diff --git a/gnu/llvm/lld/ELF/InputFiles.cpp b/gnu/llvm/lld/ELF/InputFiles.cpp
index 05fc61997..e7c94b852 100644
--- a/gnu/llvm/lld/ELF/InputFiles.cpp
+++ b/gnu/llvm/lld/ELF/InputFiles.cpp
@@ -67,7 +67,9 @@ std::string lld::toString(const InputFile *f) {
 
 // .gnu.warning.SYMBOL are treated as warning symbols for the given symbol
 void lld::parseGNUWarning(StringRef name, ArrayRef<char> data, size_t size) {
+  static std::mutex mu;
   if (!name.empty() && name.startswith(".gnu.warning.")) {
+    std::lock_guard<std::mutex> lock(mu);
     StringRef wsym = name.substr(13);
     StringRef s(data.begin());
     StringRef wng(s.substr(0, size));
diff --git a/gnu/llvm/lld/ELF/Relocations.cpp b/gnu/llvm/lld/ELF/Relocations.cpp
index 3c9e7e450..9bdbad2d4 100644
--- a/gnu/llvm/lld/ELF/Relocations.cpp
+++ b/gnu/llvm/lld/ELF/Relocations.cpp
@@ -792,6 +792,7 @@ void elf::reportUndefinedSymbols() {
 
 static void reportGNUWarning(Symbol &sym, InputSectionBase &sec,
                                  uint64_t offset) {
+  std::lock_guard<std::mutex> lock(relocMutex);
   if (sym.gwarn) {
     StringRef gnuWarning = gnuWarnings.lookup(sym.getName());
     // report first occurance only
diff --git a/lib/libc/stdlib/malloc.3 b/lib/libc/stdlib/malloc.3
index 3e7f7b987..e5d9b5626 100644
--- a/lib/libc/stdlib/malloc.3
+++ b/lib/libc/stdlib/malloc.3
@@ -30,9 +30,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"	$OpenBSD: malloc.3,v 1.139 2023/10/22 14:04:52 jmc Exp $
+.\"	$OpenBSD: malloc.3,v 1.141 2023/12/04 22:52:41 tb Exp $
 .\"
-.Dd $Mdocdate: October 22 2023 $
+.Dd $Mdocdate: December 4 2023 $
 .Dt MALLOC 3
 .Os
 .Sh NAME
@@ -298,11 +298,12 @@ To view the leak report:
 By default, the immediate caller of a
 .Nm
 function will be recorded.
-Use malloc options
-.Cm 2
-or
+Use malloc option
+.Cm 2 ,
 .Cm 3
-to record the caller one or two stack frames deeper instead.
+or
+.Cm 4
+to record deeper call stacks.
 These malloc options imply
 .Cm D .
 .It Cm F
@@ -843,9 +844,10 @@ to avoid these problems on
 .Ox .
 .Pp
 The mechanism to record caller functions when using malloc options
-.Cm 2
+.Cm 2 ,
+.Cm 3 ,
 or
-.Cm 3
+.Cm 4
 is not guaranteed to work for all platforms, compilers or compilation
 options,
 and might even crash your program.
diff --git a/lib/libc/stdlib/malloc.c b/lib/libc/stdlib/malloc.c
index ba1a28788..3681319cc 100644
--- a/lib/libc/stdlib/malloc.c
+++ b/lib/libc/stdlib/malloc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: malloc.c,v 1.293 2023/11/04 11:02:35 otto Exp $	*/
+/*	$OpenBSD: malloc.c,v 1.294 2023/12/04 07:01:45 otto Exp $	*/
 /*
  * Copyright (c) 2008, 2010, 2011, 2016, 2023 Otto Moerbeek <otto@drijf.net>
  * Copyright (c) 2012 Matthew Dempsky <matthew@openbsd.org>
@@ -139,6 +139,16 @@ struct bigcache {
 	size_t psize;
 };
 
+#ifdef MALLOC_STATS
+#define NUM_FRAMES		4
+struct btnode {
+	RBT_ENTRY(btnode) entry;
+	void *caller[NUM_FRAMES];
+};
+RBT_HEAD(btshead, btnode);
+RBT_PROTOTYPE(btshead, btnode, entry, btcmp);
+#endif /* MALLOC_STATS */
+
 struct dir_info {
 	u_int32_t canary1;
 	int active;			/* status of malloc */
@@ -175,6 +185,9 @@ struct dir_info {
 	size_t cheap_reallocs;
 	size_t malloc_used;		/* bytes allocated */
 	size_t malloc_guarded;		/* bytes used for guards */
+	struct btshead btraces;		/* backtraces seen */
+	struct btnode *btnodes;		/* store of backtrace nodes */
+	size_t btnodesused;
 #define STATS_ADD(x,y)	((x) += (y))
 #define STATS_SUB(x,y)	((x) -= (y))
 #define STATS_INC(x)	((x)++)
@@ -261,38 +274,52 @@ void malloc_dump(void);
 PROTO_NORMAL(malloc_dump);
 static void malloc_exit(void);
 static void print_chunk_details(struct dir_info *, void *, size_t, size_t);
-#endif
+static void* store_caller(struct dir_info *, struct btnode *);
 
+/* below are the arches for which deeper caller info has been tested */
 #if defined(__aarch64__) || \
 	defined(__amd64__) || \
-	defined(__arm__)
-static inline void* caller(void)
+	defined(__arm__) || \
+	defined(__i386__) || \
+	defined(__powerpc__)
+__attribute__((always_inline))
+static inline void*
+caller(struct dir_info *d)
 {
-	void *p;
-
-	switch (DO_STATS) {
-	case 0:
-	default:
+	struct btnode p;
+	int level = DO_STATS;
+	if (level == 0)
 		return NULL;
-	case 1:
-		p = __builtin_return_address(0);
-		break;
-	case 2:
-		p = __builtin_return_address(1);
-		break;
-	case 3:
-		p = __builtin_return_address(2);
-		break;
-	}
-	return __builtin_extract_return_addr(p);
+
+	memset(&p.caller, 0, sizeof(p.caller));
+	if (level >= 1)
+		p.caller[0] = __builtin_extract_return_addr(
+		    __builtin_return_address(0));
+	if (p.caller[0] != NULL && level >= 2)
+		p.caller[1] = __builtin_extract_return_addr(
+		    __builtin_return_address(1));
+	if (p.caller[1] != NULL && level >= 3)
+		p.caller[2] = __builtin_extract_return_addr(
+		    __builtin_return_address(2));
+	if (p.caller[2] != NULL && level >= 4)
+		p.caller[3] = __builtin_extract_return_addr(
+		    __builtin_return_address(3));
+	return store_caller(d, &p);
 }
 #else
-static inline void* caller(void)
+__attribute__((always_inline))
+static inline void* caller(struct dir_info *d)
 {
-	return DO_STATS == 0 ? NULL :
-	    __builtin_extract_return_addr(__builtin_return_address(0));
+	struct btnode p;
+
+	if (DO_STATS == 0)
+		return NULL;
+	memset(&p.caller, 0, sizeof(p.caller));
+	p.caller[0] = __builtin_extract_return_addr(__builtin_return_address(0));
+	return store_caller(d, &p);
 }
 #endif
+#endif /* MALLOC_STATS */
 
 /* low bits of r->p determine size: 0 means >= page size and r->size holding
  * real size, otherwise low bits is the bucket + 1
@@ -411,6 +438,9 @@ omalloc_parseopt(char opt)
 	case '3':
 		mopts.malloc_stats = 3;
 		break;
+	case '4':
+		mopts.malloc_stats = 4;
+		break;
 #endif /* MALLOC_STATS */
 	case 'f':
 		mopts.malloc_freecheck = 0;
@@ -525,7 +555,7 @@ omalloc_init(void)
 
 #ifdef MALLOC_STATS
 	if (DO_STATS && (atexit(malloc_exit) == -1)) {
-		dprintf(STDERR_FILENO, "malloc() warning: atexit(2) failed."
+		dprintf(STDERR_FILENO, "malloc() warning: atexit(3) failed."
 		    " Will not be able to dump stats on exit\n");
 	}
 #endif
@@ -555,6 +585,9 @@ omalloc_poolinit(struct dir_info *d, int mmap_flag)
 	}
 	d->mmap_flag = mmap_flag;
 	d->malloc_junk = mopts.def_malloc_junk;
+#ifdef MALLOC_STATS
+	RBT_INIT(btshead, &d->btraces);
+#endif
 	d->canary1 = mopts.malloc_canary ^ (u_int32_t)(uintptr_t)d;
 	d->canary2 = ~d->canary1;
 }
@@ -1091,15 +1124,13 @@ bin_of(unsigned int size)
 	const unsigned int linear = 6;
 	const unsigned int subbin = 2;
 
-	unsigned int mask, range, rounded, sub_index, rounded_size;
+	unsigned int mask, rounded, rounded_size;
 	unsigned int n_bits, shift;
 
 	n_bits = lb(size | (1U << linear));
 	shift = n_bits - subbin;
 	mask = (1ULL << shift) - 1;
 	rounded = size + mask; /* XXX: overflow. */
-	sub_index = rounded >> shift;
-	range = n_bits - linear;
 
 	rounded_size = rounded & ~mask;
 	return rounded_size;
@@ -1135,6 +1166,7 @@ static void *
 malloc_bytes(struct dir_info *d, size_t size)
 {
 	u_int i, k, r, bucket, listnum;
+	int j;
 	u_short	*lp;
 	struct chunk_info *bp;
 	void *p;
@@ -1155,7 +1187,7 @@ malloc_bytes(struct dir_info *d, size_t size)
 			return NULL;
 	}
 
-	if (bp->canary != (u_short)d->canary1)
+	if (bp->canary != (u_short)d->canary1 || bucket != bp->bucket)
 		wrterror(d, "chunk info corrupted");
 
 	/* bias, as bp->total is not a power of 2 */
@@ -1163,8 +1195,8 @@ malloc_bytes(struct dir_info *d, size_t size)
 
 	/* potentially start somewhere in a short */
 	lp = &bp->bits[i / MALLOC_BITS];
-	if (*lp) {
-		int j = i % MALLOC_BITS; /* j must be signed */
+	j = i % MALLOC_BITS; /* j must be signed */
+	if (*lp >> j) {
 		k = ffs(*lp >> j);
 		if (k != 0) {
 			k += j - 1;
@@ -1200,13 +1232,13 @@ found:
 		STATS_SETFN(r, k, d->caller);
 	}
 
-	k *= B2ALLOC(bp->bucket);
+	k *= B2ALLOC(bucket);
 
 	p = (char *)bp->page + k;
-	if (bp->bucket > 0) {
-		validate_junk(d, p, B2SIZE(bp->bucket));
+	if (bucket > 0) {
+		validate_junk(d, p, B2SIZE(bucket));
 		if (mopts.chunk_canaries)
-			fill_canary(p, size, B2SIZE(bp->bucket));
+			fill_canary(p, size, B2SIZE(bucket));
 	}
 	return p;
 }
@@ -1511,7 +1543,7 @@ malloc(size_t size)
 	int saved_errno = errno;
 
 	PROLOGUE(getpool(), "malloc")
-	SET_CALLER(d, caller());
+	SET_CALLER(d, caller(d));
 	r = omalloc(d, size, 0);
 	EPILOGUE()
 	return r;
@@ -1526,7 +1558,7 @@ malloc_conceal(size_t size)
 	int saved_errno = errno;
 
 	PROLOGUE(mopts.malloc_pool[0], "malloc_conceal")
-	SET_CALLER(d, caller());
+	SET_CALLER(d, caller(d));
 	r = omalloc(d, size, 0);
 	EPILOGUE()
 	return r;
@@ -1937,7 +1969,7 @@ realloc(void *ptr, size_t size)
 	int saved_errno = errno;
 
 	PROLOGUE(getpool(), "realloc")
-	SET_CALLER(d, caller());
+	SET_CALLER(d, caller(d));
 	r = orealloc(&d, ptr, size);
 	EPILOGUE()
 	return r;
@@ -1958,7 +1990,7 @@ calloc(size_t nmemb, size_t size)
 	int saved_errno = errno;
 
 	PROLOGUE(getpool(), "calloc")
-	SET_CALLER(d, caller());
+	SET_CALLER(d, caller(d));
 	if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
 	    nmemb > 0 && SIZE_MAX / nmemb < size) {
 		d->active--;
@@ -1984,7 +2016,7 @@ calloc_conceal(size_t nmemb, size_t size)
 	int saved_errno = errno;
 
 	PROLOGUE(mopts.malloc_pool[0], "calloc_conceal")
-	SET_CALLER(d, caller());
+	SET_CALLER(d, caller(d));
 	if ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
 	    nmemb > 0 && SIZE_MAX / nmemb < size) {
 		d->active--;
@@ -2130,7 +2162,7 @@ recallocarray(void *ptr, size_t oldnmemb, size_t newnmemb, size_t size)
 		return recallocarray_p(ptr, oldnmemb, newnmemb, size);
 
 	PROLOGUE(getpool(), "recallocarray")
-	SET_CALLER(d, caller());
+	SET_CALLER(d, caller(d));
 
 	if ((newnmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&
 	    newnmemb > 0 && SIZE_MAX / newnmemb < size) {
@@ -2289,7 +2321,7 @@ posix_memalign(void **memptr, size_t alignment, size_t size)
 		malloc_recurse(d);
 		goto err;
 	}
-	SET_CALLER(d, caller());
+	SET_CALLER(d, caller(d));
 	r = omemalign(d, alignment, size, 0);
 	d->active--;
 	_MALLOC_UNLOCK(d->mutex);
@@ -2328,7 +2360,7 @@ aligned_alloc(size_t alignment, size_t size)
 	}
 
 	PROLOGUE(getpool(), "aligned_alloc")
-	SET_CALLER(d, caller());
+	SET_CALLER(d, caller(d));
 	r = omemalign(d, alignment, size, 0);
 	EPILOGUE()
 	return r;
@@ -2337,43 +2369,74 @@ DEF_STRONG(aligned_alloc);
 
 #ifdef MALLOC_STATS
 
+static int
+btcmp(const struct btnode *e1, const struct btnode *e2)
+{
+	return memcmp(e1->caller, e2->caller, sizeof(e1->caller));
+}
+
+RBT_GENERATE(btshead, btnode, entry, btcmp);
+
+static void*
+store_caller(struct dir_info *d, struct btnode *f)
+{
+	struct btnode *p;
+
+	if (DO_STATS == 0 || d->btnodes == MAP_FAILED)
+		return NULL;
+
+	p = RBT_FIND(btshead, &d->btraces, f);
+	if (p != NULL)
+		return p;
+	if (d->btnodes == NULL ||
+	    d->btnodesused >= MALLOC_PAGESIZE / sizeof(struct btnode)) {
+		d->btnodes = map(d, MALLOC_PAGESIZE, 0);
+		if (d->btnodes == MAP_FAILED)
+			return NULL;
+		d->btnodesused = 0;
+	}
+	p = &d->btnodes[d->btnodesused++];
+	memcpy(p->caller, f->caller, sizeof(p->caller[0]) * DO_STATS);
+	RBT_INSERT(btshead, &d->btraces, p);
+	return p;
+}
+
+static void fabstorel(const void *, char *, size_t);
+
 static void
-print_chunk_details(struct dir_info *pool, void *p, size_t sz, size_t i)
+print_chunk_details(struct dir_info *pool, void *p, size_t sz, size_t index)
 {
 	struct region_info *r;
 	struct chunk_info *chunkinfo;
+	struct btnode* btnode;
 	uint32_t chunknum;
-	Dl_info info;
-	const char *caller, *pcaller = NULL;
-	const char *object = ".";
-	const char *pobject = ".";
+	int frame;
+	char buf1[128];
+	char buf2[128];
 	const char *msg = "";
 
 	r = find(pool, p);
 	chunkinfo = (struct chunk_info *)r->size;
 	chunknum = find_chunknum(pool, chunkinfo, p, 0);
-	caller = r->f[chunknum];
-	if (dladdr(caller, &info) != 0) {
-		caller -= (uintptr_t)info.dli_fbase;
-		object = info.dli_fname;
-	}
+	btnode = (struct btnode *)r->f[chunknum];
+	frame = DO_STATS - 1;
+	if (btnode != NULL)
+		fabstorel(btnode->caller[frame], buf1, sizeof(buf1));
+	strlcpy(buf2, ". 0x0", sizeof(buf2));
 	if (chunknum > 0) {
 		chunknum--;
-		pcaller = r->f[chunknum];
-		if (dladdr(pcaller, &info) != 0) {
-			pcaller -= (uintptr_t)info.dli_fbase;
-			pobject = info.dli_fname;
-		}
+		btnode = (struct btnode *)r->f[chunknum];
+		if (btnode != NULL)
+			fabstorel(btnode->caller[frame], buf2, sizeof(buf2));
 		if (CHUNK_FREE(chunkinfo, chunknum))
 			msg = " (now free)";
 	}
 
 	wrterror(pool,
-	    "write to free chunk %p[%zu..%zu]@%zu allocated at %s %p "
-	    "(preceding chunk %p allocated at %s %p%s)",
-	    p, i * sizeof(uint64_t),
-	    (i + 1) * sizeof(uint64_t) - 1, sz, object, caller, p - sz,
-	    pobject, pcaller, msg);
+	    "write to free chunk %p[%zu..%zu]@%zu allocated at %s "
+	    "(preceding chunk %p allocated at %s%s)",
+	    p, index * sizeof(uint64_t), (index + 1) * sizeof(uint64_t) - 1,
+	    sz, buf1, p - sz, buf2, msg);
 }
 
 static void
@@ -2475,6 +2538,52 @@ putleakinfo(struct leaktree *leaks, void *f, size_t sz, int cnt)
 	}
 }
 
+static void
+fabstorel(const void *f, char *buf, size_t size)
+{
+	Dl_info info;
+	const char *object = ".";
+	const char *caller;
+
+	caller = f;
+	if (caller != NULL && dladdr(f, &info) != 0) {
+		caller -= (uintptr_t)info.dli_fbase;
+		object = info.dli_fname;
+	}
+	snprintf(buf, size, "%s %p", object, caller);
+}
+
+static void
+dump_leak(struct leaknode *p)
+{
+	int i;
+	char buf[128];
+
+	if (p->d.f == NULL) {
+		fabstorel(NULL, buf, sizeof(buf));
+		ulog("%18p %7zu %6u %6zu addr2line -e %s\n",
+		    p->d.f, p->d.total_size, p->d.count,
+		    p->d.total_size / p->d.count, buf);
+		return;
+	}
+
+	for (i = 0; i < DO_STATS; i++) {
+		const char *abscaller;
+
+		abscaller = ((struct btnode*)p->d.f)->caller[i];
+		if (abscaller == NULL)
+			break;
+		fabstorel(abscaller, buf, sizeof(buf));
+		if (i == 0)
+			ulog("%18p %7zu %6u %6zu addr2line -e %s\n",
+			    abscaller, p->d.total_size, p->d.count,
+			    p->d.total_size / p->d.count, buf);
+		else
+			ulog("%*p %*s %6s %6s addr2line -e %s\n",
+			    i + 18, abscaller, 7 - i, "-", "-", "-", buf);
+	}
+}
+
 static void
 dump_leaks(struct leaktree *leaks)
 {
@@ -2483,22 +2592,8 @@ dump_leaks(struct leaktree *leaks)
 	ulog("Leak report:\n");
 	ulog("                 f     sum      #    avg\n");
 
-	RBT_FOREACH(p, leaktree, leaks) {
-		Dl_info info;
-		const char *caller = p->d.f;
-		const char *object = ".";
-
-		if (caller != NULL) {
-			if (dladdr(p->d.f, &info) != 0) {
-				caller -= (uintptr_t)info.dli_fbase;
-				object = info.dli_fname;
-			}
-		}
-		ulog("%18p %7zu %6u %6zu addr2line -e %s %p\n",
-		    p->d.f, p->d.total_size, p->d.count,
-		    p->d.total_size / p->d.count,
-		    object, caller);
-	}
+	RBT_FOREACH(p, leaktree, leaks) 
+		dump_leak(p);
 }
 
 static void
diff --git a/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 b/lib/libcrypto/man/OPENSSL_load_builtin_modules.3
index bcaa57a9a..2b20efaf0 100644
--- a/lib/libcrypto/man/OPENSSL_load_builtin_modules.3
+++ b/lib/libcrypto/man/OPENSSL_load_builtin_modules.3
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: OPENSSL_load_builtin_modules.3,v 1.7 2023/11/19 20:59:00 tb Exp $
+.\"	$OpenBSD: OPENSSL_load_builtin_modules.3,v 1.8 2023/12/05 02:41:13 jsg Exp $
 .\"	OpenSSL b97fdb57 Nov 11 09:33:09 2016 +0100
 .\"
 .\" This file was written by Dr. Stephen Henson <steve@openssl.org>.
@@ -48,12 +48,12 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: November 19 2023 $
+.Dd $Mdocdate: December 5 2023 $
 .Dt OPENSSL_LOAD_BUILTIN_MODULES 3
 .Os
 .Sh NAME
 .Nm OPENSSL_load_builtin_modules ,
-.Nm ASN1_add_oid_module ,
+.Nm ASN1_add_oid_module
 .Nd add standard configuration modules
 .Sh SYNOPSIS
 .In openssl/conf.h
diff --git a/sys/arch/arm64/arm64/genassym.cf b/sys/arch/arm64/arm64/genassym.cf
index faeb6fdb4..dd5dbe19a 100644
--- a/sys/arch/arm64/arm64/genassym.cf
+++ b/sys/arch/arm64/arm64/genassym.cf
@@ -1,4 +1,4 @@
-#	$OpenBSD: genassym.cf,v 1.9 2022/12/10 10:13:58 patrick Exp $
+#	$OpenBSD: genassym.cf,v 1.10 2023/12/04 21:19:26 miod Exp $
 #	$NetBSD: genassym.cf,v 1.27 2003/11/04 10:33:16 dsl Exp$
 
 # Copyright (c) 1982, 1990 The Regents of the University of California.
@@ -44,6 +44,7 @@ member	sf_sc
 
 struct	cpu_info
 member	ci_curproc
+member	ci_curpcb
 member	ci_el1_stkend
 member	ci_trampoline_vectors
 member	ci_ttbr1
@@ -63,17 +64,12 @@ member	pcb_flags
 member	pcb_sp
 member	pcb_tcb
 
-export	PCB_FPU
-
 struct	trapframe
 member	tf_x
 member	tf_sp
 member	tf_elr
 define	TF_SIZE		sizeof(struct trapframe)
 
-struct	cpu_info
-member	ci_curpcb
-
 struct	switchframe
 member	sf_x19
 member	sf_x21
@@ -82,5 +78,3 @@ member	sf_x25
 member	sf_x27
 member	sf_x29
 define	SWITCHFRAME_SZ sizeof(struct switchframe)
-
-export	IPL_NONE
diff --git a/sys/arch/arm64/arm64/machdep.c b/sys/arch/arm64/arm64/machdep.c
index d0c160113..69dc76ae9 100644
--- a/sys/arch/arm64/arm64/machdep.c
+++ b/sys/arch/arm64/arm64/machdep.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: machdep.c,v 1.84 2023/08/10 21:01:50 kettenis Exp $ */
+/* $OpenBSD: machdep.c,v 1.85 2023/12/04 15:00:09 claudio Exp $ */
 /*
  * Copyright (c) 2014 Patrick Wildt <patrick@blueri.se>
  * Copyright (c) 2021 Mark Kettenis <kettenis@openbsd.org>
@@ -1067,13 +1067,15 @@ initarm(struct arm64_bootparams *abp)
 		physmem += atop(end - start);
 	}
 
+	kmeminit_nkmempages();
+
 	/*
 	 * Make sure that we have enough KVA to initialize UVM.  In
 	 * particular, we need enough KVA to be able to allocate the
-	 * vm_page structures.
+	 * vm_page structures and nkmempages for malloc(9).
 	 */
 	pmap_growkernel(VM_MIN_KERNEL_ADDRESS + 1024 * 1024 * 1024 +
-	    physmem * sizeof(struct vm_page));
+	    physmem * sizeof(struct vm_page) + ptoa(nkmempages));
 
 #ifdef DDB
 	db_machine_init();
diff --git a/sys/arch/arm64/include/bootconfig.h b/sys/arch/arm64/include/bootconfig.h
index b47defd59..071b93069 100644
--- a/sys/arch/arm64/include/bootconfig.h
+++ b/sys/arch/arm64/include/bootconfig.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: bootconfig.h,v 1.3 2018/05/28 19:39:15 kettenis Exp $	*/
+/*	$OpenBSD: bootconfig.h,v 1.4 2023/12/05 05:27:26 jsg Exp $	*/
 /*	$NetBSD: bootconfig.h,v 1.2 2001/06/21 22:08:28 chris Exp $	*/
 
 /*-
@@ -44,6 +44,4 @@ struct arm64_bootparams {
 
 void initarm(struct arm64_bootparams *);
 
-extern char *boot_file;
-
 #endif /* _MACHINE_BOOTCONFIG_H_ */
diff --git a/sys/dev/mii/eephy.c b/sys/dev/mii/eephy.c
index 7b633708d..080367d45 100644
--- a/sys/dev/mii/eephy.c
+++ b/sys/dev/mii/eephy.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: eephy.c,v 1.60 2022/04/06 18:59:29 naddy Exp $	*/
+/*	$OpenBSD: eephy.c,v 1.61 2023/12/05 11:06:05 uwe Exp $	*/
 /*
  * Principal Author: Parag Patel
  * Copyright (c) 2001
@@ -290,11 +290,8 @@ eephy_reset(struct mii_softc *sc)
 
 	/*
 	 * Do a software reset for these settings to take effect.
-	 * Disable autonegotiation, such that all capabilities get
-	 * advertised when it is switched back on.
 	 */
 	reg = PHY_READ(sc, E1000_CR);
-	reg &= ~E1000_CR_AUTO_NEG_ENABLE;
 	PHY_WRITE(sc, E1000_CR, reg | E1000_CR_RESET);
 }
 
diff --git a/sys/dev/pci/drm/i915/gt/intel_gt.c b/sys/dev/pci/drm/i915/gt/intel_gt.c
index d44e11c27..f7cfe5abd 100644
--- a/sys/dev/pci/drm/i915/gt/intel_gt.c
+++ b/sys/dev/pci/drm/i915/gt/intel_gt.c
@@ -909,8 +909,6 @@ int intel_gt_probe_all(struct drm_i915_private *i915)
 
 err:
 	i915_probe_error(i915, "Failed to initialize %s! (%d)\n", gtdef->name, ret);
-	intel_gt_release_all(i915);
-
 	return ret;
 }
 
@@ -1006,8 +1004,6 @@ int intel_gt_probe_all(struct drm_i915_private *i915)
 
 err:
 	i915_probe_error(i915, "Failed to initialize %s! (%d)\n", gtdef->name, ret);
-	intel_gt_release_all(i915);
-
 	return ret;
 }
 
@@ -1028,15 +1024,6 @@ int intel_gt_tiles_init(struct drm_i915_private *i915)
 	return 0;
 }
 
-void intel_gt_release_all(struct drm_i915_private *i915)
-{
-	struct intel_gt *gt;
-	unsigned int id;
-
-	for_each_gt(gt, i915, id)
-		i915->gt[id] = NULL;
-}
-
 void intel_gt_info_print(const struct intel_gt_info *info,
 			 struct drm_printer *p)
 {
diff --git a/sys/dev/pci/drm/i915/i915_driver.c b/sys/dev/pci/drm/i915/i915_driver.c
index 4585d2324..b701ae106 100644
--- a/sys/dev/pci/drm/i915/i915_driver.c
+++ b/sys/dev/pci/drm/i915/i915_driver.c
@@ -935,7 +935,7 @@ int i915_driver_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
 	ret = i915_driver_mmio_probe(i915);
 	if (ret < 0)
-		goto out_tiles_cleanup;
+		goto out_runtime_pm_put;
 
 	ret = i915_driver_hw_probe(i915);
 	if (ret < 0)
@@ -993,8 +993,6 @@ out_cleanup_hw:
 	i915_ggtt_driver_late_release(i915);
 out_cleanup_mmio:
 	i915_driver_mmio_release(i915);
-out_tiles_cleanup:
-	intel_gt_release_all(i915);
 out_runtime_pm_put:
 	enable_rpm_wakeref_asserts(&i915->runtime_pm);
 	i915_driver_late_release(i915);
@@ -1047,7 +1045,7 @@ int i915_driver_probe(struct drm_i915_private *i915, const struct pci_device_id
 
 	ret = i915_driver_mmio_probe(i915);
 	if (ret < 0)
-		goto out_tiles_cleanup;
+		goto out_runtime_pm_put;
 
 	ret = i915_driver_hw_probe(i915);
 	if (ret < 0)
@@ -1107,8 +1105,6 @@ out_cleanup_hw:
 	i915_ggtt_driver_late_release(i915);
 out_cleanup_mmio:
 	i915_driver_mmio_release(i915);
-out_tiles_cleanup:
-	intel_gt_release_all(i915);
 out_runtime_pm_put:
 	enable_rpm_wakeref_asserts(&i915->runtime_pm);
 	i915_driver_late_release(i915);
diff --git a/sys/dev/pci/if_vr.c b/sys/dev/pci/if_vr.c
index 5e453a874..bf93bb171 100644
--- a/sys/dev/pci/if_vr.c
+++ b/sys/dev/pci/if_vr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_vr.c,v 1.159 2022/03/11 18:00:50 mpi Exp $	*/
+/*	$OpenBSD: if_vr.c,v 1.160 2023/12/05 13:43:39 kevlo Exp $	*/
 
 /*
  * Copyright (c) 1997, 1998
@@ -1603,6 +1603,7 @@ vr_stop(struct vr_softc *sc)
 	ifp->if_timer = 0;
 
 	timeout_del(&sc->sc_to);
+	timeout_del(&sc->sc_rxto);
 
 	ifp->if_flags &= ~IFF_RUNNING;
 	ifq_clr_oactive(&ifp->if_snd);
diff --git a/sys/dev/usb/uthum.c b/sys/dev/usb/uthum.c
index 7888ee8b2..ce118a5e5 100644
--- a/sys/dev/usb/uthum.c
+++ b/sys/dev/usb/uthum.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uthum.c,v 1.38 2022/01/09 05:43:02 jsg Exp $   */
+/*	$OpenBSD: uthum.c,v 1.39 2023/12/04 05:28:25 mglocker Exp $   */
 
 /*
  * Copyright (c) 2009, 2010 Yojiro UO <yuo@nui.org>
@@ -742,8 +742,16 @@ uthum_refresh_temperntc(struct uthum_softc *sc, int sensor)
 int
 uthum_ds75_temp(uint8_t msb, uint8_t lsb)
 {
+	int val;
+
 	/* DS75: 12bit precision mode : 0.0625 degrees Celsius ticks */
-	return (msb * 100) + ((lsb >> 4) * 25 / 4);
+
+	val = (msb << 8) | lsb;
+	if (val >= 32768)
+		val = val - 65536;
+	val = (val * 100) >> 8;
+
+	return val;
 }
 
 /* return C-degree * 100 value */
diff --git a/sys/uvm/uvm_swap.c b/sys/uvm/uvm_swap.c
index 5df0bf0c4..842e25626 100644
--- a/sys/uvm/uvm_swap.c
+++ b/sys/uvm/uvm_swap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_swap.c,v 1.167 2023/10/27 19:18:53 mpi Exp $	*/
+/*	$OpenBSD: uvm_swap.c,v 1.168 2023/12/05 15:50:45 claudio Exp $	*/
 /*	$NetBSD: uvm_swap.c,v 1.40 2000/11/17 11:39:39 mrg Exp $	*/
 
 /*
@@ -1548,7 +1548,7 @@ uvm_swapisfull(void)
 
 	mtx_enter(&uvm_swap_data_lock);
 	KASSERT(uvmexp.swpgonly <= uvmexp.swpages);
-	result = (uvmexp.swpgonly >= (uvmexp.swpages * 99 / 100));
+	result = (uvmexp.swpgonly >= ((long)uvmexp.swpages * 99 / 100));
 	mtx_leave(&uvm_swap_data_lock);
 
 	return result;
diff --git a/usr.sbin/smtpd/rfc5322.c b/usr.sbin/smtpd/rfc5322.c
index a6f15056d..79f55327d 100644
--- a/usr.sbin/smtpd/rfc5322.c
+++ b/usr.sbin/smtpd/rfc5322.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rfc5322.c,v 1.3 2021/06/14 17:58:16 eric Exp $	*/
+/*	$OpenBSD: rfc5322.c,v 1.4 2023/12/05 13:38:25 op Exp $	*/
 
 /*
  * Copyright (c) 2018 Eric Faurot <eric@openbsd.org>
@@ -149,7 +149,8 @@ _rfc5322_next(struct rfc5322_parser *parser, struct rfc5322_result *res)
 
 	case RFC5322_NONE:
 	case RFC5322_HEADER_END:
-		if (line && (pos = strchr(line, ':'))) {
+		if (line && line[0] != ' ' && line[0] != '\t' &&
+		    (pos = strchr(line, ':'))) {
 			len = pos - line;
 			if (buf_grow(&parser->hdr, len + 1) == -1)
 				return -1;