diff --git a/games/boggle/boggle/mach.c b/games/boggle/boggle/mach.c
index ccd3bf1d4..5445f100d 100644
--- a/games/boggle/boggle/mach.c
+++ b/games/boggle/boggle/mach.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: mach.c,v 1.22 2016/09/11 14:21:17 tb Exp $	*/
+/*	$OpenBSD: mach.c,v 1.23 2023/10/10 08:22:19 tb Exp $	*/
 /*	$NetBSD: mach.c,v 1.5 1995/04/28 22:28:48 mycroft Exp $	*/
 
 /*-
@@ -686,7 +686,7 @@ tty_showboard(char *b)
 	clear();
 	move(BOARD_LINE, BOARD_COL);
 	line = BOARD_LINE;
-	printw(separator);
+	printw("%s", separator);
 	move(++line, BOARD_COL);
 	for (i = 0; i < ncubes; i++) {
 		printw("| ");
@@ -702,7 +702,7 @@ tty_showboard(char *b)
 		if ((i + 1) % grid == 0) {
 			printw("|");
 			move(++line, BOARD_COL);
-			printw(separator);
+			printw("%s", separator);
 			move(++line, BOARD_COL);
 		}
 	}
diff --git a/games/mille/misc.c b/games/mille/misc.c
index 73b238e41..3b53c943d 100644
--- a/games/mille/misc.c
+++ b/games/mille/misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: misc.c,v 1.13 2016/01/08 18:09:59 mestre Exp $	*/
+/*	$OpenBSD: misc.c,v 1.14 2023/10/10 09:42:56 tb Exp $	*/
 /*	$NetBSD: misc.c,v 1.4 1995/03/24 05:01:54 cgd Exp $	*/
 
 /*
@@ -48,7 +48,7 @@ error(char *str, ...)
 
 	va_start(ap, str);
 	wmove(Score, ERR_Y, ERR_X);
-	vwprintw(Score, str, ap);
+	vw_printw(Score, str, ap);
 	wclrtoeol(Score);
 	beep();
 	refresh();
diff --git a/games/mille/print.c b/games/mille/print.c
index f5341f6e4..ad6aeae5b 100644
--- a/games/mille/print.c
+++ b/games/mille/print.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: print.c,v 1.9 2016/01/08 18:09:59 mestre Exp $	*/
+/*	$OpenBSD: print.c,v 1.10 2023/10/10 09:42:56 tb Exp $	*/
 /*	$NetBSD: print.c,v 1.4 1995/03/24 05:02:02 cgd Exp $	*/
 
 /*
@@ -77,7 +77,7 @@ prboard(void)
 	pp = &Player[PLAYER];
 	for (i = 0; i < HAND_SZ; i++)
 		show_card(i + 6, temp, pp->hand[i], &pp->sh_hand[i]);
-	mvprintw(6, COMP_STRT + CARD_STRT, "%2d", Topcard - Deck);
+	mvprintw(6, COMP_STRT + CARD_STRT, "%2td", Topcard - Deck);
 	show_card(8, COMP_STRT + CARD_STRT, Discard, &Sh_discard);
 	if (End == 1000) {
 		move(EXT_Y, EXT_X);
diff --git a/games/phantasia/misc.c b/games/phantasia/misc.c
index 9e03e2116..7cdd34637 100644
--- a/games/phantasia/misc.c
+++ b/games/phantasia/misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: misc.c,v 1.21 2016/01/10 13:35:10 mestre Exp $	*/
+/*	$OpenBSD: misc.c,v 1.22 2023/10/10 09:43:52 tb Exp $	*/
 /*	$NetBSD: misc.c,v 1.2 1995/03/24 03:59:03 cgd Exp $	*/
 
 /*
@@ -545,7 +545,7 @@ allstatslist(void)
 	mvprintw(13, 0, "Sin       : %9.5f", Player.p_sin);
 	mvprintw(14, 0, "Poison    : %9.5f", Player.p_poison);
 	mvprintw(15, 0, "Gems      : %9.0f", Player.p_gems);
-	mvprintw(16, 0, "Age       : %9d", Player.p_age);
+	mvprintw(16, 0, "Age       : %9ld", Player.p_age);
 	mvprintw(10, 40, "Holy Water: %9d", Player.p_holywater);
 	mvprintw(11, 40, "Amulets   : %9d", Player.p_amulets);
 	mvprintw(12, 40, "Charms    : %9d", Player.p_charms);
diff --git a/games/robots/score.c b/games/robots/score.c
index c5d811775..fe53abb7a 100644
--- a/games/robots/score.c
+++ b/games/robots/score.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: score.c,v 1.16 2019/06/28 13:32:52 deraadt Exp $	*/
+/*	$OpenBSD: score.c,v 1.17 2023/10/10 09:48:06 tb Exp $	*/
 /*	$NetBSD: score.c,v 1.3 1995/04/22 10:09:12 cgd Exp $	*/
 
 /*
@@ -112,7 +112,7 @@ score(int score_wfd)
 		move((scp - Top) + 1, 6);
 		if (!done_show && scp->s_uid == uid && scp->s_score == Score)
 			standout();
-		printw(" %d\t%d\t%-*s ", (scp - Top) + 1, scp->s_score,
+		printw(" %td\t%d\t%-*s ", (scp - Top) + 1, scp->s_score,
 			(int)(sizeof scp->s_name), scp->s_name);
 		if (!done_show && scp->s_uid == uid && scp->s_score == Score) {
 			standend();
diff --git a/lib/libcrypto/man/X509_ALGOR_dup.3 b/lib/libcrypto/man/X509_ALGOR_dup.3
index 56d9674c7..0b878b7a8 100644
--- a/lib/libcrypto/man/X509_ALGOR_dup.3
+++ b/lib/libcrypto/man/X509_ALGOR_dup.3
@@ -1,9 +1,10 @@
-.\"	$OpenBSD: X509_ALGOR_dup.3,v 1.18 2023/10/09 16:59:55 tb Exp $
+.\"	$OpenBSD: X509_ALGOR_dup.3,v 1.19 2023/10/10 13:59:47 tb Exp $
 .\"	OpenSSL 4692340e Jun 7 15:49:08 2016 -0400
 .\"
 .\" This file is a derived work.
 .\" The changes are covered by the following Copyright and license:
 .\"
+.\" Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
 .\" Copyright (c) 2016 Ingo Schwarze <schwarze@openbsd.org>
 .\"
 .\" Permission to use, copy, modify, and distribute this software for any
@@ -65,7 +66,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: October 9 2023 $
+.Dd $Mdocdate: October 10 2023 $
 .Dt X509_ALGOR_DUP 3
 .Os
 .Sh NAME
@@ -112,17 +113,39 @@
 .Fa "const X509_ALGOR *b"
 .Fc
 .Sh DESCRIPTION
-.Fn X509_ALGOR_new
-allocates and initializes an empty
+An
 .Vt X509_ALGOR
-object, representing an ASN.1
+object represents an ASN.1
 .Vt AlgorithmIdentifier
 structure defined in RFC 5280 section 4.1.1.2.
-Such objects can specify a cryptographic algorithm together
-with algorithm-specific parameters.
-They are used by many other objects, for example certificates,
+It specifies a cryptographic
+.Fa algorithm
+by an ASN.1 object identifier (OID) that can be obtained from
+.Xr OBJ_nid2obj 3 ,
+together with optional algorithm-specific
+.Fa parameters
+of the type
+.Vt ASN1_TYPE ,
+see
+.Xr ASN1_TYPE_set 3 .
+.Vt X509_ALGOR
+objects are used by many other objects, for example certificates,
 certificate revocation lists, and certificate requests.
 .Pp
+.Fn X509_ALGOR_new
+allocates a new
+.Vt X509_ALGOR
+object containing the object that
+.Xr OBJ_nid2obj 3
+returns for
+.Dv NID_undef
+as the
+.Fa algorithm
+and a
+.Dv NULL
+pointer as the
+.Fa parameters .
+.Pp
 .Fn X509_ALGOR_free
 frees
 .Fa alg
@@ -210,12 +233,7 @@ can leave
 .Fa alg
 in a corrupted state due to memory allocation failure.
 This problem can be avoided by preallocating with an error-checked call to
-.Fn X509_ALGOR_set0 alg NULL 0 NULL ,
-or the failure can be identified by
-.Fn X509_ALGOR_get0 &aobj NULL NULL alg
-returning a
-.Dv NULL
-.Fa aobj .
+.Fn X509_ALGOR_set0 alg NULL 0 NULL .
 .Pp
 .Fn X509_ALGOR_cmp
 compares
@@ -249,6 +267,7 @@ have identical encodings or non-zero otherwise.
 .Xr ASN1_TYPE_set 3 ,
 .Xr d2i_X509_ALGOR 3 ,
 .Xr EVP_DigestInit 3 ,
+.Xr OBJ_nid2obj 3 ,
 .Xr X509_get0_signature 3 ,
 .Xr X509_new 3 ,
 .Xr X509_PUBKEY_get0_param 3 ,
diff --git a/regress/sys/fileops/Makefile.inc b/regress/sys/fileops/Makefile.inc
index 1dab209ff..5a898f929 100644
--- a/regress/sys/fileops/Makefile.inc
+++ b/regress/sys/fileops/Makefile.inc
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile.inc,v 1.4 2020/12/16 21:49:20 bluhm Exp $
+# $OpenBSD: Makefile.inc,v 1.5 2023/10/10 18:17:25 anton Exp $
 
 PERL_REQUIRE != perl -e 'eval { require File::Slurp } or print $$@'
 
@@ -6,9 +6,9 @@ TESTS1=		create read mmap
 TESTS2=		many_files_root many_files_subdir file_write
 TESTS= ${TESTS1} ${TESTS2}
 
-FILEOPS_MNT=	/mnt/regress-fileops
+FILEOPS_MNT=	/mnt/regress-fileops-${FS}
 FILEOPS_PROG=	${.OBJDIR}/../fileops
-CLEANFILES=	diskimage
+CLEANFILES=	diskimage vnd
 
 .poison !defined (MOUNT)
 .poison !defined (NEWFS)
@@ -17,13 +17,13 @@ CLEANFILES=	diskimage
 
 disk: unconfig
 	dd if=/dev/urandom of=diskimage bs=1M count=64
-	vnconfig vnd0 diskimage
-	${NEWFS} /dev/rvnd0c
+	vnconfig diskimage >vnd
+	${NEWFS} /dev/r$$(<vnd)c
 
 REGRESS_SETUP_ONCE+=	mount
 mount: disk
 	mkdir -p ${FILEOPS_MNT}
-	${MOUNT} /dev/vnd0c ${FILEOPS_MNT}
+	${MOUNT} /dev/$$(<vnd)c ${FILEOPS_MNT}
 
 REGRESS_CLEANUP+=	umount
 umount:
@@ -31,9 +31,9 @@ umount:
 
 REGRESS_CLEANUP+=	unconfig
 unconfig:
-	-umount -f /dev/vnd0c 2>/dev/null || true
+	-umount -f /dev/$$(<vnd)c 2>/dev/null || true
 	-rmdir ${FILEOPS_MNT} 2>/dev/null || true
-	-vnconfig -u vnd0 2>/dev/null || true
+	-vnconfig -u $$(<vnd) 2>/dev/null || true
 	rm -f stamp-setup
 
 ${.OBJDIR}/../fileops:
diff --git a/regress/sys/fileops/ext2/Makefile b/regress/sys/fileops/ext2/Makefile
index 06eff6950..8de8a3f74 100644
--- a/regress/sys/fileops/ext2/Makefile
+++ b/regress/sys/fileops/ext2/Makefile
@@ -1,5 +1,6 @@
-# $OpenBSD: Makefile,v 1.1 2017/05/30 08:44:58 sf Exp $
+# $OpenBSD: Makefile,v 1.2 2023/10/10 18:17:25 anton Exp $
 
+FS = ext2
 NEWFS = newfs_ext2fs -I
 MOUNT = mount_ext2fs
 
diff --git a/regress/sys/fileops/ffs/Makefile b/regress/sys/fileops/ffs/Makefile
index abcbb4113..36825886e 100644
--- a/regress/sys/fileops/ffs/Makefile
+++ b/regress/sys/fileops/ffs/Makefile
@@ -1,5 +1,6 @@
-# $OpenBSD: Makefile,v 1.1 2017/05/29 11:01:16 sf Exp $
+# $OpenBSD: Makefile,v 1.2 2023/10/10 18:17:25 anton Exp $
 
+FS = ffs
 NEWFS = newfs
 MOUNT = mount
 
diff --git a/regress/sys/fileops/msdos16/Makefile b/regress/sys/fileops/msdos16/Makefile
index ecb1347f2..ef626f993 100644
--- a/regress/sys/fileops/msdos16/Makefile
+++ b/regress/sys/fileops/msdos16/Makefile
@@ -1,5 +1,6 @@
-# $OpenBSD: Makefile,v 1.1 2017/05/29 11:01:16 sf Exp $
+# $OpenBSD: Makefile,v 1.2 2023/10/10 18:17:25 anton Exp $
 
+FS = msdos16
 NEWFS = newfs_msdos -F 16
 MOUNT = mount_msdos
 
diff --git a/regress/sys/fileops/msdos32/Makefile b/regress/sys/fileops/msdos32/Makefile
index 459ce821e..a8988637c 100644
--- a/regress/sys/fileops/msdos32/Makefile
+++ b/regress/sys/fileops/msdos32/Makefile
@@ -1,5 +1,6 @@
-# $OpenBSD: Makefile,v 1.2 2021/07/14 18:23:11 bluhm Exp $
+# $OpenBSD: Makefile,v 1.3 2023/10/10 18:17:26 anton Exp $
 
+FS = msdos32
 NEWFS = newfs_msdos -F 32 -c 1
 MOUNT = mount_msdos
 
diff --git a/regress/sys/kern/pipe/test-kqueue.c b/regress/sys/kern/pipe/test-kqueue.c
index ede5bc96c..f13015f8b 100644
--- a/regress/sys/kern/pipe/test-kqueue.c
+++ b/regress/sys/kern/pipe/test-kqueue.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: test-kqueue.c,v 1.4 2021/10/22 05:03:57 anton Exp $	*/
+/*	$OpenBSD: test-kqueue.c,v 1.5 2023/10/10 18:18:05 anton Exp $	*/
 
 /*
  * Copyright (c) 2019 Anton Lindqvist <anton@openbsd.org>
@@ -137,6 +137,8 @@ test_kqueue_write(void)
 		n = read(ctx.c_pipe[0], &c, 1);
 		if (n == -1)
 			err(1, "read");
+		if (n == 0)
+			break;
 		if (n != 1)
 			errx(1, "read: %ld != 1", n);
 	}
@@ -296,5 +298,7 @@ kqueue_thread(void *arg)
 	ctx->c_alive = 0;
 	ctx_unlock(ctx);
 
+	close(fd);
+
 	return NULL;
 }
diff --git a/sbin/dhcpleased/dhcpleased.c b/sbin/dhcpleased/dhcpleased.c
index 1b76a0bd3..b5f650468 100644
--- a/sbin/dhcpleased/dhcpleased.c
+++ b/sbin/dhcpleased/dhcpleased.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dhcpleased.c,v 1.29 2023/02/15 13:47:00 florian Exp $	*/
+/*	$OpenBSD: dhcpleased.c,v 1.30 2023/10/10 16:09:53 florian Exp $	*/
 
 /*
  * Copyright (c) 2017, 2021 Florian Obser <florian@openbsd.org>
@@ -601,7 +601,7 @@ main_dispatch_engine(int fd, short event, void *bula)
 		case IMSG_WITHDRAW_RDNS: {
 			struct imsg_propose_rdns	 rdns;
 			if (IMSG_DATA_SIZE(imsg) != sizeof(rdns))
-				fatalx("%s: IMSG_PROPOSE_RDNS wrong "
+				fatalx("%s: IMSG_WITHDRAW_RDNS wrong "
 				    "length: %lu", __func__,
 				    IMSG_DATA_SIZE(imsg));
 			memcpy(&rdns, imsg.data, sizeof(rdns));
@@ -1197,7 +1197,7 @@ propose_rdns(struct imsg_propose_rdns *rdns)
 	memset(&rtdns, 0, sizeof(rtdns));
 	rtdns.sr_family = AF_INET;
 	rtdns.sr_len = 2 + rdns->rdns_count * sizeof(struct in_addr);
-	memcpy(rtdns.sr_dns, rdns->rdns, sizeof(rtdns.sr_dns));
+	memcpy(rtdns.sr_dns, rdns->rdns, rtdns.sr_len - 2);
 
 	iov[iovcnt].iov_base = &rtdns;
 	iov[iovcnt++].iov_len = sizeof(rtdns);
diff --git a/sbin/ipsecctl/pfkdump.c b/sbin/ipsecctl/pfkdump.c
index 9bd728398..60da11b65 100644
--- a/sbin/ipsecctl/pfkdump.c
+++ b/sbin/ipsecctl/pfkdump.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfkdump.c,v 1.57 2023/08/07 04:10:08 dlg Exp $	*/
+/*	$OpenBSD: pfkdump.c,v 1.58 2023/10/10 16:16:16 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2003 Markus Friedl.  All rights reserved.
@@ -406,9 +406,11 @@ print_tag(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
 {
 	struct sadb_x_tag *stag = (struct sadb_x_tag *)ext;
 	char *p;
+	int plen;
 
 	p = (char *)(stag + 1);
-	printf("%s", p);
+	plen = stag->sadb_x_tag_len * 8 - sizeof(*stag);
+	printf("%.*s", plen, p);
 }
 
 static void
@@ -590,10 +592,12 @@ static void
 print_ident(struct sadb_ext *ext, struct sadb_msg *msg, int opts)
 {
 	struct sadb_ident *ident = (struct sadb_ident *)ext;
+	int ilen;
 
-	printf("type %s id %llu: %s",
+	ilen = ident->sadb_ident_len * 8 - sizeof(*ident);
+	printf("type %s id %llu: %.*s",
 	    lookup_name(identity_types, ident->sadb_ident_type),
-	    ident->sadb_ident_id, (char *)(ident + 1));
+	    ident->sadb_ident_id, ilen, (char *)(ident + 1));
 }
 
 static void
diff --git a/sys/arch/armv7/vexpress/pciecam.c b/sys/arch/armv7/vexpress/pciecam.c
index 63d58134e..c011a4e08 100644
--- a/sys/arch/armv7/vexpress/pciecam.c
+++ b/sys/arch/armv7/vexpress/pciecam.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pciecam.c,v 1.5 2021/10/24 17:52:28 mpi Exp $ */
+/* $OpenBSD: pciecam.c,v 1.6 2023/10/10 18:40:34 miod Exp $ */
 /*
  * Copyright (c) 2013,2017 Patrick Wildt <patrick@blueri.se>
  *
@@ -28,6 +28,7 @@
 #include <dev/pci/pcivar.h>
 
 #include <dev/ofw/fdt.h>
+#include <dev/ofw/ofw_pci.h>
 #include <dev/ofw/openfirm.h>
 
 /* Assembling ECAM Configuration Address */
@@ -195,14 +196,21 @@ pciecam_attach(struct device *parent, struct device *self, void *aux)
 	    M_DEVBUF, NULL, 0, EX_NOWAIT | EX_FILLED);
 
 	for (i = 0; i < nranges; i++) {
-		if (sc->sc_pciranges[i].flags >> 24 == 0)
-			continue;
-		if (sc->sc_pciranges[i].flags >> 24 == 1)
+		switch (sc->sc_pciranges[i].flags & OFW_PCI_PHYS_HI_SPACEMASK) {
+		case OFW_PCI_PHYS_HI_SPACE_IO:
 			extent_free(sc->sc_ioex, sc->sc_pciranges[i].pci_base,
 			    sc->sc_pciranges[i].size, EX_NOWAIT);
-		else
+			break;
+		case OFW_PCI_PHYS_HI_SPACE_MEM64:
+			if (sc->sc_pciranges[i].pci_base +
+			    sc->sc_pciranges[i].size >= (1ULL << 32))
+				break;
+			/* FALLTHROUGH */
+		case OFW_PCI_PHYS_HI_SPACE_MEM32:
 			extent_free(sc->sc_memex, sc->sc_pciranges[i].pci_base,
 			    sc->sc_pciranges[i].size, EX_NOWAIT);
+			break;
+		}
 	}
 
 	memcpy(&sc->sc_bus, sc->sc_iot, sizeof(sc->sc_bus));
diff --git a/sys/dev/fdt/if_dwqe_fdt.c b/sys/dev/fdt/if_dwqe_fdt.c
index 7a43333f6..7e6afaba3 100644
--- a/sys/dev/fdt/if_dwqe_fdt.c
+++ b/sys/dev/fdt/if_dwqe_fdt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_dwqe_fdt.c,v 1.16 2023/10/09 14:25:00 stsp Exp $	*/
+/*	$OpenBSD: if_dwqe_fdt.c,v 1.17 2023/10/10 07:11:50 stsp Exp $	*/
 /*
  * Copyright (c) 2008, 2019 Mark Kettenis <kettenis@openbsd.org>
  * Copyright (c) 2017, 2022 Patrick Wildt <patrick@blueri.se>
@@ -193,18 +193,18 @@ dwqe_fdt_attach(struct device *parent, struct device *self, void *aux)
 		    LINK_STATE_FULL_DUPLEX : LINK_STATE_HALF_DUPLEX;
 	}
 
-	sc->sc_clk = clock_get_frequency(faa->fa_node, "stmmaceth");
-	if (sc->sc_clk > 500000000)
+	sc->sc_clkrate = clock_get_frequency(faa->fa_node, "stmmaceth");
+	if (sc->sc_clkrate > 500000000)
 		sc->sc_clk = GMAC_MAC_MDIO_ADDR_CR_500_800;
-	else if (sc->sc_clk > 300000000)
+	else if (sc->sc_clkrate > 300000000)
 		sc->sc_clk = GMAC_MAC_MDIO_ADDR_CR_300_500;
-	else if (sc->sc_clk > 150000000)
+	else if (sc->sc_clkrate > 150000000)
 		sc->sc_clk = GMAC_MAC_MDIO_ADDR_CR_150_250;
-	else if (sc->sc_clk > 100000000)
+	else if (sc->sc_clkrate > 100000000)
 		sc->sc_clk = GMAC_MAC_MDIO_ADDR_CR_100_150;
-	else if (sc->sc_clk > 60000000)
+	else if (sc->sc_clkrate > 60000000)
 		sc->sc_clk = GMAC_MAC_MDIO_ADDR_CR_60_100;
-	else if (sc->sc_clk > 35000000)
+	else if (sc->sc_clkrate > 35000000)
 		sc->sc_clk = GMAC_MAC_MDIO_ADDR_CR_35_60;
 	else
 		sc->sc_clk = GMAC_MAC_MDIO_ADDR_CR_20_35;
diff --git a/sys/dev/ic/dwqe.c b/sys/dev/ic/dwqe.c
index 9880d5e7f..7d260ef46 100644
--- a/sys/dev/ic/dwqe.c
+++ b/sys/dev/ic/dwqe.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dwqe.c,v 1.12 2023/10/09 14:25:00 stsp Exp $	*/
+/*	$OpenBSD: dwqe.c,v 1.13 2023/10/10 07:11:50 stsp Exp $	*/
 /*
  * Copyright (c) 2008, 2019 Mark Kettenis <kettenis@openbsd.org>
  * Copyright (c) 2017, 2022 Patrick Wildt <patrick@blueri.se>
@@ -772,7 +772,7 @@ dwqe_up(struct dwqe_softc *sc)
 	ifp->if_flags |= IFF_RUNNING;
 	ifq_clr_oactive(&ifp->if_snd);
 
-	dwqe_write(sc, GMAC_MAC_1US_TIC_CTR, (sc->sc_clk / 1000000) - 1);
+	dwqe_write(sc, GMAC_MAC_1US_TIC_CTR, (sc->sc_clkrate / 1000000) - 1);
 
 	/* Start receive DMA */
 	reg = dwqe_read(sc, GMAC_CHAN_RX_CONTROL(0));
diff --git a/sys/dev/ic/dwqereg.h b/sys/dev/ic/dwqereg.h
index d35a81157..70954d471 100644
--- a/sys/dev/ic/dwqereg.h
+++ b/sys/dev/ic/dwqereg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dwqereg.h,v 1.2 2023/02/16 14:43:53 kettenis Exp $	*/
+/*	$OpenBSD: dwqereg.h,v 1.3 2023/10/10 19:06:42 kettenis Exp $	*/
 /*
  * Copyright (c) 2008, 2019 Mark Kettenis <kettenis@openbsd.org>
  * Copyright (c) 2017, 2022 Patrick Wildt <patrick@blueri.se>
@@ -39,8 +39,6 @@
 #define  GMAC_MAC_PACKET_FILTER_PR	(1 << 0)
 #define GMAC_MAC_HASH_TAB_REG0	0x0010
 #define GMAC_MAC_HASH_TAB_REG1	0x0014
-#define GMAC_VERSION		0x0020
-#define  GMAC_VERSION_SNPS_MASK		0xff
 #define GMAC_INT_MASK		0x003c
 #define  GMAC_INT_MASK_LPIIM		(1 << 10)
 #define  GMAC_INT_MASK_PIM		(1 << 3)
@@ -60,6 +58,8 @@
 #define GMAC_INT_STATUS		0x00b0
 #define GMAC_INT_EN		0x00b4
 #define GMAC_MAC_1US_TIC_CTR	0x00dc
+#define GMAC_VERSION		0x0110
+#define  GMAC_VERSION_SNPS_MASK		0xff
 #define GMAC_MAC_HW_FEATURE(x)	(0x011c + (x) * 0x4)
 #define  GMAC_MAC_HW_FEATURE1_TXFIFOSIZE(x) (((x) >> 6) & 0x1f)
 #define  GMAC_MAC_HW_FEATURE1_RXFIFOSIZE(x) (((x) >> 0) & 0x3f)
diff --git a/sys/dev/ic/dwqevar.h b/sys/dev/ic/dwqevar.h
index f703cfda1..68d698a50 100644
--- a/sys/dev/ic/dwqevar.h
+++ b/sys/dev/ic/dwqevar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dwqevar.h,v 1.7 2023/10/09 14:25:00 stsp Exp $	*/
+/*	$OpenBSD: dwqevar.h,v 1.8 2023/10/10 07:11:50 stsp Exp $	*/
 /*
  * Copyright (c) 2008, 2019 Mark Kettenis <kettenis@openbsd.org>
  * Copyright (c) 2017, 2022 Patrick Wildt <patrick@blueri.se>
@@ -80,6 +80,7 @@ struct dwqe_softc {
 	struct task		sc_statchg_task;
 
 	uint32_t		sc_clk;
+	uint32_t		sc_clkrate;
 
 	bus_size_t		sc_clk_sel;
 	uint32_t		sc_clk_sel_125;
diff --git a/sys/kern/kern_clockintr.c b/sys/kern/kern_clockintr.c
index 712ddfbdb..834775b11 100644
--- a/sys/kern/kern_clockintr.c
+++ b/sys/kern/kern_clockintr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kern_clockintr.c,v 1.59 2023/10/08 21:08:00 cheloha Exp $ */
+/* $OpenBSD: kern_clockintr.c,v 1.60 2023/10/11 00:02:25 cheloha Exp $ */
 /*
  * Copyright (c) 2003 Dale Rahn <drahn@openbsd.org>
  * Copyright (c) 2020 Mark Kettenis <kettenis@openbsd.org>
@@ -390,17 +390,17 @@ clockintr_schedule_locked(struct clockintr *cl, uint64_t expiration)
 }
 
 void
-clockintr_stagger(struct clockintr *cl, uint64_t period, uint32_t n,
-    uint32_t count)
+clockintr_stagger(struct clockintr *cl, uint64_t period, uint32_t numer,
+    uint32_t denom)
 {
 	struct clockintr_queue *cq = cl->cl_queue;
 
-	KASSERT(n < count);
+	KASSERT(numer < denom);
 
 	mtx_enter(&cq->cq_mtx);
 	if (ISSET(cl->cl_flags, CLST_PENDING))
 		panic("%s: clock interrupt pending", __func__);
-	cl->cl_expiration = period / count * n;
+	cl->cl_expiration = period / denom * numer;
 	mtx_leave(&cq->cq_mtx);
 }
 
diff --git a/sys/net/pf.c b/sys/net/pf.c
index 55fab0b2a..1ebe7149d 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf.c,v 1.1186 2023/09/08 13:40:52 naddy Exp $ */
+/*	$OpenBSD: pf.c,v 1.1188 2023/10/10 16:26:06 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -3201,7 +3201,7 @@ pf_modulate_sack(struct pf_pdesc *pd, struct pf_state_peer *dst)
 	optsoff = pd->off + sizeof(struct tcphdr);
 #define TCPOLEN_MINSACK	(TCPOLEN_SACK + 2)
 	if (olen < TCPOLEN_MINSACK ||
-	    !pf_pull_hdr(pd->m, optsoff, opts, olen, NULL, NULL, pd->af))
+	    !pf_pull_hdr(pd->m, optsoff, opts, olen, NULL, pd->af))
 		return (0);
 
 	eoh = opts + olen;
@@ -3871,7 +3871,7 @@ pf_get_wscale(struct pf_pdesc *pd)
 
 	olen = (pd->hdr.tcp.th_off << 2) - sizeof(struct tcphdr);
 	if (olen < TCPOLEN_WINDOW || !pf_pull_hdr(pd->m,
-	    pd->off + sizeof(struct tcphdr), opts, olen, NULL, NULL, pd->af))
+	    pd->off + sizeof(struct tcphdr), opts, olen, NULL, pd->af))
 		return (0);
 
 	opt = opts;
@@ -3896,7 +3896,7 @@ pf_get_mss(struct pf_pdesc *pd)
 
 	olen = (pd->hdr.tcp.th_off << 2) - sizeof(struct tcphdr);
 	if (olen < TCPOLEN_MAXSEG || !pf_pull_hdr(pd->m,
-	    pd->off + sizeof(struct tcphdr), opts, olen, NULL, NULL, pd->af))
+	    pd->off + sizeof(struct tcphdr), opts, olen, NULL, pd->af))
 		return (0);
 
 	opt = opts;
@@ -4467,8 +4467,6 @@ pf_test_rule(struct pf_pdesc *pd, struct pf_rule **rm, struct pf_state **sm,
 		goto cleanup;
 	}
 
-	action = PF_PASS;
-
 	if (pd->virtual_proto != PF_VPROTO_FRAGMENT
 	    && !ctx.state_icmp && r->keep_state) {
 
@@ -4511,6 +4509,8 @@ pf_test_rule(struct pf_pdesc *pd, struct pf_rule **rm, struct pf_state **sm,
 #endif /* INET6 */
 
 	} else {
+		action = PF_PASS;
+
 		while ((ctx.ri = SLIST_FIRST(&ctx.rules))) {
 			SLIST_REMOVE_HEAD(&ctx.rules, entry);
 			pool_put(&pf_rule_item_pl, ctx.ri);
@@ -5691,7 +5691,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
 			ipoff2 = pd->off + ICMP_MINLEN;
 
 			if (!pf_pull_hdr(pd2.m, ipoff2, &h2, sizeof(h2),
-			    NULL, reason, pd2.af)) {
+			    reason, pd2.af)) {
 				DPFPRINTF(LOG_NOTICE,
 				    "ICMP error message too short (ip)");
 				return (PF_DROP);
@@ -5719,7 +5719,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
 			ipoff2 = pd->off + sizeof(struct icmp6_hdr);
 
 			if (!pf_pull_hdr(pd2.m, ipoff2, &h2_6, sizeof(h2_6),
-			    NULL, reason, pd2.af)) {
+			    reason, pd2.af)) {
 				DPFPRINTF(LOG_NOTICE,
 				    "ICMP error message too short (ip6)");
 				return (PF_DROP);
@@ -5770,7 +5770,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
 			 * expected. Don't access any TCP header fields after
 			 * th_seq, an ackskew test is not possible.
 			 */
-			if (!pf_pull_hdr(pd2.m, pd2.off, th, 8, NULL, reason,
+			if (!pf_pull_hdr(pd2.m, pd2.off, th, 8, reason,
 			    pd2.af)) {
 				DPFPRINTF(LOG_NOTICE,
 				    "ICMP error message too short (tcp)");
@@ -5951,7 +5951,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
 			int		 action;
 
 			if (!pf_pull_hdr(pd2.m, pd2.off, uh, sizeof(*uh),
-			    NULL, reason, pd2.af)) {
+			    reason, pd2.af)) {
 				DPFPRINTF(LOG_NOTICE,
 				    "ICMP error message too short (udp)");
 				return (PF_DROP);
@@ -6079,7 +6079,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
 			}
 
 			if (!pf_pull_hdr(pd2.m, pd2.off, iih, ICMP_MINLEN,
-			    NULL, reason, pd2.af)) {
+			    reason, pd2.af)) {
 				DPFPRINTF(LOG_NOTICE,
 				    "ICMP error message too short (icmp)");
 				return (PF_DROP);
@@ -6185,7 +6185,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
 			}
 
 			if (!pf_pull_hdr(pd2.m, pd2.off, iih,
-			    sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) {
+			    sizeof(struct icmp6_hdr), reason, pd2.af)) {
 				DPFPRINTF(LOG_NOTICE,
 				    "ICMP error message too short (icmp6)");
 				return (PF_DROP);
@@ -6364,7 +6364,7 @@ pf_test_state_icmp(struct pf_pdesc *pd, struct pf_state **stp,
  */
 void *
 pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
-    u_short *actionp, u_short *reasonp, sa_family_t af)
+    u_short *reasonp, sa_family_t af)
 {
 	int iplen = 0;
 
@@ -6374,12 +6374,7 @@ pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
 		u_int16_t	 fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
 
 		if (fragoff) {
-			if (fragoff >= len)
-				ACTION_SET(actionp, PF_PASS);
-			else {
-				ACTION_SET(actionp, PF_DROP);
-				REASON_SET(reasonp, PFRES_FRAG);
-			}
+			REASON_SET(reasonp, PFRES_FRAG);
 			return (NULL);
 		}
 		iplen = ntohs(h->ip_len);
@@ -6395,7 +6390,6 @@ pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
 #endif /* INET6 */
 	}
 	if (m->m_pkthdr.len < off + len || iplen < off + len) {
-		ACTION_SET(actionp, PF_DROP);
 		REASON_SET(reasonp, PFRES_SHORT);
 		return (NULL);
 	}
@@ -6949,7 +6943,7 @@ pf_walk_header(struct pf_pdesc *pd, struct ip *h, u_short *reason)
 			    end < pd->off + sizeof(ext))
 				return (PF_PASS);
 			if (!pf_pull_hdr(pd->m, pd->off, &ext, sizeof(ext),
-			    NULL, reason, AF_INET)) {
+			    reason, AF_INET)) {
 				DPFPRINTF(LOG_NOTICE, "IP short exthdr");
 				return (PF_DROP);
 			}
@@ -6975,7 +6969,7 @@ pf_walk_option6(struct pf_pdesc *pd, struct ip6_hdr *h, int off, int end,
 
 	while (off < end) {
 		if (!pf_pull_hdr(pd->m, off, &opt.ip6o_type,
-		    sizeof(opt.ip6o_type), NULL, reason, AF_INET6)) {
+		    sizeof(opt.ip6o_type), reason, AF_INET6)) {
 			DPFPRINTF(LOG_NOTICE, "IPv6 short opt type");
 			return (PF_DROP);
 		}
@@ -6984,7 +6978,7 @@ pf_walk_option6(struct pf_pdesc *pd, struct ip6_hdr *h, int off, int end,
 			continue;
 		}
 		if (!pf_pull_hdr(pd->m, off, &opt, sizeof(opt),
-		    NULL, reason, AF_INET6)) {
+		    reason, AF_INET6)) {
 			DPFPRINTF(LOG_NOTICE, "IPv6 short opt");
 			return (PF_DROP);
 		}
@@ -7009,7 +7003,7 @@ pf_walk_option6(struct pf_pdesc *pd, struct ip6_hdr *h, int off, int end,
 				return (PF_DROP);
 			}
 			if (!pf_pull_hdr(pd->m, off, &jumbo, sizeof(jumbo),
-			    NULL, reason, AF_INET6)) {
+			    reason, AF_INET6)) {
 				DPFPRINTF(LOG_NOTICE, "IPv6 short jumbo");
 				return (PF_DROP);
 			}
@@ -7058,7 +7052,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason)
 			break;
 		case IPPROTO_HOPOPTS:
 			if (!pf_pull_hdr(pd->m, pd->off, &ext, sizeof(ext),
-			    NULL, reason, AF_INET6)) {
+			    reason, AF_INET6)) {
 				DPFPRINTF(LOG_NOTICE, "IPv6 short exthdr");
 				return (PF_DROP);
 			}
@@ -7085,7 +7079,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason)
 				return (PF_DROP);
 			}
 			if (!pf_pull_hdr(pd->m, pd->off, &frag, sizeof(frag),
-			    NULL, reason, AF_INET6)) {
+			    reason, AF_INET6)) {
 				DPFPRINTF(LOG_NOTICE, "IPv6 short fragment");
 				return (PF_DROP);
 			}
@@ -7113,7 +7107,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason)
 				return (PF_PASS);
 			}
 			if (!pf_pull_hdr(pd->m, pd->off, &rthdr, sizeof(rthdr),
-			    NULL, reason, AF_INET6)) {
+			    reason, AF_INET6)) {
 				DPFPRINTF(LOG_NOTICE, "IPv6 short rthdr");
 				return (PF_DROP);
 			}
@@ -7140,7 +7134,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason)
 				return (PF_PASS);
 			}
 			if (!pf_pull_hdr(pd->m, pd->off, &ext, sizeof(ext),
-			    NULL, reason, AF_INET6)) {
+			    reason, AF_INET6)) {
 				DPFPRINTF(LOG_NOTICE, "IPv6 short exthdr");
 				return (PF_DROP);
 			}
@@ -7167,7 +7161,7 @@ pf_walk_header6(struct pf_pdesc *pd, struct ip6_hdr *h, u_short *reason)
 				return (PF_PASS);
 			}
 			if (!pf_pull_hdr(pd->m, pd->off, &icmp6, sizeof(icmp6),
-			    NULL, reason, AF_INET6)) {
+			    reason, AF_INET6)) {
 				DPFPRINTF(LOG_NOTICE, "IPv6 short icmp6hdr");
 				return (PF_DROP);
 			}
@@ -7338,7 +7332,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
 		struct tcphdr	*th = &pd->hdr.tcp;
 
 		if (!pf_pull_hdr(pd->m, pd->off, th, sizeof(*th),
-		    NULL, reason, pd->af))
+		    reason, pd->af))
 			return (PF_DROP);
 		pd->hdrlen = sizeof(*th);
 		if (th->th_dport == 0 ||
@@ -7357,7 +7351,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
 		struct udphdr	*uh = &pd->hdr.udp;
 
 		if (!pf_pull_hdr(pd->m, pd->off, uh, sizeof(*uh),
-		    NULL, reason, pd->af))
+		    reason, pd->af))
 			return (PF_DROP);
 		pd->hdrlen = sizeof(*uh);
 		if (uh->uh_dport == 0 ||
@@ -7373,7 +7367,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
 	}
 	case IPPROTO_ICMP: {
 		if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp, ICMP_MINLEN,
-		    NULL, reason, pd->af))
+		    reason, pd->af))
 			return (PF_DROP);
 		pd->hdrlen = ICMP_MINLEN;
 		if (pd->off + pd->hdrlen > pd->tot_len) {
@@ -7388,7 +7382,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
 		size_t	icmp_hlen = sizeof(struct icmp6_hdr);
 
 		if (!pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp6, icmp_hlen,
-		    NULL, reason, pd->af))
+		    reason, pd->af))
 			return (PF_DROP);
 		/* ICMP headers we look further into to match state */
 		switch (pd->hdr.icmp6.icmp6_type) {
@@ -7411,7 +7405,7 @@ pf_setup_pdesc(struct pf_pdesc *pd, sa_family_t af, int dir,
 		}
 		if (icmp_hlen > sizeof(struct icmp6_hdr) &&
 		    !pf_pull_hdr(pd->m, pd->off, &pd->hdr.icmp6, icmp_hlen,
-		    NULL, reason, pd->af))
+		    reason, pd->af))
 			return (PF_DROP);
 		pd->hdrlen = icmp_hlen;
 		if (pd->off + pd->hdrlen > pd->tot_len) {
diff --git a/sys/net/pf_norm.c b/sys/net/pf_norm.c
index ef2c88491..fde4a21f0 100644
--- a/sys/net/pf_norm.c
+++ b/sys/net/pf_norm.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf_norm.c,v 1.228 2023/07/06 04:55:05 dlg Exp $ */
+/*	$OpenBSD: pf_norm.c,v 1.229 2023/10/10 11:25:31 bluhm Exp $ */
 
 /*
  * Copyright 2001 Niels Provos <provos@citi.umich.edu>
@@ -1075,7 +1075,7 @@ pf_normalize_ip6(struct pf_pdesc *pd, u_short *reason)
 	if (pd->fragoff == 0)
 		goto no_fragment;
 
-	if (!pf_pull_hdr(pd->m, pd->fragoff, &frag, sizeof(frag), NULL, reason,
+	if (!pf_pull_hdr(pd->m, pd->fragoff, &frag, sizeof(frag), reason,
 	    AF_INET6))
 		return (PF_DROP);
 
@@ -1216,7 +1216,7 @@ pf_normalize_tcp_init(struct pf_pdesc *pd, struct pf_state_peer *src)
 
 	olen = (th->th_off << 2) - sizeof(*th);
 	if (olen < TCPOLEN_TIMESTAMP || !pf_pull_hdr(pd->m,
-	    pd->off + sizeof(*th), opts, olen, NULL, NULL, pd->af))
+	    pd->off + sizeof(*th), opts, olen, NULL, pd->af))
 		return (0);
 
 	opt = opts;
@@ -1299,7 +1299,7 @@ pf_normalize_tcp_stateful(struct pf_pdesc *pd, u_short *reason,
 	if (olen >= TCPOLEN_TIMESTAMP &&
 	    ((src->scrub && (src->scrub->pfss_flags & PFSS_TIMESTAMP)) ||
 	    (dst->scrub && (dst->scrub->pfss_flags & PFSS_TIMESTAMP))) &&
-	    pf_pull_hdr(pd->m, pd->off + sizeof(*th), opts, olen, NULL, NULL,
+	    pf_pull_hdr(pd->m, pd->off + sizeof(*th), opts, olen, NULL,
 	    pd->af)) {
 
 		/* Modulate the timestamps.  Can be used for NAT detection, OS
@@ -1633,7 +1633,7 @@ pf_normalize_mss(struct pf_pdesc *pd, u_int16_t maxmss)
 	olen = (pd->hdr.tcp.th_off << 2) - sizeof(struct tcphdr);
 	optsoff = pd->off + sizeof(struct tcphdr);
 	if (olen < TCPOLEN_MAXSEG ||
-	    !pf_pull_hdr(pd->m, optsoff, opts, olen, NULL, NULL, pd->af))
+	    !pf_pull_hdr(pd->m, optsoff, opts, olen, NULL, pd->af))
 		return (0);
 
 	opt = opts;
diff --git a/sys/net/pf_osfp.c b/sys/net/pf_osfp.c
index 247d87600..c2a406c32 100644
--- a/sys/net/pf_osfp.c
+++ b/sys/net/pf_osfp.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf_osfp.c,v 1.46 2023/05/07 12:45:21 kn Exp $ */
+/*	$OpenBSD: pf_osfp.c,v 1.47 2023/10/10 11:25:31 bluhm Exp $ */
 
 /*
  * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
@@ -111,8 +111,7 @@ pf_osfp_fingerprint(struct pf_pdesc *pd)
 		ip6 = mtod(pd->m, struct ip6_hdr *);
 		break;
 	}
-	if (!pf_pull_hdr(pd->m, pd->off, hdr, th->th_off << 2, NULL, NULL,
-	    pd->af))
+	if (!pf_pull_hdr(pd->m, pd->off, hdr, th->th_off << 2, NULL, pd->af))
 		return (NULL);
 
 	return (pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)hdr));
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index 27cce82bd..b8f1286e6 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfvar.h,v 1.533 2023/07/06 04:55:05 dlg Exp $ */
+/*	$OpenBSD: pfvar.h,v 1.534 2023/10/10 11:25:31 bluhm Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -1192,12 +1192,6 @@ enum pfi_kif_refs {
 #define SCNT_SRC_NODE_REMOVALS	2
 #define SCNT_MAX		3
 
-#define ACTION_SET(a, x) \
-	do { \
-		if ((a) != NULL) \
-			*(a) = (x); \
-	} while (0)
-
 #define REASON_SET(a, x) \
 	do { \
 		if ((void *)(a) != NULL) { \
@@ -1649,8 +1643,7 @@ void	pf_poolmask(struct pf_addr *, struct pf_addr*,
 	    struct pf_addr *, struct pf_addr *, sa_family_t);
 void	pf_addr_inc(struct pf_addr *, sa_family_t);
 
-void   *pf_pull_hdr(struct mbuf *, int, void *, int, u_short *, u_short *,
-	    sa_family_t);
+void   *pf_pull_hdr(struct mbuf *, int, void *, int, u_short *, sa_family_t);
 #define PF_HI (true)
 #define PF_LO (!PF_HI)
 #define PF_ALGNMNT(off) (((off) % 2) == 0 ? PF_HI : PF_LO)
diff --git a/usr.bin/ssh/cipher.c b/usr.bin/ssh/cipher.c
index c7664a3ef..28a7f7bd9 100644
--- a/usr.bin/ssh/cipher.c
+++ b/usr.bin/ssh/cipher.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher.c,v 1.119 2021/04/03 06:18:40 djm Exp $ */
+/* $OpenBSD: cipher.c,v 1.120 2023/10/10 06:49:54 tb Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -428,27 +428,6 @@ cipher_free(struct sshcipher_ctx *cc)
 	freezero(cc, sizeof(*cc));
 }
 
-/*
- * Exports an IV from the sshcipher_ctx required to export the key
- * state back from the unprivileged child to the privileged parent
- * process.
- */
-int
-cipher_get_keyiv_len(const struct sshcipher_ctx *cc)
-{
-	const struct sshcipher *c = cc->cipher;
-
-	if ((c->flags & CFLAG_CHACHAPOLY) != 0)
-		return 0;
-	else if ((c->flags & CFLAG_AESCTR) != 0)
-		return sizeof(cc->ac_ctx.ctr);
-#ifdef WITH_OPENSSL
-	return EVP_CIPHER_CTX_iv_length(cc->evp);
-#else
-	return 0;
-#endif
-}
-
 int
 cipher_get_keyiv(struct sshcipher_ctx *cc, u_char *iv, size_t len)
 {
diff --git a/usr.bin/ssh/cipher.h b/usr.bin/ssh/cipher.h
index 1a591cd7f..6533ff2bb 100644
--- a/usr.bin/ssh/cipher.h
+++ b/usr.bin/ssh/cipher.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: cipher.h,v 1.55 2020/01/23 10:24:29 dtucker Exp $ */
+/* $OpenBSD: cipher.h,v 1.56 2023/10/10 06:49:54 tb Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -73,6 +73,5 @@ u_int	 cipher_ctx_is_plaintext(struct sshcipher_ctx *);
 
 int	 cipher_get_keyiv(struct sshcipher_ctx *, u_char *, size_t);
 int	 cipher_set_keyiv(struct sshcipher_ctx *, const u_char *, size_t);
-int	 cipher_get_keyiv_len(const struct sshcipher_ctx *);
 
 #endif				/* CIPHER_H */
diff --git a/usr.bin/ssh/ssh2.h b/usr.bin/ssh/ssh2.h
index 0d48d0527..836eeda7c 100644
--- a/usr.bin/ssh/ssh2.h
+++ b/usr.bin/ssh/ssh2.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh2.h,v 1.21 2023/08/28 03:28:43 djm Exp $ */
+/* $OpenBSD: ssh2.h,v 1.22 2023/10/10 03:57:45 djm Exp $ */
 
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -53,6 +53,7 @@
  *   Local extensions:
  *
  *     192-255  Local extensions
+ *     248-255  Local extensions (OpenSSH will never use numbers in this range)
  */
 
 /* special marker for no message */
diff --git a/usr.bin/systat/engine.c b/usr.bin/systat/engine.c
index 84d314653..1abebbdbb 100644
--- a/usr.bin/systat/engine.c
+++ b/usr.bin/systat/engine.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: engine.c,v 1.29 2021/07/02 15:34:16 millert Exp $	 */
+/* $OpenBSD: engine.c,v 1.30 2023/10/10 09:30:06 tb Exp $	 */
 /*
  * Copyright (c) 2001, 2007 Can Erkin Acar <canacar@openbsd.org>
  *
@@ -122,7 +122,6 @@ tb_end(void)
 
 int
 tbprintf(char *format, ...)
-	GCC_PRINTFLIKE(1,2)       /* defined in curses.h */
 {
 	int len;
 	va_list arg;
@@ -146,7 +145,6 @@ tbprintf(char *format, ...)
 
 int
 tbprintft(char *format, ...)
-	GCC_PRINTFLIKE(1,2)       /* defined in curses.h */
 {
 	int len;
 	va_list arg;
diff --git a/usr.bin/systat/netstat.c b/usr.bin/systat/netstat.c
index 289e1386c..e0117ddcd 100644
--- a/usr.bin/systat/netstat.c
+++ b/usr.bin/systat/netstat.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: netstat.c,v 1.45 2015/03/12 01:03:00 claudio Exp $	*/
+/*	$OpenBSD: netstat.c,v 1.46 2023/10/10 09:27:03 tb Exp $	*/
 /*	$NetBSD: netstat.c,v 1.3 1995/06/18 23:53:07 cgd Exp $	*/
 
 /*-
@@ -388,7 +388,7 @@ shownetstat(struct netinfo *p)
 	switch (p->nif_proto) {
 	case IPPROTO_TCP:
 	case IPPROTO_UDP:
-		tbprintf(proto);
+		tbprintf("%s", proto);
 		if (p->nif_family == AF_INET6)
 			tbprintf("6");
 		break;
diff --git a/usr.sbin/bgpd/rde_community.c b/usr.sbin/bgpd/rde_community.c
index d7a8717f4..803a374e8 100644
--- a/usr.sbin/bgpd/rde_community.c
+++ b/usr.sbin/bgpd/rde_community.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rde_community.c,v 1.13 2023/07/12 14:45:43 claudio Exp $ */
+/*	$OpenBSD: rde_community.c,v 1.14 2023/10/10 14:36:28 claudio Exp $ */
 
 /*
  * Copyright (c) 2019 Claudio Jeker <claudio@openbsd.org>
@@ -556,10 +556,9 @@ community_writebuf(struct rde_community *comm, uint8_t type, int ebgp,
 	start = -1;
 	for (l = 0; l < comm->nentries; l++) {
 		cp = &comm->communities[l];
-
-		if (ebgp && non_transitive_ext_community(cp))
-			continue;
 		if ((uint8_t)cp->flags == t) {
+			if (ebgp && non_transitive_ext_community(cp))
+				continue;
 			num++;
 			if (start == -1)
 				start = l;