23 files changed, 154 insertions, 156 deletions

diff --git a/.cirrus.yml b/.cirrus.yml
index e62b172efea9..b5c96820c192 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -4,7 +4,7 @@ compute_engine_instance:
   # gcloud compute images list --project freebsd-org-cloud-dev --no-standard-images
   platform: freebsd
   image_project: freebsd-org-cloud-dev
-  image: freebsd-14-2-release-amd64-ufs
+  image: freebsd-14-3-release-amd64-ufs
   cpu: 8
   memory: 8G
   disk: 40
diff --git a/include/resolv.h b/include/resolv.h
index f32f52bab431..6ef79601b5f8 100644
--- a/include/resolv.h
+++ b/include/resolv.h
@@ -188,7 +188,7 @@ struct __res_state {
 			struct __res_state_ext *ext;	/*%< extension for IPv6 */
 		} _ext;
 	} _u;
-	u_char	*_rnd;			/*%< PRIVATE: random state */
+	u_char	*_rnd;			/*%< PRIVATE: random state (unused) */
 };
 
 typedef struct __res_state *res_state;
@@ -380,7 +380,6 @@ extern const struct res_sym __p_rcode_syms[];
 #define res_nisourserver	__res_nisourserver
 #define res_ownok		__res_ownok
 #define res_queriesmatch	__res_queriesmatch
-#define res_rndinit		__res_rndinit
 #define res_randomid		__res_randomid
 #define res_nrandomid		__res_nrandomid
 #define sym_ntop		__sym_ntop
@@ -445,7 +444,6 @@ int		dn_count_labels(const char *);
 int		dn_comp(const char *, u_char *, int, u_char **, u_char **);
 int		dn_expand(const u_char *, const u_char *, const u_char *,
 			  char *, int);
-void		res_rndinit(res_state);
 u_int		res_randomid(void);
 u_int		res_nrandomid(res_state);
 int		res_nameinquery(const char *, int, int, const u_char *,
diff --git a/lib/libc/Makefile b/lib/libc/Makefile
index d0c254e33396..8705568f6d34 100644
--- a/lib/libc/Makefile
+++ b/lib/libc/Makefile
@@ -109,7 +109,6 @@ NOASM=
 .include "${LIBC_SRCTOP}/inet/Makefile.inc"
 .include "${LIBC_SRCTOP}/isc/Makefile.inc"
 .include "${LIBC_SRCTOP}/locale/Makefile.inc"
-.include "${LIBC_SRCTOP}/md/Makefile.inc"
 .include "${LIBC_SRCTOP}/nameser/Makefile.inc"
 .include "${LIBC_SRCTOP}/net/Makefile.inc"
 .include "${LIBC_SRCTOP}/nls/Makefile.inc"
diff --git a/lib/libc/gen/fts.3 b/lib/libc/gen/fts.3
index ee558b892c8c..b937607b48e0 100644
--- a/lib/libc/gen/fts.3
+++ b/lib/libc/gen/fts.3
@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd June 30, 2025
+.Dd October 1, 2025
 .Dt FTS 3
 .Os
 .Sh NAME
@@ -376,7 +376,44 @@ The
 .Fa fts_name
 field is always
 .Dv NUL Ns -terminated .
-.Sh FTS_OPEN
+.Ss Thread Safety
+The
+.Nm
+functions can safely be used in multi-threaded programs provided no
+two threads access the same
+.Vt FTS
+or
+.Vt FTSENT
+structure simultaneously.
+However, unless the
+.Dv FTS_NOCHDIR
+flag was passed to
+.Fn fts_open
+or
+.Fn fts_open_b ,
+calls to
+.Fn fts_read
+and
+.Fn fts_children
+may change the current working directory, which will affect all
+threads.
+Conversely, changing the current working directory either during or
+between calls to
+.Fn fts_read
+or
+.Fn fts_children
+(even in a single-thread program) may cause
+.Nm
+to malfunction unless the
+.Dv FTS_NOCHDIR
+flag was passed to
+.Fn fts_open
+or
+.Fn fts_open_b
+and all paths in
+.Va path_argv
+were absolute.
+.Ss Fn fts_open
 The
 .Fn fts_open
 function takes a pointer to an array of character pointers naming one
@@ -545,7 +582,7 @@ the directory traversal order is in the order listed in
 .Fa path_argv
 for the root paths, and in the order listed in the directory for
 everything else.
-.Sh FTS_OPEN_B
+.Ss Fn fts_open_b
 The
 .Fn fts_open_b
 function is identical to
@@ -554,7 +591,7 @@ except that it takes a block pointer instead of a function pointer.
 The block is copied before
 .Fn fts_open_b
 returns, so the original can safely go out of scope or be released.
-.Sh FTS_READ
+.Ss Fn fts_read
 The
 .Fn fts_read
 function returns a pointer to an
@@ -605,7 +642,7 @@ after the
 structure has been returned by the function
 .Fn fts_read
 in post-order.
-.Sh FTS_CHILDREN
+.Ss Fn fts_children
 The
 .Fn fts_children
 function returns a pointer to an
@@ -679,7 +716,7 @@ and
 .Fa fts_namelen
 fields.
 .El
-.Sh FTS_SET
+.Ss Fn fts_set
 The function
 .Fn fts_set
 allows the user application to determine further processing for the
@@ -749,7 +786,7 @@ The file may be one of those most recently returned by either
 or
 .Fn fts_read .
 .El
-.Sh FTS_CLOSE
+.Ss Fn fts_close
 The
 .Fn fts_close
 function closes a file hierarchy stream
diff --git a/lib/libc/include/port_before.h b/lib/libc/include/port_before.h
index cfc43c53f157..aa2cd394104a 100644
--- a/lib/libc/include/port_before.h
+++ b/lib/libc/include/port_before.h
@@ -5,7 +5,6 @@
 #define _LIBC		1
 #define DO_PTHREADS	1
 #define USE_POLL	1
-#define HAVE_MD5	1
 
 #define ISC_SOCKLEN_T	socklen_t
 #define ISC_FORMAT_PRINTF(fmt, args) \
diff --git a/lib/libc/md/Makefile.inc b/lib/libc/md/Makefile.inc
deleted file mode 100644
index 82c5f0670485..000000000000
--- a/lib/libc/md/Makefile.inc
+++ /dev/null
@@ -1,3 +0,0 @@
-.PATH: ${SRCTOP}/sys/kern
-
-SRCS+=	md5c.c
diff --git a/lib/libc/resolv/Symbol.map b/lib/libc/resolv/Symbol.map
index 6b9c43298fb5..26daecbe2eff 100644
--- a/lib/libc/resolv/Symbol.map
+++ b/lib/libc/resolv/Symbol.map
@@ -103,6 +103,5 @@ FBSD_1.0 {
 };
 
 FBSD_1.4 {
-	__res_rndinit;
 	__res_nrandomid;
 };
diff --git a/lib/libc/resolv/res_init.c b/lib/libc/resolv/res_init.c
index 71ab2dcb7038..5a2fce013c8c 100644
--- a/lib/libc/resolv/res_init.c
+++ b/lib/libc/resolv/res_init.c
@@ -86,19 +86,6 @@
 #include <unistd.h>
 #include <netdb.h>
 
-#ifndef HAVE_MD5
-# include "../dst/md5.h"
-#else
-# ifdef SOLARIS2
-#  include <sys/md5.h>
-# elif _LIBC
-# include <md5.h>
-# endif
-#endif
-#ifndef _MD5_H_
-# define _MD5_H_ 1	/*%< make sure we do not include rsaref md5.h file */
-#endif
-
 #include "un-namespace.h"
 
 #include "port_after.h"
@@ -184,8 +171,6 @@ __res_vinit(res_state statp, int preinit) {
 		statp->options = RES_DEFAULT;
 	}
 
-	statp->_rnd = malloc(16);
-	res_rndinit(statp);
 	statp->id = res_nrandomid(statp);
 
 	memset(u, 0, sizeof(u));
@@ -733,48 +718,18 @@ net_mask(struct in_addr in)		/*!< XXX - should really use system's version of th
 }
 #endif
 
-static u_char srnd[16];
-
 void
-res_rndinit(res_state statp)
+freebsd15_res_rndinit(res_state statp)
 {
-	struct timeval now;
-	u_int32_t u32;
-	u_int16_t u16;
-	u_char *rnd = statp->_rnd == NULL ? srnd : statp->_rnd;
-
-	gettimeofday(&now, NULL);
-	u32 = now.tv_sec;
-	memcpy(rnd, &u32, 4);
-	u32 = now.tv_usec;
-	memcpy(rnd + 4, &u32, 4);
-	u32 += now.tv_sec;
-	memcpy(rnd + 8, &u32, 4);
-	u16 = getpid();
-	memcpy(rnd + 12, &u16, 2);
+	(void)statp;
 }
+__sym_compat(__res_rndinit, freebsd15_res_rndinit, FBSD_1.4);
 
 u_int
 res_nrandomid(res_state statp) {
-	struct timeval now;
-	u_int16_t u16;
-	MD5_CTX ctx;
-	u_char *rnd = statp->_rnd == NULL ? srnd : statp->_rnd;
-
-	gettimeofday(&now, NULL);
-	u16 = (u_int16_t) (now.tv_sec ^ now.tv_usec);
-	memcpy(rnd + 14, &u16, 2);
-#ifndef HAVE_MD5
-	MD5_Init(&ctx);
-	MD5_Update(&ctx, rnd, 16);
-	MD5_Final(rnd, &ctx);
-#else
-	MD5Init(&ctx);
-	MD5Update(&ctx, rnd, 16);
-	MD5Final(rnd, &ctx);
-#endif
-	memcpy(&u16, rnd + 14, 2);
-	return ((u_int) u16);
+	(void) statp;
+
+	return ((u_int)(arc4random() & 0xffff));
 }
 
 /*%
@@ -808,10 +763,6 @@ res_ndestroy(res_state statp) {
 		free(statp->_u._ext.ext);
 		statp->_u._ext.ext = NULL;
 	}
-	if (statp->_rnd != NULL) {
-		free(statp->_rnd);
-		statp->_rnd = NULL;
-	}
 	statp->options &= ~RES_INIT;
 }
 
diff --git a/libexec/flua/Makefile b/libexec/flua/Makefile
index cc750e30525f..23de404710d0 100644
--- a/libexec/flua/Makefile
+++ b/libexec/flua/Makefile
@@ -16,7 +16,6 @@ FLUA_MODULES+=	libjail
 .endif
 FLUA_MODULES+=	libucl
 FLUA_MODULES+=	liblyaml
-FLUA_MODULES+=	lposix
 
 .ifdef BOOTSTRAPPING
 # libfreebsd is generally omitted from the bootstrap flua because its
@@ -55,6 +54,7 @@ SRCS+=	lua.c
 # FreeBSD Extensions
 .PATH: ${.CURDIR}/modules
 SRCS+=	linit_flua.c
+SRCS+=	lposix.c
 
 CFLAGS+=	-I${SRCTOP}/lib/liblua -I${.CURDIR}/modules -I${LUASRC}
 CFLAGS+=	-DLUA_PROGNAME="\"${PROG}\""
diff --git a/libexec/flua/linit_flua.c b/libexec/flua/linit_flua.c
index bb3748daefb4..65356c938671 100644
--- a/libexec/flua/linit_flua.c
+++ b/libexec/flua/linit_flua.c
@@ -33,6 +33,7 @@
 
 #include "lualib.h"
 #include "lauxlib.h"
+#include "lposix.h"
 
 #include "bootstrap.h"
 
@@ -54,6 +55,8 @@ static const luaL_Reg loadedlibs[] = {
 #if defined(LUA_COMPAT_BITLIB)
   {LUA_BITLIBNAME, luaopen_bit32},
 #endif
+  /* FreeBSD Extensions */
+  {"posix", luaopen_posix},
   {NULL, NULL}
 };
 
diff --git a/libexec/flua/lposix/Makefile b/libexec/flua/lposix/Makefile
deleted file mode 100644
index 92321d51be9a..000000000000
--- a/libexec/flua/lposix/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-SHLIB_NAME=	posix.so
-WARNS?=	3
-
-.include "Makefile.inc"
-.include <bsd.lib.mk>
diff --git a/libexec/flua/lposix/Makefile.inc b/libexec/flua/lposix/Makefile.inc
deleted file mode 100644
index 499e6779e84d..000000000000
--- a/libexec/flua/lposix/Makefile.inc
+++ /dev/null
@@ -1,2 +0,0 @@
-.PATH:	${.PARSEDIR}
-SRCS+=	lposix.c
diff --git a/libexec/flua/lposix/lposix.c b/libexec/flua/modules/lposix.c
index 430bb6f28baf..75cdd345aeaa 100644
--- a/libexec/flua/lposix/lposix.c
+++ b/libexec/flua/modules/lposix.c
@@ -21,8 +21,6 @@
 #include "lauxlib.h"
 #include "lposix.h"
 
-#include "bootstrap.h"
-
 static void
 enforce_max_args(lua_State *L, int max)
 {
@@ -699,6 +697,3 @@ luaopen_posix(lua_State *L)
 
 	return (1);
 }
-
-/* Only this one needed in our bootstrap set, it will load the others. */
-FLUA_MODULE(posix);
diff --git a/libexec/flua/lposix/lposix.h b/libexec/flua/modules/lposix.h
index 1aa33f042571..1aa33f042571 100644
--- a/libexec/flua/lposix/lposix.h
+++ b/libexec/flua/modules/lposix.h
diff --git a/libexec/nuageinit/nuageinit b/libexec/nuageinit/nuageinit
index 29340a3d91ea..f29fa8ba1bac 100755
--- a/libexec/nuageinit/nuageinit
+++ b/libexec/nuageinit/nuageinit
@@ -6,6 +6,7 @@
 -- Copyright(c) 2025 Jesús Daniel Colmenares Oviedo <dtxdf@FreeBSD.org>
 
 local nuage = require("nuage")
+local lfs = require("lfs")
 local ucl = require("ucl")
 local yaml = require("lyaml")
 
diff --git a/release/Makefile.mirrors b/release/Makefile.mirrors
index 958ac7717616..6778b86873e6 100644
--- a/release/Makefile.mirrors
+++ b/release/Makefile.mirrors
@@ -63,10 +63,12 @@ STAGE_TARGETS+=		oci-images-stage
 OCI_DIR=		${TLD}/OCI-IMAGES/${REVISION}-${BRANCH}/${TARGET_ARCH}
 .endif
 
+.if !defined(EMBEDDED) || empty(EMBEDDED)
 .if !defined(NOPKGBASE) || empty(NOPKGBASE)
 STAGE_TARGETS+=		pkgbase-repo-stage
 PKGBASE_DIR=		${TLD}/PKGBASE-REPOS/${REVISION}-${BRANCH}/${TARGET_ARCH}
 .endif
+.endif
 
 CLEANFILES+=		${STAGE_TARGETS}
 CHECKSUM_FILES?=	SHA512 SHA256
diff --git a/release/scripts/make-pkg-package.sh b/release/scripts/make-pkg-package.sh
index a1e006bd6964..3a1b163bd591 100755
--- a/release/scripts/make-pkg-package.sh
+++ b/release/scripts/make-pkg-package.sh
@@ -8,6 +8,13 @@ PKG_ABI=$(${PKG_CMD} -o ABI_FILE=${WSTAGEDIR}/bin/sh config ABI)
 unset PKG_VERSION
 unset MAKEFLAGS
 unset PKGBASE
+# Ports interprets CROSS_TOOLCHAIN differently from src, and having this set
+# breaks the package-pkg build.  For now, forcibly unset this and hope ports
+# can find a working compiler.
+if [ -n "$CROSS_TOOLCHAIN" ]; then
+	printf >&2 '%s: WARNING: CROSS_TOOLCHAIN will be ignored for the pkg build.\n' "$0"
+	unset CROSS_TOOLCHAIN
+fi
 export WRKDIRPREFIX=/tmp/ports.${TARGET}
 export DISTDIR=/tmp/distfiles
 export WRKDIR=$(make -C ${PORTSDIR}/ports-mgmt/pkg I_DONT_CARE_IF_MY_BUILDS_TARGET_THE_WRONG_RELEASE=YES -V WRKDIR)
diff --git a/release/tools/vagrant.conf b/release/tools/vagrant.conf
index 7ab0e1238693..5b0f38b740a6 100644
--- a/release/tools/vagrant.conf
+++ b/release/tools/vagrant.conf
@@ -14,14 +14,16 @@ export VM_EXTRA_PACKAGES="${VM_EXTRA_PACKAGES} shells/bash \
 export VM_RC_LIST="firstboot_freebsd_update firstboot_pkgs growfs"
 
 vagrant_common () {
-	# The firstboot_pkgs rc.d script will download the repository
-	# catalogue and install or update pkg when the instance first
-	# launches, so these files would just be replaced anyway; removing
-	# them from the image allows it to boot faster.
-	env ASSUME_ALWAYS_YES=yes pkg -c ${DESTDIR} clean -y -a
-	env ASSUME_ALWAYS_YES=yes pkg -c ${DESTDIR} delete -f -y pkg
-	rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports
-	rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods
+	if [ -z "${NO_ROOT}" ]; then
+		# The firstboot_pkgs rc.d script will download the repository
+		# catalogue and install or update pkg when the instance first
+		# launches, so these files would just be replaced anyway;
+		# removing them from the image allows it to boot faster.
+		pkg -c ${DESTDIR} clean -y -a
+		pkg -c ${DESTDIR} delete -f -y pkg
+		rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports
+		rm -r ${DESTDIR}/var/db/pkg/repos/FreeBSD-ports-kmods
+	fi
 
 	# Vagrant instances use DHCP to get their network configuration.
 	echo 'ifconfig_DEFAULT="SYNCDHCP"' >> ${DESTDIR}/etc/rc.conf
@@ -40,8 +42,7 @@ vagrant_common () {
 	# Create the vagrant user with a password of vagrant
 	/usr/sbin/pw -R ${DESTDIR} \
 		groupadd vagrant -g 1001
-	chroot ${DESTDIR} mkdir -p /home/vagrant
-	/usr/sbin/pw -R ${DESTDIR} \
+	/usr/sbin/pw -R ${DESTDIR} -M ${DESTDIR}/METALOG \
 		useradd vagrant \
 		-m -M 0755 -w yes -n vagrant -u 1001 -g 1001 -G 0 \
 		-c 'Vagrant User' -d '/home/vagrant' -s '/bin/csh'
@@ -58,11 +59,11 @@ vagrant_common () {
 	echo "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key" > ${DESTDIR}/home/vagrant/.ssh/authorized_keys
 	echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN1YdxBpNlzxDqfJyw/QKow1F+wvG9hXGoqiysfJOn5Y vagrant insecure public key" >> ${DESTDIR}/home/vagrant/.ssh/authorized_keys
 	chmod 600 ${DESTDIR}/home/vagrant/.ssh/authorized_keys
-	metalog_add_data ./home/vagrant/.ssh/authorized_keys 0600
 
 	chmod 700 ${DESTDIR}/home/vagrant/.ssh
 	chown -R 1001 ${DESTDIR}/home/vagrant/.ssh
-	echo "./home/vagrant/.ssh type=dir uid=1001 gid=1001 mode=0700" >> METALOG
+	echo "./home/vagrant/.ssh type=dir uid=1001 gid=1001 mode=0700" >> ${DESTDIR}/METALOG
+	echo "./home/vagrant/.ssh/authorized_keys type=file uid=1001 gid=1001 mode=0600" >> ${DESTDIR}/METALOG
 
 	# Reboot quickly, Don't wait at the panic screen
 	echo 'debug.trace_on_panic=1' >> ${DESTDIR}/etc/sysctl.conf
diff --git a/share/man/man4/ice.4 b/share/man/man4/ice.4
index 3f7a9017756d..13ad304a2d5a 100644
--- a/share/man/man4/ice.4
+++ b/share/man/man4/ice.4
@@ -1,4 +1,4 @@
-.\"-
+.\"
 .\" SPDX-License-Identifier: BSD-3-Clause
 .\"
 .\" Copyright (c) 2019-2020, Intel Corporation
@@ -32,12 +32,12 @@
 .\"
 .\" * Other names and brands may be claimed as the property of others.
 .\"
-.Dd March 28, 2025
+.Dd October 3, 2025
 .Dt ICE 4
 .Os
 .Sh NAME
 .Nm ice
-.Nd "Intel\(rg Ethernet 800 Series Driver"
+.Nd Intel Ethernet 800 Series Driver
 .Sh SYNOPSIS
 To compile this driver into the kernel, place the following lines in your
 kernel configuration file:
@@ -86,7 +86,7 @@ Intel\(rg Ethernet Connection E830\-XXV
 .El
 .Pp
 For questions related to hardware requirements, refer to the documentation
-supplied with your adapter.
+supplied with the adapter.
 .Pp
 Support for Jumbo Frames is provided via the interface MTU setting.
 Selecting an MTU larger than 1500 bytes with the
@@ -134,17 +134,16 @@ See the
 .Dq Intel\(rg Ethernet Adapters and Devices User Guide
 for more details on DDP and Safe Mode.
 .Pp
-If you encounter issues with the DDP package file, you may need to download
-an updated driver or
+If issues are encountered with the DDP package file, an updated driver or
 .Sy ice_ddp
-module.
+module may need to be downloaded.
 See the log messages for more information.
 .Pp
-You cannot update the DDP package if any PF drivers are already loaded.
+The DDP package cannot be updated if any PF drivers are already loaded.
 To overwrite a package, unload all PFs and then reload the driver with the
 new package.
 .Pp
-You can only use one DDP package per driver, even if you have more than one
+Only one DDP package can be used per driver, even if more than one
 device installed that uses the driver.
 .Pp
 Only the first loaded PF per device can download a package for that device.
@@ -164,9 +163,9 @@ each jumbo packet.
 This should help to avoid buffer starvation issues when allocating receive
 packets.
 .Pp
-Packet loss may have a greater impact on throughput when you use jumbo
-frames.
-If you observe a drop in performance after enabling jumbo frames, enabling
+Packet loss may have a greater impact on throughput when jumbo frames are in
+use.
+If a drop in performance is observed after enabling jumbo frames, enabling
 flow control may mitigate the issue.
 .Ss Remote Direct Memory Access
 Remote Direct Memory Access, or RDMA, allows a network device to transfer data
@@ -184,14 +183,14 @@ operating in multiport mode with more than 4 ports.
 For detailed installation and configuration information for RDMA, see
 .Xr irdma 4 .
 .Ss RDMA Monitoring
-For debugging/testing purposes, you can use sysctl to set up a mirroring
+For debugging/testing purposes, a sysctl can be used to set up a mirroring
 interface on a port.
 The interface can receive mirrored RDMA traffic for packet
 analysis tools like
 .Xr tcpdump 1 .
 This mirroring may impact performance.
 .Pp
-To use RDMA monitoring, you may need to reserve more MSI\-X interrupts.
+To use RDMA monitoring, more MSI\-X interrupts may need to be reserved.
 Before the
 .Nm
 driver loads, configure the following tunable provided by
@@ -200,7 +199,7 @@ driver loads, configure the following tunable provided by
 dev.ice.<interface #>.iflib.use_extra_msix_vectors=4
 .Ed
 .Pp
-You may need to adjust the number of extra MSI\-X interrupt vectors.
+The number of extra MSI\-X interrupt vectors may need to be adjusted.
 .Pp
 To create/delete the interface:
 .Bd -literal -offset indent
@@ -276,7 +275,7 @@ To enable/disable priority flow control in software\-based DCBX mode:
 sysctl dev.ice.<interface #>.pfc=1 (or 0 to disable)
 .Ed
 .Pp
-Enhanced Transmission Selection (ETS) allows you to assign bandwidth to certain
+Enhanced Transmission Selection (ETS) allows bandwidth to be assigned to certain
 TCs, to help ensure traffic reliability.
 To view the assigned ETS configuration, use the following:
 .Bd -literal -offset indent
@@ -310,7 +309,7 @@ Use the following sysctl to enable or disable L3 QoS:
 sysctl dev.ice.<interface #>.pfc_mode=1 (or 0 to disable)
 .Ed
 .Pp
-If you disable L3 QoS mode, it returns to L2 QoS mode.
+If the L3 QoS mode is disabled, it returns to L2 QoS mode.
 .Pp
 To map a DSCP value to a traffic class, separate the values by commas.
 For example, to map DSCPs 0\-3 and DSCP 8 to DCB TCs 0\-3 and 4, respectively:
@@ -329,7 +328,7 @@ sysctl dev.ice.<interface #>.dscp2tc_map
 .Pp
 L3 QoS mode is not available when FW\-LLDP is enabled.
 .Pp
-You also cannot enable FW\-LLDP if L3 QoS mode is active.
+FW\-LLDP cannot be enabled if L3 QoS mode is active.
 .Pp
 Disable FW\-LLDP before switching to L3 QoS mode.
 .Pp
@@ -355,11 +354,11 @@ To check the current LLDP setting:
 sysctl dev.ice.<interface #>.fw_lldp_agent
 .Ed
 .Pp
-You must enable the UEFI HII LLDP Agent attribute for this setting
+The UEFI HII LLDP Agent attribute must be enabled for this setting
 to take effect.
 If the
 .Dq LLDP AGENT
-attribute is set to disabled, you cannot enable the FW\-LLDP Agent from the
+attribute is set to disabled, the FW\-LLDP Agent cannot be enabled from the
 driver.
 .Ss Link\-Level Flow Control (LFC)
 Ethernet Flow Control (IEEE 802.3x) can be configured with sysctl to enable
@@ -416,11 +415,11 @@ provide a stable link without FEC.
 .Pp
 For devices to benefit from this feature, link partners must have FEC enabled.
 .Pp
-If you enable the sysctl
-.Em allow_no_fec_modules_in_auto
-Auto FEC negotiation will include
+If the
+.Va allow_no_fec_modules_in_auto
+sysctl is enabled Auto FEC negotiation will include
 .Dq No FEC
-in case your link partner does not have FEC enabled or is not FEC capable:
+in case the link partner does not have FEC enabled or is not FEC capable:
 .Bd -literal -offset indent
 sysctl dev.ice.<interface #>.allow_no_fec_modules_in_auto=1
 .Ed
@@ -443,16 +442,16 @@ To see the valid FEC modes for the link:
 sysctl \-d dev.ice.<interface #>.requested_fec
 .Ed
 .Ss Speed and Duplex Configuration
-You cannot set duplex or autonegotiation settings.
+The speed and duplex settings cannot be hard set.
 .Pp
-To have your device change the speeds it will use in auto-negotiation or
+To have the device change the speeds it will use in auto-negotiation or
 force link with:
 .Bd -literal -offset indent
 sysctl dev.ice.<interface #>.advertise_speed=<mask>
 .Ed
 .Pp
 Supported speeds will vary by device.
-Depending on the speeds your device supports, valid bits used in a speed mask
+Depending on the speeds the device supports, valid bits used in a speed mask
 could include:
 .Bd -literal -offset indent
 0x0 \- Auto
@@ -493,13 +492,13 @@ At a high level, to capture a firmware log:
 .It
 Set the configuration for the firmware log.
 .It
-Perform the necessary steps to generate the issue you are trying to debug.
+Perform the necessary steps to reproduce the issue.
 .It
 Capture the firmware log.
 .It
 Stop capturing the firmware log.
 .It
-Reset your firmware log settings as needed.
+Reset the firmware log settings as needed.
 .It
 Work with Customer Support to debug the issue.
 .El
@@ -583,8 +582,8 @@ PF Registration (Bit 30)
 Module Version (Bit 31)
 .El
 .Pp
-You can change the verbosity level of the firmware logs.
-You can set only one log level per module, and each level includes the
+The verbosity level of the firmware logs can be modified.
+It is possible to set only one log level per module, and each level includes the
 verbosity levels lower than it.
 For instance, setting the level to
 .Dq normal
@@ -640,8 +639,8 @@ dmesg > log_output
 NOTE: Logging a large number of modules or too high of a verbosity level will
 add extraneous messages to dmesg and could hinder debug efforts.
 .Ss Debug Dump
-Intel\(rg Ethernet 800 Series devices support debug dump, which allows you to
-obtain runtime register values from the firmware for
+Intel\(rg Ethernet 800 Series devices support debug dump, which allows
+gathering of runtime register values from the firmware for
 .Dq clusters
 of events and then write the results to a single dump file, for debugging
 complicated issues in the field.
@@ -654,7 +653,7 @@ stateless snapshot of the whole device.
 .Pp
 NOTE: Like with firmware logs, the contents of the debug dump are not
 human\-readable.
-You must work with Customer Support to decode the file.
+Work with Customer Support to decode the file.
 .Pp
 Debug dump is per device, not per PF.
 .Pp
@@ -717,20 +716,19 @@ sysctl dev.ice.0.debug.dump.clusters=0
 .Pp
 NOTE: Using 0 will skip Manageability Transactions data.
 .Pp
-If you don't specify a cluster, the driver will dump all clusters to a
+If a single cluster is not specified, the driver will dump all clusters to a
 single file.
 Issue the debug dump command, using the following:
 .Bd -literal -offset indent
 sysctl \-b dev.ice.<interface #>.debug.dump.dump=1 > dump.bin
 .Ed
 .Pp
-NOTE: The driver will not receive the command if you do not write
-.Dq 1
-to the sysctl.
+NOTE: The driver will not receive the command if the sysctl is not set to
+.Dq 1 .
 .Pp
 Replace
 .Dq dump.bin
-above with the file name you want to use.
+above with the preferred file name.
 .Pp
 To clear the
 .Va clusters
@@ -744,7 +742,7 @@ The ice driver supports the ability to obtain the values of the PHY registers
 from Intel(R) Ethernet 810 Series devices in order to debug link and
 connection issues during runtime.
 .Pp
-The driver allows you to obtain information about:
+The driver provides information about:
 .Bl -bullet
 .It
 Rx and Tx Equalization parameters
@@ -758,12 +756,12 @@ sysctl dev.ice.<interface #>.debug.phy_statistics
 .Ed
 .Pp
 NOTE: The contents of the registers are not human\-readable.
-Like with firmware logs and debug dump, you must work with Customer Support
+Like with firmware logs and debug dump, work with Customer Support
 to decode the file.
 .Ss Transmit Balancing
-Some Intel(R) Ethernet 800 Series devices allow you to enable a transmit
+Some Intel(R) Ethernet 800 Series devices allow for enabling a transmit
 balancing feature to improve transmit performance under certain conditions.
-When the feature is enabled, you should experience more consistent transmit
+When enabled, the feature should provide more consistent transmit
 performance across queues and/or PFs and VFs.
 .Pp
 By default, transmit balancing is disabled in the NVM.
@@ -784,7 +782,7 @@ configures the device accordingly.
 .Pp
 NOTE: The user selection for transmit balancing in EPCT or HII is persistent
 across reboots.
-You must reboot the system for the selected setting to take effect.
+The system must be rebooted for the selected setting to take effect.
 .Pp
 This setting is device wide.
 .Pp
@@ -801,7 +799,7 @@ sysctl dev.ice.<interface #>.temp
 may have a low number of network memory buffers (mbufs) by default.
 If the number of mbufs available is too low, it may cause the driver to fail
 to initialize and/or cause the system to become unresponsive.
-You can check to see if the system is mbuf\-starved by running
+Check to see if the system is mbuf\-starved by running
 .Ic netstat Fl m .
 Increase the number of mbufs by editing the lines below in
 .Pa /etc/sysctl.conf :
@@ -813,7 +811,7 @@ kern.ipc.nmbjumbo16
 kern.ipc.nmbufs
 .Ed
 .Pp
-The amount of memory that you allocate is system specific, and may require some
+The amount of memory that should be allocated is system specific, and may require some
 trial and error.
 Also, increasing the following in
 .Pa /etc/sysctl.conf
@@ -908,8 +906,8 @@ link partner's switch ports.
 Some PCIe x8 slots are actually configured as x4 slots.
 These slots have insufficient bandwidth for full line rate with dual port and
 quad port devices.
-In addition, if you put a PCIe v4.0 or v3.0\-capable adapter into a PCIe v2.x
-slot, you cannot get full bandwidth.
+In addition, if a PCIe v4.0 or v3.0\-capable adapter is placed into a PCIe v2.x
+slot, full bandwidth will not be possible.
 .Pp
 The driver detects this situation and writes the following message in the
 system log:
@@ -920,7 +918,7 @@ Please move the device to a different PCI\-e link with more lanes and/or
 higher transfer rate.
 .Ed
 .Pp
-If this error occurs, moving your adapter to a true PCIe x8 or x16 slot will
+If this error occurs, moving the adapter to a true PCIe x8 or x16 slot will
 resolve the issue.
 For best performance, install devices in the following PCI slots:
 .Bl -bullet
diff --git a/sys/dev/acpica/acpi_apei.c b/sys/dev/acpica/acpi_apei.c
index 9cfd46c97430..624c81ad1b4f 100644
--- a/sys/dev/acpica/acpi_apei.c
+++ b/sys/dev/acpica/acpi_apei.c
@@ -754,7 +754,7 @@ apei_detach(device_t dev)
 	apei_nmi = NULL;
 	apei_nmi_nges = NULL;
 	if (sc->nges.swi_ih != NULL) {
-		swi_remove(&sc->nges.swi_ih);
+		swi_remove(sc->nges.swi_ih);
 		sc->nges.swi_ih = NULL;
 	}
 	if (acpi_get_handle(dev) != NULL) {
diff --git a/sys/dev/pci/pci.c b/sys/dev/pci/pci.c
index 9e43a4c1909f..cde98cb62cef 100644
--- a/sys/dev/pci/pci.c
+++ b/sys/dev/pci/pci.c
@@ -240,6 +240,7 @@ struct pci_quirk {
 #define	PCI_QUIRK_DISABLE_MSIX	5 /* MSI-X doesn't work */
 #define	PCI_QUIRK_MSI_INTX_BUG	6 /* PCIM_CMD_INTxDIS disables MSI */
 #define	PCI_QUIRK_REALLOC_BAR	7 /* Can't allocate memory at the default address */
+#define	PCI_QUIRK_DISABLE_FLR	8 /* Function-Level Reset (FLR) not working. */
 	int	arg1;
 	int	arg2;
 };
@@ -319,6 +320,13 @@ static const struct pci_quirk pci_quirks[] = {
 	 * expected place.
 	 */
 	{ 0x98741002, PCI_QUIRK_REALLOC_BAR,	0, 	0 },
+
+	/*
+	 * With some MediaTek mt76 WiFi FLR does not work despite advertised.
+	 */
+	{ 0x061614c3, PCI_QUIRK_DISABLE_FLR,	0,	0 }, /* mt76 7922 */
+
+	/* end of table */
 	{ 0 }
 };
 
@@ -6740,6 +6748,8 @@ pcie_flr(device_t dev, u_int max_delay, bool force)
 
 	if (!(pci_read_config(dev, cap + PCIER_DEVICE_CAP, 4) & PCIEM_CAP_FLR))
 		return (false);
+	if (pci_has_quirk(pci_get_devid(dev), PCI_QUIRK_DISABLE_FLR))
+		return (false);
 
 	/*
 	 * Disable busmastering to prevent generation of new
diff --git a/sys/dev/vmware/vmxnet3/if_vmx.c b/sys/dev/vmware/vmxnet3/if_vmx.c
index 62b5f313a137..1a314ca6660e 100644
--- a/sys/dev/vmware/vmxnet3/if_vmx.c
+++ b/sys/dev/vmware/vmxnet3/if_vmx.c
@@ -2056,7 +2056,12 @@ vmxnet3_update_admin_status(if_ctx_t ctx)
 	struct vmxnet3_softc *sc;
 
 	sc = iflib_get_softc(ctx);
-	if (sc->vmx_ds->event != 0)
+	/*
+	 * iflib may invoke this routine before vmxnet3_attach_post() has
+	 * run, which is before the top level shared data area is
+	 * initialized and the device made aware of it.
+	 */
+	if (sc->vmx_ds != NULL && sc->vmx_ds->event != 0)
 		vmxnet3_evintr(sc);
 
 	vmxnet3_refresh_host_stats(sc);
diff --git a/usr.sbin/bsdinstall/bsdinstall.8 b/usr.sbin/bsdinstall/bsdinstall.8
index 527250d380d1..6175d26b4fd3 100644
--- a/usr.sbin/bsdinstall/bsdinstall.8
+++ b/usr.sbin/bsdinstall/bsdinstall.8
@@ -1,4 +1,6 @@
-.\"-
+.\"
+.\" SPDX-License-Identifier: BSD-2-Clause
+.\"
 .\" Copyright (c) 2011-2013 Nathan Whitehorn <nwhitehorn@FreeBSD.org> All rights reserved.
 .\" Copyright (c) 2018 Roberto Fernandez Cueto <roberfern@gmail.com>
 .\" Copyright (c) 2024 The FreeBSD Foundation
@@ -27,7 +29,7 @@
 .\" ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd November 4, 2024
+.Dd October 3, 2025
 .Dt BSDINSTALL 8
 .Os
 .Sh NAME
@@ -40,9 +42,10 @@
 .Op Ar ...
 .Sh DESCRIPTION
 .Nm
-is used for installation of new systems, both for system setup from
-installation media, e.g., CD-ROMs, and for use on live systems to prepare
-VM images and jails.
+is used for installation of new systems,
+both for system setup from installation media,
+such as discs, USBs, or network boot environments,
+and for use on live systems to prepare jails and virtual machine images.
 .Pp
 Much like
 .Xr make 1 , Nm
@@ -56,7 +59,7 @@ these subtargets can be invoked separately by an installation script.
 .Sh OPTIONS
 .Nm
 supports the following options, global to all targets:
-.Bl -tag -width indent+
+.Bl -tag -width "-D file"
 .It Fl D Ar file
 Provide a path for the installation log file
 .Pq overrides Ev BSDINSTALL_LOG .
@@ -73,7 +76,7 @@ For interactive use, most users will be interested only in the
 and
 .Cm script
 targets.
-.Bl -tag -width "jail destination"
+.Bl -tag -width "-D file"
 .It Cm auto
 Run the standard interactive installation, including disk partitioning.
 .It Cm jail Ar destination
@@ -295,7 +298,7 @@ Many are used internally during installation and have reasonable default values
 for most installation scenarios.
 Others are set by various interactive user prompts, and can be usefully
 overridden when making scripted or customized installers.
-.Bl -tag -width "BSDINSTALL_DISTSITE"
+.Bl -tag -width "-D file"
 .It Ev TMPDIR
 The directory to use for temporary files.
 Default: