3 files changed, 21 insertions, 28 deletions

diff --git a/lib/libc/stdlib/atexit.3 b/lib/libc/stdlib/atexit.3
index 4ff384813550..4082c887497c 100644
--- a/lib/libc/stdlib/atexit.3
+++ b/lib/libc/stdlib/atexit.3
@@ -29,7 +29,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd September 6, 2002
+.Dd March 31, 2026
 .Dt ATEXIT 3
 .Os
 .Sh NAME
@@ -90,6 +90,7 @@ function was called by a program that did not supply a
 implementation.
 .El
 .Sh SEE ALSO
+.Xr _exit 2 ,
 .Xr at_quick_exit 3 ,
 .Xr exit 3
 .Sh STANDARDS
diff --git a/lib/libc/stdlib/realpath.3 b/lib/libc/stdlib/realpath.3
index 76f40249963b..a17ddee0b2f1 100644
--- a/lib/libc/stdlib/realpath.3
+++ b/lib/libc/stdlib/realpath.3
@@ -28,7 +28,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd October 10, 2025
+.Dd March 18, 2026
 .Dt REALPATH 3
 .Os
 .Sh NAME
@@ -75,27 +75,24 @@ must exist when
 is called, and all but the last component must name either directories or
 symlinks pointing to the directories.
 .Sh "RETURN VALUES"
-The
+On success, the
 .Fn realpath
 function returns
 .Fa resolved_path
-on success.
-If the function was supplied
-.Dv NULL
-as
-.Fa resolved_path ,
-and operation did not cause errors, the returned value is
-a null-terminated string in a buffer allocated by a call to
-.Fn malloc 3 .
+if it was not
+.Dv NULL ,
+or a pointer to a null-terminated string which must be freed by the
+caller if it was.
 If an error occurs,
 .Fn realpath
 returns
 .Dv NULL ,
 and if
 .Fa resolved_path
-is not
+was not
 .Dv NULL ,
-the array that it points to contains the pathname which caused the problem.
+the array that it points to contains the pathname which caused the
+problem.
 .Sh ERRORS
 The function
 .Fn realpath
@@ -107,6 +104,9 @@ for any of the errors specified for the library functions
 and
 .Xr getcwd 3 .
 .Sh SEE ALSO
+.Xr basename 3 ,
+.Xr dirname 3 ,
+.Xr free 3 ,
 .Xr getcwd 3
 .Sh STANDARDS
 The
@@ -118,15 +118,3 @@ The
 .Fn realpath
 function first appeared in
 .Bx 4.4 .
-.Sh CAVEATS
-This implementation of
-.Fn realpath
-differs slightly from the Solaris implementation.
-The
-.Bx 4.4
-version always returns absolute pathnames,
-whereas the Solaris implementation will,
-under certain circumstances, return a relative
-.Fa resolved_path
-when given a relative
-.Fa pathname .
diff --git a/lib/libc/stdlib/realpath.c b/lib/libc/stdlib/realpath.c
index 18f29e95ee6b..9dc0cc4d3dd4 100644
--- a/lib/libc/stdlib/realpath.c
+++ b/lib/libc/stdlib/realpath.c
@@ -98,7 +98,6 @@ realpath1(const char *path, char *resolved)
 			left_len = 0;
 		}
 
-		prev_len = resolved_len;
 		if (resolved[resolved_len - 1] != '/') {
 			if (resolved_len + 1 >= PATH_MAX) {
 				errno = ENAMETOOLONG;
@@ -129,7 +128,9 @@ realpath1(const char *path, char *resolved)
 		/*
 		 * Append the next path component and lstat() it.
 		 */
-		resolved_len = strlcat(resolved, next_token, PATH_MAX);
+		prev_len = resolved_len;
+		resolved_len += strlcpy(resolved + prev_len, next_token,
+		    PATH_MAX - prev_len);
 		if (resolved_len >= PATH_MAX) {
 			errno = ENAMETOOLONG;
 			return (NULL);
@@ -141,8 +142,11 @@ realpath1(const char *path, char *resolved)
 			 * directory is not a directory.  Rewind the path
 			 * to correctly indicate where the error lies.
 			 */
-			if (errno == EACCES || errno == ENOTDIR)
+			if (errno == EACCES || errno == ENOTDIR) {
+				if (prev_len > 1)
+					prev_len--;
 				resolved[prev_len] = '\0';
+			}
 			return (NULL);
 		}
 		if (S_ISLNK(sb.st_mode)) {