diff --git a/lib/libcrypto/x509/x509_asid.c b/lib/libcrypto/x509/x509_asid.c
index c9d3c8d7c..2fda58c3f 100644
--- a/lib/libcrypto/x509/x509_asid.c
+++ b/lib/libcrypto/x509/x509_asid.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: x509_asid.c,v 1.42 2024/02/19 15:44:10 tb Exp $ */
+/*	$OpenBSD: x509_asid.c,v 1.43 2024/02/20 14:58:16 tb Exp $ */
 /*
  * Contributed to the OpenSSL Project by the American Registry for
  * Internet Numbers ("ARIN").
@@ -558,6 +558,8 @@ extract_min_max(ASIdOrRange *aor, ASN1_INTEGER **min, ASN1_INTEGER **max)
 		*max = aor->u.range->max;
 		return 1;
 	}
+	*min = NULL;
+	*max = NULL;
 
 	return 0;
 }
diff --git a/regress/sys/net/mpath/Makefile b/regress/sys/net/mpath/Makefile
new file mode 100644
index 000000000..1f7ae80d8
--- /dev/null
+++ b/regress/sys/net/mpath/Makefile
@@ -0,0 +1,166 @@
+#	$OpenBSD: Makefile,v 1.1 2024/02/20 20:04:51 bluhm Exp $
+
+# Copyright (c) 2024 Alexander Bluhm <bluhm@openbsd.org>
+#
+# Permission to use, copy, modify, and distribute this software for any
+# purpose with or without fee is hereby granted, provided that the above
+# copyright notice and this permission notice appear in all copies.
+#
+# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+# Regression test for multipath routing.
+
+# Test that routes set with the -mpath flag distribute the traffic.
+# Each route has a different gateway and the UDP packets have different
+# source addresses.  The destination address is identical for all
+# routes and packets.  Analyze the use counter in netstat -r output
+# to check that multiple routes have been used.  Currently this works
+# only for IPv4.  sysctl net.inet.ip.multipath and net.inet6.ip6.multipath
+# are enabled before testing and reset afterwards.  All routes and
+# interface addresses are created on loopback in a separate routing
+# domain.
+
+# Set up loopback interface in a different routing domain.
+# Create multipath routes on this loopback.
+# Send a bunch of packets with multiple source IP to same destination.
+# Count in netstart -r that most routes have been used.
+
+# This test uses routing domain and interface number 11.
+# Adjust it here, if you want to use something else.
+N1 =		11
+NUMS =		${N1}
+
+# Traffic distribution has not been implemented for IPv6.
+REGRESS_EXPECTED_FAILURES +=	run-netstat6
+
+.include <bsd.own.mk>
+
+.PHONY: busy-rdomains ifconfig unconfig pfctl
+
+REGRESS_SETUP_ONCE +=	busy-rdomains
+busy-rdomains:
+	# Check if rdomains are busy.
+.for n in ${NUMS}
+	@if /sbin/ifconfig | grep -v '^lo$n:' | grep ' rdomain $n '; then\
+	    echo routing domain $n is already used >&2; exit 1; fi
+.endfor
+
+REGRESS_SETUP_ONCE +=	multipath
+multipath:
+	${SUDO} /sbin/sysctl net.inet.ip.multipath=1
+	${SUDO} /sbin/sysctl net.inet6.ip6.multipath=1
+
+REGRESS_CLEANUP +=	singlepath
+singlepath:
+	${SUDO} /sbin/sysctl net.inet.ip.multipath=0
+	${SUDO} /sbin/sysctl net.inet6.ip6.multipath=0
+
+REGRESS_SETUP_ONCE +=	ifconfig
+ifconfig: unconfig
+	# Create and configure loopback interfaces.
+.for n in ${NUMS}
+	${SUDO} /sbin/ifconfig lo$n rdomain $n
+	${SUDO} /sbin/ifconfig lo$n inet 10.0.0.1/8
+	${SUDO} /sbin/ifconfig lo$n inet 10.0.0.$n alias
+.for i in 0 1 2 3 4 5 6 7 8 9
+	${SUDO} /sbin/ifconfig lo$n inet 10.0.$n.$i alias
+	${SUDO} /sbin/route -n -T $n add -inet -blackhole -mpath -host \
+	    10.$n.0.0 10.0.$n.$i
+.endfor
+	${SUDO} /sbin/ifconfig lo$n inet6 fc00::$n alias
+.for i in 0 1 2 3 4 5 6 7 8 9
+	${SUDO} /sbin/ifconfig lo$n inet6 fc00::$n:$i alias
+	${SUDO} /sbin/route -n -T $n add -inet6 -blackhole -mpath -host \
+	    fc00::$n:0:0 fc00::$n:$i
+.endfor
+	# Wait until IPv6 addresses are no longer tentative.
+	for i in `jot 50`; do\
+	    if ! /sbin/ifconfig lo$n | fgrep -q tentative; then\
+		    break;\
+	    fi;\
+	    sleep .1;\
+	done
+	! /sbin/ifconfig lo${N1} | fgrep tentative
+.endfor
+
+REGRESS_CLEANUP +=	unconfig
+unconfig:
+	# Destroy interfaces.
+.for n in ${NUMS}
+	-${SUDO} /sbin/ifconfig lo$n rdomain $n
+.for i in 0 1 2 3 4 5 6 7 8 9
+	-${SUDO} /sbin/route -n -T $n delete -inet6 -host \
+	    fc00::$n:0:0 fc00::$n:$i
+	-${SUDO} /sbin/route -n -T $n delete -inet -host \
+	    10.$n.0.0 10.0.$n.$i
+.endfor
+	-${SUDO} /sbin/ifconfig lo$n -inet -inet6
+	-${SUDO} /sbin/ifconfig lo$n destroy
+.endfor
+	rm -f stamp-ifconfig
+
+REGRESS_TARGETS +=	run-netcat
+run-netcat netstat.log:
+	# count UDP IPv6 packets used with multipath routes
+	rm -f netstat.log
+.for i in 0 1 2 3 4 5 6 7 8 9
+	/usr/bin/nc -4 -V${N1} -u -z -s10.0.${N1}.$i 10.${N1}.0.0 discard
+.endfor
+	/usr/bin/netstat -T${N1} -f inet -rn >netstat.log
+
+REGRESS_TARGETS +=	run-netstat
+run-netstat: netstat.log
+	# check route distribution of IPv4 packets
+	awk 'BEGIN{ mpath = uses = used = maxuse = 0; }\
+	    /^10.${N1}.0.0 /{\
+		if ($$3 == "UGHSBP") mpath++;\
+		if ($$5 > 0) used++;\
+		if ($$5 > max) max = $$5;\
+		uses += $$5;\
+	    }\
+	    END{\
+		print "mpath "mpath", uses "uses", max "max", used "used;\
+		if (mpath != 10) { print "not 10 mpath: " mpath; exit 1; }\
+		if (uses != 10) { print "not 10 uses: " uses; exit 1; }\
+		if (max > 5) { print "max more than 5: " max; exit 1; }\
+		if (used < 5) { print "used less than 5: " used; exit 1; }\
+	    }' \
+	    netstat.log
+
+REGRESS_TARGETS +=	run-netcat6
+run-netcat6 netstat6.log:
+	# count UDP IPv6 packets used with multipath routes
+	rm -f netstat6.log
+.for i in 0 1 2 3 4 5 6 7 8 9
+	/usr/bin/nc -6 -V${N1} -u -z -sfc00::${N1}:$i fc00::${N1}:0:0 discard
+.endfor
+	/usr/bin/netstat -T${N1} -f inet6 -rn >netstat6.log
+
+REGRESS_TARGETS +=	run-netstat6
+run-netstat6: netstat6.log
+	# check route distribution of IPv6 packets
+	awk 'BEGIN{ mpath = used = uses = max = 0; }\
+	    /^fc00::${N1}:0:0 /{\
+		if ($$3 == "UGHSBP") mpath++;\
+		if ($$5 > 0) used++;\
+		if ($$5 > max) max = $$5;\
+		uses += $$5;\
+	    }\
+	    END{\
+		print "mpath "mpath", uses "uses", max "max", used "used;\
+		if (mpath != 10) { print "not 10 mpath: " mpath; exit 1; }\
+		if (uses != 10) { print "not 10 uses: " uses; exit 1; }\
+		if (max > 5) { print "max more than 5: " max; exit 1; }\
+		if (used < 5) { print "used less than 5: " used; exit 1; }\
+	    }' \
+	    netstat6.log
+
+CLEANFILES +=	*.log stamp-*
+
+.include <bsd.regress.mk>
diff --git a/regress/usr.bin/Makefile b/regress/usr.bin/Makefile
index b80b71483..1e60f6f10 100644
--- a/regress/usr.bin/Makefile
+++ b/regress/usr.bin/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.50 2023/09/21 21:22:43 bluhm Exp $
+#	$OpenBSD: Makefile,v 1.51 2024/02/20 09:42:49 claudio Exp $
 
 SUBDIR+= apply
 SUBDIR+= basename bc
@@ -12,7 +12,7 @@ SUBDIR+= m4 mail make mandoc
 SUBDIR+= nc
 SUBDIR+= openssl
 SUBDIR+= patch pkg-config
-SUBDIR+= rcs rev rsync
+SUBDIR+= rcs rev rsync rsync-unit
 SUBDIR+= sdiff sed seq signify snmp sort
 SUBDIR+= ssh
 SUBDIR+= tsort
diff --git a/regress/usr.bin/rsync-unit/Makefile b/regress/usr.bin/rsync-unit/Makefile
new file mode 100644
index 000000000..653615db8
--- /dev/null
+++ b/regress/usr.bin/rsync-unit/Makefile
@@ -0,0 +1,15 @@
+# $OpenBSD: Makefile,v 1.1 2024/02/20 09:40:58 claudio Exp $
+
+.PATH:	${.CURDIR}/../../../usr.bin/rsync
+
+PROGS += rmatch_test
+
+.for p in ${PROGS}
+REGRESS_TARGETS +=	run-regress-$p
+.endfor
+
+CFLAGS+= -I${.CURDIR} -I${.CURDIR}/../../../usr.bin/rsync
+
+SRCS_rmatch_test =	rmatch_test.c rmatch.c
+
+.include <bsd.regress.mk>
diff --git a/regress/usr.bin/rsync-unit/rmatch_test.c b/regress/usr.bin/rsync-unit/rmatch_test.c
new file mode 100644
index 000000000..357979813
--- /dev/null
+++ b/regress/usr.bin/rsync-unit/rmatch_test.c
@@ -0,0 +1,252 @@
+/*	$OpenBSD: rmatch_test.c,v 1.2 2024/02/20 10:37:35 claudio Exp $	*/
+
+/*
+ * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#include <stdio.h>
+#include <string.h>
+
+int	rmatch(const char *, const char *, int);
+
+struct tv {
+	const char *pattern;
+	const char *string;
+	int result;
+	const char *reason;
+} tvs[] = {
+	{ "*abc", "aaaabc", 0 },
+	{ "abc", "abc", 0 },
+	{ "*aaa", "bbbcaa", 1 },
+	{ "aaa", "aabb", 1 },
+	{ "[a]??", "aaa", 0 },
+	{ "*[a]??", "abcabc", 0 },
+	{ "[b]??", "abcabc", 1 },
+	{ "*[b]??*", "abcabc", 0 },
+	{ "[a-z]", "a", 0 },
+	{ "*[a-z]", "1234a", 0 },
+	{ "[a-z]", "A", 1 },
+	{ "*[a-z]", "1234A", 1 },
+	{ "[[:lower:]]", "a", 0 },
+	{ "*[[:lower:]]", "1234a", 0 },
+	{ "[[:lower:]]", "A", 1 },
+	{ "*[[:lower:]]", "1234A", 1 },
+	{ "?", "a", 0 },
+	{ "*?", "1234a", 0 },
+	{ "\\a", "a", 0 },
+	{ "*\\a", "1234a", 0 },
+	{ "/", "/", 0 },
+	{ "*/", "1234/", 0 },
+	{ "?", "/", 1 },
+	{ "*?", "1234/", 1 },
+	{ "\\/", "/", 0 },
+	{ "*\\/", "1234/", 0 },
+	{ "*abc/", "abc/", 0 },
+	{ "*abc/", "ababc/", 0 },
+	{ "*abc/*", "abc/xyz", 0 },
+	{ "*abc/", "xyz/abc", 1 },
+	{ "*abc/", "ab/", 1 },
+	{ "*abc/", "abc", 1 },
+	{ "*abc/", "abc.", 1 },
+	{ "*abc/", "abcab/", 1 },
+	{ "*abc/", "abcd/abc", 1 },
+	{ "**??""?/", "a/aa/aaa/", 0 },
+	{ "**??""?/", "a/aa/aa/", 1 },
+	{ "**??""?/", "a/aa/aaaxxxx/", 0 },
+	{ "**abc/", "a/aa/xxabc/", 0 },
+
+	/* rysnc wildtest.txt */
+
+	{ "foo", "foo", 0 },
+	{ "bar", "foo", 1 },
+	{ "", "", 0 },
+	{ "???", "foo", 0 },
+	{ "??", "foo", 1 },
+	{ "*", "foo", 0 },
+	{ "f*", "foo", 0 },
+	{ "*f", "foo", 1 },
+	{ "*foo*", "foo", 0 },
+	{ "*ob*a*r*", "foobar", 0 },
+	{ "*ab", "aaaaaaabababab", 0 },
+	{ "foo\\*", "foo*", 0 },
+	{ "foo\\*bar", "foobar", 1 },
+	{ "f\\\\oo", "f\\oo", 0 },
+	{ "*[al]?", "ball", 0 },
+	{ "[ten]", "ten", 1 },
+	{ "**[!te]", "ten", 0 },
+	{ "**[!ten]", "ten", 1 },
+	{ "t[a-g]n", "ten", 0 },
+	{ "t[!a-g]n", "ten", 1 },
+	{ "t[!a-g]n", "ton", 0 },
+	{ "t[^a-g]n", "ton", 0 },
+	{ "a[]]b", "a]b", 0 },
+	{ "a[]-]b", "a-b", 0 },
+	{ "a[]-]b", "a]b", 0 },
+	{ "a[]-]b", "aab", 1 },
+	{ "a[]a-]b", "aab", 0 },
+	{ "]", "]", 0 },
+	{ "foo*bar", "foo/baz/bar", 1 },
+	{ "foo**bar", "foo/baz/bar", 0 },
+	{ "foo?bar", "foo/bar", 1 },
+	{ "foo[/]bar", "foo/bar", 1 },
+	{ "f[^eiu][^eiu][^eiu][^eiu][^eiu]r", "foo/bar", 1 },
+	{ "f[^eiu][^eiu][^eiu][^eiu][^eiu]r", "foo-bar", 0 },
+	{ "**/foo", "foo", 1 },
+	{ "**/foo", "/foo", 0 },
+	{ "**/foo", "bar/baz/foo", 0 },
+	{ "*/foo", "bar/baz/foo", 1 },
+	{ "**/bar*", "foo/bar/baz", 1 },
+	{ "**/bar/*", "deep/foo/bar/baz", 0 },
+	{ "**/bar/*", "deep/foo/bar/baz/", 1 },
+	{ "**/bar/**", "deep/foo/bar/baz/", 0 },
+	{ "**/bar/*", "deep/foo/bar", 1 },
+	{ "**/bar/**", "deep/foo/bar/", 0 },
+	{ "**/bar**", "foo/bar/baz", 0 },
+	{ "*/bar/**", "foo/bar/baz/x", 0 },
+	{ "*/bar/**", "deep/foo/bar/baz/x", 1 },
+	{ "**/bar/*/*", "deep/foo/bar/baz/x", 0 },
+	{ "a[c-c]st", "acrt", 1 },
+	{ "a[c-c]rt", "acrt", 0 },
+	{ "[!]-]", "]", 1 },
+	{ "[!]-]", "a", 0 },
+	{ "\\", "", 1 },
+	{ "\\", "\\", 1, "backslash at end is taken literally" },
+	{ "*/\\", "/\\", 1, "backslash at end is taken literally" },
+	{ "*/\\\\", "/\\", 0 },
+	{ "foo", "foo", 0 },
+	{ "@foo", "@foo", 0 },
+	{ "@foo", "foo", 1 },
+	{ "\\[ab]", "[ab]", 0 },
+	{ "[[]ab]", "[ab]", 0 },
+	{ "[[:]ab]", "[ab]", 0 },
+	{ "[[::]ab]", "[ab]", 1, "bad char class taken literally" },
+	{ "[[:digit]ab]", "[ab]", 0 },
+	{ "[\\[:]ab]", "[ab]", 0 },
+	{ "\\??\\?b", "?a?b", 0 },
+	{ "\\a\\b\\c", "abc", 0 },
+	{ "", "foo", 1 },
+	{ "**/t[o]", "foo/bar/baz/to", 0 },
+	{ "[[:alpha:]][[:digit:]][[:upper:]]", "a1B", 0 },
+	{ "[[:digit:][:upper:][:space:]]", "a", 1 },
+	{ "[[:digit:][:upper:][:space:]]", "A", 0 },
+	{ "[[:digit:][:upper:][:space:]]", "1", 0 },
+	{ "[[:digit:][:upper:][:spaci:]]", "1", 1 },
+	{ "[[:digit:][:upper:][:space:]]", " ", 0 },
+	{ "[[:digit:][:upper:][:space:]]", ".", 1 },
+	{ "[[:digit:][:punct:][:space:]]", ".", 0 },
+	{ "[[:xdigit:]]", "5", 0 },
+	{ "[[:xdigit:]]", "f", 0 },
+	{ "[[:xdigit:]]", "D", 0 },
+	{ "[[:alnum:][:alpha:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:][:xdigit:]]", "_", 0 },
+	{ "[^[:alnum:][:alpha:][:blank:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:][:xdigit:]]", "", 0 },
+	{ "[^[:alnum:][:alpha:][:blank:][:cntrl:][:digit:][:lower:][:space:][:upper:][:xdigit:]]", ".", 0 },
+	{ "[a-c[:digit:]x-z]", "5", 0 },
+	{ "[a-c[:digit:]x-z]", "b", 0 },
+	{ "[a-c[:digit:]x-z]", "y", 0 },
+	{ "[a-c[:digit:]x-z]", "q", 1 },
+	{ "[\\\\-^]", "]", 0 },
+	{ "[\\\\-^]", "[", 1 },
+	{ "[\\-_]", "-", 0 },
+	{ "[\\]]", "]", 0 },
+	{ "[\\]]", "\\]", 1 },
+	{ "[\\]]", "\\", 1 },
+	{ "a[]b", "ab", 1 },
+	{ "a[]b", "a[]b", 1, "empty [] is taken literally" },
+	{ "ab[", "ab[", 1, "single [ char taken literally" },
+	{ "[!", "ab", 1 },
+	{ "[-", "ab", 1 },
+	{ "[-]", "-", 0 },
+	{ "[a-", "-", 1 },
+	{ "[!a-", "-", 1 },
+	{ "[--A]", "-", 0 },
+	{ "[--A]", "5", 0 },
+	{ "[ --]", " ", 0 },
+	{ "[ --]", "$", 0 },
+	{ "[ --]", "-", 0 },
+	{ "[ --]", "0", 1 },
+	{ "[---]", "-", 0 },
+	{ "[------]", "-", 0 },
+	{ "[a-e-n]", "j", 1 },
+	{ "[a-e-n]", "-", 0 },
+	{ "[!------]", "a", 0 },
+	{ "[]-a]", "[", 1 },
+	{ "[]-a]", "^", 0 },
+	{ "[!]-a]", "^", 1 },
+	{ "[!]-a]", "[", 0 },
+	{ "[a^bc]", "^", 0 },
+	{ "[a-]b]", "-b]", 0 },
+	{ "[\\]", "\\", 1 },
+	{ "[\\\\]", "\\", 0 },
+	{ "[!\\\\]", "\\", 1 },
+	{ "[A-\\\\]", "G", 0 },
+	{ "b*a", "aaabbb", 1 },
+	{ "*ba*", "aabcaa", 1 },
+	{ "[,]", ",", 0 },
+	{ "[\\\\,]", ",", 0 },
+	{ "[\\\\,]", "\\", 0 },
+	{ "[,-.]", "-", 0 },
+	{ "[,-.]", "+", 1 },
+	{ "[,-.]", "-.]", 1 },
+	{ "[\\1-\\3]", "2", 0 },
+	{ "[\\1-\\3]", "3", 0 },
+	{ "[\\1-\\3]", "4", 1 },
+	{ "[[-\\]]", "\\", 0 },
+	{ "[[-\\]]", "[", 0 },
+	{ "[[-\\]]", "]", 0 },
+	{ "[[-\\]]", "-", 1 },
+	{ "-*-*-*-*-*-*-12-*-*-*-m-*-*-*", "-adobe-courier-bold-o-normal--12-120-75-75-m-70-iso8859-1", 0 },
+	{ "-*-*-*-*-*-*-12-*-*-*-m-*-*-*", "-adobe-courier-bold-o-normal--12-120-75-75-X-70-iso8859-1", 1 },
+	{ "-*-*-*-*-*-*-12-*-*-*-m-*-*-*", "-adobe-courier-bold-o-normal--12-120-75-75-/-70-iso8859-1", 1 },
+	{ "/*/*/*/*/*/*/12/*/*/*/m/*/*/*", "/adobe/courier/bold/o/normal//12/120/75/75/m/70/iso8859/1", 0 },
+	{ "/*/*/*/*/*/*/12/*/*/*/m/*/*/*", "/adobe/courier/bold/o/normal//12/120/75/75/X/70/iso8859/1", 1 },
+	{ "**/*a*b*g*n*t", "abcd/abcdefg/abcdefghijk/abcdefghijklmnop.txt", 0 },
+	{ "**/*a*b*g*n*t", "abcd/abcdefg/abcdefghijk/abcdefghijklmnop.txtz", 1 },
+
+	/* infinte loop test from Kyle Evans */
+	{ "dir/*.o", "dir1/a.o", 1 },
+
+	{ NULL },
+};
+
+int
+main (int argc, char **argv)
+{
+	const char *p, *s;
+	size_t i;
+	int rv = 0;
+
+	for (i = 0; tvs[i].pattern != NULL; i++) {
+		p = tvs[i].pattern;
+		s = tvs[i].string;
+		if (rmatch(p, s, 0) == tvs[i].result) {
+			printf("string %s pattern %s does %s\n",
+			    tvs[i].string, tvs[i].pattern,
+			    tvs[i].result ? "not match" : "match");
+		} else if (tvs[i].reason) {
+			printf("string %s pattern %s SHOULD %s but %s\n",
+			    tvs[i].string, tvs[i].pattern,
+			    tvs[i].result ? "not match" : "match",
+			    tvs[i].reason);
+		} else {
+			printf("FAILED: string %s pattern %s failed to %s\n",
+			    tvs[i].string, tvs[i].pattern,
+			    tvs[i].result ? "not match" : "match");
+			rv = 1;
+		}
+	}
+
+	return rv;
+}
diff --git a/sys/dev/ic/qwx.c b/sys/dev/ic/qwx.c
index d891ed6a5..4d5ae2a57 100644
--- a/sys/dev/ic/qwx.c
+++ b/sys/dev/ic/qwx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: qwx.c,v 1.45 2024/02/16 22:46:07 phessler Exp $	*/
+/*	$OpenBSD: qwx.c,v 1.48 2024/02/20 11:48:19 stsp Exp $	*/
 
 /*
  * Copyright 2023 Stefan Sperling <stsp@openbsd.org>
@@ -154,7 +154,6 @@ void qwx_dp_rx_deliver_msdu(struct qwx_softc *, struct qwx_rx_msdu *);
 
 int qwx_scan(struct qwx_softc *);
 void qwx_scan_abort(struct qwx_softc *);
-int qwx_disassoc(struct qwx_softc *);
 int qwx_auth(struct qwx_softc *);
 int qwx_deauth(struct qwx_softc *);
 int qwx_run(struct qwx_softc *);
@@ -548,12 +547,6 @@ qwx_newstate_task(void *arg)
 				goto out;
 			/* FALLTHROUGH */
 		case IEEE80211_S_ASSOC:
-			if (nstate <= IEEE80211_S_ASSOC) {
-				err = qwx_disassoc(sc);
-				if (err)
-					goto out;
-			}
-			/* FALLTHROUGH */
 		case IEEE80211_S_AUTH:
 			if (nstate <= IEEE80211_S_AUTH) {
 				err = qwx_deauth(sc);
@@ -10158,6 +10151,48 @@ fail_link_desc_cleanup:
 	return ret;
 }
 
+void
+qwx_dp_reo_cmd_list_cleanup(struct qwx_softc *sc)
+{
+	struct qwx_dp *dp = &sc->dp;
+	struct dp_reo_cmd *cmd, *tmp;
+	struct dp_reo_cache_flush_elem *cmd_cache, *tmp_cache;
+	struct dp_rx_tid *rx_tid;
+#ifdef notyet
+	spin_lock_bh(&dp->reo_cmd_lock);
+#endif
+	TAILQ_FOREACH_SAFE(cmd, &dp->reo_cmd_list, entry, tmp) {
+		TAILQ_REMOVE(&dp->reo_cmd_list, cmd, entry);
+		rx_tid = &cmd->data;
+		if (rx_tid->mem) {
+			qwx_dmamem_free(sc->sc_dmat, rx_tid->mem);
+			rx_tid->mem = NULL;
+			rx_tid->vaddr = NULL;
+			rx_tid->paddr = 0ULL;
+			rx_tid->size = 0;
+		}
+		free(cmd, M_DEVBUF, sizeof(*cmd));
+	}
+
+	TAILQ_FOREACH_SAFE(cmd_cache, &dp->reo_cmd_cache_flush_list,
+	    entry, tmp_cache) {
+		TAILQ_REMOVE(&dp->reo_cmd_cache_flush_list, cmd_cache, entry);
+		dp->reo_cmd_cache_flush_count--;
+		rx_tid = &cmd_cache->data;
+		if (rx_tid->mem) {
+			qwx_dmamem_free(sc->sc_dmat, rx_tid->mem);
+			rx_tid->mem = NULL;
+			rx_tid->vaddr = NULL;
+			rx_tid->paddr = 0ULL;
+			rx_tid->size = 0;
+		}
+		free(cmd_cache, M_DEVBUF, sizeof(*cmd_cache));
+	}
+#ifdef notyet
+	spin_unlock_bh(&dp->reo_cmd_lock);
+#endif
+}
+
 void
 qwx_dp_free(struct qwx_softc *sc)
 {
@@ -10168,9 +10203,7 @@ qwx_dp_free(struct qwx_softc *sc)
 	    HAL_WBM_IDLE_LINK, &dp->wbm_idle_ring);
 
 	qwx_dp_srng_common_cleanup(sc);
-#ifdef notyet
-	ath11k_dp_reo_cmd_list_cleanup(ab);
-#endif
+	qwx_dp_reo_cmd_list_cleanup(sc);
 	for (i = 0; i < sc->hw_params.max_tx_ring; i++) {
 #if 0
 		spin_lock_bh(&dp->tx_ring[i].tx_idr_lock);
@@ -11648,6 +11681,54 @@ qwx_vdev_start_resp_event(struct qwx_softc *sc, struct mbuf *m)
 	    vdev_start_resp.vdev_id);
 }
 
+int
+qwx_pull_vdev_stopped_param_tlv(struct qwx_softc *sc, struct mbuf *m,
+    uint32_t *vdev_id)
+{
+	const void **tb;
+	const struct wmi_vdev_stopped_event *ev;
+	int ret;
+
+	tb = qwx_wmi_tlv_parse_alloc(sc, mtod(m, void *), m->m_pkthdr.len);
+	if (tb == NULL) {
+		ret = ENOMEM;
+		printf("%s: failed to parse tlv: %d\n",
+		    sc->sc_dev.dv_xname, ret);
+		return ret;
+	}
+
+	ev = tb[WMI_TAG_VDEV_STOPPED_EVENT];
+	if (!ev) {
+		printf("%s: failed to fetch vdev stop ev\n",
+		    sc->sc_dev.dv_xname);
+		free(tb, M_DEVBUF, WMI_TAG_MAX * sizeof(*tb));
+		return EPROTO;
+	}
+
+	*vdev_id = ev->vdev_id;
+
+	free(tb, M_DEVBUF, WMI_TAG_MAX * sizeof(*tb));
+	return 0;
+}
+
+void
+qwx_vdev_stopped_event(struct qwx_softc *sc, struct mbuf *m)
+{
+	uint32_t vdev_id = 0;
+
+	if (qwx_pull_vdev_stopped_param_tlv(sc, m, &vdev_id) != 0) {
+		printf("%s: failed to extract vdev stopped event\n",
+		    sc->sc_dev.dv_xname);
+		return;
+	}
+
+	sc->vdev_setup_done = 1;
+	wakeup(&sc->vdev_setup_done);
+
+	DNPRINTF(QWX_D_WMI, "%s: vdev stopped for vdev id %d", __func__,
+	    vdev_id);
+}
+
 int
 qwx_wmi_tlv_iter_parse(struct qwx_softc *sc, uint16_t tag, uint16_t len,
     const void *ptr, void *data)
@@ -12906,10 +12987,10 @@ qwx_wmi_tlv_op_rx(struct qwx_softc *sc, struct mbuf *m)
 	case WMI_OFFLOAD_BCN_TX_STATUS_EVENTID:
 		ath11k_bcn_tx_status_event(ab, skb);
 		break;
-	case WMI_VDEV_STOPPED_EVENTID:
-		ath11k_vdev_stopped_event(ab, skb);
-		break;
 #endif
+	case WMI_VDEV_STOPPED_EVENTID:
+		qwx_vdev_stopped_event(sc, m);
+		break;
 	case WMI_MGMT_RX_EVENTID:
 		qwx_mgmt_rx_event(sc, m);
 		/* mgmt_rx_event() owns the skb now! */
@@ -13752,6 +13833,52 @@ qwx_peer_map_event(struct qwx_softc *sc, uint8_t vdev_id, uint16_t peer_id,
 #endif
 }
 
+struct ieee80211_node *
+qwx_peer_find_by_id(struct qwx_softc *sc, uint16_t peer_id)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_node *ni = NULL;
+	int s;
+
+	s = splnet();
+	RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree) {
+		struct qwx_node *nq = (struct qwx_node *)ni;
+		if (nq->peer.peer_id == peer_id)
+			break;
+	}
+	splx(s);
+
+	return ni;
+}
+
+void
+qwx_peer_unmap_event(struct qwx_softc *sc, uint16_t peer_id)
+{
+	struct ieee80211_node *ni;
+#ifdef notyet
+	spin_lock_bh(&ab->base_lock);
+#endif
+	ni = qwx_peer_find_by_id(sc, peer_id);
+	if (!ni) {
+		printf("%s: peer-unmap-event: unknown peer id %d\n",
+		    sc->sc_dev.dv_xname, peer_id);
+		goto exit;
+	}
+
+	DPRINTF(QWX_D_HTT, "%s: peer unmap vdev %d peer %s id %d\n",
+	    __func__, peer->vdev_id, ether_sprintf(ni->ni_macaddr), peer_id);
+#if 0
+	list_del(&peer->list);
+	kfree(peer);
+#endif
+	sc->peer_mapped = 1;
+	wakeup(&sc->peer_mapped);
+exit:
+#ifdef notyet
+	spin_unlock_bh(&ab->base_lock);
+#endif
+	return;
+}
 
 void
 qwx_dp_htt_htc_t2h_msg_handler(struct qwx_softc *sc, struct mbuf *m)
@@ -13805,13 +13932,13 @@ qwx_dp_htt_htc_t2h_msg_handler(struct qwx_softc *sc, struct mbuf *m)
 		qwx_peer_map_event(sc, vdev_id, peer_id, mac_addr, ast_hash,
 		    hw_peer_id);
 		break;
-#if 0
 	case HTT_T2H_MSG_TYPE_PEER_UNMAP:
 	case HTT_T2H_MSG_TYPE_PEER_UNMAP2:
 		peer_id = FIELD_GET(HTT_T2H_PEER_UNMAP_INFO_PEER_ID,
-				    resp->peer_unmap_ev.info);
-		ath11k_peer_unmap_event(ab, peer_id);
+		    resp->peer_unmap_ev.info);
+		qwx_peer_unmap_event(sc, peer_id);
 		break;
+#if 0
 	case HTT_T2H_MSG_TYPE_PPDU_STATS_IND:
 		ath11k_htt_pull_ppdu_stats(ab, skb);
 		break;
@@ -18581,6 +18708,38 @@ qwx_wmi_vdev_up(struct qwx_softc *sc, uint32_t vdev_id, uint32_t pdev_id,
 	return 0;
 }
 
+int
+qwx_wmi_vdev_down(struct qwx_softc *sc, uint32_t vdev_id, uint8_t pdev_id)
+{
+	struct qwx_pdev_wmi *wmi = &sc->wmi.wmi[pdev_id];
+	struct wmi_vdev_down_cmd *cmd;
+	struct mbuf *m;
+	int ret;
+
+	m = qwx_wmi_alloc_mbuf(sizeof(*cmd));
+	if (!m)
+		return ENOMEM;
+
+	cmd = (struct wmi_vdev_down_cmd *)(mtod(m, uint8_t *) +
+	    sizeof(struct ath11k_htc_hdr) + sizeof(struct wmi_cmd_hdr));
+
+	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_VDEV_DOWN_CMD) |
+	    FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
+	cmd->vdev_id = vdev_id;
+
+	ret = qwx_wmi_cmd_send(wmi, m, WMI_VDEV_DOWN_CMDID);
+	if (ret) {
+		printf("%s: failed to submit WMI_VDEV_DOWN cmd\n",
+		    sc->sc_dev.dv_xname);
+		m_freem(m);
+		return ret;
+	}
+
+	DNPRINTF(QWX_D_WMI, "%s: cmd vdev down id 0x%x\n", __func__, vdev_id);
+
+	return 0;
+}
+
 void
 qwx_wmi_put_wmi_channel(struct wmi_channel *chan,
     struct wmi_vdev_start_req_arg *arg)
@@ -18634,6 +18793,38 @@ qwx_wmi_put_wmi_channel(struct wmi_channel *chan,
 	    arg->channel.max_power);
 }
 
+int
+qwx_wmi_vdev_stop(struct qwx_softc *sc, uint8_t vdev_id, uint8_t pdev_id)
+{
+	struct qwx_pdev_wmi *wmi = &sc->wmi.wmi[pdev_id];
+	struct wmi_vdev_stop_cmd *cmd;
+	struct mbuf *m;
+	int ret;
+
+	m = qwx_wmi_alloc_mbuf(sizeof(*cmd));
+	if (!m)
+		return ENOMEM;
+
+	cmd = (struct wmi_vdev_stop_cmd *)(mtod(m, uint8_t *) +
+	    sizeof(struct ath11k_htc_hdr) + sizeof(struct wmi_cmd_hdr));
+
+	cmd->tlv_header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_VDEV_STOP_CMD) |
+	    FIELD_PREP(WMI_TLV_LEN, sizeof(*cmd) - TLV_HDR_SIZE);
+	cmd->vdev_id = vdev_id;
+
+	ret = qwx_wmi_cmd_send(wmi, m, WMI_VDEV_STOP_CMDID);
+	if (ret) {
+		printf("%s: failed to submit WMI_VDEV_STOP cmd\n",
+		    sc->sc_dev.dv_xname);
+		m_freem(m);
+		return ret;
+	}
+
+	DNPRINTF(QWX_D_WMI, "%s: cmd vdev stop id 0x%x\n", __func__, vdev_id);
+
+	return ret;
+}
+
 int
 qwx_wmi_vdev_start(struct qwx_softc *sc, struct wmi_vdev_start_req_arg *arg,
     int pdev_id, int restart)
@@ -21790,6 +21981,46 @@ qwx_mac_set_txbf_conf(struct qwx_vif *arvif)
 	return 0;
 }
 
+int
+qwx_mac_vdev_stop(struct qwx_softc *sc, struct qwx_vif *arvif, int pdev_id)
+{
+	int ret;
+#ifdef notyet
+	lockdep_assert_held(&ar->conf_mutex);
+#endif
+#if 0
+	reinit_completion(&ar->vdev_setup_done);
+#endif
+	sc->vdev_setup_done = 0;
+	ret = qwx_wmi_vdev_stop(sc, arvif->vdev_id, pdev_id);
+	if (ret) {
+		printf("%s: failed to stop WMI vdev %i: %d\n",
+		    sc->sc_dev.dv_xname, arvif->vdev_id, ret);
+		return ret;
+	}
+
+	ret = qwx_mac_vdev_setup_sync(sc);
+	if (ret) {
+		printf("%s: failed to synchronize setup for vdev %i: %d\n",
+		    sc->sc_dev.dv_xname, arvif->vdev_id, ret);
+		return ret;
+	}
+
+	if (sc->num_started_vdevs > 0)
+		sc->num_started_vdevs--;
+
+	DNPRINTF(QWX_D_MAC, "%s: vdev vdev_id %d stopped\n", __func__,
+	    arvif->vdev_id);
+
+	if (test_bit(ATH11K_CAC_RUNNING, sc->sc_flags)) {
+		clear_bit(ATH11K_CAC_RUNNING, sc->sc_flags);
+		DNPRINTF(QWX_D_MAC, "%s: CAC Stopped for vdev %d\n", __func__,
+		    arvif->vdev_id);
+	}
+
+	return 0;
+}
+
 int
 qwx_mac_vdev_start_restart(struct qwx_softc *sc, struct qwx_vif *arvif,
     int pdev_id, int restart)
@@ -22458,7 +22689,9 @@ qwx_peer_delete(struct qwx_softc *sc, uint32_t vdev_id, uint8_t pdev_id,
 {
 	int ret;
 
+	sc->peer_mapped = 0;
 	sc->peer_delete_done = 0;
+
 	ret = qwx_wmi_send_peer_delete_cmd(sc, addr, vdev_id, pdev_id);
 	if (ret) {
 		printf("%s: failed to delete peer vdev_id %d addr %s ret %d\n",
@@ -22466,6 +22699,16 @@ qwx_peer_delete(struct qwx_softc *sc, uint32_t vdev_id, uint8_t pdev_id,
 		return ret;
 	}
 
+	while (!sc->peer_mapped) {
+		ret = tsleep_nsec(&sc->peer_mapped, 0, "qwxpeer",
+		    SEC_TO_NSEC(3));
+		if (ret) {
+			printf("%s: peer delete unmap timeout\n",
+			    sc->sc_dev.dv_xname);
+			return ret;
+		}
+	}
+
 	while (!sc->peer_delete_done) {
 		ret = tsleep_nsec(&sc->peer_delete_done, 0, "qwxpeerd",
 		    SEC_TO_NSEC(3));
@@ -22848,6 +23091,12 @@ qwx_dp_rx_tid_del_func(struct qwx_dp *dp, void *ctx,
 	now = gettime();
 	elem->ts = now;
 	memcpy(&elem->data, rx_tid, sizeof(*rx_tid));
+
+	rx_tid->mem = NULL;
+	rx_tid->vaddr = NULL;
+	rx_tid->paddr = 0ULL;
+	rx_tid->size = 0;
+
 #ifdef notyet
 	spin_lock_bh(&dp->reo_cmd_lock);
 #endif
@@ -22903,18 +23152,65 @@ qwx_peer_rx_tid_delete(struct qwx_softc *sc, struct ath11k_peer *peer,
 	cmd.upd0 |= HAL_REO_CMD_UPD0_VLD;
 	ret = qwx_dp_tx_send_reo_cmd(sc, rx_tid, HAL_REO_CMD_UPDATE_RX_QUEUE,
 	    &cmd, qwx_dp_rx_tid_del_func);
-	if (ret && ret != ESHUTDOWN) {
-		printf("%s: failed to send "
-		    "HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n",
-		    sc->sc_dev.dv_xname, tid, ret);
-	}
+	if (ret) {
+		if (ret != ESHUTDOWN) {
+			printf("%s: failed to send "
+			    "HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n",
+			    sc->sc_dev.dv_xname, tid, ret);
+		}
 
-	if (rx_tid->mem) {
-		qwx_dmamem_free(sc->sc_dmat, rx_tid->mem);
-		rx_tid->mem = NULL;
-		rx_tid->vaddr = NULL;
-		rx_tid->paddr = 0ULL;
-		rx_tid->size = 0;
+		if (rx_tid->mem) {
+			qwx_dmamem_free(sc->sc_dmat, rx_tid->mem);
+			rx_tid->mem = NULL;
+			rx_tid->vaddr = NULL;
+			rx_tid->paddr = 0ULL;
+			rx_tid->size = 0;
+		}
+	}
+}
+
+void
+qwx_dp_rx_frags_cleanup(struct qwx_softc *sc, struct dp_rx_tid *rx_tid,
+    int rel_link_desc)
+{
+#ifdef notyet
+	lockdep_assert_held(&ab->base_lock);
+#endif
+#if 0
+	if (rx_tid->dst_ring_desc) {
+		if (rel_link_desc)
+			ath11k_dp_rx_link_desc_return(ab, (u32 *)rx_tid->dst_ring_desc,
+						      HAL_WBM_REL_BM_ACT_PUT_IN_IDLE);
+		kfree(rx_tid->dst_ring_desc);
+		rx_tid->dst_ring_desc = NULL;
+	}
+#endif
+	rx_tid->cur_sn = 0;
+	rx_tid->last_frag_no = 0;
+	rx_tid->rx_frag_bitmap = 0;
+#if 0
+	__skb_queue_purge(&rx_tid->rx_frags);
+#endif
+}
+
+void
+qwx_peer_rx_tid_cleanup(struct qwx_softc *sc, struct ath11k_peer *peer)
+{
+	struct dp_rx_tid *rx_tid;
+	int i;
+#ifdef notyet
+	lockdep_assert_held(&ar->ab->base_lock);
+#endif
+	for (i = 0; i < IEEE80211_NUM_TID; i++) {
+		rx_tid = &peer->rx_tid[i];
+
+		qwx_peer_rx_tid_delete(sc, peer, i);
+		qwx_dp_rx_frags_cleanup(sc, rx_tid, 1);
+#if 0
+		spin_unlock_bh(&ar->ab->base_lock);
+		del_timer_sync(&rx_tid->frag_timer);
+		spin_lock_bh(&ar->ab->base_lock);
+#endif
 	}
 }
 
@@ -23410,6 +23706,26 @@ qwx_dp_tx(struct qwx_softc *sc, struct qwx_vif *arvif, uint8_t pdev_id,
 	return 0;
 }
 
+int
+qwx_mac_station_remove(struct qwx_softc *sc, struct qwx_vif *arvif,
+    uint8_t pdev_id, struct ieee80211_node *ni)
+{
+	struct qwx_node *nq = (struct qwx_node *)ni;
+	struct ath11k_peer *peer = &nq->peer;
+	int ret;
+
+	qwx_peer_rx_tid_cleanup(sc, peer);
+
+	ret = qwx_peer_delete(sc, arvif->vdev_id, pdev_id, ni->ni_macaddr);
+	if (ret) {
+		printf("%s: unable to delete BSS peer: %d\n",
+		   sc->sc_dev.dv_xname, ret);
+		return ret;
+	}
+
+	return 0;
+}
+
 int
 qwx_mac_station_add(struct qwx_softc *sc, struct qwx_vif *arvif,
     uint8_t pdev_id, struct ieee80211_node *ni)
@@ -24095,8 +24411,35 @@ qwx_auth(struct qwx_softc *sc)
 int
 qwx_deauth(struct qwx_softc *sc)
 {
-	printf("%s: not implemented\n", __func__);
-	return ENOTSUP;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_node *ni = ic->ic_bss;
+	struct qwx_vif *arvif = TAILQ_FIRST(&sc->vif_list); /* XXX */
+	uint8_t pdev_id = 0; /* TODO: derive pdev ID somehow? */
+	int ret;
+
+	ret = qwx_mac_vdev_stop(sc, arvif, pdev_id);
+	if (ret) {
+		printf("%s: unable to stop vdev vdev_id %d: %d\n",
+		   sc->sc_dev.dv_xname, arvif->vdev_id, ret);
+		return ret;
+	}
+
+	ret = qwx_wmi_set_peer_param(sc, ni->ni_macaddr, arvif->vdev_id,
+	    pdev_id, WMI_PEER_AUTHORIZE, 0);
+	if (ret) {
+		printf("%s: unable to deauthorize BSS peer: %d\n",
+		   sc->sc_dev.dv_xname, ret);
+		return ret;
+	}
+
+	ret = qwx_mac_station_remove(sc, arvif, pdev_id, ni);
+	if (ret)
+		return ret;
+
+	DNPRINTF(QWX_D_MAC, "%s: disassociated from bssid %s aid %d\n",
+	    __func__, arvif->vdev_id, ether_sprintf(ni->ni_bssid), arvif->aid);
+
+	return 0;
 }
 
 void
@@ -24194,13 +24537,6 @@ qwx_peer_assoc_prepare(struct qwx_softc *sc, struct qwx_vif *arvif,
 	/* TODO: amsdu_disable req? */
 }
 
-int
-qwx_disassoc(struct qwx_softc *sc)
-{
-	printf("%s: not implemented\n", __func__);
-	return ENOTSUP;
-}
-
 int
 qwx_run(struct qwx_softc *sc)
 {
@@ -24296,14 +24632,24 @@ int
 qwx_run_stop(struct qwx_softc *sc)
 {
 	struct ieee80211com *ic = &sc->sc_ic;
+	struct qwx_vif *arvif = TAILQ_FIRST(&sc->vif_list); /* XXX */
+	uint8_t pdev_id = 0; /* TODO: derive pdev ID somehow? */
+	int ret;
 
 	sc->ops.irq_disable(sc);
 
 	if (ic->ic_opmode == IEEE80211_M_STA)
 		ic->ic_bss->ni_txrate = 0;
 
-	printf("%s: not implemented\n", __func__);
-	return ENOTSUP;
+	ret = qwx_wmi_vdev_down(sc, arvif->vdev_id, pdev_id);
+	if (ret)
+		return ret;
+
+	arvif->is_up = 0;
+
+	DNPRINTF(QWX_D_MAC, "%s: vdev %d down\n", __func__, arvif->vdev_id);
+
+	return 0;
 }
 
 #if NBPFILTER > 0
diff --git a/sys/dev/pci/drm/i915/gt/uc/intel_gsc_uc_heci_cmd_submit.c b/sys/dev/pci/drm/i915/gt/uc/intel_gsc_uc_heci_cmd_submit.c
index 89ed5ee9c..2fde5c360 100644
--- a/sys/dev/pci/drm/i915/gt/uc/intel_gsc_uc_heci_cmd_submit.c
+++ b/sys/dev/pci/drm/i915/gt/uc/intel_gsc_uc_heci_cmd_submit.c
@@ -81,8 +81,17 @@ out_rq:
 
 	i915_request_add(rq);
 
-	if (!err && i915_request_wait(rq, 0, msecs_to_jiffies(500)) < 0)
-		err = -ETIME;
+	if (!err) {
+		/*
+		 * Start timeout for i915_request_wait only after considering one possible
+		 * pending GSC-HECI submission cycle on the other (non-privileged) path.
+		 */
+		if (wait_for(i915_request_started(rq), GSC_HECI_REPLY_LATENCY_MS))
+			drm_dbg(&gsc_uc_to_gt(gsc)->i915->drm,
+				"Delay in gsc-heci-priv submission to gsccs-hw");
+		if (i915_request_wait(rq, 0, msecs_to_jiffies(GSC_HECI_REPLY_LATENCY_MS)) < 0)
+			err = -ETIME;
+	}
 
 	i915_request_put(rq);
 
@@ -186,6 +195,13 @@ out_rq:
 	i915_request_add(rq);
 
 	if (!err) {
+		/*
+		 * Start timeout for i915_request_wait only after considering one possible
+		 * pending GSC-HECI submission cycle on the other (privileged) path.
+		 */
+		if (wait_for(i915_request_started(rq), GSC_HECI_REPLY_LATENCY_MS))
+			drm_dbg(&gsc_uc_to_gt(gsc)->i915->drm,
+				"Delay in gsc-heci-non-priv submission to gsccs-hw");
 		if (i915_request_wait(rq, I915_WAIT_INTERRUPTIBLE,
 				      msecs_to_jiffies(timeout_ms)) < 0)
 			err = -ETIME;
diff --git a/sys/dev/pci/drm/i915/gt/uc/intel_gsc_uc_heci_cmd_submit.h b/sys/dev/pci/drm/i915/gt/uc/intel_gsc_uc_heci_cmd_submit.h
index 09d3fbdad..c4308291c 100644
--- a/sys/dev/pci/drm/i915/gt/uc/intel_gsc_uc_heci_cmd_submit.h
+++ b/sys/dev/pci/drm/i915/gt/uc/intel_gsc_uc_heci_cmd_submit.h
@@ -12,6 +12,12 @@ struct i915_vma;
 struct intel_context;
 struct intel_gsc_uc;
 
+#define GSC_HECI_REPLY_LATENCY_MS 500
+/*
+ * Max FW response time is 500ms, but this should be counted from the time the
+ * command has hit the GSC-CS hardware, not the preceding handoff to GuC CTB.
+ */
+
 struct intel_gsc_mtl_header {
 	u32 validity_marker;
 #define GSC_HECI_VALIDITY_MARKER 0xA578875A
diff --git a/sys/dev/pci/drm/i915/pxp/intel_pxp_gsccs.c b/sys/dev/pci/drm/i915/pxp/intel_pxp_gsccs.c
index 86f58a5bd..cc81a4624 100644
--- a/sys/dev/pci/drm/i915/pxp/intel_pxp_gsccs.c
+++ b/sys/dev/pci/drm/i915/pxp/intel_pxp_gsccs.c
@@ -111,7 +111,7 @@ gsccs_send_message(struct intel_pxp *pxp,
 
 	ret = intel_gsc_uc_heci_cmd_submit_nonpriv(&gt->uc.gsc,
 						   exec_res->ce, &pkt, exec_res->bb_vaddr,
-						   GSC_REPLY_LATENCY_MS);
+						   GSC_HECI_REPLY_LATENCY_MS);
 	if (ret) {
 		drm_err(&i915->drm, "failed to send gsc PXP msg (%d)\n", ret);
 		goto unlock;
diff --git a/sys/dev/pci/drm/i915/pxp/intel_pxp_gsccs.h b/sys/dev/pci/drm/i915/pxp/intel_pxp_gsccs.h
index 298ad38e6..9aae779c4 100644
--- a/sys/dev/pci/drm/i915/pxp/intel_pxp_gsccs.h
+++ b/sys/dev/pci/drm/i915/pxp/intel_pxp_gsccs.h
@@ -8,16 +8,14 @@
 
 #include <linux/types.h>
 
+#include "gt/uc/intel_gsc_uc_heci_cmd_submit.h"
+
 struct intel_pxp;
 
-#define GSC_REPLY_LATENCY_MS 210
-/*
- * Max FW response time is 200ms, to which we add 10ms to account for overhead
- * such as request preparation, GuC submission to hw and pipeline completion times.
- */
 #define GSC_PENDING_RETRY_MAXCOUNT 40
 #define GSC_PENDING_RETRY_PAUSE_MS 50
-#define GSCFW_MAX_ROUND_TRIP_LATENCY_MS (GSC_PENDING_RETRY_MAXCOUNT * GSC_PENDING_RETRY_PAUSE_MS)
+#define GSCFW_MAX_ROUND_TRIP_LATENCY_MS (GSC_HECI_REPLY_LATENCY_MS + \
+					 (GSC_PENDING_RETRY_MAXCOUNT * GSC_PENDING_RETRY_PAUSE_MS))
 
 #ifdef CONFIG_DRM_I915_PXP
 void intel_pxp_gsccs_fini(struct intel_pxp *pxp);
diff --git a/usr.bin/rsync/rmatch.c b/usr.bin/rsync/rmatch.c
index 0fe01dcb7..920ef25d6 100644
--- a/usr.bin/rsync/rmatch.c
+++ b/usr.bin/rsync/rmatch.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rmatch.c,v 1.3 2022/12/26 19:16:02 jmc Exp $	*/
+/*	$OpenBSD: rmatch.c,v 1.4 2024/02/20 10:36:23 claudio Exp $	*/
 
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
@@ -260,8 +260,12 @@ matchsub(const char **pp, const char **ss, const char *end, int wild)
 		/* eat possible escape char before '/' */
 		if (pattern[0] == '\\' && pattern[1] == '/')
 			pattern++;
-		if (pattern[0] == '/')
+		if (pattern[0] == '/') {
+			/* hit the barrier but we still have characters left */
+			if (string < end)
+				return 1;
 			break;
+		}
 
 		/* check if there are still characters available to compare */
 		if (string >= end)
diff --git a/usr.bin/ssh/servconf.c b/usr.bin/ssh/servconf.c
index 84b3fb1ea..7ae6cc0b0 100644
--- a/usr.bin/ssh/servconf.c
+++ b/usr.bin/ssh/servconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.403 2023/10/11 22:42:26 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.404 2024/02/20 04:10:03 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -1888,7 +1888,7 @@ process_server_config_line_depth(ServerOptions *options, char *line,
 		arg = argv_assemble(1, &arg); /* quote command correctly */
 		arg2 = argv_assemble(ac, av); /* rest of command */
 		xasprintf(&options->subsystem_args[options->num_subsystems],
-		    "%s %s", arg, arg2);
+		    "%s%s%s", arg, *arg2 == '\0' ? "" : " ", arg2);
 		free(arg2);
 		argv_consume(&ac);
 		options->num_subsystems++;
diff --git a/usr.sbin/snmpd/ax.c b/usr.sbin/snmpd/ax.c
index 4a2509a2f..cf5c00e0d 100644
--- a/usr.sbin/snmpd/ax.c
+++ b/usr.sbin/snmpd/ax.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ax.c,v 1.4 2023/12/21 12:43:31 martijn Exp $ */
+/*	$OpenBSD: ax.c,v 1.6 2024/02/20 12:51:10 martijn Exp $ */
 /*
  * Copyright (c) 2019 Martijn van Duren <martijn@openbsd.org>
  *
@@ -36,7 +36,6 @@ static int ax_pdu_need(struct ax *, size_t);
 static int ax_pdu_header(struct ax *,
     enum ax_pdu_type, uint8_t, uint32_t, uint32_t, uint32_t,
     struct ax_ostring *);
-static uint32_t ax_packetid(struct ax *);
 static uint32_t ax_pdu_queue(struct ax *);
 static int ax_pdu_add_uint16(struct ax *, uint16_t);
 static int ax_pdu_add_uint32(struct ax *, uint32_t);
@@ -89,7 +88,6 @@ ax_free(struct ax *ax)
 	close(ax->ax_fd);
 	free(ax->ax_rbuf);
 	free(ax->ax_wbuf);
-	free(ax->ax_packetids);
 	free(ax);
 }
 
@@ -103,11 +101,10 @@ ax_recv(struct ax *ax)
 	struct ax_pdu_searchrangelist *srl = NULL;
 	struct ax_pdu_varbindlist *vbl;
 	struct ax_searchrange *sr;
-	size_t rbsize, packetidx = 0, i, rawlen;
+	size_t rbsize, rawlen;
 	ssize_t nread;
 	uint8_t *u8;
 	uint8_t *rbuf;
-	int found;
 
 	/* Only read a single packet at a time to make sure libevent triggers */
 	if (ax->ax_rblen < AX_PDU_HEADER) {
@@ -394,24 +391,6 @@ ax_recv(struct ax *ax)
 		}
 		break;
 	case AX_PDU_TYPE_RESPONSE:
-		if (ax->ax_packetids != NULL) {
-			found = 0;
-			for (i = 0; ax->ax_packetids[i] != 0; i++) {
-				if (ax->ax_packetids[i] ==
-				    pdu->ap_header.aph_packetid) {
-					packetidx = i;
-					found = 1;
-				}
-			}
-			if (found) {
-				ax->ax_packetids[packetidx] =
-				    ax->ax_packetids[i - 1];
-				ax->ax_packetids[i - 1] = 0;
-			} else {
-				errno = EPROTO;
-				goto fail;
-			}
-		}
 		if (rawlen < 8) {
 			errno = EPROTO;
 			goto fail;
@@ -543,7 +522,7 @@ uint32_t
 ax_close(struct ax *ax, uint32_t sessionid,
     enum ax_close_reason reason)
 {
-	if (ax_pdu_header(ax, AX_PDU_TYPE_CLOSE, 0, sessionid, 0, 0,
+	if (ax_pdu_header(ax, AX_PDU_TYPE_CLOSE, 0, sessionid, arc4random(), 0,
 	    NULL) == -1)
 		return 0;
 
@@ -1163,8 +1142,6 @@ ax_pdu_header(struct ax *ax, enum ax_pdu_type type, uint8_t flags,
 		flags |= AX_PDU_FLAG_NETWORK_BYTE_ORDER;
 	ax->ax_wbuf[ax->ax_wbtlen++] = flags;
 	ax->ax_wbuf[ax->ax_wbtlen++] = 0;
-	if (packetid == 0)
-		packetid = ax_packetid(ax);
 	if (ax_pdu_add_uint32(ax, sessionid) == -1 ||
 	    ax_pdu_add_uint32(ax, transactionid) == -1 ||
 	    ax_pdu_add_uint32(ax, packetid) == -1 ||
@@ -1179,40 +1156,6 @@ ax_pdu_header(struct ax *ax, enum ax_pdu_type type, uint8_t flags,
 	return 0;
 }
 
-static uint32_t
-ax_packetid(struct ax *ax)
-{
-	uint32_t packetid, *packetids;
-	size_t npackets = 0, i;
-	int found;
-
-	if (ax->ax_packetids != NULL) {
-		for (npackets = 0; ax->ax_packetids[npackets] != 0; npackets++)
-			continue;
-	}
-	if (ax->ax_packetidsize == 0 || npackets == ax->ax_packetidsize - 1) {
-		packetids = recallocarray(ax->ax_packetids, ax->ax_packetidsize,
-		    ax->ax_packetidsize + 25, sizeof(*packetids));
-		if (packetids == NULL)
-			return 0;
-		ax->ax_packetidsize += 25;
-		ax->ax_packetids = packetids;
-	}
-	do {
-		found = 0;
-		packetid = arc4random();
-		for (i = 0; ax->ax_packetids[i] != 0; i++) {
-			if (ax->ax_packetids[i] == packetid) {
-				found = 1;
-				break;
-			}
-		}
-	} while (packetid == 0 || found);
-	ax->ax_packetids[npackets] = packetid;
-
-	return packetid;
-}
-
 static int
 ax_pdu_add_uint16(struct ax *ax, uint16_t value)
 {
diff --git a/usr.sbin/snmpd/ax.h b/usr.sbin/snmpd/ax.h
index 36006221a..abfb70f12 100644
--- a/usr.sbin/snmpd/ax.h
+++ b/usr.sbin/snmpd/ax.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ax.h,v 1.3 2023/12/21 12:43:31 martijn Exp $ */
+/*	$OpenBSD: ax.h,v 1.4 2024/02/20 12:25:43 martijn Exp $ */
 /*
  * Copyright (c) 2019 Martijn van Duren <martijn@openbsd.org>
  *
@@ -125,8 +125,6 @@ struct ax {
 	size_t ax_wblen;
 	size_t ax_wbtlen;
 	size_t ax_wbsize;
-	uint32_t *ax_packetids;
-	size_t ax_packetidsize;
 };
 
 #ifndef AX_PRIMITIVE
diff --git a/usr.sbin/snmpd/mib.y b/usr.sbin/snmpd/mib.y
index 2e467aaa4..cad0a2128 100644
--- a/usr.sbin/snmpd/mib.y
+++ b/usr.sbin/snmpd/mib.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mib.y,v 1.1 2024/01/27 09:53:59 martijn Exp $	*/
+/*	$OpenBSD: mib.y,v 1.2 2024/02/20 12:41:13 martijn Exp $	*/
 
 /*
  * Copyright (c) 2023 Martijn van Duren <martijn@openbsd.org>
@@ -496,7 +496,7 @@ moduleidentity		: descriptor MODULEIDENTITY lastupdated
 
 lastupdated		: LASTUPDATED TEXT {
 				char timebuf[14] = "";
-				struct tm tm;
+				struct tm tm = {};
 				size_t len;
 
 				if ((len = strlen($2)) == 11)
@@ -505,11 +505,11 @@ lastupdated		: LASTUPDATED TEXT {
 				else if (len == 13)
 					strlcpy(timebuf, $2, sizeof(timebuf));
 				else {
-					yyerror("Invalid LAST-UPDATED");
+					yyerror("Invalid LAST-UPDATED: %s", $2);
 					YYERROR;
 				}
 
-				if (strptime(timebuf, "%Y%M%d%H%MZ", &tm) == NULL) {
+				if (strptime(timebuf, "%Y%m%d%H%MZ", &tm) == NULL) {
 					yyerror("Invalid LAST-UPDATED: %s", $2);
 					YYERROR;
 				}
diff --git a/usr.sbin/snmpd/parse.y b/usr.sbin/snmpd/parse.y
index 09c4084dc..2a702e8db 100644
--- a/usr.sbin/snmpd/parse.y
+++ b/usr.sbin/snmpd/parse.y
@@ -1,4 +1,4 @@
-/*	$OpenBSD: parse.y,v 1.89 2024/02/06 15:36:11 martijn Exp $	*/
+/*	$OpenBSD: parse.y,v 1.90 2024/02/20 12:32:48 martijn Exp $	*/
 
 /*
  * Copyright (c) 2007, 2008, 2012 Reyk Floeter <reyk@openbsd.org>
@@ -1760,9 +1760,13 @@ resolve_oids(void)
 	free(trapcmds);
 
 	for (i = 0; i < ntrapaddresses; i++) {
-		if (resolve_oid(
-		    &trapaddresses[i].tr->ta_oid, &trapaddresses[i].oid) == -1)
-			return -1;
+		if (trapaddresses[i].oid.descriptor == NULL)
+			trapaddresses[i].tr->ta_oid.bo_n = 0;
+		else {
+			if (resolve_oid(&trapaddresses[i].tr->ta_oid,
+			    &trapaddresses[i].oid) == -1)
+				return -1;
+		}
 		TAILQ_INSERT_TAIL(&conf->sc_trapreceivers,
 		    trapaddresses[i].tr, entry);
 	}