capacity16(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 		return -1;
 	}
 
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 10) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 11) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 12) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 13) */
-	if (!ISSET(xs->flags, SCSI_POLL)) {
-		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
-		    UFSHCI_REG_UTRIACR_IAEN |
-		    UFSHCI_REG_UTRIACR_IAPWEN |
-		    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
-		    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
-	}
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * slot, sizeof(*utrd), BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * slot, sizeof(*ucd), BUS_DMASYNC_PREWRITE);
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 14) */
-	ufshci_doorbell_set(sc, slot);
+	ccb->ccb_status = CCB_STATUS_INPROGRESS;
+	ufshci_doorbell_write(sc, slot);
 
 	return slot;
 }
@@ -947,8 +899,9 @@ ufshci_utr_cmd_capacity(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	bus_dmamap_t dmap = ccb->ccb_dmamap;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 1) */
-	slot = ufshci_doorbell_get_free(sc);
-	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd) + (sizeof(*utrd) * slot);
+	slot = ccb->ccb_slot;
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += slot;
 	memset(utrd, 0, sizeof(*utrd));
 	DPRINTF("%s: slot=%d\n", __func__, slot);
 
@@ -965,14 +918,15 @@ ufshci_utr_cmd_capacity(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	utrd->dw2 = UFSHCI_UTRD_DW2_OCS_IOV;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2e) */
-	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd) + (sizeof(*ucd) * slot);
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += slot;
 	memset(ucd, 0, sizeof(*ucd));
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2f) */
 	ucd->cmd.hdr.tc = UPIU_TC_I2T_COMMAND;
 	ucd->cmd.hdr.flags = (1 << 6); /* Bit-5 = Write, Bit-6 = Read */
 	ucd->cmd.hdr.lun = 0;
-	ucd->cmd.hdr.taskid = ufshci_get_taskid(sc);
+	ucd->cmd.hdr.taskid = 0;
 	ucd->cmd.hdr.cmd_set_type = 0; /* SCSI command */
 	ucd->cmd.hdr.query = 0;
 	ucd->cmd.hdr.response = 0;
@@ -1030,20 +984,14 @@ ufshci_utr_cmd_capacity(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 		return -1;
 	}
 
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 10) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 11) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 12) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 13) */
-	if (!ISSET(xs->flags, SCSI_POLL)) {
-		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
-		    UFSHCI_REG_UTRIACR_IAEN |
-		    UFSHCI_REG_UTRIACR_IAPWEN |
-		    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
-		    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
-	}
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * slot, sizeof(*utrd), BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * slot, sizeof(*ucd), BUS_DMASYNC_PREWRITE);
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 14) */
-	ufshci_doorbell_set(sc, slot);
+	ccb->ccb_status = CCB_STATUS_INPROGRESS;
+	ufshci_doorbell_write(sc, slot);
 
 	return slot;
 }
@@ -1059,8 +1007,9 @@ ufshci_utr_cmd_io(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	bus_dmamap_t dmap = ccb->ccb_dmamap;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 1) */
-	slot = ufshci_doorbell_get_free(sc);
-	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd) + (sizeof(*utrd) * slot);
+	slot = ccb->ccb_slot;
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += slot;
 	memset(utrd, 0, sizeof(*utrd));
 	DPRINTF("%s: slot=%d\n", __func__, slot);
 
@@ -1080,7 +1029,8 @@ ufshci_utr_cmd_io(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	utrd->dw2 = UFSHCI_UTRD_DW2_OCS_IOV;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2e) */
-	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd) + (sizeof(*ucd) * slot);
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += slot;
 	memset(ucd, 0, sizeof(*ucd));
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2f) */
@@ -1090,7 +1040,7 @@ ufshci_utr_cmd_io(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	else
 		ucd->cmd.hdr.flags = (1 << 5); /* Bit-5 = Write */
 	ucd->cmd.hdr.lun = 0;
-	ucd->cmd.hdr.taskid = ufshci_get_taskid(sc);
+	ucd->cmd.hdr.taskid = 0;
 	ucd->cmd.hdr.cmd_set_type = 0; /* SCSI command */
 	ucd->cmd.hdr.query = 0;
 	ucd->cmd.hdr.response = 0;
@@ -1102,8 +1052,6 @@ ufshci_utr_cmd_io(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	ucd->cmd.expected_xfer_len = htobe32(xs->datalen);
 
 	memcpy(ucd->cmd.cdb, &xs->cmd, sizeof(ucd->cmd.cdb));
-	if (dir == SCSI_DATA_OUT)
-		ucd->cmd.cdb[1] = (1 << 3); /* FUA: Force Unit Access */
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2g) */
 	/* Already done with above memset */
@@ -1145,20 +1093,14 @@ ufshci_utr_cmd_io(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 		return -1;
 	}
 
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 10) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 11) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 12) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 13) */
-	if (!ISSET(xs->flags, SCSI_POLL)) {
-		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
-		    UFSHCI_REG_UTRIACR_IAEN |
-		    UFSHCI_REG_UTRIACR_IAPWEN |
-		    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
-		    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
-	}
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * slot, sizeof(*utrd), BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * slot, sizeof(*ucd), BUS_DMASYNC_PREWRITE);
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 14) */
-	ufshci_doorbell_set(sc, slot);
+	ccb->ccb_status = CCB_STATUS_INPROGRESS;
+	ufshci_doorbell_write(sc, slot);
 
 	return slot;
 }
@@ -1173,8 +1115,9 @@ ufshci_utr_cmd_sync(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	struct ufshci_ucd *ucd;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 1) */
-	slot = ufshci_doorbell_get_free(sc);
-	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd) + (sizeof(*utrd) * slot);
+	slot = ccb->ccb_slot;
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += slot;
 	memset(utrd, 0, sizeof(*utrd));
 	DPRINTF("%s: slot=%d\n", __func__, slot);
 
@@ -1191,14 +1134,15 @@ ufshci_utr_cmd_sync(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 	utrd->dw2 = UFSHCI_UTRD_DW2_OCS_IOV;
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2e) */
-	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd) + (sizeof(*ucd) * slot);
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += slot;
 	memset(ucd, 0, sizeof(*ucd));
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 2f) */
 	ucd->cmd.hdr.tc = UPIU_TC_I2T_COMMAND;
 	ucd->cmd.hdr.flags = 0; /* No data transfer */
 	ucd->cmd.hdr.lun = 0;
-	ucd->cmd.hdr.taskid = ufshci_get_taskid(sc);
+	ucd->cmd.hdr.taskid = 0;
 	ucd->cmd.hdr.cmd_set_type = 0; /* SCSI command */
 	ucd->cmd.hdr.query = 0;
 	ucd->cmd.hdr.response = 0;
@@ -1248,20 +1192,14 @@ ufshci_utr_cmd_sync(struct ufshci_softc *sc, struct ufshci_ccb *ccb,
 		return -1;
 	}
 
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 10) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 11) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 12) */
-	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 13) */
-	if (!ISSET(xs->flags, SCSI_POLL)) {
-		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
-		    UFSHCI_REG_UTRIACR_IAEN |
-		    UFSHCI_REG_UTRIACR_IAPWEN |
-		    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
-		    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
-	}
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * slot, sizeof(*utrd), BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * slot, sizeof(*ucd), BUS_DMASYNC_PREWRITE);
 
 	/* 7.2.1 Basic Steps when Building a UTP Transfer Request: 14) */
-	ufshci_doorbell_set(sc, slot);
+	ccb->ccb_status = CCB_STATUS_INPROGRESS;
+	ufshci_doorbell_write(sc, slot);
 
 	return slot;
 }
@@ -1273,23 +1211,45 @@ ufshci_xfer_complete(struct ufshci_softc *sc)
 	uint32_t reg;
 	int i;
 
-	reg = ufshci_doorbell_read(sc);
+	mtx_enter(&sc->sc_cmd_mtx);
+
+	/* Wait for all commands to complete. */
+	while ((reg = ufshci_doorbell_read(sc))) {
+		DPRINTF("%s: doorbell reg=0x%x\n", __func__, reg);
+		if (reg == 0)
+			break;
+	}
 
 	for (i = 0; i < sc->sc_nutrs; i++) {
 		ccb = &sc->sc_ccbs[i];
 
-		if (ccb->ccb_slot == -1)
-			/* CCB isn't used. */
+		/* Skip unused CCBs. */
+		if (ccb->ccb_status != CCB_STATUS_INPROGRESS)
 			continue;
 
-		if (reg & (1 << ccb->ccb_slot))
-			/* Transfer is still in progress. */
-			continue;
-
-		/* Transfer has completed. */
 		if (ccb->ccb_done == NULL)
-			panic("ccb_done not defined");
-		ccb->ccb_done(sc, ccb);
+			panic("ccb done wasn't defined");
+
+		/* 7.2.3: Clear completion notification 3b) */
+		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRLCNR, (1U << i));
+
+		/* 7.2.3: Mark software slot for re-use 3c) */
+		ccb->ccb_status = CCB_STATUS_READY2FREE;
+
+		DPRINTF("slot %d completed\n", i);
+	}
+	mtx_leave(&sc->sc_cmd_mtx);
+
+	/*
+	 * Complete the CCB, which will re-schedule new transfers if any are
+	 * pending.
+	 */
+	for (i = 0; i < sc->sc_nutrs; i++) {
+		ccb = &sc->sc_ccbs[i];
+
+		/* 7.2.3: Process the transfer by higher OS layer 3a) */
+		if (ccb->ccb_status == CCB_STATUS_READY2FREE)
+			ccb->ccb_done(sc, ccb);
 	}
 
 	return 0;
@@ -1323,7 +1283,7 @@ ufshci_ccb_alloc(struct ufshci_softc *sc, int nccbs)
 			goto free_maps;
 
 		ccb->ccb_cookie = NULL;
-		ccb->ccb_slot = -1;
+		ccb->ccb_slot = i;
 
 		SIMPLEQ_INSERT_TAIL(&sc->sc_ccb_list, ccb, ccb_entry);
 	}
@@ -1387,15 +1347,17 @@ ufshci_scsi_cmd(struct scsi_xfer *xs)
 	struct scsi_link *link = xs->sc_link;
 	struct ufshci_softc *sc = link->bus->sb_adapter_softc;
 
+	mtx_enter(&sc->sc_cmd_mtx);
+
 	DPRINTF("%s: cmd=0x%x\n", __func__, xs->cmd.opcode);
 
-	if (!cold && !sc->sc_intraggr_enabled) {
-		DPRINTF("%s: Enable interrupt aggregation\n", __func__);
+	/* Schedule interrupt aggregation. */
+	if (ISSET(xs->flags, SCSI_POLL) == 0 && sc->sc_intraggr_enabled == 0) {
 		UFSHCI_WRITE_4(sc, UFSHCI_REG_UTRIACR,
 		    UFSHCI_REG_UTRIACR_IAEN |
 		    UFSHCI_REG_UTRIACR_IAPWEN |
 		    UFSHCI_REG_UTRIACR_CTR |
-		    UFSHCI_REG_UTRIACR_IACTH(UFSHCI_INTR_AGGR_COUNT) |
+		    UFSHCI_REG_UTRIACR_IACTH(sc->sc_iacth) |
 		    UFSHCI_REG_UTRIACR_IATOVAL(UFSHCI_INTR_AGGR_TIMEOUT));
 		sc->sc_intraggr_enabled = 1;
 	}
@@ -1406,45 +1368,52 @@ ufshci_scsi_cmd(struct scsi_xfer *xs)
 	case READ_10:
 	case READ_12:
 	case READ_16:
+		DPRINTF("io read\n");
 		ufshci_scsi_io(xs, SCSI_DATA_IN);
-		return;
+		break;
 
 	case WRITE_COMMAND:
 	case WRITE_10:
 	case WRITE_12:
 	case WRITE_16:
+		DPRINTF("io write\n");
 		ufshci_scsi_io(xs, SCSI_DATA_OUT);
-		return;
+		break;
 
 	case SYNCHRONIZE_CACHE:
+		DPRINTF("sync\n");
 		ufshci_scsi_sync(xs);
-		return;
+		break;
 
 	case INQUIRY:
+		DPRINTF("inquiry\n");
 		ufshci_scsi_inquiry(xs);
-		return;
+		break;
 
 	case READ_CAPACITY_16:
+		DPRINTF("capacity16\n");
 		ufshci_scsi_capacity16(xs);
-		return;
+		break;
 	case READ_CAPACITY:
+		DPRINTF("capacity\n");
 		ufshci_scsi_capacity(xs);
-		return;
+		break;
 
 	case TEST_UNIT_READY:
 	case PREVENT_ALLOW:
 	case START_STOP:
 		xs->error = XS_NOERROR;
 		scsi_done(xs);
-		return;
+		break;
 	default:
 		DPRINTF("%s: unhandled scsi command 0x%02x\n",
 		    __func__, xs->cmd.opcode);
+		xs->error = XS_DRIVER_STUFFUP;
+		scsi_done(xs);
 		break;
 	}
 
-	xs->error = XS_DRIVER_STUFFUP;
-	scsi_done(xs);
+	mtx_leave(&sc->sc_cmd_mtx);
 }
 
 void
@@ -1498,8 +1467,8 @@ ufshci_scsi_inquiry(struct scsi_xfer *xs)
 	ccb->ccb_done = ufshci_scsi_io_done;
 
 	/* Response length should be UPIU_SCSI_RSP_INQUIRY_SIZE. */
-	ccb->ccb_slot = ufshci_utr_cmd_inquiry(sc, ccb, xs);
-	if (ccb->ccb_slot == -1)
+	error = ufshci_utr_cmd_inquiry(sc, ccb, xs);
+	if (error == -1)
 		goto error2;
 
 	if (ISSET(xs->flags, SCSI_POLL)) {
@@ -1515,7 +1484,6 @@ ufshci_scsi_inquiry(struct scsi_xfer *xs)
 error2:
 	bus_dmamap_unload(sc->sc_dmat, dmap);
 	ccb->ccb_cookie = NULL;
-	ccb->ccb_slot = -1;
 	ccb->ccb_done = NULL;
 error1:
 	xs->error = XS_DRIVER_STUFFUP;
@@ -1553,8 +1521,8 @@ ufshci_scsi_capacity16(struct scsi_xfer *xs)
 	ccb->ccb_done = ufshci_scsi_io_done;
 
 	/* Response length should be UPIU_SCSI_RSP_CAPACITY16_SIZE. */
-	ccb->ccb_slot = ufshci_utr_cmd_capacity16(sc, ccb, xs);
-	if (ccb->ccb_slot == -1)
+	error = ufshci_utr_cmd_capacity16(sc, ccb, xs);
+	if (error == -1)
 		goto error2;
 
 	if (ISSET(xs->flags, SCSI_POLL)) {
@@ -1570,7 +1538,6 @@ ufshci_scsi_capacity16(struct scsi_xfer *xs)
 error2:
 	bus_dmamap_unload(sc->sc_dmat, dmap);
 	ccb->ccb_cookie = NULL;
-	ccb->ccb_slot = -1;
 	ccb->ccb_done = NULL;
 error1:
 	xs->error = XS_DRIVER_STUFFUP;
@@ -1608,8 +1575,8 @@ ufshci_scsi_capacity(struct scsi_xfer *xs)
 	ccb->ccb_done = ufshci_scsi_io_done;
 
 	/* Response length should be UPIU_SCSI_RSP_CAPACITY_SIZE */
-	ccb->ccb_slot = ufshci_utr_cmd_capacity(sc, ccb, xs);
-	if (ccb->ccb_slot == -1)
+	error = ufshci_utr_cmd_capacity(sc, ccb, xs);
+	if (error == -1)
 		goto error2;
 
 	if (ISSET(xs->flags, SCSI_POLL)) {
@@ -1625,7 +1592,6 @@ ufshci_scsi_capacity(struct scsi_xfer *xs)
 error2:
 	bus_dmamap_unload(sc->sc_dmat, dmap);
 	ccb->ccb_cookie = NULL;
-	ccb->ccb_slot = -1;
 	ccb->ccb_done = NULL;
 error1:
 	xs->error = XS_DRIVER_STUFFUP;
@@ -1640,6 +1606,7 @@ ufshci_scsi_sync(struct scsi_xfer *xs)
 	struct ufshci_ccb *ccb = xs->io;
 	uint64_t lba;
 	uint32_t blocks;
+	int error;
 
 	/* lba = 0, blocks = 0: Synchronize all logical blocks. */
 	lba = 0; blocks = 0;
@@ -1651,9 +1618,9 @@ ufshci_scsi_sync(struct scsi_xfer *xs)
 	ccb->ccb_cookie = xs;
 	ccb->ccb_done = ufshci_scsi_done;
 
-	ccb->ccb_slot = ufshci_utr_cmd_sync(sc, ccb, xs, (uint32_t)lba,
+	error = ufshci_utr_cmd_sync(sc, ccb, xs, (uint32_t)lba,
 	    (uint16_t)blocks);
-	if (ccb->ccb_slot == -1)
+	if (error == -1)
 		goto error;
 
 	if (ISSET(xs->flags, SCSI_POLL)) {
@@ -1668,7 +1635,6 @@ ufshci_scsi_sync(struct scsi_xfer *xs)
 
 error:
         ccb->ccb_cookie = NULL;
-        ccb->ccb_slot = -1;
         ccb->ccb_done = NULL;
 
 	xs->error = XS_DRIVER_STUFFUP;
@@ -1708,11 +1674,10 @@ ufshci_scsi_io(struct scsi_xfer *xs, int dir)
 	ccb->ccb_done = ufshci_scsi_io_done;
 
 	if (dir == SCSI_DATA_IN)
-		ccb->ccb_slot = ufshci_utr_cmd_io(sc, ccb, xs, SCSI_DATA_IN);
+		error = ufshci_utr_cmd_io(sc, ccb, xs, SCSI_DATA_IN);
 	else
-		ccb->ccb_slot = ufshci_utr_cmd_io(sc, ccb, xs, SCSI_DATA_OUT);
-
-	if (ccb->ccb_slot == -1)
+		error = ufshci_utr_cmd_io(sc, ccb, xs, SCSI_DATA_OUT);
+	if (error == -1)
 		goto error2;
 
 	if (ISSET(xs->flags, SCSI_POLL)) {
@@ -1728,7 +1693,6 @@ ufshci_scsi_io(struct scsi_xfer *xs, int dir)
 error2:
 	bus_dmamap_unload(sc->sc_dmat, dmap);
 	ccb->ccb_cookie = NULL;
-	ccb->ccb_slot = -1;
 	ccb->ccb_done = NULL;
 error1:
 	xs->error = XS_DRIVER_STUFFUP;
@@ -1740,6 +1704,8 @@ ufshci_scsi_io_done(struct ufshci_softc *sc, struct ufshci_ccb *ccb)
 {
 	struct scsi_xfer *xs = ccb->ccb_cookie;
 	bus_dmamap_t dmap = ccb->ccb_dmamap;
+	struct ufshci_ucd *ucd;
+	struct ufshci_utrd *utrd;
 
 	bus_dmamap_sync(sc->sc_dmat, dmap, 0, dmap->dm_mapsize,
 	    ISSET(xs->flags, SCSI_DATA_IN) ? BUS_DMASYNC_POSTREAD :
@@ -1747,11 +1713,29 @@ ufshci_scsi_io_done(struct ufshci_softc *sc, struct ufshci_ccb *ccb)
 
 	bus_dmamap_unload(sc->sc_dmat, dmap);
 
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * ccb->ccb_slot, sizeof(*ucd),
+	    BUS_DMASYNC_POSTWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * ccb->ccb_slot, sizeof(*utrd),
+	    BUS_DMASYNC_POSTWRITE);
+
+	/* TODO: Do more checks on the Response UPIU in case of errors? */
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += ccb->ccb_slot;
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += ccb->ccb_slot;
+	if (utrd->dw2 != UFSHCI_UTRD_DW2_OCS_SUCCESS) {
+		printf("%s: error: slot=%d, ocs=0x%x, rsp-tc=0x%x\n",
+		    __func__, ccb->ccb_slot, utrd->dw2, ucd->rsp.hdr.tc);
+	}
+
 	ccb->ccb_cookie = NULL;
-	ccb->ccb_slot = -1;
+	ccb->ccb_status = CCB_STATUS_FREE;
 	ccb->ccb_done = NULL;
 
-	xs->error = XS_NOERROR;
+	xs->error = (utrd->dw2 == UFSHCI_UTRD_DW2_OCS_SUCCESS) ?
+	    XS_NOERROR : XS_DRIVER_STUFFUP;
 	xs->status = SCSI_OK;
 	xs->resid = 0;
 	scsi_done(xs);
@@ -1761,12 +1745,32 @@ void
 ufshci_scsi_done(struct ufshci_softc *sc, struct ufshci_ccb *ccb)
 {
 	struct scsi_xfer *xs = ccb->ccb_cookie;
+	struct ufshci_ucd *ucd;
+	struct ufshci_utrd *utrd;
+
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_ucd),
+	    sizeof(*ucd) * ccb->ccb_slot, sizeof(*ucd),
+	    BUS_DMASYNC_POSTWRITE);
+	bus_dmamap_sync(sc->sc_dmat, UFSHCI_DMA_MAP(sc->sc_dmamem_utrd),
+	    sizeof(*utrd) * ccb->ccb_slot, sizeof(*utrd),
+	    BUS_DMASYNC_POSTWRITE);
+
+	/* TODO: Do more checks on the Response UPIU in case of errors? */
+	utrd = UFSHCI_DMA_KVA(sc->sc_dmamem_utrd);
+	utrd += ccb->ccb_slot;
+	ucd = UFSHCI_DMA_KVA(sc->sc_dmamem_ucd);
+	ucd += ccb->ccb_slot;
+	if (utrd->dw2 != UFSHCI_UTRD_DW2_OCS_SUCCESS) {
+		printf("%s: error: slot=%d, ocs=0x%x, rsp-tc=0x%x\n",
+		    __func__, ccb->ccb_slot, utrd->dw2, ucd->rsp.hdr.tc);
+	}
 
 	ccb->ccb_cookie = NULL;
-	ccb->ccb_slot = -1;
+	ccb->ccb_status = CCB_STATUS_FREE;
 	ccb->ccb_done = NULL;
 
-	xs->error = XS_NOERROR;
+	xs->error = (utrd->dw2 == UFSHCI_UTRD_DW2_OCS_SUCCESS) ?
+	    XS_NOERROR : XS_DRIVER_STUFFUP;
 	xs->status = SCSI_OK;
 	xs->resid = 0;
 	scsi_done(xs);
diff --git a/sys/dev/ic/ufshcireg.h b/sys/dev/ic/ufshcireg.h
index d251c5f35..688d66962 100644
--- a/sys/dev/ic/ufshcireg.h
+++ b/sys/dev/ic/ufshcireg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufshcireg.h,v 1.5 2024/04/19 20:43:33 mglocker Exp $ */
+/*	$OpenBSD: ufshcireg.h,v 1.7 2024/05/09 08:20:22 mglocker Exp $ */
 
 /*
  * Copyright (c) 2022 Marcus Glocker <mglocker@openbsd.org>
@@ -21,7 +21,6 @@
  */
 #define UFSHCI_UCD_PRDT_MAX_SEGS	64
 #define UFSHCI_UCD_PRDT_MAX_XFER	(UFSHCI_UCD_PRDT_MAX_SEGS * PAGE_SIZE)
-#define UFSHCI_INTR_AGGR_COUNT		1 /* Max. allowed value = 31 */
 #define UFSHCI_INTR_AGGR_TIMEOUT	0x64 /* 4ms */
 #define UFSHCI_MAX_UNITS		32
 
@@ -257,7 +256,7 @@ struct ufshci_utrd {
 	uint32_t dw5; /* UTP Cmd. Desc. Base Addr. Upper 32-bits (UCDBAU) */
 	uint32_t dw6; /* RUO, RUL */
 	uint32_t dw7; /* PRDTO, PRDTL */
-};
+} __packed;
 
 /*
  * UTP Command Descriptor, PRDT (Physical Region Description Table) Structure
@@ -274,7 +273,7 @@ struct ufshci_ucd_prdt {
 	uint32_t dw1; /* Data base Address Upper 32-bits (DBAU) */
 	uint32_t dw2; /* Reserved */
 	uint32_t dw3; /* Data Byte Count (DBC) */
-};
+} __packed;
 
 /*
  * UTP Task Management Request Descriptor Structure
@@ -306,7 +305,7 @@ struct ufshci_utmrd {
 	uint32_t dw3; /* Reserved */
 	uint8_t dw4_w11[32]; /* Task Management Request UPIU */
 	uint8_t dw12_dw19[32]; /* Task Management Response UPIU */
-};
+} __packed;
 
 /*
  * ****************************************************************************
@@ -344,19 +343,19 @@ struct upiu_hdr {
 	uint8_t ehs_len;
 	uint8_t device_info;
 	uint16_t ds_len;		/* Data Segment Length */
-};
+} __packed;
 
 struct upiu_command {
 	struct upiu_hdr hdr;
 	uint32_t expected_xfer_len;
 	uint8_t cdb[16];
-};
+} __packed;
 
 struct upiu_response {
 	struct upiu_hdr hdr;
 	uint32_t residual_xfer_len;
 	uint8_t cdb[16];
-};
+} __packed;
 
 struct ufshci_ucd {
 	struct upiu_command cmd;
diff --git a/sys/dev/ic/ufshcivar.h b/sys/dev/ic/ufshcivar.h
index 57573ecfc..65b9d6fe0 100644
--- a/sys/dev/ic/ufshcivar.h
+++ b/sys/dev/ic/ufshcivar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ufshcivar.h,v 1.1 2023/02/04 23:11:59 mglocker Exp $ */
+/*	$OpenBSD: ufshcivar.h,v 1.4 2024/05/09 08:06:42 mglocker Exp $ */
 
 /*
  * Copyright (c) 2022 Marcus Glocker <mglocker@openbsd.org>
@@ -40,6 +40,10 @@ struct ufshci_ccb {
 	bus_dmamap_t			 ccb_dmamap;
 	void				*ccb_cookie;
 	int				 ccb_slot;
+#define CCB_STATUS_FREE		0
+#define CCB_STATUS_INPROGRESS	1
+#define CCB_STATUS_READY2FREE	2
+	int				 ccb_status;
 	void				 (*ccb_done)(struct ufshci_softc *,
 					     struct ufshci_ccb *);
 };
@@ -54,6 +58,8 @@ struct ufshci_softc {
 	bus_dma_tag_t		 sc_dmat;
 
 	uint8_t			 sc_intraggr_enabled;
+	uint8_t			 sc_iacth;
+	struct mutex		 sc_cmd_mtx;
 
 	uint32_t		 sc_ver;
 	uint32_t		 sc_cap;
diff --git a/usr.bin/ssh/clientloop.c b/usr.bin/ssh/clientloop.c
index 79bffbc00..b7d4c11f4 100644
--- a/usr.bin/ssh/clientloop.c
+++ b/usr.bin/ssh/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.405 2024/04/30 02:14:10 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.406 2024/05/09 09:46:47 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -147,7 +147,6 @@ static time_t control_persist_exit_time = 0;
 volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */
 static int last_was_cr;		/* Last character was a newline. */
 static int exit_status;		/* Used to store the command exit status. */
-static struct sshbuf *stderr_buffer;	/* Used for final exit message. */
 static int connection_in;	/* Connection to server (input). */
 static int connection_out;	/* Connection to server (output). */
 static int need_rekeying;	/* Set to non-zero if rekeying is requested. */
@@ -192,17 +191,18 @@ static void quit_message(const char *fmt, ...)
 static void
 quit_message(const char *fmt, ...)
 {
-	char *msg;
+	char *msg, *fmt2;
 	va_list args;
-	int r;
+	xasprintf(&fmt2, "%s\r\n", fmt);
 
 	va_start(args, fmt);
-	xvasprintf(&msg, fmt, args);
+	xvasprintf(&msg, fmt2, args);
 	va_end(args);
 
-	if ((r = sshbuf_putf(stderr_buffer, "%s\r\n", msg)) != 0)
-		fatal_fr(r, "sshbuf_putf");
+	(void)atomicio(vwrite, STDERR_FILENO, msg, strlen(msg));
 	free(msg);
+	free(fmt2);
+
 	quit_pending = 1;
 }
 
@@ -1437,7 +1437,7 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
 	struct pollfd *pfd = NULL;
 	u_int npfd_alloc = 0, npfd_active = 0;
 	double start_time, total_time;
-	int channel_did_enqueue = 0, r, len;
+	int channel_did_enqueue = 0, r;
 	u_int64_t ibytes, obytes;
 	int conn_in_ready, conn_out_ready;
 	sigset_t bsigset, osigset;
@@ -1489,10 +1489,6 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
 
 	quit_pending = 0;
 
-	/* Initialize buffer. */
-	if ((stderr_buffer = sshbuf_new()) == NULL)
-		fatal_f("sshbuf_new failed");
-
 	client_init_dispatch(ssh);
 
 	/*
@@ -1623,6 +1619,14 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
 
 	/* Terminate the session. */
 
+	/*
+	 * In interactive mode (with pseudo tty) display a message indicating
+	 * that the connection has been closed.
+	 */
+	if (have_pty && options.log_level >= SYSLOG_LEVEL_INFO)
+		quit_message("Connection to %s closed.", host);
+
+
 	/* Stop watching for window change. */
 	ssh_signal(SIGWINCH, SIG_DFL);
 
@@ -1655,27 +1659,6 @@ client_loop(struct ssh *ssh, int have_pty, int escape_char_arg,
 		cleanup_exit(255);
 	}
 
-	/*
-	 * In interactive mode (with pseudo tty) display a message indicating
-	 * that the connection has been closed.
-	 */
-	if (have_pty && options.log_level >= SYSLOG_LEVEL_INFO)
-		quit_message("Connection to %s closed.", host);
-
-	/* Output any buffered data for stderr. */
-	if (sshbuf_len(stderr_buffer) > 0) {
-		len = atomicio(vwrite, fileno(stderr),
-		    (u_char *)sshbuf_ptr(stderr_buffer),
-		    sshbuf_len(stderr_buffer));
-		if (len < 0 || (u_int)len != sshbuf_len(stderr_buffer))
-			error("Write failed flushing stderr buffer.");
-		else if ((r = sshbuf_consume(stderr_buffer, len)) != 0)
-			fatal_fr(r, "sshbuf_consume");
-	}
-
-	/* Clear and free any buffers. */
-	sshbuf_free(stderr_buffer);
-
 	/* Report bytes transferred, and transfer rates. */
 	total_time = monotime_double() - start_time;
 	ssh_packet_get_bytes(ssh, &ibytes, &obytes);
diff --git a/usr.sbin/acme-client/key.c b/usr.sbin/acme-client/key.c
index af8cc7d5c..9ece3059d 100644
--- a/usr.sbin/acme-client/key.c
+++ b/usr.sbin/acme-client/key.c
@@ -1,4 +1,4 @@
-/*	$Id: key.c,v 1.8 2023/08/29 14:44:53 op Exp $ */
+/*	$Id: key.c,v 1.9 2024/05/09 06:08:11 tb Exp $ */
 /*
  * Copyright (c) 2019 Renaud Allard <renaud@allard.it>
  * Copyright (c) 2016 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -42,79 +42,76 @@ rsa_key_create(FILE *f, const char *fname)
 	EVP_PKEY_CTX	*ctx = NULL;
 	EVP_PKEY	*pkey = NULL;
 
-	/* First, create the context and the key. */
-
 	if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_RSA, NULL)) == NULL) {
 		warnx("EVP_PKEY_CTX_new_id");
 		goto err;
-	} else if (EVP_PKEY_keygen_init(ctx) <= 0) {
+	}
+	if (EVP_PKEY_keygen_init(ctx) <= 0) {
 		warnx("EVP_PKEY_keygen_init");
 		goto err;
-	} else if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, KBITS) <= 0) {
+	}
+	if (EVP_PKEY_CTX_set_rsa_keygen_bits(ctx, KBITS) <= 0) {
 		warnx("EVP_PKEY_set_rsa_keygen_bits");
 		goto err;
-	} else if (EVP_PKEY_keygen(ctx, &pkey) <= 0) {
+	}
+	if (EVP_PKEY_keygen(ctx, &pkey) <= 0) {
 		warnx("EVP_PKEY_keygen");
 		goto err;
 	}
 
 	/* Serialise the key to the disc. */
 
-	if (PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
-		goto out;
+	if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL)) {
+		warnx("%s: PEM_write_PrivateKey", fname);
+		goto err;
+	}
 
-	warnx("%s: PEM_write_PrivateKey", fname);
+	EVP_PKEY_CTX_free(ctx);
+	return pkey;
 
 err:
 	EVP_PKEY_free(pkey);
-	pkey = NULL;
-out:
 	EVP_PKEY_CTX_free(ctx);
-	return pkey;
+	return NULL;
 }
 
 EVP_PKEY *
 ec_key_create(FILE *f, const char *fname)
 {
-	EC_KEY		*eckey = NULL;
+	EVP_PKEY_CTX	*ctx = NULL;
 	EVP_PKEY	*pkey = NULL;
 
-	if ((eckey = EC_KEY_new_by_curve_name(NID_secp384r1)) == NULL) {
-		warnx("EC_KEY_new_by_curve_name");
+	if ((ctx = EVP_PKEY_CTX_new_id(EVP_PKEY_EC, NULL)) == NULL) {
+		warnx("EVP_PKEY_CTX_new_id");
+		goto err;
+	}
+	if (EVP_PKEY_keygen_init(ctx) <= 0) {
+		warnx("EVP_PKEY_keygen_init");
+		goto err;
+	}
+	if (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx, NID_secp384r1) <= 0) {
+		warnx("EVP_PKEY_CTX_set_ec_paramgen_curve_nid");
+		goto err;
+	}
+	if (EVP_PKEY_keygen(ctx, &pkey) <= 0) {
+		warnx("EVP_PKEY_keygen");
 		goto err;
 	}
 
-	if (!EC_KEY_generate_key(eckey)) {
-		warnx("EC_KEY_generate_key");
+	/* Serialise the key to the disc. */
+
+	if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL)) {
+		warnx("%s: PEM_write_PrivateKey", fname);
 		goto err;
 	}
 
-	/* Serialise the key to the disc in EC format */
-
-	if (!PEM_write_ECPrivateKey(f, eckey, NULL, NULL, 0, NULL, NULL)) {
-		warnx("%s: PEM_write_ECPrivateKey", fname);
-		goto err;
-	}
-
-	/* Convert the EC key into a PKEY structure */
-
-	if ((pkey = EVP_PKEY_new()) == NULL) {
-		warnx("EVP_PKEY_new");
-		goto err;
-	}
-	if (!EVP_PKEY_set1_EC_KEY(pkey, eckey)) {
-		warnx("EVP_PKEY_set1_EC_KEY");
-		goto err;
-	}
-
-	goto out;
+	EVP_PKEY_CTX_free(ctx);
+	return pkey;
 
 err:
 	EVP_PKEY_free(pkey);
-	pkey = NULL;
-out:
-	EC_KEY_free(eckey);
-	return pkey;
+	EVP_PKEY_CTX_free(ctx);
+	return NULL;
 }
 
 EVP_PKEY *