diff --git a/distrib/miniroot/install.sub b/distrib/miniroot/install.sub
index 86db0c32b..94de170ab 100644
--- a/distrib/miniroot/install.sub
+++ b/distrib/miniroot/install.sub
@@ -1,5 +1,5 @@
 #!/bin/ksh
-#	$OpenBSD: install.sub,v 1.1260 2024/02/19 13:53:03 kn Exp $
+#	$OpenBSD: install.sub,v 1.1261 2024/03/05 19:47:58 kn Exp $
 #
 # Copyright (c) 1997-2015 Todd Miller, Theo de Raadt, Ken Westerback
 # Copyright (c) 2015, Robert Peichaer <rpe@openbsd.org>
@@ -1777,7 +1777,7 @@ install_files() {
 	if [[ $MODE == upgrade ]]; then
 		if isin base$VERSION.tgz $_get_sets; then
 			rm -f /mnt/usr/share/relink/usr/lib/*
-			rm -rf /mnt/usr/lib/libLLVM.so.[0-6].0
+			rm -rf /mnt/usr/lib/libLLVM.so.[0-7].0
 			rm -rf /mnt/usr/libdata/perl5
 		fi
 		if isin comp$VERSION.tgz $_get_sets; then
diff --git a/distrib/sets/lists/comp/mi b/distrib/sets/lists/comp/mi
index fb6762dc3..f0fae99b0 100644
--- a/distrib/sets/lists/comp/mi
+++ b/distrib/sets/lists/comp/mi
@@ -1781,7 +1781,6 @@
 ./usr/share/man/man3/ASN1_mbstring_copy.3
 ./usr/share/man/man3/ASN1_parse_dump.3
 ./usr/share/man/man3/ASN1_put_object.3
-./usr/share/man/man3/ASN1_time_parse.3
 ./usr/share/man/man3/ASRange_new.3
 ./usr/share/man/man3/AUTHORITY_KEYID_new.3
 ./usr/share/man/man3/BASIC_CONSTRAINTS_new.3
@@ -2194,7 +2193,6 @@
 ./usr/share/man/man3/X509_ATTRIBUTE_new.3
 ./usr/share/man/man3/X509_ATTRIBUTE_set1_object.3
 ./usr/share/man/man3/X509_CINF_new.3
-./usr/share/man/man3/X509_CRL_METHOD_new.3
 ./usr/share/man/man3/X509_CRL_get0_by_serial.3
 ./usr/share/man/man3/X509_CRL_new.3
 ./usr/share/man/man3/X509_CRL_print.3
diff --git a/lib/libcrypto/man/ASN1_STRING_new.3 b/lib/libcrypto/man/ASN1_STRING_new.3
index 9500b82df..19b0ca116 100644
--- a/lib/libcrypto/man/ASN1_STRING_new.3
+++ b/lib/libcrypto/man/ASN1_STRING_new.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ASN1_STRING_new.3,v 1.25 2023/07/28 05:48:33 tb Exp $
+.\"	$OpenBSD: ASN1_STRING_new.3,v 1.26 2024/03/05 18:30:40 tb Exp $
 .\"	OpenSSL 99d63d46 Tue Mar 24 07:52:24 2015 -0400
 .\"
 .\" Copyright (c) 2017 Ingo Schwarze <schwarze@openbsd.org>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: July 28 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt ASN1_STRING_NEW 3
 .Os
 .Sh NAME
@@ -212,7 +212,6 @@ is returned and an error code can be retrieved with
 .Xr ASN1_PRINTABLE_type 3 ,
 .Xr ASN1_STRING_length 3 ,
 .Xr ASN1_STRING_print_ex 3 ,
-.Xr ASN1_time_parse 3 ,
 .Xr ASN1_TIME_set 3 ,
 .Xr ASN1_TYPE_get 3 ,
 .Xr ASN1_UNIVERSALSTRING_to_string 3 ,
diff --git a/lib/libcrypto/man/ASN1_TIME_set.3 b/lib/libcrypto/man/ASN1_TIME_set.3
index b5ed51567..233cb13f2 100644
--- a/lib/libcrypto/man/ASN1_TIME_set.3
+++ b/lib/libcrypto/man/ASN1_TIME_set.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ASN1_TIME_set.3,v 1.22 2024/02/18 16:30:17 tb Exp $
+.\" $OpenBSD: ASN1_TIME_set.3,v 1.23 2024/03/05 18:30:40 tb Exp $
 .\" full merge up to: OpenSSL 3d0f1cb9 Jul 11 03:01:24 2017 +0800
 .\" selective merge up to: OpenSSL 24a535ea Sep 22 13:14:20 2020 +0100
 .\"
@@ -68,7 +68,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: February 18 2024 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt ASN1_TIME_SET 3
 .Os
 .Sh NAME
@@ -659,7 +659,6 @@ BIO_free(b);
 .Ed
 .Sh SEE ALSO
 .Xr ASN1_TIME_new 3 ,
-.Xr ASN1_time_parse 3 ,
 .Xr X509_cmp_time 3
 .Sh STANDARDS
 The usage of the ASN.1
diff --git a/lib/libcrypto/man/ASN1_time_parse.3 b/lib/libcrypto/man/ASN1_time_parse.3
deleted file mode 100644
index 6ec45e5dc..000000000
--- a/lib/libcrypto/man/ASN1_time_parse.3
+++ /dev/null
@@ -1,141 +0,0 @@
-.\" $OpenBSD: ASN1_time_parse.3,v 1.9 2020/11/02 17:45:35 tb Exp $
-.\"
-.\" Copyright (c) 2016 Bob Beck <beck@openbsd.org>
-.\"
-.\" Permission to use, copy, modify, and distribute this software for any
-.\" purpose with or without fee is hereby granted, provided that the above
-.\" copyright notice and this permission notice appear in all copies.
-.\"
-.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-.\"
-.Dd $Mdocdate: November 2 2020 $
-.Dt ASN1_TIME_PARSE 3
-.Os
-.Sh NAME
-.Nm ASN1_time_parse ,
-.Nm ASN1_time_tm_cmp ,
-.Nm ASN1_TIME_set_tm
-.Nd LibreSSL utilities for ASN.1 time types
-.Sh SYNOPSIS
-.In openssl/asn1.h
-.Ft int
-.Fn ASN1_time_parse "const char *bytes" "size_t len" "struct tm *tm" "int mode"
-.Ft int
-.Fn ASN1_time_tm_cmp "struct tm *tm1" "struct tm *tm2"
-.Ft ASN1_TIME *
-.Fn ASN1_TIME_set_tm "ASN1_TIME *s" "struct tm *tm"
-.Sh DESCRIPTION
-The
-.Fn ASN1_time_parse
-function parses an ASN.1 time string of
-.Ar len
-bytes starting at
-.Ar bytes .
-The resulting time is stored in
-.Ar tm
-if
-.Ar tm
-is not
-.Dv NULL .
-.Pp
-The
-.Ar mode
-parameter must be one of
-.Bl -bullet -offset four
-.It
-0 to parse a time as specified in RFC 5280 for an X509 object,
-which may be either a UTC time or a Generalized time.
-.It
-.Dv V_ASN1_UTCTIME
-to parse an RFC 5280 format UTC time.
-.It
-.Dv V_ASN1_GENERALIZEDTIME
-to parse an RFC 5280 format Generalized time.
-.El
-.Pp
-The
-.Fn ASN1_time_tm_cmp
-function compares two times in
-.Ar tm1
-and
-.Ar tm2 .
-.Pp
-The function
-.Fn ASN1_TIME_set_tm
-sets the
-.Vt ASN1_TIME
-structure
-.Fa s
-to the time represented by the
-.Vt struct tm
-value pointed to by
-.Fa tm .
-If
-.Fa s
-is
-.Dv NULL ,
-a new
-.Vt ASN1_TIME
-structure is allocated and returned.
-.Sh RETURN VALUES
-.Fn ASN1_time_parse
-returns
-.Bl -bullet -offset four
-.It
--1 if the string was invalid for the
-.Ar mode
-specified.
-.It
-.Dv V_ASN1_UTCTIME
-if the string parsed as a valid UTC time.
-.It
-.Dv V_ASN1_GENERALIZEDTIME
-if the string parsed as a valid Generalized time.
-.El
-.Pp
-.Fn ASN1_time_tm_cmp
-returns
-.Bl -bullet -offset four
-.It
--1 if
-.Ar tm1
-is less than
-.Ar tm2 .
-.It
-1 if
-.Ar tm1
-is greater than
-.Ar tm2 .
-.It
-0 if
-.Ar tm1
-is the same as
-.Ar tm2 .
-.El
-.Pp
-.Fn ASN1_TIME_set_tm
-returns a pointer to an
-.Vt ASN1_TIME
-structure or
-.Dv NULL
-if an error occurred.
-.Sh SEE ALSO
-.Xr ASN1_TIME_new 3 ,
-.Xr ASN1_TIME_set 3 ,
-.Xr X509_cmp_time 3
-.Sh HISTORY
-.Fn ASN1_time_parse
-and
-.Fn ASN1_time_tm_cmp
-first appeared in
-.Ox 6.1
-and
-.Fn ASN1_TIME_set_tm
-in
-.Ox 6.2 .
diff --git a/lib/libcrypto/man/ERR_load_crypto_strings.3 b/lib/libcrypto/man/ERR_load_crypto_strings.3
index 72d10b030..2bca8af60 100644
--- a/lib/libcrypto/man/ERR_load_crypto_strings.3
+++ b/lib/libcrypto/man/ERR_load_crypto_strings.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ERR_load_crypto_strings.3,v 1.11 2023/07/21 10:45:44 tb Exp $
+.\" $OpenBSD: ERR_load_crypto_strings.3,v 1.12 2024/03/05 19:21:31 tb Exp $
 .\" full merge up to: OpenSSL f672aee4 Feb 9 11:52:40 2016 -0500
 .\" selective merge up to: OpenSSL b3696a55 Sep 2 09:35:50 2017 -0400
 .\"
@@ -66,7 +66,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: July 21 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt ERR_LOAD_CRYPTO_STRINGS 3
 .Os
 .Sh NAME
@@ -89,7 +89,6 @@
 .\" ERR_load_EC_strings()
 .\" ERR_load_ERR_strings()
 .\" ERR_load_EVP_strings()
-.\" ERR_load_GOST_strings()
 .\" ERR_load_OBJ_strings()
 .\" ERR_load_OCSP_strings()
 .\" ERR_load_PEM_strings()
diff --git a/lib/libcrypto/man/EVP_PKCS82PKEY.3 b/lib/libcrypto/man/EVP_PKCS82PKEY.3
index 0f6667388..30a43b8dc 100644
--- a/lib/libcrypto/man/EVP_PKCS82PKEY.3
+++ b/lib/libcrypto/man/EVP_PKCS82PKEY.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_PKCS82PKEY.3,v 1.2 2023/12/21 21:32:01 tb Exp $
+.\" $OpenBSD: EVP_PKCS82PKEY.3,v 1.3 2024/03/05 19:21:31 tb Exp $
 .\"
 .\" Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: December 21 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt EVP_PKCS82PKEY 3
 .Os
 .Sh NAME
@@ -39,7 +39,7 @@ creates a PKCS#8
 structure representing the private key contained in
 .Fa pkey .
 .Pp
-Supported algorithms include DH, DSA, EC, GOST2001, and RSA.
+Supported algorithms include DH, DSA, EC, and RSA.
 .Sh RETURN VALUES
 These functions return a newly allocated object or
 .Dv NULL
diff --git a/lib/libcrypto/man/EVP_PKEY_cmp.3 b/lib/libcrypto/man/EVP_PKEY_cmp.3
index 42bfb6fec..2e42a9946 100644
--- a/lib/libcrypto/man/EVP_PKEY_cmp.3
+++ b/lib/libcrypto/man/EVP_PKEY_cmp.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_PKEY_cmp.3,v 1.13 2023/09/08 11:37:58 schwarze Exp $
+.\" $OpenBSD: EVP_PKEY_cmp.3,v 1.14 2024/03/05 19:21:31 tb Exp $
 .\" full merge up to: OpenSSL 05ea606a May 20 20:52:46 2016 -0400
 .\" selective merge up to: OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
 .\"
@@ -67,7 +67,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: September 8 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt EVP_PKEY_CMP 3
 .Os
 .Sh NAME
@@ -77,7 +77,7 @@
 .Nm EVP_PKEY_cmp
 .\" .Nm EVP_PKEY_save_parameters is intentionally undocumented
 .\" because nothing uses it according to codesearch.debian.net
-.\" and it only affects X509_PUBKEY_set(3) for DSA and GOST2001 keys,
+.\" and it only affects X509_PUBKEY_set(3) for DSA,
 .\" resulting in incomplete output without the public key parameters.
 .Nd public key parameter and comparison functions
 .Sh SYNOPSIS
diff --git a/lib/libcrypto/man/EVP_PKEY_derive.3 b/lib/libcrypto/man/EVP_PKEY_derive.3
index c82018341..8940572d1 100644
--- a/lib/libcrypto/man/EVP_PKEY_derive.3
+++ b/lib/libcrypto/man/EVP_PKEY_derive.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_PKEY_derive.3,v 1.9 2023/09/09 14:26:35 schwarze Exp $
+.\" $OpenBSD: EVP_PKEY_derive.3,v 1.10 2024/03/05 19:21:31 tb Exp $
 .\" full merge up to: OpenSSL 48e5119a Jan 19 10:49:22 2018 +0100
 .\"
 .\" This file is a derived work.
@@ -66,7 +66,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: September 9 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt EVP_PKEY_DERIVE 3
 .Os
 .Sh NAME
@@ -109,7 +109,6 @@ The library provides built-in support for keys with an
 of
 .Dv EVP_PKEY_DH ,
 .Dv EVP_PKEY_EC ,
-.Dv EVP_PKEY_GOSTR01 ,
 .Dv EVP_PKEY_HKDF ,
 and
 .Dv EVP_PKEY_X25519 .
diff --git a/lib/libcrypto/man/EVP_PKEY_get_default_digest_nid.3 b/lib/libcrypto/man/EVP_PKEY_get_default_digest_nid.3
index bef39987a..50a0ddba1 100644
--- a/lib/libcrypto/man/EVP_PKEY_get_default_digest_nid.3
+++ b/lib/libcrypto/man/EVP_PKEY_get_default_digest_nid.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_PKEY_get_default_digest_nid.3,v 1.7 2023/09/13 14:57:21 schwarze Exp $
+.\" $OpenBSD: EVP_PKEY_get_default_digest_nid.3,v 1.8 2024/03/05 19:21:31 tb Exp $
 .\" full merge up to: OpenSSL df75c2bf Dec 9 01:02:36 2018 +0100
 .\"
 .\" This file is a derived work.
@@ -66,7 +66,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: September 13 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt EVP_PKEY_GET_DEFAULT_DIGEST_NID 3
 .Os
 .Sh NAME
@@ -103,8 +103,6 @@ Support for the following public key algorithms is built into the library:
 .It Dv EVP_PKEY_DSA       Ta Dv NID_sha1                Ta mandatory
 .It Dv EVP_PKEY_EC        Ta Dv NID_sha1                Ta mandatory
 .It Dv EVP_PKEY_ED25519   Ta Dv NID_undef               Ta mandatory
-.It Dv EVP_PKEY_GOSTIMIT  Ta Dv NID_id_Gost28147_89_MAC Ta mandatory
-.It Dv EVP_PKEY_GOSTR01   Ta variable                   Ta mandatory
 .It Dv EVP_PKEY_HMAC      Ta Dv NID_sha1                Ta advisory
 .It Dv EVP_PKEY_RSA       Ta Dv NID_sha256              Ta advisory
 .El
diff --git a/lib/libcrypto/man/EVP_PKEY_set1_RSA.3 b/lib/libcrypto/man/EVP_PKEY_set1_RSA.3
index 4825b6056..07db27003 100644
--- a/lib/libcrypto/man/EVP_PKEY_set1_RSA.3
+++ b/lib/libcrypto/man/EVP_PKEY_set1_RSA.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_PKEY_set1_RSA.3,v 1.21 2023/12/21 21:32:01 tb Exp $
+.\" $OpenBSD: EVP_PKEY_set1_RSA.3,v 1.22 2024/03/05 19:21:31 tb Exp $
 .\" full merge up to: OpenSSL 99d63d46 Oct 26 13:56:48 2016 -0400
 .\"
 .\" This file is a derived work.
@@ -65,7 +65,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: December 21 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt EVP_PKEY_SET1_RSA 3
 .Os
 .Sh NAME
@@ -87,7 +87,6 @@
 .Nm EVP_PKEY_assign_DSA ,
 .Nm EVP_PKEY_assign_DH ,
 .Nm EVP_PKEY_assign_EC_KEY ,
-.Nm EVP_PKEY_assign_GOST ,
 .Nm EVP_PKEY_assign ,
 .Nm EVP_PKEY_base_id ,
 .Nm EVP_PKEY_id ,
@@ -182,11 +181,6 @@
 .Fa "EC_KEY *key"
 .Fc
 .Ft int
-.Fo EVP_PKEY_assign_GOST
-.Fa "EVP_PKEY *pkey"
-.Fa "GOST_KEY *key"
-.Fc
-.Ft int
 .Fo EVP_PKEY_assign
 .Fa "EVP_PKEY *pkey"
 .Fa "int type"
@@ -268,7 +262,6 @@ becomes unspecified.
 .Fn EVP_PKEY_assign_DSA ,
 .Fn EVP_PKEY_assign_DH ,
 .Fn EVP_PKEY_assign_EC_KEY ,
-.Fn EVP_PKEY_assign_GOST ,
 and
 .Fn EVP_PKEY_assign
 also set the referenced key to
@@ -292,9 +285,8 @@ The following types are supported:
 .Dv EVP_PKEY_RSA ,
 .Dv EVP_PKEY_DSA ,
 .Dv EVP_PKEY_DH ,
-.Dv EVP_PKEY_EC ,
 and
-.Dv EVP_PKEY_GOSTR01 .
+.Dv EVP_PKEY_EC .
 .Pp
 .Fn EVP_PKEY_base_id
 returns the type of
@@ -307,8 +299,6 @@ according to the following table:
 .It Dv EVP_PKEY_DH       Ta = Dv NID_dhKeyAgreement       Ta DH
 .It Dv EVP_PKEY_DSA      Ta = Dv NID_dsa                  Ta DSA
 .It Dv EVP_PKEY_EC       Ta = Dv NID_X9_62_id_ecPublicKey Ta EC
-.It Dv EVP_PKEY_GOSTIMIT Ta = Dv NID_id_Gost28147_89_MAC  Ta GOST-MAC
-.It Dv EVP_PKEY_GOSTR01  Ta = Dv NID_id_GostR3410_2001    Ta GOST2001
 .It Dv EVP_PKEY_HMAC     Ta = Dv NID_hmac                 Ta HMAC
 .It Dv EVP_PKEY_RSA      Ta = Dv NID_rsaEncryption        Ta RSA
 .It Dv EVP_PKEY_RSA_PSS  Ta = Dv NID_rsassaPss            Ta RSA-PSS
@@ -326,8 +316,6 @@ The following deprecated aliases are still supported:
 .It Dv EVP_PKEY_DSA2        Ta = Dv NID_dsaWithSHA                Ta DSA
 .It Dv EVP_PKEY_DSA3        Ta = Dv NID_dsaWithSHA1               Ta DSA
 .It Dv EVP_PKEY_DSA4        Ta = Dv NID_dsaWithSHA1_2             Ta DSA
-.It Dv EVP_PKEY_GOSTR12_256 Ta = Dv NID_id_tc26_gost3410_2012_256 Ta GOST2001
-.It Dv EVP_PKEY_GOSTR12_512 Ta = Dv NID_id_tc26_gost3410_2012_512 Ta GOST2001
 .It Dv EVP_PKEY_RSA2        Ta = Dv NID_rsa                       Ta RSA
 .El
 .Pp
@@ -408,7 +396,6 @@ functions must be freed as well as
 .Fn EVP_PKEY_assign_DSA ,
 .Fn EVP_PKEY_assign_DH ,
 .Fn EVP_PKEY_assign_EC_KEY ,
-.Fn EVP_PKEY_assign_GOST ,
 .Fn EVP_PKEY_assign ,
 .Fn EVP_PKEY_set_type ,
 and
@@ -436,7 +423,6 @@ the return value points to an
 .Vt DSA ,
 .Vt DH ,
 .Vt EC_KEY ,
-.Vt GOST_KEY ,
 or
 .Vt ASN1_OCTET_STRING
 object depending on the type of
@@ -494,10 +480,6 @@ and
 first appeared in OpenSSL 1.0.0 and have been available since
 .Ox 4.9 .
 .Pp
-.Fn EVP_PKEY_assign_GOST
-first appeared in
-.Ox 5.7 .
-.Pp
 .Fn EVP_PKEY_get0_RSA ,
 .Fn EVP_PKEY_get0_DSA ,
 .Fn EVP_PKEY_get0_DH ,
diff --git a/lib/libcrypto/man/EVP_PKEY_size.3 b/lib/libcrypto/man/EVP_PKEY_size.3
index b45cda7f9..f49678d0a 100644
--- a/lib/libcrypto/man/EVP_PKEY_size.3
+++ b/lib/libcrypto/man/EVP_PKEY_size.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: EVP_PKEY_size.3,v 1.2 2023/09/12 15:29:03 schwarze Exp $
+.\" $OpenBSD: EVP_PKEY_size.3,v 1.3 2024/03/05 19:21:31 tb Exp $
 .\" full merge up to: OpenSSL eed9d03b Jan 8 11:04:15 2020 +0100
 .\"
 .\" This file is a derived work.
@@ -65,7 +65,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: September 12 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt EVP_PKEY_SIZE 3
 .Os
 .Sh NAME
@@ -144,7 +144,6 @@ is supported for the following algorithms:
 .It DSA    Ta Xr DSA_size 3
 .It EC     Ta Xr ECDSA_size 3
 .It ED25519 Ta 64, but see below
-.It GOST01 Ta 64 or 128
 .It HMAC   Ta Dv EVP_MAX_MD_SIZE No = 64
 .It RSA    Ta Xr RSA_size 3
 .It X25519 Ta Dv X25519_KEYLEN No = 32
@@ -173,7 +172,6 @@ By default, the following algorithms are supported:
 .It DSA    Ta the public domain parameter Fa p Ta Xr DSA_bits 3
 .It EC     Ta the order of the group Ta Xr EC_GROUP_order_bits 3
 .It ED25519 Ta 253 Ta \(em
-.It GOST01 Ta 256 or 512 Ta \(em
 .It RSA    Ta the public modulus Ta Xr RSA_bits 3
 .It X25519 Ta 253 Ta \(em
 .El
@@ -192,7 +190,6 @@ By default, the following algorithms are supported:
 .It DSA    Ta Xr DSA_security_bits 3
 .It EC     Ta Xr EC_GROUP_order_bits 3 divided by 2
 .It ED25519 Ta 128
-.It GOST01 Ta not supported, return value is \-2
 .It RSA    Ta Xr RSA_security_bits 3
 .It X25519 Ta 128
 .El
diff --git a/lib/libcrypto/man/Makefile b/lib/libcrypto/man/Makefile
index 565f58312..5f213edcd 100644
--- a/lib/libcrypto/man/Makefile
+++ b/lib/libcrypto/man/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.284 2024/03/05 17:21:40 tb Exp $
+# $OpenBSD: Makefile,v 1.286 2024/03/06 02:34:14 tb Exp $
 
 .include <bsd.own.mk>
 
@@ -29,7 +29,6 @@ MAN=	\
 	ASN1_mbstring_copy.3 \
 	ASN1_parse_dump.3 \
 	ASN1_put_object.3 \
-	ASN1_time_parse.3 \
 	ASRange_new.3 \
 	AUTHORITY_KEYID_new.3 \
 	BASIC_CONSTRAINTS_new.3 \
@@ -313,7 +312,6 @@ MAN=	\
 	X509_ATTRIBUTE_new.3 \
 	X509_ATTRIBUTE_set1_object.3 \
 	X509_CINF_new.3 \
-	X509_CRL_METHOD_new.3 \
 	X509_CRL_get0_by_serial.3 \
 	X509_CRL_new.3 \
 	X509_CRL_print.3 \
diff --git a/lib/libcrypto/man/X509_CRL_METHOD_new.3 b/lib/libcrypto/man/X509_CRL_METHOD_new.3
deleted file mode 100644
index f80ce743c..000000000
--- a/lib/libcrypto/man/X509_CRL_METHOD_new.3
+++ /dev/null
@@ -1,182 +0,0 @@
-.\" $OpenBSD: X509_CRL_METHOD_new.3,v 1.1 2021/10/30 16:20:35 schwarze Exp $
-.\"
-.\" Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org>
-.\"
-.\" Permission to use, copy, modify, and distribute this software for any
-.\" purpose with or without fee is hereby granted, provided that the above
-.\" copyright notice and this permission notice appear in all copies.
-.\"
-.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
-.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-.\"
-.Dd $Mdocdate: October 30 2021 $
-.Dt X509_CRL_METHOD_NEW 3
-.Os
-.Sh NAME
-.Nm X509_CRL_METHOD_new ,
-.Nm X509_CRL_METHOD_free ,
-.Nm X509_CRL_set_default_method ,
-.Nm X509_CRL_set_meth_data ,
-.Nm X509_CRL_get_meth_data
-.Nd customize CRL handling
-.Sh SYNOPSIS
-.In openssl/x509.h
-.Ft X509_CRL_METHOD *
-.Fo X509_CRL_METHOD_new
-.Fa "int (*crl_init)(X509_CRL *crl)"
-.Fa "int (*crl_free)(X509_CRL *crl)"
-.Fa "int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret,\
- ASN1_INTEGER *ser, X509_NAME *issuer)"
-.Fa "int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk)"
-.Fc
-.Ft void
-.Fn X509_CRL_METHOD_free "X509_CRL_METHOD *method"
-.Ft void
-.Fn X509_CRL_set_default_method "const X509_CRL_METHOD *method"
-.Ft void
-.Fn X509_CRL_set_meth_data "X509_CRL *crl" "void *data"
-.Ft void *
-.Fn X509_CRL_get_meth_data "X509_CRL *crl"
-.Sh DESCRIPTION
-These functions customize BER decoding and signature verification
-of X.509 certificate revocation lists,
-as well as retrieval of revoked entries from such lists.
-.Pp
-.Fn X509_CRL_METHOD_new
-allocates and initializes a new
-.Vt X509_CRL_METHOD
-object, storing the four pointers to callback functions in it
-that are provided as arguments.
-.Pp
-.Fn X509_CRL_METHOD_free
-frees the given
-.Fa method
-object.
-If
-.Fa method
-is a
-.Dv NULL
-pointer or points to the static object built into the library,
-no action occurs.
-.Pp
-.Fn X509_CRL_set_default_method
-designates the given
-.Fa method
-to be used for objects that will be created with
-.Xr X509_CRL_new 3
-in the future.
-It has no effect on
-.Vt X509_CRL
-objects that already exist.
-If
-.Fa method
-is
-.Dv NULL ,
-any previously installed method will no longer be used for new
-.Vt X509_CRL
-objects created in the future, and those future objects will adhere
-to the default behaviour instead.
-.Pp
-The optional function
-.Fn crl_init
-will be called at the end of
-.Xr d2i_X509_CRL 3 ,
-the optional function
-.Fn crl_free
-near the end of
-.Xr X509_CRL_free 3 ,
-immediately before freeing
-.Fa crl
-itself.
-The function
-.Fn crl_lookup
-will be called by
-.Xr X509_CRL_get0_by_serial 3 ,
-setting
-.Fa issuer
-to
-.Dv NULL ,
-and by
-.Xr X509_CRL_get0_by_cert 3 ,
-both instead of performing the default action.
-The function
-.Fn crl_verify
-will be called by
-.Xr X509_CRL_verify 3
-instead of performing the default action.
-.Pp
-.Fn X509_CRL_set_meth_data
-stores the pointer to the auxiliary
-.Fa data
-inside the
-.Fa crl
-object.
-The pointer is expected to remain valid during the whole lifetime of the
-.Fa crl
-object but is not automatically freed when the
-.Fa crl
-object is freed.
-.Pp
-.Fn X509_CRL_get_meth_data
-retrieves the
-.Fa data
-from
-.Fa crl
-the was added with
-.Fn X509_CRL_set_meth_data .
-This may for example be useful inside the four callback methods
-installed with
-.Fn X509_CRL_METHOD_new .
-.Sh RETURN VALUES
-.Fn X509_CRL_METHOD_new
-returns a pointer to the new object or
-.Dv NULL
-if memory allocation fails.
-.Pp
-.Fn X509_CRL_get_meth_data
-returns the pointer previously installed with
-.Fn X509_CRL_set_meth_data
-or
-.Dv NULL
-if
-.Fn X509_CRL_set_meth_data
-was not called on
-.Fa crl .
-.Pp
-The callback functions
-.Fn crl_init
-and
-.Fn crl_free
-are supposed to return 1 for success or 0 for failure.
-.Pp
-The callback function
-.Fn crl_lookup
-is supposed to return 0 for failure or 1 for success,
-except if the revoked entry has the reason
-.Qq removeFromCRL ,
-in which case it is supposed to return 2.
-.Pp
-The callback function
-.Fn crl_verify
-is supposed to return 1 if the signature is valid
-or 0 if the signature check fails.
-If the signature could not be checked at all because it was invalid
-or some other error occurred, \-1 may be returned.
-.Sh SEE ALSO
-.Xr ASN1_INTEGER_new 3 ,
-.Xr d2i_X509_CRL 3 ,
-.Xr EVP_PKEY_new 3 ,
-.Xr X509_CRL_get0_by_serial 3 ,
-.Xr X509_CRL_new 3 ,
-.Xr X509_CRL_verify 3 ,
-.Xr X509_NAME_new 3 ,
-.Xr X509_REVOKED_new 3
-.Sh HISTORY
-These functions first appeared in OpenSSL 1.0.0
-and have been available since
-.Ox 4.9 .
diff --git a/lib/libcrypto/man/X509_CRL_get0_by_serial.3 b/lib/libcrypto/man/X509_CRL_get0_by_serial.3
index 865e86feb..f5edee608 100644
--- a/lib/libcrypto/man/X509_CRL_get0_by_serial.3
+++ b/lib/libcrypto/man/X509_CRL_get0_by_serial.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: X509_CRL_get0_by_serial.3,v 1.12 2021/10/30 16:20:35 schwarze Exp $
+.\" $OpenBSD: X509_CRL_get0_by_serial.3,v 1.13 2024/03/06 02:34:14 tb Exp $
 .\" full merge up to: OpenSSL cdd6c8c5 Mar 20 12:29:37 2017 +0100
 .\"
 .\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: October 30 2021 $
+.Dd $Mdocdate: March 6 2024 $
 .Dt X509_CRL_GET0_BY_SERIAL 3
 .Os
 .Sh NAME
@@ -105,18 +105,6 @@ except that it looks for a revoked entry using the serial number
 of certificate
 .Fa x .
 .Pp
-If
-.Xr X509_CRL_set_default_method 3
-was in effect at the time the
-.Fa crl
-object was created,
-.Fn X509_CRL_get0_by_serial
-and
-.Fn X509_CRL_get0_by_cert
-invoke the
-.Fn crl_lookup
-callback function instead of performing the default action.
-.Pp
 .Fn X509_CRL_get_REVOKED
 returns an internal pointer to a stack of all revoked entries for
 .Fa crl .
@@ -170,7 +158,6 @@ returns a STACK of revoked entries.
 .Xr X509_CRL_get_ext 3 ,
 .Xr X509_CRL_get_issuer 3 ,
 .Xr X509_CRL_get_version 3 ,
-.Xr X509_CRL_METHOD_new 3 ,
 .Xr X509_CRL_new 3 ,
 .Xr X509_REVOKED_new 3 ,
 .Xr X509V3_get_d2i 3
diff --git a/lib/libcrypto/man/X509_CRL_new.3 b/lib/libcrypto/man/X509_CRL_new.3
index 82ba18266..f9355fcfd 100644
--- a/lib/libcrypto/man/X509_CRL_new.3
+++ b/lib/libcrypto/man/X509_CRL_new.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: X509_CRL_new.3,v 1.13 2021/10/30 16:20:35 schwarze Exp $
+.\" $OpenBSD: X509_CRL_new.3,v 1.14 2024/03/06 02:34:14 tb Exp $
 .\"
 .\" Copyright (c) 2016, 2018, 2021 Ingo Schwarze <schwarze@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: October 30 2021 $
+.Dd $Mdocdate: March 6 2024 $
 .Dt X509_CRL_NEW 3
 .Os
 .Sh NAME
@@ -67,19 +67,6 @@ decrements the reference count of
 by 1.
 If the reference count reaches 0, it frees
 .Fa crl .
-If
-.Xr X509_CRL_set_default_method 3
-was in effect at the time
-.Fa crl
-was created and the
-.Fn crl_free
-callback is not
-.Dv NULL ,
-that callback is invoked near the end of
-.Fn X509_CRL_free ,
-right before freeing
-.Fa crl
-itself.
 .Pp
 .Fn X509_CRL_INFO_new
 allocates and initializes an empty
@@ -125,7 +112,6 @@ returns 1 on success or 0 on error.
 .Xr X509_CRL_get_issuer 3 ,
 .Xr X509_CRL_get_version 3 ,
 .Xr X509_CRL_match 3 ,
-.Xr X509_CRL_METHOD_new 3 ,
 .Xr X509_CRL_print 3 ,
 .Xr X509_CRL_sign 3 ,
 .Xr X509_EXTENSION_new 3 ,
diff --git a/lib/libcrypto/man/X509_cmp_time.3 b/lib/libcrypto/man/X509_cmp_time.3
index 0f2afdad0..bb430dfbb 100644
--- a/lib/libcrypto/man/X509_cmp_time.3
+++ b/lib/libcrypto/man/X509_cmp_time.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: X509_cmp_time.3,v 1.11 2021/11/12 14:34:57 schwarze Exp $
+.\" $OpenBSD: X509_cmp_time.3,v 1.12 2024/03/05 18:30:40 tb Exp $
 .\" full merge up to: OpenSSL 83cf7abf May 29 13:07:08 2018 +0100
 .\"
 .\" This file is a derived work.
@@ -65,7 +65,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: November 12 2021 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt X509_CMP_TIME 3
 .Os
 .Sh NAME
@@ -108,8 +108,6 @@
 .Fn X509_cmp_time
 parses
 .Fa asn1_time
-with
-.Xr ASN1_time_parse 3
 and compares it to
 .Fa cmp_time ,
 or to the current time if
@@ -182,7 +180,6 @@ structure or
 on error.
 .Sh SEE ALSO
 .Xr ASN1_TIME_new 3 ,
-.Xr ASN1_time_parse 3 ,
 .Xr ASN1_TIME_set 3 ,
 .Xr time 3
 .Sh HISTORY
diff --git a/lib/libcrypto/man/X509_get0_notBefore.3 b/lib/libcrypto/man/X509_get0_notBefore.3
index 53b18d599..5e5c08b79 100644
--- a/lib/libcrypto/man/X509_get0_notBefore.3
+++ b/lib/libcrypto/man/X509_get0_notBefore.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: X509_get0_notBefore.3,v 1.6 2023/06/06 16:20:13 schwarze Exp $
+.\" $OpenBSD: X509_get0_notBefore.3,v 1.7 2024/03/05 18:30:40 tb Exp $
 .\" content checked up to: OpenSSL 27b138e9 May 19 00:16:38 2017 +0000
 .\"
 .\" Copyright (c) 2018, 2020 Ingo Schwarze <schwarze@openbsd.org>
@@ -15,7 +15,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: June 6 2023 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt X509_GET0_NOTBEFORE 3
 .Os
 .Sh NAME
@@ -230,7 +230,6 @@ determining reasons for failure with
 .Xr ERR_get_error 3 .
 .Sh SEE ALSO
 .Xr ASN1_TIME_set 3 ,
-.Xr ASN1_TIME_set_tm 3 ,
 .Xr X509_cmp_time 3 ,
 .Xr X509_CRL_get0_by_serial 3 ,
 .Xr X509_CRL_new 3 ,
diff --git a/lib/libcrypto/man/X509_sign.3 b/lib/libcrypto/man/X509_sign.3
index 52890207f..059d92bac 100644
--- a/lib/libcrypto/man/X509_sign.3
+++ b/lib/libcrypto/man/X509_sign.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: X509_sign.3,v 1.10 2023/04/28 15:51:18 job Exp $
+.\" $OpenBSD: X509_sign.3,v 1.11 2024/03/06 02:34:14 tb Exp $
 .\" full merge up to: OpenSSL df75c2bf Dec 9 01:02:36 2018 +0100
 .\"
 .\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
@@ -48,7 +48,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: April 28 2023 $
+.Dd $Mdocdate: March 6 2024 $
 .Dt X509_SIGN 3
 .Os
 .Sh NAME
@@ -145,16 +145,6 @@ and
 .Fn X509_CRL_verify
 sign and verify certificate requests and CRLs, respectively.
 .Pp
-If
-.Xr X509_CRL_set_default_method 3
-was in effect at the time the
-.Vt X509_CRL
-object was created,
-.Fn X509_CRL_verify
-calls the
-.Fn crl_verify
-callback function instead of performing the default action.
-.Pp
 .Fn X509_sign_ctx
 is used where the default parameters for the corresponding public key
 and digest are not suitable.
@@ -183,7 +173,6 @@ In some cases of failure, the reason can be determined with
 .Xr d2i_X509 3 ,
 .Xr EVP_DigestInit 3 ,
 .Xr X509_CRL_get0_by_serial 3 ,
-.Xr X509_CRL_METHOD_new 3 ,
 .Xr X509_CRL_new 3 ,
 .Xr X509_get_pubkey 3 ,
 .Xr X509_get_subject_name 3 ,
diff --git a/lib/libcrypto/man/d2i_X509_CRL.3 b/lib/libcrypto/man/d2i_X509_CRL.3
index a0a19b4f5..948c283b5 100644
--- a/lib/libcrypto/man/d2i_X509_CRL.3
+++ b/lib/libcrypto/man/d2i_X509_CRL.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: d2i_X509_CRL.3,v 1.8 2021/10/30 16:20:35 schwarze Exp $
+.\" $OpenBSD: d2i_X509_CRL.3,v 1.9 2024/03/06 02:34:14 tb Exp $
 .\"
 .\" Copyright (c) 2016, 2021 Ingo Schwarze <schwarze@openbsd.org>
 .\"
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd $Mdocdate: October 30 2021 $
+.Dd $Mdocdate: March 6 2024 $
 .Dt D2I_X509_CRL 3
 .Os
 .Sh NAME
@@ -96,15 +96,6 @@ decode and encode an ASN.1
 .Vt CertificateList
 structure defined in RFC 5280 section 5.1.
 .Pp
-If
-.Xr X509_CRL_set_default_method 3
-is in effect and the
-.Fn crl_init
-callback is not
-.Dv NULL ,
-that callback is invoked at the end of
-.Fn d2i_X509_CRL .
-.Pp
 .Fn d2i_X509_CRL_bio ,
 .Fn d2i_X509_CRL_fp ,
 .Fn i2d_X509_CRL_bio ,
@@ -132,7 +123,6 @@ the revokedCertificates field of the ASN.1
 structure.
 .Sh SEE ALSO
 .Xr ASN1_item_d2i 3 ,
-.Xr X509_CRL_METHOD_new 3 ,
 .Xr X509_CRL_new 3 ,
 .Xr X509_REVOKED_new 3
 .Sh STANDARDS
diff --git a/lib/libcrypto/man/evp.3 b/lib/libcrypto/man/evp.3
index ece3bfe7f..0222dd66b 100644
--- a/lib/libcrypto/man/evp.3
+++ b/lib/libcrypto/man/evp.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: evp.3,v 1.28 2024/03/05 17:21:40 tb Exp $
+.\" $OpenBSD: evp.3,v 1.29 2024/03/06 02:34:14 tb Exp $
 .\" full merge up to: OpenSSL man7/evp 24a535ea Sep 22 13:14:20 2020 +0100
 .\"
 .\" This file was written by Ulf Moeller <ulf@openssl.org>,
@@ -51,7 +51,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: March 5 2024 $
+.Dd $Mdocdate: March 6 2024 $
 .Dt EVP 3
 .Os
 .Sh NAME
@@ -234,7 +234,6 @@ family of functions provides base64 encoding and decoding.
 .Xr SSL_CTX_set_tlsext_ticket_key_cb 3 ,
 .Xr X509_ALGOR_set_md 3 ,
 .Xr X509_check_private_key 3 ,
-.Xr X509_CRL_METHOD_new 3 ,
 .Xr X509_digest 3 ,
 .Xr X509_get_pubkey 3 ,
 .Xr X509_PUBKEY_set 3 ,
diff --git a/lib/libcrypto/man/lh_new.3 b/lib/libcrypto/man/lh_new.3
index 37fccf0cb..2550a7d2e 100644
--- a/lib/libcrypto/man/lh_new.3
+++ b/lib/libcrypto/man/lh_new.3
@@ -1,4 +1,4 @@
-.\" $OpenBSD: lh_new.3,v 1.12 2024/03/04 19:03:31 tb Exp $
+.\" $OpenBSD: lh_new.3,v 1.13 2024/03/05 22:15:29 tb Exp $
 .\" full merge up to:
 .\" OpenSSL doc/crypto/lhash.pod 1bc74519 May 20 08:11:46 2016 -0400
 .\" selective merge up to:
@@ -118,7 +118,7 @@
 .\" copied and put under another distribution licence
 .\" [including the GNU Public Licence.]
 .\"
-.Dd $Mdocdate: March 4 2024 $
+.Dd $Mdocdate: March 5 2024 $
 .Dt LH_NEW 3
 .Os
 .Sh NAME
@@ -379,8 +379,6 @@ lh_STUFF_doall_arg(hashtable, LHASH_DOALL_ARG_FN(STUFF_print), BIO,
 .Pp
 .Fn lh_<type>_error
 can be used to determine if an error occurred in the last operation.
-.Fn lh_<type>_error
-is a macro.
 .Sh RETURN VALUES
 .Fn lh_<type>_new
 returns
diff --git a/libexec/security/security b/libexec/security/security
index 5ad160da5..dc7cdf084 100644
--- a/libexec/security/security
+++ b/libexec/security/security
@@ -1,6 +1,6 @@
 #!/usr/bin/perl -T
 
-# $OpenBSD: security,v 1.41 2020/10/11 18:28:17 millert Exp $
+# $OpenBSD: security,v 1.42 2024/03/05 18:54:29 kn Exp $
 #
 # Copyright (c) 2011, 2012, 2014, 2015 Ingo Schwarze <schwarze@openbsd.org>
 # Copyright (c) 2011 Andrew Fresh <andrew@afresh1.com>
@@ -883,10 +883,17 @@ sub check_disklabels {
 	nag !(open my $fh, '-|', qw(df -ln)),
 	    "cannot spawn df: $!"
 	    and return;
-	my @disks = sort map m{^/dev/(\w*\d*)[a-p]}, <$fh>;
+	my %disks;
+	@disks{map m{^/dev/(\w*\d*)[a-p]}, <$fh>} = ();
 	close_or_nag $fh, "df";
 
-	foreach my $disk (@disks) {
+	unless (nag !(open my $fh, '-|', qw(bioctl softraid0)),
+	    "cannot spawn bioctl: $!") {
+		@disks{map m{<(\w*\d*)[a-p]>}, <$fh>} = ();
+		close_or_nag $fh, "bioctl";
+	}
+
+	foreach my $disk (sort keys %disks) {
 		$check_title = "======\n$disk diffs (-OLD  +NEW)\n======";
 		my $filename = BACKUP_DIR . "disklabel.$disk";
 		system "disklabel $disk > $filename";
diff --git a/regress/lib/libc/atexit/atexit_test.c b/regress/lib/libc/atexit/atexit_test.c
index b060a9b34..f00a81a6c 100644
--- a/regress/lib/libc/atexit/atexit_test.c
+++ b/regress/lib/libc/atexit/atexit_test.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: atexit_test.c,v 1.9 2017/07/27 15:08:37 bluhm Exp $ */
+/*	$OpenBSD: atexit_test.c,v 1.10 2024/03/05 19:27:47 miod Exp $ */
 
 /*
  * Copyright (c) 2002 Daniel Hartmeier
@@ -40,6 +40,14 @@
 #include <signal.h>
 #include <unistd.h>
 
+/*
+ * XXX Provide a prototype for aligned_alloc on pre-C11 compilers to prevent
+ * inclusion of hidden/stdlib.h below to cause a missing prototype error.
+ */
+#if (__ISO_C_VISIBLE - 0) < 2011
+void *aligned_alloc(size_t, size_t);
+#endif
+
 #include "include/namespace.h"
 #include "hidden/stdlib.h"
 #include "stdlib/atexit.h"
diff --git a/sys/arch/arm64/arm64/cpu.c b/sys/arch/arm64/arm64/cpu.c
index 910399d2e..afcded566 100644
--- a/sys/arch/arm64/arm64/cpu.c
+++ b/sys/arch/arm64/arm64/cpu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cpu.c,v 1.107 2024/03/01 15:57:43 kettenis Exp $	*/
+/*	$OpenBSD: cpu.c,v 1.108 2024/03/05 18:42:20 kettenis Exp $	*/
 
 /*
  * Copyright (c) 2016 Dale Rahn <drahn@dalerahn.com>
@@ -1042,6 +1042,13 @@ cpu_init(void)
 		WRITE_SPECIALREG(sctlr_el1, sctlr);
 	}
 
+	/* Enable strict BTI compatibility for PACIASP and PACIBSP. */
+	if (ID_AA64PFR1_BT(cpu_id_aa64pfr1) >= ID_AA64PFR1_BT_IMPL) {
+		sctlr = READ_SPECIALREG(sctlr_el1);
+		sctlr |= SCTLR_BT0 | SCTLR_BT1;
+		WRITE_SPECIALREG(sctlr_el1, sctlr);
+	}
+
 	/* Initialize debug registers. */
 	WRITE_SPECIALREG(mdscr_el1, DBG_MDSCR_TDCC);
 	WRITE_SPECIALREG(oslar_el1, 0);
diff --git a/sys/arch/arm64/include/armreg.h b/sys/arch/arm64/include/armreg.h
index 7cbd0cda7..78c0980da 100644
--- a/sys/arch/arm64/include/armreg.h
+++ b/sys/arch/arm64/include/armreg.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: armreg.h,v 1.30 2023/11/29 23:32:16 kettenis Exp $ */
+/* $OpenBSD: armreg.h,v 1.31 2024/03/05 18:42:20 kettenis Exp $ */
 /*-
  * Copyright (c) 2013, 2014 Andrew Turner
  * Copyright (c) 2015 The FreeBSD Foundation
@@ -656,6 +656,8 @@
 #define	SCTLR_EnDA	0x0000000008000000
 #define	SCTLR_EnIB	0x0000000040000000
 #define	SCTLR_EnIA	0x0000000080000000
+#define	SCTLR_BT0	0x0000000800000000
+#define	SCTLR_BT1	0x0000001000000000
 
 /* SPSR_EL1 */
 /*
diff --git a/sys/dev/pci/azalia.c b/sys/dev/pci/azalia.c
index b2b5618e1..c7223b6a1 100644
--- a/sys/dev/pci/azalia.c
+++ b/sys/dev/pci/azalia.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: azalia.c,v 1.285 2023/11/23 14:24:06 jsg Exp $	*/
+/*	$OpenBSD: azalia.c,v 1.286 2024/03/06 00:11:25 jsg Exp $	*/
 /*	$NetBSD: azalia.c,v 1.20 2006/05/07 08:31:44 kent Exp $	*/
 
 /*-
@@ -476,6 +476,7 @@ azalia_configure_pci(azalia_t *az)
 	case PCI_PRODUCT_INTEL_JSL_HDA:
 	case PCI_PRODUCT_INTEL_EHL_HDA:
 	case PCI_PRODUCT_INTEL_ADL_N_HDA:
+	case PCI_PRODUCT_INTEL_MTL_HDA:
 		reg = azalia_pci_read(az->pc, az->tag,
 		    INTEL_PCIE_NOSNOOP_REG);
 		reg &= INTEL_PCIE_NOSNOOP_MASK;
@@ -500,6 +501,7 @@ const struct pci_matchid azalia_pci_devices[] = {
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_JSL_HDA },
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_EHL_HDA },
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_ADL_N_HDA },
+	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HDA },
 };
 
 int
diff --git a/sys/dev/pci/dwiic_pci.c b/sys/dev/pci/dwiic_pci.c
index 23e6782ee..3d0a00adb 100644
--- a/sys/dev/pci/dwiic_pci.c
+++ b/sys/dev/pci/dwiic_pci.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dwiic_pci.c,v 1.24 2023/11/23 14:24:06 jsg Exp $ */
+/* $OpenBSD: dwiic_pci.c,v 1.25 2024/03/06 00:11:25 jsg Exp $ */
 /*
  * Synopsys DesignWare I2C controller
  * PCI attachment
@@ -172,6 +172,12 @@ const struct pci_matchid dwiic_pci_ids[] = {
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_ADL_N_I2C_3 },
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_ADL_N_I2C_4 },
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_ADL_N_I2C_5 },
+	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_0 },
+	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_1 },
+	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_2 },
+	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_3 },
+	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_4 },
+	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_5 },
 };
 
 int
diff --git a/sys/dev/pci/ichiic.c b/sys/dev/pci/ichiic.c
index 5a7625977..8477c0024 100644
--- a/sys/dev/pci/ichiic.c
+++ b/sys/dev/pci/ichiic.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ichiic.c,v 1.53 2024/02/21 22:57:11 jsg Exp $	*/
+/*	$OpenBSD: ichiic.c,v 1.54 2024/03/06 00:11:25 jsg Exp $	*/
 
 /*
  * Copyright (c) 2005, 2006 Alexander Yurchenko <grange@openbsd.org>
@@ -141,6 +141,7 @@ const struct pci_matchid ichiic_ids[] = {
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_JSL_SMB },
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_EHL_SMB },
 	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_ADL_N_SMB },
+	{ PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_SMB },
 };
 
 int
diff --git a/sys/dev/pci/pcidevs b/sys/dev/pci/pcidevs
index c5f325903..5e7438f08 100644
--- a/sys/dev/pci/pcidevs
+++ b/sys/dev/pci/pcidevs
@@ -1,4 +1,4 @@
-$OpenBSD: pcidevs,v 1.2066 2024/03/04 05:34:07 jsg Exp $
+$OpenBSD: pcidevs,v 1.2067 2024/03/06 00:05:18 jsg Exp $
 /*	$NetBSD: pcidevs,v 1.30 1997/06/24 06:20:24 thorpej Exp $	*/
 
 /*
@@ -6374,7 +6374,97 @@ product INTEL 600SERIES_GSPI_2	0x7afb	600 Series GSPI
 product INTEL 600SERIES_I2C_4	0x7afc	600 Series I2C
 product INTEL 600SERIES_I2C_5	0x7afd	600 Series I2C
 product INTEL 600SERIES_UART_2	0x7afe	600 Series UART
+product INTEL MTL_U4_HB		0x7d00	Core Ultra Host
+product INTEL MTL_H_HB_2	0x7d01	Core Ultra Host
+product INTEL MTL_U_HB_2	0x7d02	Core Ultra Host
+product INTEL MTL_DTT		0x7d03	Core Ultra DTT
+product INTEL MTL_VMD		0x7d0b	Core Ultra VMD
+product INTEL MTL_PMT		0x7d0d	Core Ultra PMT
+product INTEL MTL_H_HB_1	0x7d14	Core Ultra Host
+product INTEL MTL_U_HB_1	0x7d16	Core Ultra Host
+product INTEL MTL_IPU		0x7d19	Core Ultra IPU
+product INTEL MTL_NPU		0x7d1d	Core Ultra NPU
+product INTEL MTL_U4_GT_1	0x7d40	Graphics
+product INTEL MTL_U_GT_1	0x7d45	Graphics
+product INTEL MTL_H_GT_1	0x7d55	Arc Graphics
+product INTEL MTL_U_GT_2	0x7d60	Graphics
+product INTEL MTL_H_GT_2	0x7dd5	Graphics
+product INTEL MTL_H_ESPI	0x7e02	Core Ultra eSPI
+product INTEL MTL_U_ESPI	0x7e03	Core Ultra eSPI
+product INTEL MTL_U4_ESPI	0x7e07	Core Ultra eSPI
+product INTEL MTL_P2SB_SOC	0x7e20	Core Ultra P2SB
+product INTEL MTL_PMC_SOC	0x7e21	Core Ultra PMC
+product INTEL MTL_SMB		0x7e22	Core Ultra SMBus
+product INTEL MTL_SPI		0x7e23	Core Ultra SPI
+product INTEL MTL_TH		0x7e24	Core Ultra TH
+product INTEL MTL_UART_0	0x7e25	Core Ultra UART
+product INTEL MTL_UART_1	0x7e26	Core Ultra UART
+product INTEL MTL_GSPI_0	0x7e27	Core Ultra GSPI
+product INTEL MTL_HDA		0x7e28	Core Ultra HD Audio
+product INTEL MTL_GSPI_1	0x7e30	Core Ultra GSPI
+product INTEL MTL_PCIE_1	0x7e38	Core Ultra PCIE
+product INTEL MTL_PCIE_2	0x7e39	Core Ultra PCIE
+product INTEL MTL_PCIE_3	0x7e3a	Core Ultra PCIE
+product INTEL MTL_PCIE_4	0x7e3b	Core Ultra PCIE
+product INTEL MTL_PCIE_5	0x7e3c	Core Ultra PCIE
+product INTEL MTL_PCIE_6	0x7e3d	Core Ultra PCIE
+product INTEL MTL_PCIE_7	0x7e3e	Core Ultra PCIE
+product INTEL MTL_PCIE_8	0x7e3f	Core Ultra PCIE
 product INTEL WL_22500_14	0x7e40	Wi-Fi 6 AX210
+product INTEL MTL_ISH		0x7e45	Core Ultra ISH
+product INTEL MTL_GSPI_2	0x7e46	Core Ultra GSPI
+product INTEL MTL_THC_0_1	0x7e48	Core Ultra THC
+product INTEL MTL_THC_0_2	0x7e49	Core Ultra THC
+product INTEL MTL_THC_1_1	0x7e4a	Core Ultra THC
+product INTEL MTL_THC_1_2	0x7e4b	Core Ultra THC
+product INTEL MTL_GNA		0x7e4c	Core Ultra GNA
+product INTEL MTL_PCIE_9	0x7e4d	Core Ultra PCIE
+product INTEL MTL_I2C_4		0x7e50	Core Ultra I2C
+product INTEL MTL_I2C_5		0x7e51	Core Ultra I2C
+product INTEL MTL_UART_2	0x7e52	Core Ultra UART
+product INTEL MTL_HECI_5	0x7e58	Core Ultra HECI
+product INTEL MTL_HECI_6	0x7e59	Core Ultra HECI
+product INTEL MTL_HECI_7	0x7e5a	Core Ultra HECI
+product INTEL MTL_AHCI		0x7e63	Core Ultra AHCI
+product INTEL MTL_RAID_1	0x7e67	Core Ultra RAID
+product INTEL MTL_HECI_1	0x7e70	Core Ultra HECI
+product INTEL MTL_HECI_2	0x7e71	Core Ultra HECI
+product INTEL MTL_IDER		0x7e72	Core Ultra IDE-R
+product INTEL MTL_KT		0x7e73	Core Ultra KT
+product INTEL MTL_HECI_3	0x7e74	Core Ultra HECI
+product INTEL MTL_HECI_4	0x7e75	Core Ultra HECI
+product INTEL MTL_I2C_0		0x7e78	Core Ultra I2C
+product INTEL MTL_I2C_1		0x7e79	Core Ultra I2C
+product INTEL MTL_I2C_2		0x7e7a	Core Ultra I2C
+product INTEL MTL_I2C_3		0x7e7b	Core Ultra I2C
+product INTEL MTL_I3C		0x7e7c	Core Ultra I3C
+product INTEL MTL_XHCI_2	0x7e7d	Core Ultra xHCI
+product INTEL MTL_XDCI_2	0x7e7e	Core Ultra xDCI
+product INTEL MTL_SRAM		0x7e7f	Core Ultra SRAM
+product INTEL MTL_U4_XHCI	0x7eb0	Core Ultra xHCI
+product INTEL MTL_U4_XDCI	0x7eb1	Core Ultra xDCI
+product INTEL MTL_U4_TBT_DMA0	0x7eb2	Core Ultra TBT
+product INTEL MTL_U4_PCIE_16	0x7eb4	Core Ultra PCIE
+product INTEL MTL_U4_PCIE_17	0x7eb5	Core Ultra PCIE
+product INTEL MTL_U4_P2SB_IOE	0x7eb8	Core Ultra P2SB
+product INTEL MTL_U4_IEH_IOE	0x7eb9	Core Ultra IEH
+product INTEL MTL_U4_PMC_IOE	0x7ebe	Core Ultra PMC
+product INTEL MTL_U4_SRAM_IOE	0x7ebf	Core Ultra SRAM
+product INTEL MTL_XHCI_1	0x7ec0	Core Ultra xHCI
+product INTEL MTL_XDCI_1	0x7ec1	Core Ultra xDCI
+product INTEL MTL_TBT_DMA0	0x7ec2	Core Ultra TBT
+product INTEL MTL_TBT_DMA1	0x7ec3	Core Ultra TBT
+product INTEL MTL_PCIE_16	0x7ec4	Core Ultra PCIE
+product INTEL MTL_PCIE_17	0x7ec5	Core Ultra PCIE
+product INTEL MTL_PCIE_18	0x7ec6	Core Ultra PCIE
+product INTEL MTL_PCIE_19	0x7ec7	Core Ultra PCIE
+product INTEL MTL_P2SB_IOE	0x7ec8	Core Ultra P2SB
+product INTEL MTL_IEH_IOE	0x7ec9	Core Ultra IEH
+product INTEL MTL_PCIE_10	0x7eca	Core Ultra PCIE
+product INTEL MTL_PCIE_11	0x7ecb	Core Ultra PCIE
+product INTEL MTL_H_PCIE_12	0x7ecc 	Core Ultra PCIE
+product INTEL MTL_PMC_IOE	0x7ece	Core Ultra PMC
+product INTEL MTL_SRAM_IOE	0x7ecf	Core Ultra SRAM
 product INTEL WL_22500_15	0x7f70	Wi-Fi 6 AX211
 product INTEL US15W_HB		0x8100	US15W Host
 product INTEL US15L_HB		0x8101	US15L/UL11L Host
diff --git a/sys/dev/pci/pcidevs.h b/sys/dev/pci/pcidevs.h
index ea87f34f7..d6c8f129e 100644
--- a/sys/dev/pci/pcidevs.h
+++ b/sys/dev/pci/pcidevs.h
@@ -2,7 +2,7 @@
  * THIS FILE AUTOMATICALLY GENERATED.  DO NOT EDIT.
  *
  * generated from:
- *	OpenBSD: pcidevs,v 1.2066 2024/03/04 05:34:07 jsg Exp 
+ *	OpenBSD: pcidevs,v 1.2067 2024/03/06 00:05:18 jsg Exp 
  */
 /*	$NetBSD: pcidevs,v 1.30 1997/06/24 06:20:24 thorpej Exp $	*/
 
@@ -6379,7 +6379,97 @@
 #define	PCI_PRODUCT_INTEL_600SERIES_I2C_4	0x7afc		/* 600 Series I2C */
 #define	PCI_PRODUCT_INTEL_600SERIES_I2C_5	0x7afd		/* 600 Series I2C */
 #define	PCI_PRODUCT_INTEL_600SERIES_UART_2	0x7afe		/* 600 Series UART */
+#define	PCI_PRODUCT_INTEL_MTL_U4_HB	0x7d00		/* Core Ultra Host */
+#define	PCI_PRODUCT_INTEL_MTL_H_HB_2	0x7d01		/* Core Ultra Host */
+#define	PCI_PRODUCT_INTEL_MTL_U_HB_2	0x7d02		/* Core Ultra Host */
+#define	PCI_PRODUCT_INTEL_MTL_DTT	0x7d03		/* Core Ultra DTT */
+#define	PCI_PRODUCT_INTEL_MTL_VMD	0x7d0b		/* Core Ultra VMD */
+#define	PCI_PRODUCT_INTEL_MTL_PMT	0x7d0d		/* Core Ultra PMT */
+#define	PCI_PRODUCT_INTEL_MTL_H_HB_1	0x7d14		/* Core Ultra Host */
+#define	PCI_PRODUCT_INTEL_MTL_U_HB_1	0x7d16		/* Core Ultra Host */
+#define	PCI_PRODUCT_INTEL_MTL_IPU	0x7d19		/* Core Ultra IPU */
+#define	PCI_PRODUCT_INTEL_MTL_NPU	0x7d1d		/* Core Ultra NPU */
+#define	PCI_PRODUCT_INTEL_MTL_U4_GT_1	0x7d40		/* Graphics */
+#define	PCI_PRODUCT_INTEL_MTL_U_GT_1	0x7d45		/* Graphics */
+#define	PCI_PRODUCT_INTEL_MTL_H_GT_1	0x7d55		/* Arc Graphics */
+#define	PCI_PRODUCT_INTEL_MTL_U_GT_2	0x7d60		/* Graphics */
+#define	PCI_PRODUCT_INTEL_MTL_H_GT_2	0x7dd5		/* Graphics */
+#define	PCI_PRODUCT_INTEL_MTL_H_ESPI	0x7e02		/* Core Ultra eSPI */
+#define	PCI_PRODUCT_INTEL_MTL_U_ESPI	0x7e03		/* Core Ultra eSPI */
+#define	PCI_PRODUCT_INTEL_MTL_U4_ESPI	0x7e07		/* Core Ultra eSPI */
+#define	PCI_PRODUCT_INTEL_MTL_P2SB_SOC	0x7e20		/* Core Ultra P2SB */
+#define	PCI_PRODUCT_INTEL_MTL_PMC_SOC	0x7e21		/* Core Ultra PMC */
+#define	PCI_PRODUCT_INTEL_MTL_SMB	0x7e22		/* Core Ultra SMBus */
+#define	PCI_PRODUCT_INTEL_MTL_SPI	0x7e23		/* Core Ultra SPI */
+#define	PCI_PRODUCT_INTEL_MTL_TH	0x7e24		/* Core Ultra TH */
+#define	PCI_PRODUCT_INTEL_MTL_UART_0	0x7e25		/* Core Ultra UART */
+#define	PCI_PRODUCT_INTEL_MTL_UART_1	0x7e26		/* Core Ultra UART */
+#define	PCI_PRODUCT_INTEL_MTL_GSPI_0	0x7e27		/* Core Ultra GSPI */
+#define	PCI_PRODUCT_INTEL_MTL_HDA	0x7e28		/* Core Ultra HD Audio */
+#define	PCI_PRODUCT_INTEL_MTL_GSPI_1	0x7e30		/* Core Ultra GSPI */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_1	0x7e38		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_2	0x7e39		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_3	0x7e3a		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_4	0x7e3b		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_5	0x7e3c		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_6	0x7e3d		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_7	0x7e3e		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_8	0x7e3f		/* Core Ultra PCIE */
 #define	PCI_PRODUCT_INTEL_WL_22500_14	0x7e40		/* Wi-Fi 6 AX210 */
+#define	PCI_PRODUCT_INTEL_MTL_ISH	0x7e45		/* Core Ultra ISH */
+#define	PCI_PRODUCT_INTEL_MTL_GSPI_2	0x7e46		/* Core Ultra GSPI */
+#define	PCI_PRODUCT_INTEL_MTL_THC_0_1	0x7e48		/* Core Ultra THC */
+#define	PCI_PRODUCT_INTEL_MTL_THC_0_2	0x7e49		/* Core Ultra THC */
+#define	PCI_PRODUCT_INTEL_MTL_THC_1_1	0x7e4a		/* Core Ultra THC */
+#define	PCI_PRODUCT_INTEL_MTL_THC_1_2	0x7e4b		/* Core Ultra THC */
+#define	PCI_PRODUCT_INTEL_MTL_GNA	0x7e4c		/* Core Ultra GNA */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_9	0x7e4d		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_I2C_4	0x7e50		/* Core Ultra I2C */
+#define	PCI_PRODUCT_INTEL_MTL_I2C_5	0x7e51		/* Core Ultra I2C */
+#define	PCI_PRODUCT_INTEL_MTL_UART_2	0x7e52		/* Core Ultra UART */
+#define	PCI_PRODUCT_INTEL_MTL_HECI_5	0x7e58		/* Core Ultra HECI */
+#define	PCI_PRODUCT_INTEL_MTL_HECI_6	0x7e59		/* Core Ultra HECI */
+#define	PCI_PRODUCT_INTEL_MTL_HECI_7	0x7e5a		/* Core Ultra HECI */
+#define	PCI_PRODUCT_INTEL_MTL_AHCI	0x7e63		/* Core Ultra AHCI */
+#define	PCI_PRODUCT_INTEL_MTL_RAID_1	0x7e67		/* Core Ultra RAID */
+#define	PCI_PRODUCT_INTEL_MTL_HECI_1	0x7e70		/* Core Ultra HECI */
+#define	PCI_PRODUCT_INTEL_MTL_HECI_2	0x7e71		/* Core Ultra HECI */
+#define	PCI_PRODUCT_INTEL_MTL_IDER	0x7e72		/* Core Ultra IDE-R */
+#define	PCI_PRODUCT_INTEL_MTL_KT	0x7e73		/* Core Ultra KT */
+#define	PCI_PRODUCT_INTEL_MTL_HECI_3	0x7e74		/* Core Ultra HECI */
+#define	PCI_PRODUCT_INTEL_MTL_HECI_4	0x7e75		/* Core Ultra HECI */
+#define	PCI_PRODUCT_INTEL_MTL_I2C_0	0x7e78		/* Core Ultra I2C */
+#define	PCI_PRODUCT_INTEL_MTL_I2C_1	0x7e79		/* Core Ultra I2C */
+#define	PCI_PRODUCT_INTEL_MTL_I2C_2	0x7e7a		/* Core Ultra I2C */
+#define	PCI_PRODUCT_INTEL_MTL_I2C_3	0x7e7b		/* Core Ultra I2C */
+#define	PCI_PRODUCT_INTEL_MTL_I3C	0x7e7c		/* Core Ultra I3C */
+#define	PCI_PRODUCT_INTEL_MTL_XHCI_2	0x7e7d		/* Core Ultra xHCI */
+#define	PCI_PRODUCT_INTEL_MTL_XDCI_2	0x7e7e		/* Core Ultra xDCI */
+#define	PCI_PRODUCT_INTEL_MTL_SRAM	0x7e7f		/* Core Ultra SRAM */
+#define	PCI_PRODUCT_INTEL_MTL_U4_XHCI	0x7eb0		/* Core Ultra xHCI */
+#define	PCI_PRODUCT_INTEL_MTL_U4_XDCI	0x7eb1		/* Core Ultra xDCI */
+#define	PCI_PRODUCT_INTEL_MTL_U4_TBT_DMA0	0x7eb2		/* Core Ultra TBT */
+#define	PCI_PRODUCT_INTEL_MTL_U4_PCIE_16	0x7eb4		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_U4_PCIE_17	0x7eb5		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_U4_P2SB_IOE	0x7eb8		/* Core Ultra P2SB */
+#define	PCI_PRODUCT_INTEL_MTL_U4_IEH_IOE	0x7eb9		/* Core Ultra IEH */
+#define	PCI_PRODUCT_INTEL_MTL_U4_PMC_IOE	0x7ebe		/* Core Ultra PMC */
+#define	PCI_PRODUCT_INTEL_MTL_U4_SRAM_IOE	0x7ebf		/* Core Ultra SRAM */
+#define	PCI_PRODUCT_INTEL_MTL_XHCI_1	0x7ec0		/* Core Ultra xHCI */
+#define	PCI_PRODUCT_INTEL_MTL_XDCI_1	0x7ec1		/* Core Ultra xDCI */
+#define	PCI_PRODUCT_INTEL_MTL_TBT_DMA0	0x7ec2		/* Core Ultra TBT */
+#define	PCI_PRODUCT_INTEL_MTL_TBT_DMA1	0x7ec3		/* Core Ultra TBT */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_16	0x7ec4		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_17	0x7ec5		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_18	0x7ec6		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_19	0x7ec7		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_P2SB_IOE	0x7ec8		/* Core Ultra P2SB */
+#define	PCI_PRODUCT_INTEL_MTL_IEH_IOE	0x7ec9		/* Core Ultra IEH */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_10	0x7eca		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PCIE_11	0x7ecb		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_H_PCIE_12	0x7ecc		/* Core Ultra PCIE */
+#define	PCI_PRODUCT_INTEL_MTL_PMC_IOE	0x7ece		/* Core Ultra PMC */
+#define	PCI_PRODUCT_INTEL_MTL_SRAM_IOE	0x7ecf		/* Core Ultra SRAM */
 #define	PCI_PRODUCT_INTEL_WL_22500_15	0x7f70		/* Wi-Fi 6 AX211 */
 #define	PCI_PRODUCT_INTEL_US15W_HB	0x8100		/* US15W Host */
 #define	PCI_PRODUCT_INTEL_US15L_HB	0x8101		/* US15L/UL11L Host */
diff --git a/sys/dev/pci/pcidevs_data.h b/sys/dev/pci/pcidevs_data.h
index 529935fd4..60991ad6d 100644
--- a/sys/dev/pci/pcidevs_data.h
+++ b/sys/dev/pci/pcidevs_data.h
@@ -2,7 +2,7 @@
  * THIS FILE AUTOMATICALLY GENERATED.  DO NOT EDIT.
  *
  * generated from:
- *	OpenBSD: pcidevs,v 1.2066 2024/03/04 05:34:07 jsg Exp 
+ *	OpenBSD: pcidevs,v 1.2067 2024/03/06 00:05:18 jsg Exp 
  */
 
 /*	$NetBSD: pcidevs,v 1.30 1997/06/24 06:20:24 thorpej Exp $	*/
@@ -22855,10 +22855,370 @@ static const struct pci_known_product pci_known_products[] = {
 	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_600SERIES_UART_2,
 	    "600 Series UART",
 	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_HB,
+	    "Core Ultra Host",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_H_HB_2,
+	    "Core Ultra Host",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U_HB_2,
+	    "Core Ultra Host",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_DTT,
+	    "Core Ultra DTT",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_VMD,
+	    "Core Ultra VMD",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PMT,
+	    "Core Ultra PMT",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_H_HB_1,
+	    "Core Ultra Host",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U_HB_1,
+	    "Core Ultra Host",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_IPU,
+	    "Core Ultra IPU",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_NPU,
+	    "Core Ultra NPU",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_GT_1,
+	    "Graphics",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U_GT_1,
+	    "Graphics",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_H_GT_1,
+	    "Arc Graphics",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U_GT_2,
+	    "Graphics",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_H_GT_2,
+	    "Graphics",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_H_ESPI,
+	    "Core Ultra eSPI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U_ESPI,
+	    "Core Ultra eSPI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_ESPI,
+	    "Core Ultra eSPI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_P2SB_SOC,
+	    "Core Ultra P2SB",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PMC_SOC,
+	    "Core Ultra PMC",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_SMB,
+	    "Core Ultra SMBus",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_SPI,
+	    "Core Ultra SPI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_TH,
+	    "Core Ultra TH",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_UART_0,
+	    "Core Ultra UART",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_UART_1,
+	    "Core Ultra UART",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_GSPI_0,
+	    "Core Ultra GSPI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HDA,
+	    "Core Ultra HD Audio",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_GSPI_1,
+	    "Core Ultra GSPI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_1,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_2,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_3,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_4,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_5,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_6,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_7,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_8,
+	    "Core Ultra PCIE",
+	},
 	{
 	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_WL_22500_14,
 	    "Wi-Fi 6 AX210",
 	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_ISH,
+	    "Core Ultra ISH",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_GSPI_2,
+	    "Core Ultra GSPI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_THC_0_1,
+	    "Core Ultra THC",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_THC_0_2,
+	    "Core Ultra THC",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_THC_1_1,
+	    "Core Ultra THC",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_THC_1_2,
+	    "Core Ultra THC",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_GNA,
+	    "Core Ultra GNA",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_9,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_4,
+	    "Core Ultra I2C",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_5,
+	    "Core Ultra I2C",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_UART_2,
+	    "Core Ultra UART",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HECI_5,
+	    "Core Ultra HECI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HECI_6,
+	    "Core Ultra HECI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HECI_7,
+	    "Core Ultra HECI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_AHCI,
+	    "Core Ultra AHCI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_RAID_1,
+	    "Core Ultra RAID",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HECI_1,
+	    "Core Ultra HECI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HECI_2,
+	    "Core Ultra HECI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_IDER,
+	    "Core Ultra IDE-R",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_KT,
+	    "Core Ultra KT",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HECI_3,
+	    "Core Ultra HECI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_HECI_4,
+	    "Core Ultra HECI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_0,
+	    "Core Ultra I2C",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_1,
+	    "Core Ultra I2C",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_2,
+	    "Core Ultra I2C",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I2C_3,
+	    "Core Ultra I2C",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_I3C,
+	    "Core Ultra I3C",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_XHCI_2,
+	    "Core Ultra xHCI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_XDCI_2,
+	    "Core Ultra xDCI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_SRAM,
+	    "Core Ultra SRAM",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_XHCI,
+	    "Core Ultra xHCI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_XDCI,
+	    "Core Ultra xDCI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_TBT_DMA0,
+	    "Core Ultra TBT",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_PCIE_16,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_PCIE_17,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_P2SB_IOE,
+	    "Core Ultra P2SB",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_IEH_IOE,
+	    "Core Ultra IEH",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_PMC_IOE,
+	    "Core Ultra PMC",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_U4_SRAM_IOE,
+	    "Core Ultra SRAM",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_XHCI_1,
+	    "Core Ultra xHCI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_XDCI_1,
+	    "Core Ultra xDCI",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_TBT_DMA0,
+	    "Core Ultra TBT",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_TBT_DMA1,
+	    "Core Ultra TBT",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_16,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_17,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_18,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_19,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_P2SB_IOE,
+	    "Core Ultra P2SB",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_IEH_IOE,
+	    "Core Ultra IEH",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_10,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PCIE_11,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_H_PCIE_12,
+	    "Core Ultra PCIE",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_PMC_IOE,
+	    "Core Ultra PMC",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_SRAM_IOE,
+	    "Core Ultra SRAM",
+	},
 	{
 	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_WL_22500_15,
 	    "Wi-Fi 6 AX211",
diff --git a/sys/dev/pci/pucdata.c b/sys/dev/pci/pucdata.c
index 166ff831d..f3325a1d9 100644
--- a/sys/dev/pci/pucdata.c
+++ b/sys/dev/pci/pucdata.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pucdata.c,v 1.119 2024/01/28 03:01:39 jsg Exp $	*/
+/*	$OpenBSD: pucdata.c,v 1.120 2024/03/06 00:11:25 jsg Exp $	*/
 /*	$NetBSD: pucdata.c,v 1.6 1999/07/03 05:55:23 cgd Exp $	*/
 
 /*
@@ -187,6 +187,13 @@ const struct puc_device_description puc_devs[] = {
 		{ PUC_PORT_COM, 0x10, 0x0000 },
 	    },
 	},
+	{	/* MTL KT */
+	    {	PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_MTL_KT, 0x0000, 0x0000 },
+	    {	0xffff, 0xffff,					0x0000, 0x0000 },
+	    {
+		{ PUC_PORT_COM, 0x10, 0x0000 },
+	    },
+	},
 	{	/* 82946GZ KT */
 	    {	PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_82946GZ_KT, 0x0000, 0x0000 },
 	    {	0xffff, 0xffff,					0x0000, 0x0000 },
diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index ec675a233..fc7b515c8 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_mbuf.c,v 1.289 2024/02/21 09:28:29 claudio Exp $	*/
+/*	$OpenBSD: uipc_mbuf.c,v 1.290 2024/03/05 18:52:41 bluhm Exp $	*/
 /*	$NetBSD: uipc_mbuf.c,v 1.15.4.1 1996/06/13 17:11:44 cgd Exp $	*/
 
 /*
@@ -545,29 +545,27 @@ m_purge(struct mbuf *m)
  * mbuf chain defragmenter. This function uses some evil tricks to defragment
  * an mbuf chain into a single buffer without changing the mbuf pointer.
  * This needs to know a lot of the mbuf internals to make this work.
+ * The resulting mbuf is not aligned to IP header to assist DMA transfers.
  */
 int
 m_defrag(struct mbuf *m, int how)
 {
 	struct mbuf *m0;
-	unsigned int adj;
 
 	if (m->m_next == NULL)
 		return (0);
 
 	KASSERT(m->m_flags & M_PKTHDR);
 
-	adj = mtod(m, unsigned long) & (sizeof(long) - 1);
 	if ((m0 = m_gethdr(how, m->m_type)) == NULL)
 		return (ENOBUFS);
-	if (m->m_pkthdr.len + adj > MHLEN) {
-		MCLGETL(m0, how, m->m_pkthdr.len + adj);
+	if (m->m_pkthdr.len > MHLEN) {
+		MCLGETL(m0, how, m->m_pkthdr.len);
 		if (!(m0->m_flags & M_EXT)) {
 			m_free(m0);
 			return (ENOBUFS);
 		}
 	}
-	m0->m_data += adj;
 	m_copydata(m, 0, m->m_pkthdr.len, mtod(m0, caddr_t));
 	m0->m_pkthdr.len = m0->m_len = m->m_pkthdr.len;
 
@@ -586,9 +584,9 @@ m_defrag(struct mbuf *m, int how)
 		memcpy(&m->m_ext, &m0->m_ext, sizeof(struct mbuf_ext));
 		MCLINITREFERENCE(m);
 		m->m_flags |= m0->m_flags & (M_EXT|M_EXTWR);
-		m->m_data = m->m_ext.ext_buf + adj;
+		m->m_data = m->m_ext.ext_buf;
 	} else {
-		m->m_data = m->m_pktdat + adj;
+		m->m_data = m->m_pktdat;
 		memcpy(m->m_data, m0->m_data, m0->m_len);
 	}
 	m->m_pkthdr.len = m->m_len = m0->m_len;
diff --git a/usr.bin/ssh/channels.c b/usr.bin/ssh/channels.c
index 964096247..d07232df2 100644
--- a/usr.bin/ssh/channels.c
+++ b/usr.bin/ssh/channels.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.436 2024/01/09 22:19:00 djm Exp $ */
+/* $OpenBSD: channels.c,v 1.437 2024/03/06 02:59:59 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -3203,9 +3203,8 @@ channel_proxy_downstream(struct ssh *ssh, Channel *downstream)
 			goto out;
 		}
 		/* Record that connection to this host/port is permitted. */
-		permission_set_add(ssh, FORWARD_USER, FORWARD_LOCAL, "<mux>", -1,
-		    listen_host, NULL, (int)listen_port, downstream);
-		listen_host = NULL;
+		permission_set_add(ssh, FORWARD_USER, FORWARD_LOCAL, "<mux>",
+		    -1, listen_host, NULL, (int)listen_port, downstream);
 		break;
 	case SSH2_MSG_CHANNEL_CLOSE:
 		if (have < 4)
diff --git a/usr.bin/ssh/ssh-agent.c b/usr.bin/ssh/ssh-agent.c
index 1790106cf..9b7754e96 100644
--- a/usr.bin/ssh/ssh-agent.c
+++ b/usr.bin/ssh/ssh-agent.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.304 2023/12/18 15:58:56 djm Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.305 2024/03/06 00:31:04 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -237,6 +237,7 @@ free_dest_constraints(struct dest_constraint *dcs, size_t ndcs)
 	free(dcs);
 }
 
+#ifdef ENABLE_PKCS11
 static void
 dup_dest_constraint_hop(const struct dest_constraint_hop *dch,
     struct dest_constraint_hop *out)
@@ -276,6 +277,7 @@ dup_dest_constraints(const struct dest_constraint *dcs, size_t ndcs)
 	}
 	return ret;
 }
+#endif /* ENABLE_PKCS11 */
 
 #ifdef DEBUG_CONSTRAINTS
 static void
@@ -1509,6 +1511,7 @@ no_identities(SocketEntry *e)
 	sshbuf_free(msg);
 }
 
+#ifdef ENABLE_PKCS11
 /* Add an identity to idlist; takes ownership of 'key' and 'comment' */
 static void
 add_p11_identity(struct sshkey *key, char *comment, const char *provider,
@@ -1535,7 +1538,6 @@ add_p11_identity(struct sshkey *key, char *comment, const char *provider,
 	idtab->nentries++;
 }
 
-#ifdef ENABLE_PKCS11
 static void
 process_add_smartcard_key(SocketEntry *e)
 {