Approved by:	so

In the ISO2022-CN encoding, characters may require at least seven bytes,
and MB_LEN_MAX==6 is insufficient.  From code inspection,
_ISO2022_sputwchar() can emit 10 bytes in the worst case, so use that to
size buffers.

Add a regression test.

Approved by:	so
Security:	FreeBSD-SA-26:49.iconv
Security:	CVE-2026-58082
Reviewed by:	kevans
Differential Revision:	https://reviews.freebsd.org/D57950

wcrtomb may store up to 2 2-byte escape sequences to the state buffer in
addition to the character itself.  In the worst case, a 3-byte heap
overflow is possible.

Approved by:	so
Security:	FreeBSD-SA-26:49.iconv
Security:	CVE-2026-58081
Reviewed by:	kevans
Differential Revision:	https://reviews.freebsd.org/D57949

Based on a report by Nick Wellnhofer.

Approved by:	so
Security:	FreeBSD-SA-26:49.iconv
Reviewed by:	markj, kevans
Differential Revision:	https://reviews.freebsd.org/D57948

Fix null pointer dereference with HZ8 encoding.

Fix output buffer overrun in UTF-7, VIQR, ZW encodings.

Approved by:	so
Security:	FreeBSD-SA-26:49.iconv
Security:	CVE-2026-58081
Reviewed by:	markj, kevans
Differential Revision:	https://reviews.freebsd.org/D57947

Approved by:	so
Security:	FreeBSD-SA-26:48.compat32
Security:	CVE-2026-49425
Reported by:	Adam Crosser, Praetorian
Reviewed by:	philip
Sponsored by:	The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55811

(cherry picked from commit 097cb4e9f0432c543c704cec712ce1cd3302335c)
(cherry picked from commit 4551ea3b3f04650cd5300a9eae8994bdb080db91)

Approved by:	so
Security:	FreeBSD-SA-26:47.linux
Security:	CVE-2026-49424
Reported by:	Adam Crosser, Praetorian
Reviewed by:	philip
Sponsored by:	The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D55812

(cherry picked from commit 9a9f93bcf1aa0059d759b2f3ea6faeb2760a11bd)
(cherry picked from commit 9f8db9cc67fb86eeb2b645ce7f8aa748e99241a9)

If an mbuf in the chain was skipped because it only contained bytes
from the header, the iovec index ('i') was incremented even though the
entry was not populated.  Only increment 'i' when an iovec entry is
consumed.

Add a new type of KTLS receive test which writes a single TLS record
via two separate write(2) calls over a TCP_NODELAY socket to trigger
a split in the mbuf chain in the kernel.  Test various split locations
including after the "plain" TLS header (5 bytes), after the full TLS
header, in the middle of the data payload, just before the start of
the trailer, and in the middle of the trailer.  These tests are also
run against all supported ciphers, not just CBC.  The 'header' test
for CBC ciphersuites was able to trigger the bug.

Approved by:	so
Security:	FreeBSD-SA-26:46.ktls
Security:	CVE-2026-49423
Sponsored by:	Chelsio Communications

`error` here is the return value of syscall_thread_enter() rather than
the syscall itself, so the committed audit records do not reflect
reality.  This is less harmful than them recording an error when the
operation actually succeeded, but it could still possibly be used to
throw off IDS techniques with things like bsmtrace.

Approved by:	so
Security:	FreeBSD-SA-26:45.audit
Security:	CVE-2026-49426
Reviewed by:	des, kib, markj, csjp
Differential Revision:	https://reviews.freebsd.org/D57847

sendfile(2) can transmit POSIX shared memory objects.  Typically it will
look up and wire each page before sending it to a socket; once
transmission is complete, the page is unwired and typically released
back into the page queues.  sendfile() has an advisory flag, SF_NOCACHE,
which means, "try to free the page once transmission is complete."  This
is implemented in vm_page_release(), which expects to operate on managed
pages.

Pages belonging a largepage object are de-facto wired not explicitly so.
Thus, vm_page_release() will unwire and, having found no additional
references, free the page.  Because mappings of largepage objects are
unmanaged, userspace can still access the now freed page.

Fix the problem by explicitly wiring largepage pages.  Make the VM
object destructor responsible for unwiring and freeing them.

Add a regression test.

Approved by:	so
Security:	FreeBSD-SA-26:44.posixshm
Security:	CVE-2026-49427
Reported by:	Chris Jarrett-Davies <chrisjd@openai.com>
Reviewed by:	kib
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D57832