36 files changed, 1421 insertions, 353 deletions

diff --git a/lib/clang/libclang/Makefile b/lib/clang/libclang/Makefile
index 14c3778d514a..9b9e0cbadcd7 100644
--- a/lib/clang/libclang/Makefile
+++ b/lib/clang/libclang/Makefile
@@ -2,7 +2,22 @@
 .include <bsd.init.mk>
 .include "../clang.pre.mk"
 
+.if defined(TOOLS_PREFIX)
+# Build static library during cross-tools stage
 LIB=		clang
+INTERNALLIB=
+.else
+PACKAGE=	clang
+SHLIB_CXX=	clang
+SHLIB_MAJOR=	19
+PRIVATELIB=
+.if ${MACHINE} == "powerpc"
+# Work around "relocation R_PPC_GOT16 out of range" errors
+PICFLAG=        -fPIC
+.endif
+.endif
+
+SHARED_CXXFLAGS+=	-UPIC # To avoid compile errors
 
 CFLAGS+=	-I${.OBJDIR}
 CFLAGS+=	-I${OBJTOP}/lib/clang/libllvm
@@ -71,7 +86,7 @@ SRCS_MIN+=	AST/CommentParser.cpp
 SRCS_MIN+=	AST/CommentSema.cpp
 SRCS_MIN+=	AST/ComparisonCategories.cpp
 SRCS_MIN+=	AST/ComputeDependence.cpp
-SRCS_FUL+=	AST/DataCollection.cpp
+SRCS_MIN+=	AST/DataCollection.cpp
 SRCS_MIN+=	AST/Decl.cpp
 SRCS_MIN+=	AST/DeclBase.cpp
 SRCS_MIN+=	AST/DeclCXX.cpp
@@ -159,7 +174,9 @@ SRCS_MIN+=	AST/VTableBuilder.cpp
 SRCS_MIN+=	ASTMatchers/ASTMatchFinder.cpp
 SRCS_MIN+=	ASTMatchers/ASTMatchersInternal.cpp
 SRCS_MIN+=	ASTMatchers/Dynamic/Diagnostics.cpp
+SRCS_MIN+=	ASTMatchers/Dynamic/Marshallers.cpp
 SRCS_MIN+=	ASTMatchers/Dynamic/Registry.cpp
+SRCS_MIN+=	ASTMatchers/Dynamic/VariantValue.cpp
 SRCS_MIN+=	Analysis/AnalysisDeclContext.cpp
 SRCS_MIN+=	Analysis/BodyFarm.cpp
 SRCS_MIN+=	Analysis/CFG.cpp
@@ -425,27 +442,27 @@ SRCS_MIN+=	ExtractAPI/DeclarationFragments.cpp
 SRCS_MIN+=	ExtractAPI/ExtractAPIConsumer.cpp
 SRCS_MIN+=	ExtractAPI/Serialization/SymbolGraphSerializer.cpp
 SRCS_MIN+=	ExtractAPI/TypedefUnderlyingTypeResolver.cpp
-SRCS_EXT+=	Format/AffectedRangeManager.cpp
-SRCS_EXT+=	Format/BreakableToken.cpp
-SRCS_EXT+=	Format/ContinuationIndenter.cpp
-SRCS_EXT+=	Format/DefinitionBlockSeparator.cpp
-SRCS_EXT+=	Format/Format.cpp
-SRCS_EXT+=	Format/FormatToken.cpp
-SRCS_EXT+=	Format/FormatTokenLexer.cpp
-SRCS_EXT+=	Format/IntegerLiteralSeparatorFixer.cpp
-SRCS_EXT+=	Format/MacroCallReconstructor.cpp
-SRCS_EXT+=	Format/MacroExpander.cpp
+SRCS_MIN+=	Format/AffectedRangeManager.cpp
+SRCS_MIN+=	Format/BreakableToken.cpp
+SRCS_MIN+=	Format/ContinuationIndenter.cpp
+SRCS_MIN+=	Format/DefinitionBlockSeparator.cpp
+SRCS_MIN+=	Format/Format.cpp
+SRCS_MIN+=	Format/FormatToken.cpp
+SRCS_MIN+=	Format/FormatTokenLexer.cpp
+SRCS_MIN+=	Format/IntegerLiteralSeparatorFixer.cpp
+SRCS_MIN+=	Format/MacroCallReconstructor.cpp
+SRCS_MIN+=	Format/MacroExpander.cpp
 SRCS_EXT+=	Format/MatchFilePath.cpp
-SRCS_EXT+=	Format/NamespaceEndCommentsFixer.cpp
-SRCS_EXT+=	Format/ObjCPropertyAttributeOrderFixer.cpp
-SRCS_EXT+=	Format/QualifierAlignmentFixer.cpp
-SRCS_EXT+=	Format/SortJavaScriptImports.cpp
-SRCS_EXT+=	Format/TokenAnalyzer.cpp
-SRCS_EXT+=	Format/TokenAnnotator.cpp
-SRCS_EXT+=	Format/UnwrappedLineFormatter.cpp
-SRCS_EXT+=	Format/UnwrappedLineParser.cpp
-SRCS_EXT+=	Format/UsingDeclarationsSorter.cpp
-SRCS_EXT+=	Format/WhitespaceManager.cpp
+SRCS_MIN+=	Format/NamespaceEndCommentsFixer.cpp
+SRCS_MIN+=	Format/ObjCPropertyAttributeOrderFixer.cpp
+SRCS_MIN+=	Format/QualifierAlignmentFixer.cpp
+SRCS_MIN+=	Format/SortJavaScriptImports.cpp
+SRCS_MIN+=	Format/TokenAnalyzer.cpp
+SRCS_MIN+=	Format/TokenAnnotator.cpp
+SRCS_MIN+=	Format/UnwrappedLineFormatter.cpp
+SRCS_MIN+=	Format/UnwrappedLineParser.cpp
+SRCS_MIN+=	Format/UsingDeclarationsSorter.cpp
+SRCS_MIN+=	Format/WhitespaceManager.cpp
 SRCS_MIN+=	Frontend/ASTConsumers.cpp
 SRCS_MIN+=	Frontend/ASTMerge.cpp
 SRCS_MIN+=	Frontend/ASTUnit.cpp
@@ -825,10 +842,19 @@ SRCS_MIN+=	Tooling/ArgumentsAdjusters.cpp
 SRCS_MIN+=	Tooling/CommonOptionsParser.cpp
 SRCS_MIN+=	Tooling/CompilationDatabase.cpp
 SRCS_MIN+=	Tooling/Core/Replacement.cpp
+SRCS_MIN+=	Tooling/DependencyScanning/DependencyScanningFilesystem.cpp
+SRCS_MIN+=	Tooling/DependencyScanning/DependencyScanningService.cpp
+SRCS_MIN+=	Tooling/DependencyScanning/DependencyScanningTool.cpp
+SRCS_MIN+=	Tooling/DependencyScanning/DependencyScanningWorker.cpp
+SRCS_MIN+=	Tooling/DependencyScanning/ModuleDepCollector.cpp
+SRCS_MIN+=	Tooling/ExpandResponseFilesCompilationDatabase.cpp
 SRCS_MIN+=	Tooling/FileMatchTrie.cpp
-SRCS_EXT+=	Tooling/Inclusions/HeaderIncludes.cpp
-SRCS_EXT+=	Tooling/Inclusions/IncludeStyle.cpp
+SRCS_MIN+=	Tooling/GuessTargetAndModeCompilationDatabase.cpp
+SRCS_MIN+=	Tooling/Inclusions/HeaderIncludes.cpp
+SRCS_MIN+=	Tooling/Inclusions/IncludeStyle.cpp
+SRCS_MIN+=	Tooling/InterpolatingCompilationDatabase.cpp
 SRCS_MIN+=	Tooling/JSONCompilationDatabase.cpp
+SRCS_MIN+=	Tooling/LocateToolCompilationDatabase.cpp
 SRCS_MIN+=	Tooling/Refactoring.cpp
 SRCS_MIN+=	Tooling/RefactoringCallbacks.cpp
 SRCS_MIN+=	Tooling/Tooling.cpp
@@ -845,6 +871,21 @@ SRCS_ALL+=	${SRCS_LDB}
 .endif
 SRCS+=		${SRCS_ALL:O}
 
+LIBDEPS+=	llvm
+
+.if defined(TOOLS_PREFIX)
+LIBPRIV=
+LIBEXT=		a
+.else
+LIBPRIV=	private
+LIBEXT=		so
+.endif
+
+.for lib in ${LIBDEPS}
+DPADD+=		${OBJTOP}/lib/clang/lib${lib}/lib${LIBPRIV}${lib}.${LIBEXT}
+LDADD+=		${OBJTOP}/lib/clang/lib${lib}/lib${LIBPRIV}${lib}.${LIBEXT}
+.endfor
+
 clang/AST/AbstractBasicReader.inc: \
 	${CLANG_SRCS}/include/clang/AST/PropertiesBase.td
 	${CLANG_TBLGEN} -gen-clang-basic-reader \
@@ -1300,6 +1341,4 @@ CLEANFILES+=	${TGHDRS} ${TGHDRS:C/$/.d/}
 
 .include "../clang.build.mk"
 
-INTERNALLIB=
-
 .include <bsd.lib.mk>
diff --git a/lib/clang/liblldb/Makefile b/lib/clang/liblldb/Makefile
index 48966d7cccf5..408ebc440686 100644
--- a/lib/clang/liblldb/Makefile
+++ b/lib/clang/liblldb/Makefile
@@ -2,7 +2,13 @@
 .include <bsd.init.mk>
 .include "../lldb.pre.mk"
 
-LIB=		lldb
+PACKAGE=	lldb
+SHLIB_CXX=	lldb
+SHLIB_MAJOR=	19
+PRIVATELIB=
+
+SHARED_CXXFLAGS+=	-UPIC # To avoid compile errors
+
 SRCDIR=		lldb/source
 
 CFLAGS+=	-I${LLDB_SRCS}/include
@@ -745,6 +751,19 @@ SRCS+=		Utility/VMRange.cpp
 SRCS+=		Utility/XcodeSDK.cpp
 SRCS+=		Version/Version.cpp
 
+LIBDEPS+=	clang
+LIBDEPS+=	llvm
+
+LIBPRIV=	private
+LIBEXT=		so
+
+.for lib in ${LIBDEPS}
+DPADD+=		${OBJTOP}/lib/clang/lib${lib}/lib${LIBPRIV}${lib}.${LIBEXT}
+LDADD+=		${OBJTOP}/lib/clang/lib${lib}/lib${LIBPRIV}${lib}.${LIBEXT}
+.endfor
+
+LIBADD+=	kvm
+
 LLDB_TBLGEN?=	lldb-tblgen
 
 CommandOptions.inc: ${LLDB_SRCS}/source/Commands/Options.td
@@ -780,8 +799,6 @@ CLEANFILES+=	${TGHDRS} ${TGHDRS:C/$/.d/}
 
 .include "../clang.build.mk"
 
-INTERNALLIB=
-
 # Building lldb's bindings requires swig, but we do not want to include it in
 # the FreeBSD base system (as a build tool) because it has non-trivial
 # dependencies.  As a workaround we commit the generated file.  Requires the
diff --git a/lib/clang/libllvm/Makefile b/lib/clang/libllvm/Makefile
index 98434d040baa..cb16d39961ae 100644
--- a/lib/clang/libllvm/Makefile
+++ b/lib/clang/libllvm/Makefile
@@ -2,8 +2,22 @@
 .include <bsd.init.mk>
 .include "../llvm.pre.mk"
 
+.if defined(TOOLS_PREFIX)
+# Build static library during cross-tools stage
 LIB=		llvm
 INTERNALLIB=
+.else
+PACKAGE=	clang
+SHLIB_CXX=	llvm
+SHLIB_MAJOR=	19
+PRIVATELIB=
+.if ${MACHINE} == "powerpc"
+# Work around "relocation R_PPC_GOT16 out of range" errors
+PICFLAG=        -fPIC
+.endif
+.endif
+
+SHARED_CXXFLAGS+=	-UPIC # To avoid compile errors
 
 CFLAGS+=	-I${.OBJDIR}
 CFLAGS+=	-I${SRCTOP}/sys/contrib/zstd/lib
@@ -140,7 +154,6 @@ SRCS_MIN+=	Analysis/RegionPass.cpp
 SRCS_MIN+=	Analysis/RegionPrinter.cpp
 SRCS_MIN+=	Analysis/ReplayInlineAdvisor.cpp
 SRCS_MIN+=	Analysis/ScalarEvolution.cpp
-SRCS_MIN+=	Analysis/ScalarEvolution.cpp
 SRCS_MIN+=	Analysis/ScalarEvolutionAliasAnalysis.cpp
 SRCS_MIN+=	Analysis/ScalarEvolutionDivision.cpp
 SRCS_MIN+=	Analysis/ScalarEvolutionNormalization.cpp
@@ -510,24 +523,24 @@ SRCS_EXT+=	DWP/DWP.cpp
 SRCS_EXT+=	DWP/DWPError.cpp
 SRCS_MIW+=	DebugInfo/BTF/BTFContext.cpp
 SRCS_MIW+=	DebugInfo/BTF/BTFParser.cpp
-SRCS_EXT+=	DebugInfo/CodeView/AppendingTypeTableBuilder.cpp
+SRCS_MIN+=	DebugInfo/CodeView/AppendingTypeTableBuilder.cpp
 SRCS_MIN+=	DebugInfo/CodeView/CVSymbolVisitor.cpp
 SRCS_MIN+=	DebugInfo/CodeView/CVTypeVisitor.cpp
 SRCS_MIN+=	DebugInfo/CodeView/CodeViewError.cpp
 SRCS_MIN+=	DebugInfo/CodeView/CodeViewRecordIO.cpp
 SRCS_MIN+=	DebugInfo/CodeView/ContinuationRecordBuilder.cpp
 SRCS_MIN+=	DebugInfo/CodeView/DebugChecksumsSubsection.cpp
-SRCS_EXT+=	DebugInfo/CodeView/DebugCrossExSubsection.cpp
-SRCS_EXT+=	DebugInfo/CodeView/DebugCrossImpSubsection.cpp
+SRCS_MIN+=	DebugInfo/CodeView/DebugCrossExSubsection.cpp
+SRCS_MIN+=	DebugInfo/CodeView/DebugCrossImpSubsection.cpp
 SRCS_MIN+=	DebugInfo/CodeView/DebugFrameDataSubsection.cpp
 SRCS_MIN+=	DebugInfo/CodeView/DebugInlineeLinesSubsection.cpp
 SRCS_MIN+=	DebugInfo/CodeView/DebugLinesSubsection.cpp
 SRCS_MIN+=	DebugInfo/CodeView/DebugStringTableSubsection.cpp
-SRCS_MIW+=	DebugInfo/CodeView/DebugSubsection.cpp
-SRCS_EXT+=	DebugInfo/CodeView/DebugSubsectionRecord.cpp
-SRCS_EXT+=	DebugInfo/CodeView/DebugSubsectionVisitor.cpp
-SRCS_EXT+=	DebugInfo/CodeView/DebugSymbolRVASubsection.cpp
-SRCS_EXT+=	DebugInfo/CodeView/DebugSymbolsSubsection.cpp
+SRCS_MIN+=	DebugInfo/CodeView/DebugSubsection.cpp
+SRCS_MIN+=	DebugInfo/CodeView/DebugSubsectionRecord.cpp
+SRCS_MIN+=	DebugInfo/CodeView/DebugSubsectionVisitor.cpp
+SRCS_MIN+=	DebugInfo/CodeView/DebugSymbolRVASubsection.cpp
+SRCS_MIN+=	DebugInfo/CodeView/DebugSymbolsSubsection.cpp
 SRCS_MIN+=	DebugInfo/CodeView/EnumTables.cpp
 SRCS_MIN+=	DebugInfo/CodeView/Formatters.cpp
 SRCS_MIN+=	DebugInfo/CodeView/GlobalTypeTableBuilder.cpp
@@ -541,7 +554,7 @@ SRCS_EXT+=	DebugInfo/CodeView/StringsAndChecksums.cpp
 SRCS_MIN+=	DebugInfo/CodeView/SymbolDumper.cpp
 SRCS_MIN+=	DebugInfo/CodeView/SymbolRecordHelpers.cpp
 SRCS_MIN+=	DebugInfo/CodeView/SymbolRecordMapping.cpp
-SRCS_EXT+=	DebugInfo/CodeView/SymbolSerializer.cpp
+SRCS_MIN+=	DebugInfo/CodeView/SymbolSerializer.cpp
 SRCS_MIN+=	DebugInfo/CodeView/TypeDumpVisitor.cpp
 SRCS_MIN+=	DebugInfo/CodeView/TypeHashing.cpp
 SRCS_MIN+=	DebugInfo/CodeView/TypeIndex.cpp
@@ -550,37 +563,37 @@ SRCS_EXT+=	DebugInfo/CodeView/TypeRecordHelpers.cpp
 SRCS_MIN+=	DebugInfo/CodeView/TypeRecordMapping.cpp
 SRCS_MIN+=	DebugInfo/CodeView/TypeStreamMerger.cpp
 SRCS_MIN+=	DebugInfo/CodeView/TypeTableCollection.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFAbbreviationDeclaration.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFAcceleratorTable.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFAddressRange.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFCompileUnit.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFContext.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDataExtractor.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugAbbrev.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugAddr.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugArangeSet.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugAranges.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugFrame.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugInfoEntry.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugLine.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugLoc.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugMacro.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugPubTable.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugRangeList.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDebugRnglists.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFDie.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFAbbreviationDeclaration.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFAcceleratorTable.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFAddressRange.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFCompileUnit.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFContext.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDataExtractor.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugAbbrev.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugAddr.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugArangeSet.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugAranges.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugFrame.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugInfoEntry.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugLine.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugLoc.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugMacro.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugPubTable.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugRangeList.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDebugRnglists.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFDie.cpp
 SRCS_MIN+=	DebugInfo/DWARF/DWARFExpression.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFFormValue.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFGdbIndex.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFListTable.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFTypePrinter.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFTypeUnit.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFUnit.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFUnitIndex.cpp
-SRCS_MIW+=	DebugInfo/DWARF/DWARFVerifier.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFFormValue.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFGdbIndex.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFListTable.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFTypePrinter.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFTypeUnit.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFUnit.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFUnitIndex.cpp
+SRCS_MIN+=	DebugInfo/DWARF/DWARFVerifier.cpp
 SRCS_MIN+=	DebugInfo/MSF/MSFBuilder.cpp
 SRCS_MIN+=	DebugInfo/MSF/MSFCommon.cpp
-SRCS_EXT+=	DebugInfo/MSF/MSFError.cpp
+SRCS_MIN+=	DebugInfo/MSF/MSFError.cpp
 SRCS_MIN+=	DebugInfo/MSF/MappedBlockStream.cpp
 SRCS_EXT+=	DebugInfo/PDB/GenericError.cpp
 SRCS_EXT+=	DebugInfo/PDB/IPDBSourceFile.cpp
@@ -868,7 +881,7 @@ SRCS_MIN+=	LTO/LTO.cpp
 SRCS_MIN+=	LTO/LTOBackend.cpp
 SRCS_EXL+=	LTO/LTOCodeGenerator.cpp
 SRCS_EXL+=	LTO/LTOModule.cpp
-SRCS_EXL+=	LTO/SummaryBasedOptimizations.cpp
+SRCS_MIN+=	LTO/SummaryBasedOptimizations.cpp
 SRCS_EXL+=	LTO/ThinLTOCodeGenerator.cpp
 SRCS_MIN+=	LTO/UpdateCompilerUsed.cpp
 SRCS_MIN+=	Linker/IRMover.cpp
@@ -893,7 +906,7 @@ SRCS_MIN+=	MC/MCContext.cpp
 SRCS_MIN+=	MC/MCDXContainerStreamer.cpp
 SRCS_MIN+=	MC/MCDXContainerWriter.cpp
 SRCS_XDL+=	MC/MCDisassembler/Disassembler.cpp
-SRCS_XDW+=	MC/MCDisassembler/MCDisassembler.cpp
+SRCS_MIN+=	MC/MCDisassembler/MCDisassembler.cpp
 SRCS_XDW+=	MC/MCDisassembler/MCExternalSymbolizer.cpp
 SRCS_MIN+=	MC/MCDisassembler/MCRelocationInfo.cpp
 SRCS_XDW+=	MC/MCDisassembler/MCSymbolizer.cpp
@@ -1007,9 +1020,9 @@ SRCS_MIW+=	ObjCopy/wasm/WasmWriter.cpp
 SRCS_MIN+=	Object/Archive.cpp
 SRCS_MIN+=	Object/ArchiveWriter.cpp
 SRCS_MIN+=	Object/Binary.cpp
-SRCS_MIW+=	Object/BuildID.cpp
+SRCS_MIN+=	Object/BuildID.cpp
 SRCS_MIN+=	Object/COFFImportFile.cpp
-SRCS_MIW+=	Object/COFFModuleDefinition.cpp
+SRCS_MIN+=	Object/COFFModuleDefinition.cpp
 SRCS_MIN+=	Object/COFFObjectFile.cpp
 SRCS_MIN+=	Object/Decompressor.cpp
 SRCS_MIN+=	Object/ELF.cpp
@@ -1019,31 +1032,34 @@ SRCS_MIW+=	Object/FaultMapParser.cpp
 SRCS_MIN+=	Object/IRObjectFile.cpp
 SRCS_MIN+=	Object/IRSymtab.cpp
 SRCS_MIN+=	Object/MachOObjectFile.cpp
-SRCS_MIW+=	Object/MachOUniversal.cpp
+SRCS_MIN+=	Object/MachOUniversal.cpp
 SRCS_MIW+=	Object/MachOUniversalWriter.cpp
-SRCS_MIW+=	Object/Minidump.cpp
+SRCS_MIN+=	Object/Minidump.cpp
 SRCS_MIN+=	Object/ModuleSymbolTable.cpp
 SRCS_EXT+=	Object/Object.cpp
 SRCS_MIN+=	Object/ObjectFile.cpp
-SRCS_MIW+=	Object/OffloadBinary.cpp
+SRCS_MIN+=	Object/OffloadBinary.cpp
 SRCS_MIN+=	Object/RecordStreamer.cpp
-SRCS_MIW+=	Object/RelocationResolver.cpp
+SRCS_MIN+=	Object/RelocationResolver.cpp
 SRCS_MIW+=	Object/SymbolSize.cpp
 SRCS_MIN+=	Object/SymbolicFile.cpp
-SRCS_MIW+=	Object/TapiFile.cpp
-SRCS_MIW+=	Object/TapiUniversal.cpp
+SRCS_MIN+=	Object/TapiFile.cpp
+SRCS_MIN+=	Object/TapiUniversal.cpp
 SRCS_MIN+=	Object/WasmObjectFile.cpp
 SRCS_MIW+=	Object/WindowsMachineFlag.cpp
 SRCS_MIN+=	Object/WindowsResource.cpp
 SRCS_MIN+=	Object/XCOFFObjectFile.cpp
 SRCS_MIN+=	ObjectYAML/COFFYAML.cpp
-SRCS_EXT+=	ObjectYAML/CodeViewYAMLDebugSections.cpp
-SRCS_EXT+=	ObjectYAML/CodeViewYAMLSymbols.cpp
-SRCS_EXT+=	ObjectYAML/CodeViewYAMLTypes.cpp
+SRCS_MIN+=	ObjectYAML/CodeViewYAMLDebugSections.cpp
+SRCS_MIN+=	ObjectYAML/CodeViewYAMLSymbols.cpp
+SRCS_MIN+=	ObjectYAML/CodeViewYAMLTypeHashing.cpp
+SRCS_MIN+=	ObjectYAML/CodeViewYAMLTypes.cpp
+SRCS_MIN+=	ObjectYAML/DWARFEmitter.cpp
 SRCS_MIN+=	ObjectYAML/DWARFYAML.cpp
+SRCS_MIN+=	ObjectYAML/ELFEmitter.cpp
 SRCS_MIN+=	ObjectYAML/ELFYAML.cpp
 SRCS_MIN+=	ObjectYAML/MachOYAML.cpp
-SRCS_EXT+=	ObjectYAML/YAML.cpp
+SRCS_MIN+=	ObjectYAML/YAML.cpp
 SRCS_MIN+=	Option/Arg.cpp
 SRCS_MIN+=	Option/ArgList.cpp
 SRCS_MIN+=	Option/OptTable.cpp
@@ -1136,7 +1152,7 @@ SRCS_MIN+=	Support/ErrorHandling.cpp
 SRCS_MIN+=	Support/ExponentialBackoff.cpp
 SRCS_MIN+=	Support/ExtensibleRTTI.cpp
 SRCS_MIN+=	Support/FileCollector.cpp
-SRCS_MIW+=	Support/FileOutputBuffer.cpp
+SRCS_MIN+=	Support/FileOutputBuffer.cpp
 SRCS_MIN+=	Support/FileUtilities.cpp
 SRCS_MIN+=	Support/FloatingPointMode.cpp
 SRCS_MIN+=	Support/FoldingSet.cpp
@@ -1162,7 +1178,7 @@ SRCS_MIW+=	Support/MSP430Attributes.cpp
 SRCS_MIN+=	Support/ManagedStatic.cpp
 SRCS_MIN+=	Support/MathExtras.cpp
 SRCS_MIN+=	Support/MemAlloc.cpp
-SRCS_MIW+=	Support/Memory.cpp
+SRCS_MIN+=	Support/Memory.cpp
 SRCS_MIN+=	Support/MemoryBuffer.cpp
 SRCS_MIN+=	Support/MemoryBufferRef.cpp
 SRCS_MIN+=	Support/NativeFormatting.cpp
@@ -1201,7 +1217,7 @@ SRCS_MIN+=	Support/SuffixTree.cpp
 SRCS_MIN+=	Support/SuffixTreeNode.cpp
 SRCS_EXT+=	Support/SystemUtils.cpp
 SRCS_LLD+=	Support/TarWriter.cpp
-SRCS_MIW+=	Support/ThreadPool.cpp
+SRCS_MIN+=	Support/ThreadPool.cpp
 SRCS_MIN+=	Support/Threading.cpp
 SRCS_MIN+=	Support/TimeProfiler.cpp
 SRCS_MIN+=	Support/Timer.cpp
@@ -1696,21 +1712,22 @@ SRCS_MIN+=	TargetParser/SubtargetFeature.cpp
 SRCS_MIN+=	TargetParser/TargetParser.cpp
 SRCS_MIN+=	TargetParser/Triple.cpp
 SRCS_MIN+=	TargetParser/X86TargetParser.cpp
-SRCS_MIW+=	TextAPI/Architecture.cpp
-SRCS_MIW+=	TextAPI/ArchitectureSet.cpp
+SRCS_MIN+=	TextAPI/Architecture.cpp
+SRCS_MIN+=	TextAPI/ArchitectureSet.cpp
 SRCS_MIW+=	TextAPI/BinaryReader/DylibReader.cpp
-SRCS_MIW+=	TextAPI/InterfaceFile.cpp
-SRCS_MIW+=	TextAPI/PackedVersion.cpp
-SRCS_MIW+=	TextAPI/Platform.cpp
+SRCS_MIN+=	TextAPI/InterfaceFile.cpp
+SRCS_MIN+=	TextAPI/PackedVersion.cpp
+SRCS_MIN+=	TextAPI/Platform.cpp
 SRCS_MIW+=	TextAPI/RecordVisitor.cpp
-SRCS_MIW+=	TextAPI/Symbol.cpp
-SRCS_MIW+=	TextAPI/SymbolSet.cpp
-SRCS_MIW+=	TextAPI/Target.cpp
-SRCS_MIW+=	TextAPI/TextAPIError.cpp
-SRCS_MIW+=	TextAPI/TextStub.cpp
-SRCS_MIW+=	TextAPI/TextStubCommon.cpp
-SRCS_MIW+=	TextAPI/TextStubV5.cpp
-SRCS_MIW+=	TextAPI/Utils.cpp
+SRCS_MIW+=	TextAPI/RecordsSlice.cpp
+SRCS_MIN+=	TextAPI/Symbol.cpp
+SRCS_MIN+=	TextAPI/SymbolSet.cpp
+SRCS_MIN+=	TextAPI/Target.cpp
+SRCS_MIN+=	TextAPI/TextAPIError.cpp
+SRCS_MIN+=	TextAPI/TextStub.cpp
+SRCS_MIN+=	TextAPI/TextStubCommon.cpp
+SRCS_MIN+=	TextAPI/TextStubV5.cpp
+SRCS_MIN+=	TextAPI/Utils.cpp
 SRCS_MIN+=	ToolDrivers/llvm-dlltool/DlltoolDriver.cpp
 SRCS_MIW+=	ToolDrivers/llvm-lib/LibDriver.cpp
 SRCS_MIN+=	Transforms/AggressiveInstCombine/AggressiveInstCombine.cpp
diff --git a/lib/googletest/gmock/Makefile b/lib/googletest/gmock/Makefile
index efe544932b94..b896c789a8bc 100644
--- a/lib/googletest/gmock/Makefile
+++ b/lib/googletest/gmock/Makefile
@@ -17,27 +17,25 @@ LDFLAGS+=	-L${.OBJDIR:H}/gtest
 INCSGROUPS=	MAIN_INCS INTERNAL_INCS INTERNAL_CUSTOM_INCS
 
 MAIN_INCSDIR=	${INCLUDEDIR}${PRIVATELIB:D/private/${LIB}}
+MAIN_INCS+=	gmock/gmock-actions.h
+MAIN_INCS+=	gmock/gmock-cardinalities.h
+MAIN_INCS+=	gmock/gmock-function-mocker.h
 MAIN_INCS+=	gmock/gmock-matchers.h
 MAIN_INCS+=	gmock/gmock-more-actions.h
-MAIN_INCS+=	gmock/gmock-generated-actions.h
-MAIN_INCS+=	gmock/gmock-generated-matchers.h
-MAIN_INCS+=	gmock/gmock-generated-nice-strict.h
 MAIN_INCS+=	gmock/gmock-more-matchers.h
-MAIN_INCS+=	gmock/gmock-generated-function-mockers.h
-MAIN_INCS+=	gmock/gmock-cardinalities.h
+MAIN_INCS+=	gmock/gmock-nice-strict.h
 MAIN_INCS+=	gmock/gmock-spec-builders.h
 MAIN_INCS+=	gmock/gmock.h
-MAIN_INCS+=	gmock/gmock-actions.h
 
 INTERNAL_INCSDIR=	${MAIN_INCSDIR}/internal
-INTERNAL_INCS+=		gmock/internal/gmock-port.h
 INTERNAL_INCS+=		gmock/internal/gmock-internal-utils.h
-INTERNAL_INCS+=		gmock/internal/gmock-generated-internal-utils.h
+INTERNAL_INCS+=		gmock/internal/gmock-port.h
+INTERNAL_INCS+=		gmock/internal/gmock-pp.h
 
 INTERNAL_CUSTOM_INCSDIR= ${INTERNAL_INCSDIR}/custom
-INTERNAL_CUSTOM_INCS+=	gmock/internal/custom/gmock-port.h
-INTERNAL_CUSTOM_INCS+=	gmock/internal/custom/gmock-matchers.h
 INTERNAL_CUSTOM_INCS+=	gmock/internal/custom/gmock-generated-actions.h
+INTERNAL_CUSTOM_INCS+=	gmock/internal/custom/gmock-matchers.h
+INTERNAL_CUSTOM_INCS+=	gmock/internal/custom/gmock-port.h
 
 SRCS+=		gmock-all.cc
 
diff --git a/lib/googletest/gtest/Makefile b/lib/googletest/gtest/Makefile
index 568d2c8fec41..fbfcfb5e1b3c 100644
--- a/lib/googletest/gtest/Makefile
+++ b/lib/googletest/gtest/Makefile
@@ -13,7 +13,9 @@ CXXFLAGS+=	-I${GOOGLETEST_SRCROOT}
 INCSGROUPS=	MAIN_INCS INTERNAL_INCS INTERNAL_CUSTOM_INCS
 
 MAIN_INCSDIR=	${INCLUDEDIR}${PRIVATELIB:D/private/${LIB}}
+MAIN_INCS+=	gtest/gtest-assertion-result.h
 MAIN_INCS+=	gtest/gtest-death-test.h
+MAIN_INCS+=	gtest/gtest-matchers.h
 MAIN_INCS+=	gtest/gtest-message.h
 MAIN_INCS+=	gtest/gtest-param-test.h
 MAIN_INCS+=	gtest/gtest-printers.h
@@ -28,13 +30,10 @@ INTERNAL_INCSDIR=	${MAIN_INCSDIR}/internal
 INTERNAL_INCS+=	gtest/internal/gtest-death-test-internal.h
 INTERNAL_INCS+=	gtest/internal/gtest-filepath.h
 INTERNAL_INCS+=	gtest/internal/gtest-internal.h
-INTERNAL_INCS+=	gtest/internal/gtest-linked_ptr.h
-INTERNAL_INCS+=	gtest/internal/gtest-param-util-generated.h
 INTERNAL_INCS+=	gtest/internal/gtest-param-util.h
 INTERNAL_INCS+=	gtest/internal/gtest-port-arch.h
 INTERNAL_INCS+=	gtest/internal/gtest-port.h
 INTERNAL_INCS+=	gtest/internal/gtest-string.h
-INTERNAL_INCS+=	gtest/internal/gtest-tuple.h
 INTERNAL_INCS+=	gtest/internal/gtest-type-util.h
 
 INTERNAL_CUSTOM_INCSDIR= ${INTERNAL_INCSDIR}/custom
diff --git a/lib/googletest/tests/gmock/Makefile b/lib/googletest/tests/gmock/Makefile
index c713520de094..5df1f48c0e4a 100644
--- a/lib/googletest/tests/gmock/Makefile
+++ b/lib/googletest/tests/gmock/Makefile
@@ -1,13 +1,10 @@
 
 .include <bsd.init.mk>
 
-.PATH: ${GOOGLEMOCK_SRCROOT}/src ${GOOGLEMOCK_SRCROOT}/test
+.PATH:	${GOOGLEMOCK_SRCROOT}/src ${GOOGLEMOCK_SRCROOT}/test
 
 GTESTS+=	gmock_stress_test
 
 LIBADD+=	pthread gtest gmock
 
-# The next release will resolve a number of build warnings issues.
-MK_WERROR=	no
-
 .include <bsd.test.mk>
diff --git a/lib/googletest/tests/gmock_main/Makefile b/lib/googletest/tests/gmock_main/Makefile
index 7f80fa2b732b..7523b585ac2c 100644
--- a/lib/googletest/tests/gmock_main/Makefile
+++ b/lib/googletest/tests/gmock_main/Makefile
@@ -5,17 +5,17 @@
 
 GTESTS+=	gmock-actions_test
 GTESTS+=	gmock-cardinalities_test
-GTESTS+=	gmock_ex_test
-GTESTS+=	gmock-generated-actions_test
-GTESTS+=	gmock-generated-function-mockers_test
-GTESTS+=	gmock-generated-internal-utils_test
-GTESTS+=	gmock-generated-matchers_test
+GTESTS+=	gmock-function-mocker_test
 GTESTS+=	gmock-internal-utils_test
-GTESTS+=	gmock-matchers_test
+GTESTS+=	gmock-matchers-arithmetic_test
+GTESTS+=	gmock-matchers-comparisons_test
+GTESTS+=	gmock-matchers-containers_test
+GTESTS+=	gmock-matchers-misc_test
 GTESTS+=	gmock-more-actions_test
 GTESTS+=	gmock-nice-strict_test
 GTESTS+=	gmock-port_test
 GTESTS+=	gmock-spec-builders_test
+GTESTS+=	gmock_ex_test
 GTESTS+=	gmock_link_test
 GTESTS+=	gmock_test
 
@@ -28,9 +28,12 @@ SRCS.gmock_link_test=		\
 	gmock_link_test.cc	\
 	gmock_link2_test.cc
 
-LIBADD=		gmock_main gmock gtest
+LIBADD=		gmock_main
 
-# The next release will resolve a number of build warnings issues.
-MK_WERROR=	no
+CXXFLAGS.clang+=	-Wno-error=inconsistent-missing-override
+CXXFLAGS.clang+=	-Wno-error=missing-variable-declarations
+CXXFLAGS.clang+=	-Wno-error=sign-compare
+CXXFLAGS.clang+=	-Wno-error=unused-parameter
+MK_WERROR.gcc=		no
 
 .include <bsd.test.mk>
diff --git a/lib/googletest/tests/gtest/Makefile b/lib/googletest/tests/gtest/Makefile
index 5e5a3db3781b..0000167dfe70 100644
--- a/lib/googletest/tests/gtest/Makefile
+++ b/lib/googletest/tests/gtest/Makefile
@@ -29,17 +29,17 @@ CXXFLAGS.gtest-death-test_ex_catch_test+=	\
 CXXFLAGS.gtest-death-test_ex_nocatch_test+=     \
 	-DGTEST_ENABLE_CATCH_EXCEPTIONS_=0
 
-SRCS.googletest-param-test-test=	\
-	googletest-param-test-test.cc	\
+SRCS.googletest-param-test-test=       \
+	googletest-param-test-test.cc   \
 	googletest-param-test2-test.cc
 
 LIBADD+=	gtest
 
+CXXFLAGS.clang+=	-Wno-error=missing-variable-declarations
+MK_WERROR.gcc=		no
+
 # XXX: explicitly listing -lpthread is incorrect. src.libnames.mk should be
 #      handling this.
-LIBADD.gtest_stress_test+=	pthread
-
-# The next release will resolve a number of build warnings issues.
-MK_WERROR=	no
+LIBADD.gtest_stress_test+=     pthread
 
 .include <bsd.test.mk>
diff --git a/lib/googletest/tests/gtest_main/Makefile b/lib/googletest/tests/gtest_main/Makefile
index 27f7c6fa7f36..3124042f8b95 100644
--- a/lib/googletest/tests/gtest_main/Makefile
+++ b/lib/googletest/tests/gtest_main/Makefile
@@ -5,20 +5,19 @@
 
 GTESTS+=	googletest-death-test-test
 GTESTS+=	googletest-filepath-test
-GTESTS+=	googletest-linked-ptr-test
 GTESTS+=	googletest-listener-test
-GTESTS+=	gtest_main_unittest
 GTESTS+=	googletest-message-test
 GTESTS+=	googletest-options-test
 GTESTS+=	googletest-port-test
-GTESTS+=	gtest_pred_impl_unittest
 GTESTS+=	googletest-printers-test
-GTESTS+=	gtest_prod_test
-GTESTS+=	gtest_sole_header_test
 GTESTS+=	googletest-test-part-test
 GTESTS+=	gtest-typed-test_test
+GTESTS+=	gtest_main_unittest
+GTESTS+=	gtest_pred_impl_unittest
+GTESTS+=	gtest_prod_test
 GTESTS+=	gtest_skip_test
 GTESTS+=	gtest_skip_in_environment_setup_test
+GTESTS+=	gtest_sole_header_test
 GTESTS+=	gtest_unittest
 
 CXXFLAGS+=	-I${GOOGLETEST_SRCROOT}/include
@@ -32,12 +31,13 @@ SRCS.gtest_prod_test=			\
 	gtest_prod_test.cc		\
 	production.cc
 
-LIBADD+=	gtest gtest_main
+LIBADD+=	gtest_main
 
 LIBADD.googletest-port-test+=	pthread
 LIBADD.gtest_unittest+=		pthread
 
-# The next release will resolve a number of build warnings issues.
-MK_WERROR=	no
+CXXFLAGS.clang+=	-Wno-error=missing-variable-declarations
+CXXFLAGS.clang+=	-Wno-error=unused-but-set-variable
+MK_WERROR.gcc=		no
 
 .include <bsd.test.mk>
diff --git a/lib/libarchive/Makefile b/lib/libarchive/Makefile
index de7eef14c34b..ffad23f7d65a 100644
--- a/lib/libarchive/Makefile
+++ b/lib/libarchive/Makefile
@@ -42,11 +42,11 @@ SRCS=	archive_acl.c					\
 	archive_entry_stat.c				\
 	archive_entry_strmode.c				\
 	archive_entry_xattr.c				\
-	archive_getdate.c				\
 	archive_hmac.c					\
 	archive_match.c					\
 	archive_options.c				\
 	archive_pack_dev.c				\
+	archive_parse_date.c				\
 	archive_pathmatch.c				\
 	archive_ppmd7.c					\
 	archive_ppmd8.c					\
@@ -101,6 +101,7 @@ SRCS=	archive_acl.c					\
 	archive_read_support_format_zip.c		\
 	archive_string.c				\
 	archive_string_sprintf.c			\
+	archive_time.c					\
 	archive_util.c					\
 	archive_version_details.c			\
 	archive_virtual.c				\
diff --git a/lib/libarchive/config_freebsd.h b/lib/libarchive/config_freebsd.h
index 49b212c2204c..746207360872 100644
--- a/lib/libarchive/config_freebsd.h
+++ b/lib/libarchive/config_freebsd.h
@@ -163,7 +163,6 @@
 #define HAVE_POSIX_SPAWNP 1
 #define HAVE_PTHREAD_H 1
 #define HAVE_PWD_H 1
-#define HAVE_READDIR_R 1
 #define HAVE_READLINK 1
 #define HAVE_READLINKAT 1
 #define HAVE_READPASSPHRASE 1
diff --git a/lib/libarchive/tests/Makefile b/lib/libarchive/tests/Makefile
index 2684d1661e57..b8f3e4646801 100644
--- a/lib/libarchive/tests/Makefile
+++ b/lib/libarchive/tests/Makefile
@@ -17,6 +17,7 @@ PROGS+=	libarchive_test
 CFLAGS+= -I${.CURDIR} -I${.CURDIR:H} -I${.OBJDIR}
 CFLAGS+= -I${_LIBARCHIVEDIR}/libarchive -I${_LIBARCHIVEDIR}/libarchive/test
 CFLAGS+= -I${_LIBARCHIVEDIR}/test_utils
+CFLAGS+= -I${SRCTOP}/sys/contrib/zstd/lib
 
 CFLAGS.test_utils.c+=	-Wno-cast-align
 
@@ -38,11 +39,11 @@ TESTS_SRCS= \
 	test_archive_clear_error.c		\
 	test_archive_cmdline.c			\
 	test_archive_digest.c			\
-	test_archive_getdate.c			\
 	test_archive_match_time.c		\
 	test_archive_match_owner.c		\
 	test_archive_match_path.c		\
 	test_archive_pathmatch.c		\
+	test_archive_parse_date.c		\
 	test_archive_read.c			\
 	test_archive_read_add_passphrase.c	\
 	test_archive_read_close_twice.c		\
@@ -72,6 +73,7 @@ TESTS_SRCS= \
 	test_compat_bzip2.c			\
 	test_compat_cpio.c			\
 	test_compat_gtar.c			\
+	test_compat_gtar_large.c		\
 	test_compat_gzip.c			\
 	test_compat_lz4.c			\
 	test_compat_lzip.c			\
@@ -148,7 +150,9 @@ TESTS_SRCS= \
 	test_read_format_gtar_filename.c	\
 	test_read_format_gtar_gz.c		\
 	test_read_format_gtar_lzma.c		\
+	test_read_format_gtar_redundant_L.c	\
 	test_read_format_gtar_sparse.c		\
+	test_read_format_gtar_sparse_length.c	\
 	test_read_format_gtar_sparse_skip_entry.c \
 	test_read_format_huge_rpm.c		\
 	test_read_format_iso_Z.c		\
@@ -178,6 +182,7 @@ TESTS_SRCS= \
 	test_read_format_rar_encryption_partially.c	\
 	test_read_format_rar_filter.c		\
 	test_read_format_rar_invalid1.c		\
+	test_read_format_rar_overflow.c		\
 	test_read_format_raw.c			\
 	test_read_format_tar.c			\
 	test_read_format_tar_concatenated.c	\
@@ -186,7 +191,10 @@ TESTS_SRCS= \
 	test_read_format_tar_empty_with_gnulabel.c	\
 	test_read_format_tar_filename.c		\
 	test_read_format_tar_invalid_pax_size.c \
+	test_read_format_tar_mac_metadata.c	\
+	test_read_format_tar_pax_g_large.c	\
 	test_read_format_tar_pax_large_attr.c	\
+	test_read_format_tar_pax_negative_time.c	\
 	test_read_format_tbz.c			\
 	test_read_format_tgz.c			\
 	test_read_format_tlz.c			\
@@ -219,6 +227,7 @@ TESTS_SRCS= \
 	test_read_format_zip_with_invalid_traditional_eocd.c	\
 	test_read_format_zip_zip64.c		\
 	test_read_large.c			\
+	test_read_pax_empty_val_no_nl.c		\
 	test_read_pax_xattr_rht_security_selinux.c	\
 	test_read_pax_xattr_schily.c		\
 	test_read_pax_truncated.c		\
@@ -287,6 +296,7 @@ TESTS_SRCS= \
 	test_write_format_mtree_classic_indent.c	\
 	test_write_format_mtree_fflags.c	\
 	test_write_format_mtree_no_separator.c	\
+	test_write_format_mtree_preset_digests.c	\
 	test_write_format_mtree_quoted_filename.c	\
 	test_write_format_pax.c			\
 	test_write_format_raw.c			\
@@ -303,6 +313,9 @@ TESTS_SRCS= \
 	test_write_format_xar_empty.c		\
 	test_write_format_zip.c			\
 	test_write_format_zip_compression_store.c	\
+	test_write_format_zip_compression_zstd.c	\
+	test_write_format_zip_compression_bzip2.c	\
+	test_write_format_zip_compression_lzmaxz.c	\
 	test_write_format_zip_empty.c		\
 	test_write_format_zip_empty_zip64.c	\
 	test_write_format_zip_entry_size_unset.c	\
@@ -450,6 +463,7 @@ ${PACKAGE}FILES+=	test_read_format_7zip_bcj2_copy_2.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_bcj2_copy_lzma.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_bcj2_deflate.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_deflate_arm64.7z.uu
+${PACKAGE}FILES+=	test_read_format_7zip_deflate_powerpc.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_bcj2_lzma1_1.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_bcj2_lzma1_2.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_bcj2_lzma2_1.7z.uu
@@ -479,16 +493,23 @@ ${PACKAGE}FILES+=	test_read_format_7zip_lzma1_lzma2.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_lzma2.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_lzma2_arm.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_lzma2_arm64.7z.uu
+${PACKAGE}FILES+=	test_read_format_7zip_lzma2_powerpc.7z.uu
+${PACKAGE}FILES+=	test_read_format_7zip_lzma2_riscv.7z.uu
+${PACKAGE}FILES+=	test_read_format_7zip_lzma2_sparc.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_malformed.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_malformed2.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_packinfo_digests.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_ppmd.7z.uu
+${PACKAGE}FILES+=	test_read_format_7zip_sfx_elf.elf.uu
+${PACKAGE}FILES+=	test_read_format_7zip_sfx_modified_pe.exe.uu
+${PACKAGE}FILES+=	test_read_format_7zip_sfx_pe.exe.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_solid_zstd.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_symbolic_name.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_zstd.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_zstd_arm.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_zstd_bcj.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_zstd_nobcj.7z.uu
+${PACKAGE}FILES+=	test_read_format_7zip_zstd_sparc.7z.uu
 ${PACKAGE}FILES+=	test_read_format_7zip_win_attrib.7z.uu
 ${PACKAGE}FILES+=	test_read_format_ar.ar.uu
 ${PACKAGE}FILES+=	test_read_format_cab_1.cab.uu
@@ -507,12 +528,14 @@ ${PACKAGE}FILES+=	test_read_format_cpio_svr4_gzip_rpm.rpm.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_filename_cp866.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_filename_eucjp.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_filename_koi8r.tar.Z.uu
+${PACKAGE}FILES+=	test_read_format_gtar_redundant_L.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_sparse_1_13.tar.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_sparse_1_17.tar.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_sparse_1_17_posix00.tar.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_sparse_1_17_posix01.tar.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_sparse_1_17_posix10.tar.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_sparse_1_17_posix10_modified.tar.uu
+${PACKAGE}FILES+=	test_read_format_gtar_sparse_length.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_gtar_sparse_skip_entry.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_huge_rpm.rpm.uu
 ${PACKAGE}FILES+=	test_read_format_iso.iso.Z.uu
@@ -553,6 +576,7 @@ ${PACKAGE}FILES+=	test_read_format_rar_compress_normal.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_encryption_data.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_encryption_header.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_encryption_partially.rar.uu
+${PACKAGE}FILES+=	test_read_format_rar_endarc_huge.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_filter.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_invalid1.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_multi_lzss_blocks.rar.uu
@@ -560,12 +584,15 @@ ${PACKAGE}FILES+=	test_read_format_rar_multivolume.part0001.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_multivolume.part0002.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_multivolume.part0003.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_multivolume.part0004.rar.uu
+${PACKAGE}FILES+=	test_read_format_rar_newsub_huge.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_noeof.rar.uu
+${PACKAGE}FILES+=	test_read_format_rar_overflow.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_ppmd_lzss_conversion.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_ppmd_use_after_free.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_ppmd_use_after_free2.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_sfx.exe.uu
 ${PACKAGE}FILES+=	test_read_format_rar_subblock.rar.uu
+${PACKAGE}FILES+=	test_read_format_rar_symlink_huge.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_unicode.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar_windows.rar.uu
 ${PACKAGE}FILES+=	test_read_format_rar4_encrypted.rar.uu
@@ -630,11 +657,15 @@ ${PACKAGE}FILES+=	test_read_format_tar_empty_with_gnulabel.tar.uu
 ${PACKAGE}FILES+=	test_read_format_tar_empty_pax.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_tar_filename_koi8r.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_tar_invalid_pax_size.tar.uu
+${PACKAGE}FILES+=	test_read_format_tar_mac_metadata_1.tar.uu
+${PACKAGE}FILES+=	test_read_format_tar_pax_g_large.tar.uu
 ${PACKAGE}FILES+=	test_read_format_tar_pax_large_attr.tar.Z.uu
+${PACKAGE}FILES+=	test_read_format_tar_pax_negative_time.tar.uu
 ${PACKAGE}FILES+=	test_read_format_ustar_filename_cp866.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_ustar_filename_eucjp.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_ustar_filename_koi8r.tar.Z.uu
 ${PACKAGE}FILES+=	test_read_format_warc.warc.uu
+${PACKAGE}FILES+=	test_read_format_warc_incomplete.warc.uu
 ${PACKAGE}FILES+=	test_read_format_xar_doublelink.xar.uu
 ${PACKAGE}FILES+=	test_read_format_xar_duplicate_filename_node.xar.uu
 ${PACKAGE}FILES+=	test_read_format_zip.zip.uu
@@ -694,6 +725,7 @@ ${PACKAGE}FILES+=	test_read_large_splitted_rar_ab.uu
 ${PACKAGE}FILES+=	test_read_large_splitted_rar_ac.uu
 ${PACKAGE}FILES+=	test_read_large_splitted_rar_ad.uu
 ${PACKAGE}FILES+=	test_read_large_splitted_rar_ae.uu
+${PACKAGE}FILES+=	test_read_pax_empty_val_no_nl.tar.uu
 ${PACKAGE}FILES+=	test_read_pax_xattr_rht_security_selinux.tar.uu
 ${PACKAGE}FILES+=	test_read_pax_xattr_schily.tar.uu
 ${PACKAGE}FILES+=	test_read_splitted_rar_aa.uu
diff --git a/lib/libc/gen/fts.c b/lib/libc/gen/fts.c
index ff51d2b224c2..9ffd0bd9972d 100644
--- a/lib/libc/gen/fts.c
+++ b/lib/libc/gen/fts.c
@@ -901,10 +901,12 @@ fts_stat(FTS *sp, FTSENT *p, int follow, int dfd)
 	int saved_errno;
 	const char *path;
 
-	if (dfd == -1)
-		path = p->fts_accpath, dfd = AT_FDCWD;
-	else
+	if (dfd == -1) {
+		path = p->fts_accpath;
+		dfd = AT_FDCWD;
+	} else {
 		path = p->fts_name;
+	}
 
 	/* If user needs stat info, stat buffer already allocated. */
 	sbp = ISSET(FTS_NOSTAT) ? &sb : p->fts_statp;
diff --git a/lib/libc/net/Makefile.inc b/lib/libc/net/Makefile.inc
index 42a089f97d74..e0dc44eb7e23 100644
--- a/lib/libc/net/Makefile.inc
+++ b/lib/libc/net/Makefile.inc
@@ -106,8 +106,11 @@ MLINKS+=inet6_opt_init.3 inet6_opt_append.3 \
 	inet6_rthdr_space.3 inet6_rthdr_lasthop.3 \
 	inet6_rthdr_space.3 inet6_rthdr_reverse.3 \
 	inet6_rthdr_space.3 inet6_rthdr_segments.3
-MLINKS+=linkaddr.3 link_addr.3 linkaddr.3 link_ntoa.3 
-MLINKS+=rcmd.3 iruserok.3 rcmd.3 iruserok_sa.3 \
+MLINKS+=linkaddr.3 link_addr.3 \
+	linkaddr.3 link_ntoa.3 \
+	linkaddr.3 link_ntoa_r.3
+MLINKS+=rcmd.3 iruserok.3 \
+	rcmd.3 iruserok_sa.3 \
 	rcmd.3 rcmd_af.3 \
 	rcmd.3 rresvport.3 rcmd.3 rresvport_af.3 \
 	rcmd.3 ruserok.3
diff --git a/lib/libc/net/Symbol.map b/lib/libc/net/Symbol.map
index b2ecd4f08735..093987d8c5af 100644
--- a/lib/libc/net/Symbol.map
+++ b/lib/libc/net/Symbol.map
@@ -148,6 +148,10 @@ FBSD_1.3 {
 	sctp_sendv;
 };
 
+FBSD_1.8 {
+	link_ntoa_r;
+};
+
 FBSDprivate_1.0 {
 	_nsdispatch;
 	_nsyyerror;	/* generated from nslexer.l */
diff --git a/lib/libc/net/linkaddr.3 b/lib/libc/net/linkaddr.3
index 6c2fb6ccfdc3..ceb5c4a79e9a 100644
--- a/lib/libc/net/linkaddr.3
+++ b/lib/libc/net/linkaddr.3
@@ -30,12 +30,13 @@
 .\"
 .\"     From: @(#)linkaddr.3	8.1 (Berkeley) 7/28/93
 .\"
-.Dd February 28, 2007
+.Dd May 9, 2025
 .Dt LINK_ADDR 3
 .Os
 .Sh NAME
 .Nm link_addr ,
-.Nm link_ntoa
+.Nm link_ntoa ,
+.Nm link_ntoa_r
 .Nd elementary address specification routines for link level access
 .Sh LIBRARY
 .Lb libc
@@ -43,16 +44,29 @@
 .In sys/types.h
 .In sys/socket.h
 .In net/if_dl.h
-.Ft void
+.Ft int
 .Fn link_addr "const char *addr" "struct sockaddr_dl *sdl"
 .Ft char *
 .Fn link_ntoa "const struct sockaddr_dl *sdl"
+.Ft int
+.Fn link_ntoa_r "const struct sockaddr_dl *sdl" "char *obuf" "size_t *buflen"
 .Sh DESCRIPTION
 The routine
 .Fn link_addr
-interprets character strings representing
-link-level addresses, returning binary information suitable
-for use in system calls.
+parses a character string
+.Fa addr
+representing a link-level address,
+and stores the resulting address in the structure pointed to by
+.Fa sdl .
+A link-level address consists of an optional interface name, followed by
+a colon (which is required in all cases), followed by an address
+consisting of either a string of hexadecimal digits, or a series of
+hexadecimal octets separated by one of the characters
+.Sq "." ,
+.Sq ":" ,
+or
+.Sq - .
+.Pp
 The routine
 .Fn link_ntoa
 takes
@@ -62,9 +76,34 @@ address and returns an
 string representing some of the information present,
 including the link level address itself, and the interface name
 or number, if present.
+The returned string is stored in a static buffer.
 This facility is experimental and is
 still subject to change.
 .Pp
+The routine
+.Fn link_ntoa_r
+behaves like
+.Fn link_ntoa ,
+except the string is placed in the provided buffer instead of a static
+buffer.
+The caller should initialize
+.Fa buflen
+to the number of bytes available in
+.Fa obuf .
+On return,
+.Fa buflen
+is set to the actual number of bytes required for the output buffer,
+including the NUL terminator.
+If
+.Fa obuf
+is NULL, then
+.Fa buflen
+is set as described, but nothing is written.
+This may be used to determine the required length of the buffer before
+calling
+.Fn link_ntoa_r
+a second time.
+.Pp
 For
 .Fn link_addr ,
 the string
@@ -96,12 +135,21 @@ The
 .Fn link_ntoa
 function
 always returns a null terminated string.
+.Pp
+The
+.Fn link_ntoa_r
+function returns 0 on success, or -1 if the provided buffer was not
+large enough; in the latter case, the contents of the buffer are
+indeterminate, but a trailing NUL will always be written if the buffer
+was at least one byte in size.
+.Pp
 The
 .Fn link_addr
-function
-has no return value.
-(See
-.Sx BUGS . )
+function returns 0 on success.
+If the address did not appear to be a valid link-level address, -1 is
+returned and
+.Va errno
+is set to indicate the error.
 .Sh SEE ALSO
 .Xr getnameinfo 3
 .Sh HISTORY
@@ -111,15 +159,14 @@ and
 .Fn link_ntoa
 functions appeared in
 .Bx 4.3 Reno .
+The
+.Fn link_ntoa_r
+function appeared in
+.Fx 15.0 .
 .Sh BUGS
 The returned values for link_ntoa
 reside in a static memory area.
 .Pp
-The function
-.Fn link_addr
-should diagnose improperly formed input, and there should be an unambiguous
-way to recognize this.
-.Pp
 If the
 .Va sdl_len
 field of the link socket address
diff --git a/lib/libc/net/linkaddr.c b/lib/libc/net/linkaddr.c
index df1b7b94276e..c20f989143eb 100644
--- a/lib/libc/net/linkaddr.c
+++ b/lib/libc/net/linkaddr.c
@@ -35,135 +35,261 @@ static char sccsid[] = "@(#)linkaddr.c	8.1 (Berkeley) 6/4/93";
 #include <sys/cdefs.h>
 #include <sys/types.h>
 #include <sys/socket.h>
+
 #include <net/if.h>
 #include <net/if_dl.h>
+
+#include <assert.h>
+#include <errno.h>
+#include <stdint.h>
 #include <string.h>
 
-/* States*/
-#define NAMING	0
-#define GOTONE	1
-#define GOTTWO	2
-#define RESET	3
-/* Inputs */
-#define	DIGIT	(4*0)
-#define	END	(4*1)
-#define DELIM	(4*2)
-#define LETTER	(4*3)
-
-void
+int
 link_addr(const char *addr, struct sockaddr_dl *sdl)
 {
 	char *cp = sdl->sdl_data;
 	char *cplim = sdl->sdl_len + (char *)sdl;
-	int byte = 0, state = NAMING, new;
+	const char *nptr;
+	size_t newsize;
+	int error = 0;
+	char delim = 0;
 
+	/* Initialise the sdl to zero, except for sdl_len. */
 	bzero((char *)&sdl->sdl_family, sdl->sdl_len - 1);
 	sdl->sdl_family = AF_LINK;
-	do {
-		state &= ~LETTER;
-		if ((*addr >= '0') && (*addr <= '9')) {
-			new = *addr - '0';
-		} else if ((*addr >= 'a') && (*addr <= 'f')) {
-			new = *addr - 'a' + 10;
-		} else if ((*addr >= 'A') && (*addr <= 'F')) {
-			new = *addr - 'A' + 10;
-		} else if (*addr == 0) {
-			state |= END;
-		} else if (state == NAMING &&
-			   (((*addr >= 'A') && (*addr <= 'Z')) ||
-			   ((*addr >= 'a') && (*addr <= 'z'))))
-			state |= LETTER;
-		else
-			state |= DELIM;
-		addr++;
-		switch (state /* | INPUT */) {
-		case NAMING | DIGIT:
-		case NAMING | LETTER:
-			*cp++ = addr[-1];
-			continue;
-		case NAMING | DELIM:
-			state = RESET;
-			sdl->sdl_nlen = cp - sdl->sdl_data;
-			continue;
-		case GOTTWO | DIGIT:
-			*cp++ = byte;
-			/* FALLTHROUGH */
-		case RESET | DIGIT:
-			state = GOTONE;
-			byte = new;
-			continue;
-		case GOTONE | DIGIT:
-			state = GOTTWO;
-			byte = new + (byte << 4);
-			continue;
-		default: /* | DELIM */
-			state = RESET;
-			*cp++ = byte;
-			byte = 0;
-			continue;
-		case GOTONE | END:
-		case GOTTWO | END:
-			*cp++ = byte;
-			/* FALLTHROUGH */
-		case RESET | END:
+
+	/*
+	 * Everything up to the first ':' is the interface name.  Usually the
+	 * ':' should always be present even if there's no interface name, but
+	 * since this interface was poorly specified in the past, accept a
+	 * missing colon as meaning no interface name.
+	 */
+	if ((nptr = strchr(addr, ':')) != NULL) {
+		size_t namelen = nptr - addr;
+
+		/* Ensure the sdl is large enough to store the name. */
+		if (namelen > cplim - cp) {
+			errno = ENOSPC;
+			return (-1);
+		}
+
+		memcpy(cp, addr, namelen);
+		cp += namelen;
+		sdl->sdl_nlen = namelen;
+		/* Skip the interface name and the colon. */
+		addr += namelen + 1;
+	}
+
+	/*
+	 * The remainder of the string should be hex digits representing the
+	 * address, with optional delimiters.  Each two hex digits form one
+	 * octet, but octet output can be forced using a delimiter, so we accept
+	 * a long string of hex digits, or a mix of delimited and undelimited
+	 * digits like "1122.3344.5566", or delimited one- or two-digit octets
+	 * like "1.22.3".
+	 *
+	 * If anything fails at this point, exit the loop so we set sdl_alen and
+	 * sdl_len based on whatever we did manage to parse.  This preserves
+	 * compatibility with the 4.3BSD version of link_addr, which had no way
+	 * to indicate an error and would just return.
+	 */
+#define DIGIT(c)						\
+	 (((c) >= '0' && (c) <= '9') ? ((c) - '0')		\
+	: ((c) >= 'a' && (c) <= 'f') ? ((c) - 'a' + 10)		\
+	: ((c) >= 'A' && (c) <= 'F') ? ((c) - 'A' + 10)		\
+	: (-1))
+#define ISDELIM(c) (((c) == '.' || (c) == ':' || (c) == '-') && \
+    (delim == 0 || delim == (c)))
+
+	for (;;) {
+		int digit, digit2;
+
+		/*
+		 * Treat any leading delimiters as empty bytes.  This supports
+		 * the (somewhat obsolete) form of Ethernet addresses with empty
+		 * octets, e.g. "1::3:4:5:6".
+		 */
+		while (ISDELIM(*addr) && cp < cplim) {
+			delim = *addr++;
+			*cp++ = 0;
+		}
+
+		/* Did we reach the end of the string? */
+		if (*addr == '\0')
+			break;
+
+		/*
+		 * If not, the next character must be a digit, so make sure we
+		 * have room for at least one more octet.
+		 */
+
+		if (cp >= cplim) {
+			error = ENOSPC;
+			break;
+		}
+
+		if ((digit = DIGIT(*addr)) == -1) {
+			error = EINVAL;
 			break;
 		}
-		break;
-	} while (cp < cplim);
+
+		++addr;
+
+		/* If the next character is another digit, consume it. */
+		if ((digit2 = DIGIT(*addr)) != -1) {
+			digit = (digit << 4) | digit2;
+			++addr;
+		}
+
+		if (ISDELIM(*addr)) {
+			/*
+			 * If the digit is followed by a delimiter, write it
+			 * and consume the delimiter.
+			 */
+			delim = *addr++;
+			*cp++ = digit;
+		} else if (DIGIT(*addr) != -1) {
+			/*
+			 * If two digits are followed by a third digit, treat
+			 * the two digits we have as a single octet and
+			 * continue.
+			 */
+			*cp++ = digit;
+		} else if (*addr == '\0') {
+			/* If the digit is followed by EOS, we're done. */
+			*cp++ = digit;
+			break;
+		} else {
+			/* Otherwise, the input was invalid. */
+			error = EINVAL;
+			break;
+		}
+	}
+#undef DIGIT
+#undef ISDELIM
+
+	/* How many bytes did we write to the address? */
 	sdl->sdl_alen = cp - LLADDR(sdl);
-	new = cp - (char *)sdl;
-	if (new > sizeof(*sdl))
-		sdl->sdl_len = new;
-	return;
+
+	/*
+	 * The user might have given us an sdl which is larger than sizeof(sdl);
+	 * in that case, record the actual size of the new sdl.
+	 */
+	newsize = cp - (char *)sdl;
+	if (newsize > sizeof(*sdl))
+		sdl->sdl_len = (u_char)newsize;
+
+	if (error == 0)
+		return (0);
+
+	errno = error;
+	return (-1);
 }
 
-static const char hexlist[] = "0123456789abcdef";
 
 char *
 link_ntoa(const struct sockaddr_dl *sdl)
 {
 	static char obuf[64];
+	size_t buflen;
 	_Static_assert(sizeof(obuf) >= IFNAMSIZ + 20, "obuf is too small");
+
+	/*
+	 * Ignoring the return value of link_ntoa_r() is safe here because it
+	 * always writes the terminating NUL.  This preserves the traditional
+	 * behaviour of link_ntoa().
+	 */
+	buflen = sizeof(obuf);
+	(void)link_ntoa_r(sdl, obuf, &buflen);
+	return obuf;
+}
+
+int
+link_ntoa_r(const struct sockaddr_dl *sdl, char *obuf, size_t *buflen)
+{
+	static const char hexlist[] = "0123456789abcdef";
 	char *out;
 	const u_char *in, *inlim;
 	int namelen, i, rem;
+	size_t needed;
 
-	namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
+	assert(sdl);
+	assert(buflen);
+	/* obuf may be null */
 
+	needed = 1; /* 1 for the NUL */
 	out = obuf;
-	rem = sizeof(obuf);
+	if (obuf)
+		rem = *buflen;
+	else
+		rem = 0;
+
+/*
+ * Check if at least n bytes are available in the output buffer, plus 1 for the
+ * trailing NUL.  If not, set rem = 0 so we stop writing.
+ * Either way, increment needed by the amount we would have written.
+ */
+#define CHECK(n) do {				\
+		if ((SIZE_MAX - (n)) >= needed)	\
+			needed += (n);		\
+		if (rem >= ((n) + 1))		\
+			rem -= (n);		\
+		else				\
+			rem = 0;		\
+	} while (0)
+
+/*
+ * Write the char c to the output buffer, unless the buffer is full.
+ * Note that if obuf is NULL, rem is always zero.
+ */
+#define OUT(c) do {			\
+		if (rem > 0)		\
+			*out++ = (c);	\
+	} while (0)
+
+	namelen = (sdl->sdl_nlen <= IFNAMSIZ) ? sdl->sdl_nlen : IFNAMSIZ;
 	if (namelen > 0) {
-		bcopy(sdl->sdl_data, out, namelen);
-		out += namelen;
-		rem -= namelen;
+		CHECK(namelen);
+		if (rem > 0) {
+			bcopy(sdl->sdl_data, out, namelen);
+			out += namelen;
+		}
+
 		if (sdl->sdl_alen > 0) {
-			*out++ = ':';
-			rem--;
+			CHECK(1);
+			OUT(':');
 		}
 	}
 
-	in = (const u_char *)sdl->sdl_data + sdl->sdl_nlen;
+	in = (const u_char *)LLADDR(sdl);
 	inlim = in + sdl->sdl_alen;
 
-	while (in < inlim && rem > 1) {
-		if (in != (const u_char *)sdl->sdl_data + sdl->sdl_nlen) {
-			*out++ = '.';
-			rem--;
+	while (in < inlim) {
+		if (in != (const u_char *)LLADDR(sdl)) {
+			CHECK(1);
+			OUT('.');
 		}
 		i = *in++;
 		if (i > 0xf) {
-			if (rem < 3)
-				break;
-			*out++ = hexlist[i >> 4];
-			*out++ = hexlist[i & 0xf];
-			rem -= 2;
+			CHECK(2);
+			OUT(hexlist[i >> 4]);
+			OUT(hexlist[i & 0xf]);
 		} else {
-			if (rem < 2)
-				break;
-			*out++ = hexlist[i];
-			rem--;
+			CHECK(1);
+			OUT(hexlist[i]);
 		}
 	}
-	*out = 0;
-	return (obuf);
+
+#undef CHECK
+#undef OUT
+
+	/*
+	 * We always leave enough room for the NUL if possible, but the user
+	 * might have passed a NULL or zero-length buffer.
+	 */
+	if (out && *buflen)
+		*out = '\0';
+
+	*buflen = needed;
+	return ((rem > 0) ? 0 : -1);
 }
diff --git a/lib/libc/stdlib/atexit.c b/lib/libc/stdlib/atexit.c
index 6b63d9e728c4..5b39552821ed 100644
--- a/lib/libc/stdlib/atexit.c
+++ b/lib/libc/stdlib/atexit.c
@@ -39,6 +39,7 @@ static char sccsid[] = "@(#)atexit.c	8.2 (Berkeley) 7/3/94";
 #include "namespace.h"
 #include <errno.h>
 #include <link.h>
+#include <stdbool.h>
 #include <stddef.h>
 #include <stdlib.h>
 #include <unistd.h>
@@ -60,6 +61,8 @@ _Block_copy(void*);
 #define	ATEXIT_FN_CXA	2
 
 static pthread_mutex_t atexit_mutex = PTHREAD_MUTEX_INITIALIZER;
+static void *current_finalize_dso = NULL;
+static bool call_finalize_again = false;
 
 #define _MUTEX_LOCK(x)		if (__isthreaded) _pthread_mutex_lock(x)
 #define _MUTEX_UNLOCK(x)	if (__isthreaded) _pthread_mutex_unlock(x)
@@ -119,6 +122,9 @@ atexit_register(struct atexit_fn *fptr)
 		__atexit = p;
 	}
 	p->fns[p->ind++] = *fptr;
+	if (current_finalize_dso != NULL &&
+	    current_finalize_dso == fptr->fn_dso)
+		call_finalize_again = true;
 	_MUTEX_UNLOCK(&atexit_mutex);
 	return 0;
 }
@@ -212,33 +218,38 @@ __cxa_finalize(void *dso)
 	}
 
 	_MUTEX_LOCK(&atexit_mutex);
-	for (p = __atexit; p; p = p->next) {
-		for (n = p->ind; --n >= 0;) {
-			if (p->fns[n].fn_type == ATEXIT_FN_EMPTY)
-				continue; /* already been called */
-			fn = p->fns[n];
-			if (dso != NULL && dso != fn.fn_dso) {
-				/* wrong DSO ? */
-				if (!has_phdr || global_exit ||
-				    !__elf_phdr_match_addr(&phdr_info,
-				    fn.fn_ptr.cxa_func))
-					continue;
+	current_finalize_dso = dso;
+	do {
+		call_finalize_again = false;
+		for (p = __atexit; p; p = p->next) {
+			for (n = p->ind; --n >= 0;) {
+				if (p->fns[n].fn_type == ATEXIT_FN_EMPTY)
+					continue; /* already been called */
+				fn = p->fns[n];
+				if (dso != NULL && dso != fn.fn_dso) {
+					/* wrong DSO ? */
+					if (!has_phdr || global_exit ||
+					    !__elf_phdr_match_addr(&phdr_info,
+					    fn.fn_ptr.cxa_func))
+						continue;
+				}
+				/*
+				  Mark entry to indicate that this particular
+				  handler has already been called.
+				*/
+				p->fns[n].fn_type = ATEXIT_FN_EMPTY;
+				_MUTEX_UNLOCK(&atexit_mutex);
+
+				/* Call the function of correct type. */
+				if (fn.fn_type == ATEXIT_FN_CXA)
+					fn.fn_ptr.cxa_func(fn.fn_arg);
+				else if (fn.fn_type == ATEXIT_FN_STD)
+					fn.fn_ptr.std_func();
+				_MUTEX_LOCK(&atexit_mutex);
 			}
-			/*
-			  Mark entry to indicate that this particular handler
-			  has already been called.
-			*/
-			p->fns[n].fn_type = ATEXIT_FN_EMPTY;
-		        _MUTEX_UNLOCK(&atexit_mutex);
-		
-			/* Call the function of correct type. */
-			if (fn.fn_type == ATEXIT_FN_CXA)
-				fn.fn_ptr.cxa_func(fn.fn_arg);
-			else if (fn.fn_type == ATEXIT_FN_STD)
-				fn.fn_ptr.std_func();
-			_MUTEX_LOCK(&atexit_mutex);
 		}
-	}
+	} while (call_finalize_again);
+	current_finalize_dso = NULL;
 	_MUTEX_UNLOCK(&atexit_mutex);
 	if (dso == NULL)
 		_MUTEX_DESTROY(&atexit_mutex);
diff --git a/lib/libc/tests/net/Makefile b/lib/libc/tests/net/Makefile
index 6e90f22b98f5..d939edeeb00d 100644
--- a/lib/libc/tests/net/Makefile
+++ b/lib/libc/tests/net/Makefile
@@ -4,6 +4,9 @@ PACKAGE=	tests
 ATF_TESTS_C+=	ether_test
 ATF_TESTS_C+=	eui64_aton_test
 ATF_TESTS_C+=	eui64_ntoa_test
+ATF_TESTS_CXX+=	link_addr_test
+
+CXXSTD.link_addr_test=	c++20
 
 CFLAGS+=	-I${.CURDIR}
 
diff --git a/lib/libc/tests/net/link_addr_test.cc b/lib/libc/tests/net/link_addr_test.cc
new file mode 100644
index 000000000000..b973b924dc13
--- /dev/null
+++ b/lib/libc/tests/net/link_addr_test.cc
@@ -0,0 +1,532 @@
+/*
+ * Copyright (c) 2025 Lexi Winter
+ *
+ * SPDX-License-Identifier: ISC
+ */
+
+/*
+ * Tests for link_addr() and link_ntoa().
+ *
+ * link_addr converts a string representing an (optionally null) interface name
+ * followed by an Ethernet address into a sockaddr_dl.  The expected format is
+ * "[ifname]:lladdr".  This means if ifname is not specified, the leading colon
+ * is still required.
+ *
+ * link_ntoa does the inverse of link_addr, returning a string representation
+ * of the address.
+ *
+ * Note that the output format of link_ntoa is not valid input for link_addr
+ * since the leading colon may be omitted.  This is by design.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <net/ethernet.h>
+#include <net/if_dl.h>
+
+#include <format>
+#include <iostream>
+#include <ranges>
+#include <span>
+#include <utility>
+#include <vector>
+
+#include <cstddef>
+#include <cstdint>
+
+#include <atf-c++.hpp>
+
+using namespace std::literals;
+
+/*
+ * Define operator== and operator<< for ether_addr so we can use them in
+ * ATF_EXPECT_EQ expressions.
+ */
+
+bool
+operator==(ether_addr a, ether_addr b)
+{
+	return (std::ranges::equal(a.octet, b.octet));
+}
+
+std::ostream &
+operator<<(std::ostream &s, ether_addr a)
+{
+	for (unsigned i = 0; i < ETHER_ADDR_LEN; ++i) {
+		if (i > 0)
+			s << ":";
+
+		s << std::format("{:02x}", static_cast<int>(a.octet[i]));
+	}
+
+	return (s);
+}
+
+/*
+ * Create a sockaddr_dl from a string using link_addr(), and ensure the
+ * returned struct looks valid.
+ */
+sockaddr_dl
+make_linkaddr(const std::string &addr)
+{
+	auto sdl = sockaddr_dl{};
+	int ret;
+
+	sdl.sdl_len = sizeof(sdl);
+	ret = ::link_addr(addr.c_str(), &sdl);
+
+	ATF_REQUIRE_EQ(0, ret);
+	ATF_REQUIRE_EQ(AF_LINK, static_cast<int>(sdl.sdl_family));
+	ATF_REQUIRE_EQ(true, sdl.sdl_len > 0);
+	ATF_REQUIRE_EQ(true, sdl.sdl_nlen >= 0);
+
+	return (sdl);
+}
+
+/*
+ * Return the data stored in a sockaddr_dl as a span.
+ */
+std::span<const char>
+data(const sockaddr_dl &sdl)
+{
+	// sdl_len is the entire structure, but we only want the length of the
+	// data area.
+	auto dlen = sdl.sdl_len - offsetof(sockaddr_dl, sdl_data);
+	return {&sdl.sdl_data[0], dlen};
+}
+
+/*
+ * Return the interface name stored in a sockaddr_dl as a string.
+ */
+std::string_view
+ifname(const sockaddr_dl &sdl)
+{
+	auto name = data(sdl).subspan(0, sdl.sdl_nlen);
+	return {name.begin(), name.end()};
+}
+
+/*
+ * Return the Ethernet address stored in a sockaddr_dl as an ether_addr.
+ */
+ether_addr
+addr(const sockaddr_dl &sdl)
+{
+	ether_addr ret{};
+	ATF_REQUIRE_EQ(ETHER_ADDR_LEN, sdl.sdl_alen);
+	std::ranges::copy(data(sdl).subspan(sdl.sdl_nlen, ETHER_ADDR_LEN),
+			  &ret.octet[0]);
+	return (ret);
+}
+
+/*
+ * Return the link address stored in a sockaddr_dl as a span of octets.
+ */
+std::span<const std::uint8_t>
+lladdr(const sockaddr_dl &sdl)
+{
+	auto data = reinterpret_cast<const uint8_t *>(LLADDR(&sdl));
+	return {data, data + sdl.sdl_alen};
+}
+
+
+/*
+ * Some sample addresses we use for testing.  Include at least one address for
+ * each format we want to support.
+ */
+
+struct test_address {
+	std::string input;	/* value passed to link_addr */
+	std::string ntoa;	/* expected return from link_ntoa */
+	ether_addr addr{};	/* expected return from link_addr */
+};
+
+std::vector<test_address> test_addresses{
+	// No delimiter
+	{"001122334455"s, "0.11.22.33.44.55",
+	 ether_addr{0x00, 0x11, 0x22, 0x33, 0x44, 0x55}},
+
+	// Colon delimiter
+	{"00:11:22:33:44:55"s, "0.11.22.33.44.55",
+	 ether_addr{0x00, 0x11, 0x22, 0x33, 0x44, 0x55}},
+
+	// Dash delimiter
+	{"00-11-22-33-44-55"s, "0.11.22.33.44.55",
+	 ether_addr{0x00, 0x11, 0x22, 0x33, 0x44, 0x55}},
+
+	// Period delimiter (link_ntoa format)
+	{"00.11.22.33.44.55"s, "0.11.22.33.44.55",
+	 ether_addr{0x00, 0x11, 0x22, 0x33, 0x44, 0x55}},
+
+	// Period delimiter (Cisco format)
+	{"0011.2233.4455"s, "0.11.22.33.44.55",
+	 ether_addr{0x00, 0x11, 0x22, 0x33, 0x44, 0x55}},
+
+	// An addresses without leading zeroes.
+	{"0:1:02:30:4:55"s, "0.1.2.30.4.55",
+	 ether_addr{0x00, 0x01, 0x02, 0x30, 0x04, 0x55}},
+
+	// An address with some uppercase letters.
+	{"AA:B:cC:Dd:e0:1f"s, "aa.b.cc.dd.e0.1f",
+	 ether_addr{0xaa, 0x0b, 0xcc, 0xdd, 0xe0, 0x1f}},
+
+	// Addresses composed only of letters, to make sure they're not
+	// confused with an interface name.
+
+	{"aabbccddeeff"s, "aa.bb.cc.dd.ee.ff",
+	 ether_addr{0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff}},
+
+	{"aa:bb:cc:dd:ee:ff"s, "aa.bb.cc.dd.ee.ff",
+	 ether_addr{0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff}},
+
+	// Address with a blank octet; this is an old form of Ethernet address.
+	{"00:11::33:44:55"s, "0.11.0.33.44.55",
+	 ether_addr{0x00, 0x11, 0x00, 0x33, 0x44, 0x55}},
+};
+
+/*
+ * Test without an interface name.
+ */
+ATF_TEST_CASE_WITHOUT_HEAD(basic)
+ATF_TEST_CASE_BODY(basic)
+{
+	for (const auto &ta : test_addresses) {
+		// This does basic tests on the returned value.
+		auto sdl = make_linkaddr(":" + ta.input);
+
+		// Check the ifname and address.
+		ATF_REQUIRE_EQ(""s, ifname(sdl));
+		ATF_REQUIRE_EQ(ETHER_ADDR_LEN, static_cast<int>(sdl.sdl_alen));
+		ATF_REQUIRE_EQ(ta.addr, addr(sdl));
+
+		// Check link_ntoa returns the expected value.
+		auto ntoa = std::string(::link_ntoa(&sdl));
+		ATF_REQUIRE_EQ(ta.ntoa, ntoa);
+	}
+
+}
+
+/*
+ * Test with an interface name.
+ */
+ATF_TEST_CASE_WITHOUT_HEAD(ifname)
+ATF_TEST_CASE_BODY(ifname)
+{
+	for (const auto &ta : test_addresses) {
+		auto sdl = make_linkaddr("ix0:" + ta.input);
+
+		ATF_REQUIRE_EQ("ix0", ifname(sdl));
+		ATF_REQUIRE_EQ(ETHER_ADDR_LEN, static_cast<int>(sdl.sdl_alen));
+		ATF_REQUIRE_EQ(ta.addr, addr(sdl));
+
+		auto ntoa = std::string(::link_ntoa(&sdl));
+		ATF_REQUIRE_EQ("ix0:" + ta.ntoa, ntoa);
+	}
+
+}
+
+/*
+ * Test with some invalid addresses.
+ */
+ATF_TEST_CASE_WITHOUT_HEAD(invalid)
+ATF_TEST_CASE_BODY(invalid)
+{
+	auto const invalid_addresses = std::vector{
+		// Invalid separator
+		":1/2/3"s,
+		"ix0:1/2/3"s,
+
+		// Multiple different separators
+		":1.2-3"s,
+		"ix0:1.2-3"s,
+
+		// An IP address
+		":10.1.2.200/28"s,
+		"ix0:10.1.2.200/28"s,
+
+		// Valid address followed by garbage
+		":1.2.3xxx"s,
+		":1.2.3.xxx"s,
+		"ix0:1.2.3xxx"s,
+		"ix0:1.2.3.xxx"s,
+	};
+
+	for (auto const &addr : invalid_addresses) {
+		int ret;
+
+		auto sdl = sockaddr_dl{};
+		sdl.sdl_len = sizeof(sdl);
+
+		ret = link_addr(addr.c_str(), &sdl);
+		ATF_REQUIRE_EQ(-1, ret);
+	}
+}
+
+/*
+ * Test some non-Ethernet addresses.
+ */
+ATF_TEST_CASE_WITHOUT_HEAD(nonether)
+ATF_TEST_CASE_BODY(nonether)
+{
+	sockaddr_dl sdl;
+
+	/* A short address */
+	sdl = make_linkaddr(":1:23:cc");
+	ATF_REQUIRE_EQ("", ifname(sdl));
+	ATF_REQUIRE_EQ("1.23.cc"s, ::link_ntoa(&sdl));
+	ATF_REQUIRE_EQ(3, sdl.sdl_alen);
+	ATF_REQUIRE_EQ(true,
+	    std::ranges::equal(std::vector{0x01u, 0x23u, 0xccu}, lladdr(sdl)));
+
+	/* A long address */
+	sdl = make_linkaddr(":1:23:cc:a:b:c:d:e:f");
+	ATF_REQUIRE_EQ("", ifname(sdl));
+	ATF_REQUIRE_EQ("1.23.cc.a.b.c.d.e.f"s, ::link_ntoa(&sdl));
+	ATF_REQUIRE_EQ(9, sdl.sdl_alen);
+	ATF_REQUIRE_EQ(true, std::ranges::equal(
+	    std::vector{0x01u, 0x23u, 0xccu, 0xau, 0xbu, 0xcu, 0xdu, 0xeu, 0xfu},
+	    lladdr(sdl)));
+}
+
+/*
+ * Test link_addr behaviour with undersized buffers.
+ */
+ATF_TEST_CASE_WITHOUT_HEAD(smallbuf)
+ATF_TEST_CASE_BODY(smallbuf)
+{
+	static constexpr auto garbage = std::byte{0xcc};
+	auto buf = std::vector<std::byte>();
+	sockaddr_dl *sdl;
+	int ret;
+
+	/*
+	 * Make an sdl with an sdl_data member of the appropriate size, and
+	 * place it in buf.  Ensure it's followed by a trailing byte of garbage
+	 * so we can test that link_addr doesn't write past the end.
+	 */
+	auto mksdl = [&buf](std::size_t datalen) -> sockaddr_dl * {
+		auto actual_size = datalen + offsetof(sockaddr_dl, sdl_data);
+
+		buf.resize(actual_size + 1);
+		std::ranges::fill(buf, garbage);
+
+		auto *sdl = new(reinterpret_cast<sockaddr_dl *>(&buf[0]))
+		    sockaddr_dl;
+		sdl->sdl_len = actual_size;
+		return (sdl);
+	};
+
+	/* An sdl large enough to store the interface name */
+	sdl = mksdl(3);
+	ret = link_addr("ix0:1.2.3", sdl);
+	ATF_REQUIRE(*rbegin(buf) == garbage);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(ENOSPC, errno);
+	ATF_REQUIRE_EQ(3, sdl->sdl_nlen);
+	ATF_REQUIRE_EQ("ix0", ifname(*sdl));
+	ATF_REQUIRE_EQ(0, static_cast<int>(sdl->sdl_alen));
+
+	/*
+	 * For these tests, test both with and without an interface name, since
+	 * that will overflow the buffer in different places.
+	 */
+
+	/* An empty sdl.  Nothing may grow on this cursed ground. */
+
+	sdl = mksdl(0);
+	ret = link_addr("ix0:1.2.3", sdl);
+	ATF_REQUIRE(*rbegin(buf) == garbage);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(ENOSPC, errno);
+	ATF_REQUIRE_EQ(0, sdl->sdl_nlen);
+	ATF_REQUIRE_EQ(0, static_cast<int>(sdl->sdl_alen));
+
+	sdl = mksdl(0);
+	ret = link_addr(":1.2.3", sdl);
+	ATF_REQUIRE(*rbegin(buf) == garbage);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(ENOSPC, errno);
+	ATF_REQUIRE_EQ(0, sdl->sdl_nlen);
+	ATF_REQUIRE_EQ(0, static_cast<int>(sdl->sdl_alen));
+
+	/*
+	 * An sdl large enough to store the interface name and two octets of the
+	 * address.
+	 */
+
+	sdl = mksdl(5);
+	ret = link_addr("ix0:1.2.3", sdl);
+	ATF_REQUIRE(*rbegin(buf) == garbage);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(ENOSPC, errno);
+	ATF_REQUIRE_EQ("ix0", ifname(*sdl));
+	ATF_REQUIRE(std::ranges::equal(
+	    std::vector{ 0x01, 0x02 }, lladdr(*sdl)));
+
+	sdl = mksdl(2);
+	ret = link_addr(":1.2.3", sdl);
+	ATF_REQUIRE(*rbegin(buf) == garbage);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(ENOSPC, errno);
+	ATF_REQUIRE_EQ("", ifname(*sdl));
+	ATF_REQUIRE(std::ranges::equal(
+	    std::vector{ 0x01, 0x02 }, lladdr(*sdl)));
+
+	/*
+	 * An sdl large enough to store the entire address.
+	 */
+
+	sdl = mksdl(6);
+	ret = link_addr("ix0:1.2.3", sdl);
+	ATF_REQUIRE(*rbegin(buf) == garbage);
+	ATF_REQUIRE_EQ(0, ret);
+	ATF_REQUIRE_EQ("ix0", ifname(*sdl));
+	ATF_REQUIRE(std::ranges::equal(
+	    std::vector{ 0x01, 0x02, 0x03 }, lladdr(*sdl)));
+
+	sdl = mksdl(3);
+	ret = link_addr(":1.2.3", sdl);
+	ATF_REQUIRE(*rbegin(buf) == garbage);
+	ATF_REQUIRE_EQ(0, ret);
+	ATF_REQUIRE_EQ("", ifname(*sdl));
+	ATF_REQUIRE(std::ranges::equal(
+	    std::vector{ 0x01, 0x02, 0x03 }, lladdr(*sdl)));
+}
+
+/*
+ * Test an extremely long address which would overflow link_ntoa's internal
+ * buffer.  It should handle this by truncating the output.
+ * (Test for SA-16:37.libc / CVE-2016-6559.)
+ */
+ATF_TEST_CASE_WITHOUT_HEAD(overlong)
+ATF_TEST_CASE_BODY(overlong)
+{
+	auto sdl = make_linkaddr(
+	    ":01.02.03.04.05.06.07.08.09.0a.0b.0c.0d.0e.0f."
+	    "11.12.13.14.15.16.17.18.19.1a.1b.1c.1d.1e.1f."
+	    "22.22.23.24.25.26.27.28.29.2a.2b.2c.2d.2e.2f");
+
+	ATF_REQUIRE_EQ(
+	    "1.2.3.4.5.6.7.8.9.a.b.c.d.e.f.11.12.13.14.15.16.17.18.19.1a.1b."s,
+	    ::link_ntoa(&sdl));
+}
+
+/*
+ * Test link_ntoa_r, the re-entrant version of link_ntoa().
+ */
+ATF_TEST_CASE_WITHOUT_HEAD(link_ntoa_r)
+ATF_TEST_CASE_BODY(link_ntoa_r)
+{
+	static constexpr char garbage = 0x41;
+	std::vector<char> buf;
+	sockaddr_dl sdl;
+	size_t len;
+	int ret;
+
+	// Return the contents of buf as a string, using the NUL terminator to
+	// determine length.  This is to ensure we're using the return value in
+	// the same way C code would, but we do a bit more verification to
+	// elicit a test failure rather than a SEGV if it's broken.
+	auto bufstr = [&buf]() -> std::string_view {
+		// Find the NUL.
+		auto end = std::ranges::find(buf, '\0');
+		ATF_REQUIRE(end != buf.end());
+
+		// Intentionally chopping the NUL off.
+		return {begin(buf), end};
+	};
+
+	// Resize the buffer and set the contents to a known garbage value, so
+	// we don't accidentally have a NUL in the right place when link_ntoa_r
+	// didn't put it there.
+	auto resetbuf = [&buf, &len](std::size_t size) {
+		len = size;
+		buf.resize(len);
+		std::ranges::fill(buf, garbage);
+	};
+
+	// Test a short address with a large buffer.
+	sdl = make_linkaddr("ix0:1.2.3");
+	resetbuf(64);
+	ret = ::link_ntoa_r(&sdl, &buf[0], &len);
+	ATF_REQUIRE_EQ(0, ret);
+	ATF_REQUIRE_EQ(10, len);
+	ATF_REQUIRE_EQ("ix0:1.2.3"s, bufstr());
+
+	// Test a buffer which is exactly the right size.
+	sdl = make_linkaddr("ix0:1.2.3");
+	resetbuf(10);
+	ret = ::link_ntoa_r(&sdl, &buf[0], &len);
+	ATF_REQUIRE_EQ(0, ret);
+	ATF_REQUIRE_EQ(10, len);
+	ATF_REQUIRE_EQ("ix0:1.2.3"sv, bufstr());
+
+	// Test various short buffers, using a table of buffer length and the
+	// output we expect.  All of these should produce valid but truncated
+	// strings, with a trailing NUL and with buflen set correctly.
+
+	auto buftests = std::vector<std::pair<std::size_t, std::string_view>>{
+		{1u, ""sv},
+		{2u, ""sv},
+		{3u, ""sv},
+		{4u, "ix0"sv},
+		{5u, "ix0:"sv},
+		{6u, "ix0:1"sv},
+		{7u, "ix0:1."sv},
+		{8u, "ix0:1.2"sv},
+		{9u, "ix0:1.2."sv},
+	};
+
+	for (auto const &[buflen, expected] : buftests) {
+		sdl = make_linkaddr("ix0:1.2.3");
+		resetbuf(buflen);
+		ret = ::link_ntoa_r(&sdl, &buf[0], &len);
+		ATF_REQUIRE_EQ(-1, ret);
+		ATF_REQUIRE_EQ(10, len);
+		ATF_REQUIRE_EQ(expected, bufstr());
+	}
+
+	// Test a NULL buffer, which should just set buflen.
+	sdl = make_linkaddr("ix0:1.2.3");
+	len = 0;
+	ret = ::link_ntoa_r(&sdl, NULL, &len);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(10, len);
+
+	// A NULL buffer with a non-zero length should also be accepted.
+	sdl = make_linkaddr("ix0:1.2.3");
+	len = 64;
+	ret = ::link_ntoa_r(&sdl, NULL, &len);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(10, len);
+
+	// Test a non-NULL buffer, but with a length of zero.
+	sdl = make_linkaddr("ix0:1.2.3");
+	resetbuf(1);
+	len = 0;
+	ret = ::link_ntoa_r(&sdl, &buf[0], &len);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(10, len);
+	// Check we really didn't write anything.
+	ATF_REQUIRE_EQ(garbage, buf[0]);
+
+	// Test a buffer which would be truncated in the middle of a two-digit
+	// hex octet, which should not write the truncated octet at all.
+	sdl = make_linkaddr("ix0:1.22.3");
+	resetbuf(8);
+	ret = ::link_ntoa_r(&sdl, &buf[0], &len);
+	ATF_REQUIRE_EQ(-1, ret);
+	ATF_REQUIRE_EQ(11, len);
+	ATF_REQUIRE_EQ("ix0:1."sv, bufstr());
+}
+
+ATF_INIT_TEST_CASES(tcs)
+{
+	ATF_ADD_TEST_CASE(tcs, basic);
+	ATF_ADD_TEST_CASE(tcs, ifname);
+	ATF_ADD_TEST_CASE(tcs, smallbuf);
+	ATF_ADD_TEST_CASE(tcs, invalid);
+	ATF_ADD_TEST_CASE(tcs, nonether);
+	ATF_ADD_TEST_CASE(tcs, overlong);
+	ATF_ADD_TEST_CASE(tcs, link_ntoa_r);
+}
diff --git a/lib/libc/tests/stdlib/Makefile b/lib/libc/tests/stdlib/Makefile
index aa2fa7683cb7..9df98bd4f435 100644
--- a/lib/libc/tests/stdlib/Makefile
+++ b/lib/libc/tests/stdlib/Makefile
@@ -1,6 +1,7 @@
 
 .include <src.opts.mk>
 
+ATF_TESTS_C+=		cxa_atexit_test
 ATF_TESTS_C+=		dynthr_test
 ATF_TESTS_C+=		heapsort_test
 ATF_TESTS_C+=		mergesort_test
@@ -77,5 +78,6 @@ LIBADD.${t}+=	netbsd util
 LIBADD.strtod_test+=		m
 
 SUBDIR+=	dynthr_mod
+SUBDIR+=	libatexit
 
 .include <bsd.test.mk>
diff --git a/lib/libc/tests/stdlib/cxa_atexit_test.c b/lib/libc/tests/stdlib/cxa_atexit_test.c
new file mode 100644
index 000000000000..7e2cafbce850
--- /dev/null
+++ b/lib/libc/tests/stdlib/cxa_atexit_test.c
@@ -0,0 +1,132 @@
+/*-
+ * Copyright (c) 2025 Kyle Evans <kevans@FreeBSD.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include <sys/wait.h>
+
+#include <dlfcn.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <atf-c.h>
+
+#define	ARBITRARY_EXIT_CODE	42
+
+static char *
+get_shlib(const char *srcdir)
+{
+	char *shlib;
+
+	shlib = NULL;
+	if (asprintf(&shlib, "%s/libatexit.so", srcdir) < 0)
+		atf_tc_fail("failed to construct path to libatexit.so");
+	return (shlib);
+}
+
+static void
+run_test(const atf_tc_t *tc, bool with_fatal_atexit, bool with_exit)
+{
+	pid_t p;
+	void (*set_fatal_atexit)(bool);
+	void (*set_exit_code)(int);
+	void *hdl;
+	char *shlib;
+
+	shlib = get_shlib(atf_tc_get_config_var(tc, "srcdir"));
+
+	hdl = dlopen(shlib, RTLD_LAZY);
+	ATF_REQUIRE_MSG(hdl != NULL, "dlopen: %s", dlerror());
+
+	free(shlib);
+
+	if (with_fatal_atexit) {
+		set_fatal_atexit = dlsym(hdl, "set_fatal_atexit");
+		ATF_REQUIRE_MSG(set_fatal_atexit != NULL,
+		    "set_fatal_atexit: %s", dlerror());
+	}
+	if (with_exit) {
+		set_exit_code = dlsym(hdl, "set_exit_code");
+		ATF_REQUIRE_MSG(set_exit_code != NULL, "set_exit_code: %s",
+		    dlerror());
+	}
+
+	p = atf_utils_fork();
+	if (p == 0) {
+		/*
+		 * Don't let the child clobber the results file; stderr/stdout
+		 * have been replaced by atf_utils_fork() to capture it.  We're
+		 * intentionally using exit() instead of _exit() here to run
+		 * __cxa_finalize at exit, otherwise we'd just leave it be.
+		 */
+		closefrom(3);
+
+		if (with_fatal_atexit)
+			set_fatal_atexit(true);
+		if (with_exit)
+			set_exit_code(ARBITRARY_EXIT_CODE);
+
+		dlclose(hdl);
+
+		/*
+		 * If the dtor was supposed to exit (most cases), then we should
+		 * not have made it to this point.  If it's not supposed to
+		 * exit, then we just exit with success here because we might
+		 * be expecting either a clean exit or a signal on our way out
+		 * as the final __cxa_finalize tries to run a callback in the
+		 * unloaded DSO.
+		 */
+		if (with_exit)
+			exit(1);
+		exit(0);
+	}
+
+	dlclose(hdl);
+	atf_utils_wait(p, with_exit ? ARBITRARY_EXIT_CODE : 0, "", "");
+}
+
+ATF_TC_WITHOUT_HEAD(simple_cxa_atexit);
+ATF_TC_BODY(simple_cxa_atexit, tc)
+{
+	/*
+	 * This test exits in a global object's dtor so that we check for our
+	 * dtor being run at dlclose() time.  If it isn't, then the forked child
+	 * will have a chance to exit(1) after dlclose() to raise a failure.
+	 */
+	run_test(tc, false, true);
+}
+
+ATF_TC_WITHOUT_HEAD(late_cxa_atexit);
+ATF_TC_BODY(late_cxa_atexit, tc)
+{
+	/*
+	 * This test creates another global object during a __cxa_atexit handler
+	 * invocation.  It's been observed in the wild that we weren't executing
+	 * it, then the DSO gets torn down and it was executed at application
+	 * exit time instead.  In the best case scenario we would crash if
+	 * something else hadn't been mapped there.
+	 */
+	run_test(tc, true, false);
+}
+
+ATF_TC_WITHOUT_HEAD(late_cxa_atexit_ran);
+ATF_TC_BODY(late_cxa_atexit_ran, tc)
+{
+	/*
+	 * This is a slight variation of the previous test where we trigger an
+	 * exit() in our late-registered __cxa_atexit handler so that we can
+	 * ensure it was ran *before* dlclose() finished and not through some
+	 * weird chain of events afterwards.
+	 */
+	run_test(tc, true, true);
+}
+
+ATF_TP_ADD_TCS(tp)
+{
+	ATF_TP_ADD_TC(tp, simple_cxa_atexit);
+	ATF_TP_ADD_TC(tp, late_cxa_atexit);
+	ATF_TP_ADD_TC(tp, late_cxa_atexit_ran);
+	return (atf_no_error());
+}
diff --git a/lib/libc/tests/stdlib/libatexit/Makefile b/lib/libc/tests/stdlib/libatexit/Makefile
new file mode 100644
index 000000000000..9ba04c77af62
--- /dev/null
+++ b/lib/libc/tests/stdlib/libatexit/Makefile
@@ -0,0 +1,11 @@
+SHLIB_CXX=		libatexit
+SHLIB_NAME=		libatexit.so
+SHLIB_MAJOR=		1
+SHLIBDIR=	${TESTSDIR}
+PACKAGE=	tests
+SRCS=		libatexit.cc
+
+TESTSDIR:=	${TESTSBASE}/${RELDIR:C/libc\/tests/libc/:H}
+
+
+.include <bsd.lib.mk>
diff --git a/lib/libc/tests/stdlib/libatexit/libatexit.cc b/lib/libc/tests/stdlib/libatexit/libatexit.cc
new file mode 100644
index 000000000000..bb286c97e421
--- /dev/null
+++ b/lib/libc/tests/stdlib/libatexit/libatexit.cc
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2025 Kyle Evans <kevans@FreeBSD.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ */
+
+#include <unistd.h>
+
+static int exit_code = -1;
+static bool fatal_atexit;
+
+extern "C" {
+	void set_fatal_atexit(bool);
+	void set_exit_code(int);
+}
+
+void
+set_fatal_atexit(bool fexit)
+{
+	fatal_atexit = fexit;
+}
+
+void
+set_exit_code(int code)
+{
+	exit_code = code;
+}
+
+struct other_object {
+	~other_object() {
+
+		/*
+		 * In previous versions of our __cxa_atexit handling, we would
+		 * never actually execute this handler because it's added during
+		 * ~object() below; __cxa_finalize would never revisit it.  We
+		 * will allow the caller to configure us to exit with a certain
+		 * exit code so that it can run us twice: once to ensure we
+		 * don't crash at the end, and again to make sure the handler
+		 * actually ran.
+		 */
+		if (exit_code != -1)
+			_exit(exit_code);
+	}
+};
+
+void
+create_staticobj()
+{
+	static other_object obj;
+}
+
+struct object {
+	~object() {
+		/*
+		 * If we're doing the fatal_atexit behavior (i.e., create an
+		 * object that will add its own dtor for __cxa_finalize), then
+		 * we don't exit here.
+		 */
+		if (fatal_atexit)
+			create_staticobj();
+		else if (exit_code != -1)
+			_exit(exit_code);
+	}
+};
+
+static object obj;
diff --git a/lib/libcrypt/crypt-nthash.c b/lib/libcrypt/crypt-nthash.c
index 28c832dd6f9f..cc9dbf7533cd 100644
--- a/lib/libcrypt/crypt-nthash.c
+++ b/lib/libcrypt/crypt-nthash.c
@@ -57,17 +57,17 @@ crypt_nthash(const char *pw, const char *salt __unused, char *buffer)
 	u_char hash[MD4_SIZE];
 	const char *s;
 	MD4_CTX	ctx;
-  
-	bzero(unipw, sizeof(unipw)); 
+
+	bzero(unipw, sizeof(unipw));
 	/* convert to unicode (thanx Archie) */
 	unipwLen = 0;
 	for (s = pw; unipwLen < sizeof(unipw) / 2 && *s; s++)
 		unipw[unipwLen++] = htons(*s << 8);
-        
+
 	/* Compute MD4 of Unicode password */
- 	MD4Init(&ctx);
+	MD4Init(&ctx);
 	MD4Update(&ctx, (u_char *)unipw, unipwLen*sizeof(u_int16_t));
-	MD4Final(hash, &ctx);  
+	MD4Final(hash, &ctx);
 
 	buffer = stpcpy(buffer, magic);
 	*buffer++ = '$';
diff --git a/lib/libexpat/expat_config.h b/lib/libexpat/expat_config.h
index 2bb52a4baa03..748f75ee157d 100644
--- a/lib/libexpat/expat_config.h
+++ b/lib/libexpat/expat_config.h
@@ -89,7 +89,7 @@
 #define PACKAGE_NAME "expat"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "expat 2.6.4"
+#define PACKAGE_STRING "expat 2.7.1"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "expat"
@@ -98,7 +98,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "2.6.4"
+#define PACKAGE_VERSION "2.7.1"
 
 /* Define to 1 if all of the C90 standard headers exist (not just the ones
    required in a freestanding environment). This macro is provided for
@@ -106,7 +106,7 @@
 #define STDC_HEADERS 1
 
 /* Version number of package */
-#define VERSION "2.6.4"
+#define VERSION "2.7.1"
 
 /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
    significant byte first (like Motorola and SPARC, unlike Intel). */
diff --git a/lib/libexpat/libbsdxml.3 b/lib/libexpat/libbsdxml.3
index 21c07d39e5e2..c91184840b70 100644
--- a/lib/libexpat/libbsdxml.3
+++ b/lib/libexpat/libbsdxml.3
@@ -23,7 +23,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"/
-.Dd December 8, 2024
+.Dd April 7, 2025
 .Dt LIBBSDXML 3
 .Os
 .Sh NAME
@@ -34,7 +34,7 @@
 .Sh DESCRIPTION
 The
 .Nm
-library is a verbatim copy of the eXpat XML library version 2.6.4.
+library is a verbatim copy of the eXpat XML library version 2.7.1.
 .Pp
 The
 .Nm
diff --git a/lib/liblzma/Makefile b/lib/liblzma/Makefile
index be0ceef80ba9..84580dd01ef3 100644
--- a/lib/liblzma/Makefile
+++ b/lib/liblzma/Makefile
@@ -81,16 +81,13 @@ SRCS+=	common.c \
 
 
 .PATH: ${LZMADIR}/check
-SRCS+=	check.c \
-	crc32_table.c \
-	crc64_table.c
+SRCS+=	check.c		\
+	crc32_fast.c	\
+	crc64_fast.c
 .if defined(MACHINE_ARCH) && ${MACHINE_ARCH} == "i386"
 SRCS+=	crc32_x86.S \
 	crc64_x86.S
 ACFLAGS+=	-Wa,--noexecstack
-.else
-SRCS+=	crc32_fast.c \
-	crc64_fast.c
 .endif
 
 .PATH: ${LZMADIR}/lz
diff --git a/lib/liblzma/Symbol.map b/lib/liblzma/Symbol.map
index 938b6191b4f4..0976e26a3c8d 100644
--- a/lib/liblzma/Symbol.map
+++ b/lib/liblzma/Symbol.map
@@ -118,6 +118,15 @@ XZ_5.6 {
 	lzma_mt_block_size;
 };
 
+XZ_5.8 {
+	lzma_bcj_arm64_encode;
+	lzma_bcj_arm64_decode;
+	lzma_bcj_riscv_encode;
+	lzma_bcj_riscv_decode;
+	lzma_bcj_x86_encode;
+	lzma_bcj_x86_decode;
+};
+
 XZprivate_1.0 {
 	lzma_alloc;
 	lzma_alloc_zero;
diff --git a/lib/liblzma/Versions.def b/lib/liblzma/Versions.def
index 25064d9d50e7..555ef25c8801 100644
--- a/lib/liblzma/Versions.def
+++ b/lib/liblzma/Versions.def
@@ -11,6 +11,9 @@ XZ_5.4 {
 XZ_5.6 {
 } XZ_5.4;
 
-XZprivate_1.0 {
+XZ_5.8 {
 } XZ_5.6;
 
+XZprivate_1.0 {
+} XZ_5.8;
+
diff --git a/lib/liblzma/config.h b/lib/liblzma/config.h
index 3e51b0b92463..963d08c93e7a 100644
--- a/lib/liblzma/config.h
+++ b/lib/liblzma/config.h
@@ -68,6 +68,12 @@
 /* Define to 1 if you have the <cpuid.h> header file. */
 #define HAVE_CPUID_H 1
 
+/* Define to 1 if the 32-bit x86 CRC assembly files are used. */
+/* FreeBSD - only enabled for i386 */
+#if defined(__FreeBSD__) && defined(__i386__)
+#define HAVE_CRC_X86_ASM 1
+#endif
+
 /* Define if the GNU dcgettext() function is already present or preinstalled.
    */
 /* FreeBSD - disabled intentionally */
@@ -193,6 +199,9 @@
    */
 /* #undef HAVE_LINUX_LANDLOCK */
 
+/* Define to 1 if 64-bit LoongArch CRC32 instructions are supported. */
+/* #undef HAVE_LOONGARCH_CRC32 */
+
 /* Define to 1 if .lz (lzip) decompression support is enabled. */
 #define HAVE_LZIP_DECODER 1
 
@@ -335,6 +344,9 @@
 /* Define to 1 if you have the 'utimes' function. */
 /* #undef HAVE_UTIMES */
 
+/* Define to 1 if you have the 'vasprintf' function. */
+#define HAVE_VASPRINTF 1
+
 /* Define to 1 or 0, depending whether the compiler supports simple visibility
    declarations. */
 #define HAVE_VISIBILITY 1
@@ -391,7 +403,7 @@
 #define PACKAGE_NAME "XZ Utils"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "XZ Utils 5.6.3"
+#define PACKAGE_STRING "XZ Utils 5.8.1"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "xz"
@@ -400,7 +412,7 @@
 #define PACKAGE_URL "https://tukaani.org/xz/"
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "5.6.3"
+#define PACKAGE_VERSION "5.8.1"
 
 /* Define to necessary symbol if this constant uses a non-standard name on
    your system. */
@@ -565,7 +577,7 @@
 
 
 /* Version number of package */
-#define VERSION "5.6.3"
+#define VERSION "5.8.1"
 
 /* Define WORDS_BIGENDIAN to 1 if your processor stores words with the most
    significant byte first (like Motorola and SPARC, unlike Intel). */
diff --git a/lib/libradius/radlib.c b/lib/libradius/radlib.c
index 2049468f455f..cd1f1df1b234 100644
--- a/lib/libradius/radlib.c
+++ b/lib/libradius/radlib.c
@@ -321,8 +321,10 @@ is_valid_request(struct rad_handle *h)
 	hctx = HMAC_CTX_new();
 	while (pos < len - 2) {
 		alen = h->in[pos + 1];
-		if (alen < 2)
+		if (alen < 2) {
+			HMAC_CTX_free(hctx);
 			return (0);
+		}
 		if (h->in[pos] == RAD_MESSAGE_AUTHENTIC) {
 			if (len - pos < MD5_DIGEST_LENGTH + 2) {
 				HMAC_CTX_free(hctx);
diff --git a/lib/libsbuf/tests/sbuf_core_test.c b/lib/libsbuf/tests/sbuf_core_test.c
index 1ed320316510..b01a43e12c5c 100644
--- a/lib/libsbuf/tests/sbuf_core_test.c
+++ b/lib/libsbuf/tests/sbuf_core_test.c
@@ -26,6 +26,8 @@
 #include <sys/cdefs.h>
 #include <sys/param.h>
 #include <sys/sbuf.h>
+
+#include <atf-c.h>
 #include <errno.h>
 #include <stdarg.h>
 #include <stdio.h>
@@ -33,12 +35,10 @@
 #include <string.h>
 #include <unistd.h>
 
-#include <atf-c.h>
-
 #include "sbuf_test_common.h"
 
-static char	test_string[] = "this is a test string";
-#define	TEST_STRING_CHOP_COUNT	5
+static char test_string[] = "this is a test string";
+#define TEST_STRING_CHOP_COUNT 5
 _Static_assert(nitems(test_string) > TEST_STRING_CHOP_COUNT,
     "test_string is too short");
 
@@ -76,8 +76,8 @@ ATF_TC_BODY(sbuf_clear_test, tc)
 
 	buf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(buf_len == 0, "sbuf_len (%zd) != 0", buf_len);
-	ATF_REQUIRE_STREQ_MSG(sbuf_data(sb), "",
-	    "sbuf (\"%s\") was not empty", sbuf_data(sb));
+	ATF_REQUIRE_STREQ_MSG(sbuf_data(sb), "", "sbuf (\"%s\") was not empty",
+	    sbuf_data(sb));
 
 	sbuf_delete(sb);
 }
@@ -104,7 +104,6 @@ ATF_TC_BODY(sbuf_done_and_sbuf_finish_test, tc)
 static int
 drain_ret0(void *arg, const char *data, int len)
 {
-
 	(void)arg;
 	(void)data;
 	(void)len;
@@ -145,10 +144,11 @@ ATF_TC_BODY(sbuf_len_test, tc)
 		buf_len = sbuf_len(sb);
 		ATF_REQUIRE_MSG(buf_len == (ssize_t)(i * test_string_len),
 		    "sbuf_len (%zd) != %zu", buf_len, i * test_string_len);
-		ATF_REQUIRE_MSG(sbuf_cat(sb, test_string) == 0, "sbuf_cat failed");
+		ATF_REQUIRE_MSG(sbuf_cat(sb, test_string) == 0,
+		    "sbuf_cat failed");
 	}
 
-#ifdef	HAVE_SBUF_SET_FLAGS
+#ifdef HAVE_SBUF_SET_FLAGS
 	sbuf_set_flags(sb, SBUF_INCLUDENUL);
 	ATF_REQUIRE_MSG((ssize_t)(i * test_string_len + 1) == sbuf_len(sb),
 	    "sbuf_len(..) didn't report the NUL char");
@@ -173,8 +173,8 @@ ATF_TC_BODY(sbuf_new_fixedlen, tc)
 
 	child_proc = atf_utils_fork();
 	if (child_proc == 0) {
-		ATF_REQUIRE_EQ_MSG(0, sbuf_finish(&sb), "sbuf_finish failed: %s",
-		    strerror(errno));
+		ATF_REQUIRE_EQ_MSG(0, sbuf_finish(&sb),
+		    "sbuf_finish failed: %s", strerror(errno));
 
 		sbuf_putbuf(&sb);
 		exit(0);
@@ -183,7 +183,8 @@ ATF_TC_BODY(sbuf_new_fixedlen, tc)
 
 	sbuf_putc(&sb, ' ');
 
-	ATF_CHECK_EQ_MSG(-1, sbuf_finish(&sb), "failed to return error on overflow");
+	ATF_CHECK_EQ_MSG(-1, sbuf_finish(&sb),
+	    "failed to return error on overflow");
 
 	sbuf_delete(&sb);
 }
@@ -244,7 +245,6 @@ ATF_TC_BODY(sbuf_setpos_test, tc)
 
 ATF_TP_ADD_TCS(tp)
 {
-
 	ATF_TP_ADD_TC(tp, sbuf_clear_test);
 	ATF_TP_ADD_TC(tp, sbuf_done_and_sbuf_finish_test);
 	ATF_TP_ADD_TC(tp, sbuf_drain_ret0_test);
@@ -252,15 +252,15 @@ ATF_TP_ADD_TCS(tp)
 	ATF_TP_ADD_TC(tp, sbuf_new_fixedlen);
 #if 0
 	/* TODO */
-#ifdef	HAVE_SBUF_CLEAR_FLAGS
+#ifdef HAVE_SBUF_CLEAR_FLAGS
 	ATF_TP_ADD_TC(tp, sbuf_clear_flags_test);
 #endif
-#ifdef	HAVE_SBUF_GET_FLAGS
+#ifdef HAVE_SBUF_GET_FLAGS
 	ATF_TP_ADD_TC(tp, sbuf_get_flags_test);
 #endif
 	ATF_TP_ADD_TC(tp, sbuf_new_positive_test);
 	ATF_TP_ADD_TC(tp, sbuf_new_negative_test);
-#ifdef	HAVE_SBUF_SET_FLAGS
+#ifdef HAVE_SBUF_SET_FLAGS
 	ATF_TP_ADD_TC(tp, sbuf_set_flags_test);
 #endif
 #endif
diff --git a/lib/libsbuf/tests/sbuf_stdio_test.c b/lib/libsbuf/tests/sbuf_stdio_test.c
index 5bf32c674901..4987c1409723 100644
--- a/lib/libsbuf/tests/sbuf_stdio_test.c
+++ b/lib/libsbuf/tests/sbuf_stdio_test.c
@@ -26,6 +26,8 @@
 #include <sys/cdefs.h>
 #include <sys/param.h>
 #include <sys/sbuf.h>
+
+#include <atf-c.h>
 #include <errno.h>
 #include <stdarg.h>
 #include <stdio.h>
@@ -33,17 +35,15 @@
 #include <string.h>
 #include <unistd.h>
 
-#include <atf-c.h>
-
 #include "sbuf_test_common.h"
 
-static char	test_string[] = "this is a test string";
+static char test_string[] = "this is a test string";
 
-#define	MESSAGE_FORMAT	"message: %s\n"
-#define	MESSAGE_SEPARATOR	';'
+#define MESSAGE_FORMAT	  "message: %s\n"
+#define MESSAGE_SEPARATOR ';'
 
 static int
-sbuf_vprintf_helper(struct sbuf *sb, const char * restrict format, ...)
+sbuf_vprintf_helper(struct sbuf *sb, const char *restrict format, ...)
 {
 	va_list ap;
 	int rc;
@@ -117,8 +117,8 @@ ATF_TC_BODY(sbuf_printf_test, tc)
 	struct sbuf *sb;
 	char *test_string_tmp;
 
-	asprintf(&test_string_tmp, "%s%c" MESSAGE_FORMAT,
-	    test_string, MESSAGE_SEPARATOR, test_string);
+	asprintf(&test_string_tmp, "%s%c" MESSAGE_FORMAT, test_string,
+	    MESSAGE_SEPARATOR, test_string);
 	ATF_REQUIRE_MSG(test_string_tmp != NULL, "asprintf failed");
 
 	sb = sbuf_new_auto();
@@ -177,8 +177,8 @@ ATF_TC_BODY(sbuf_vprintf_test, tc)
 	char *test_string_tmp;
 	int rc;
 
-	asprintf(&test_string_tmp, "%s%c" MESSAGE_FORMAT,
-	    test_string, MESSAGE_SEPARATOR, test_string);
+	asprintf(&test_string_tmp, "%s%c" MESSAGE_FORMAT, test_string,
+	    MESSAGE_SEPARATOR, test_string);
 	ATF_REQUIRE_MSG(test_string_tmp != NULL, "asprintf failed");
 
 	sb = sbuf_new_auto();
@@ -204,7 +204,6 @@ ATF_TC_BODY(sbuf_vprintf_test, tc)
 
 ATF_TP_ADD_TCS(tp)
 {
-
 	ATF_TP_ADD_TC(tp, sbuf_printf_drain_null_test);
 	ATF_TP_ADD_TC(tp, sbuf_printf_drain_test);
 	ATF_TP_ADD_TC(tp, sbuf_printf_test);
diff --git a/lib/libsbuf/tests/sbuf_string_test.c b/lib/libsbuf/tests/sbuf_string_test.c
index 9deccc572692..9ff3dde0cab3 100644
--- a/lib/libsbuf/tests/sbuf_string_test.c
+++ b/lib/libsbuf/tests/sbuf_string_test.c
@@ -26,28 +26,33 @@
 #include <sys/cdefs.h>
 #include <sys/param.h>
 #include <sys/sbuf.h>
+
+#include <atf-c.h>
 #include <errno.h>
 #include <libutil.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
-#include <atf-c.h>
-
 #include "sbuf_test_common.h"
 
-static char	test_string[] = "this is a test string";
-static char	test_whitespace_string[] = " \f\n\r\t\v ";
-static int	test_buffer[] = { 0, 1, 2, 3, 4, 5, };
+static char test_string[] = "this is a test string";
+static char test_whitespace_string[] = " \f\n\r\t\v ";
+static int test_buffer[] = {
+	0,
+	1,
+	2,
+	3,
+	4,
+	5,
+};
 
 static void
 check_buffers_equal(const void *sb_buf, const void *test_buf, size_t len)
 {
-
 	if (memcmp(sb_buf, test_buf, len) != 0) {
 		printf("sbuf:\n");
-		hexdump(sb_buf, len, NULL, 0),
-		printf("test_buf:\n");
+		hexdump(sb_buf, len, NULL, 0), printf("test_buf:\n");
 		hexdump(test_buf, len, NULL, 0);
 		atf_tc_fail("contents of sbuf didn't match test_buf contents");
 	}
@@ -76,16 +81,16 @@ ATF_TC_BODY(sbuf_bcat_test, tc)
 
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(test_sbuf_len == (ssize_t)sizeof(test_buffer),
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, sizeof(test_buffer));
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    sizeof(test_buffer));
 
 	ATF_CHECK_MSG(sbuf_bcat(sb, test_buffer, sizeof(test_buffer)) == 0,
 	    "sbuf_bcat failed");
 
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(test_sbuf_len == (ssize_t)(2 * sizeof(test_buffer)),
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, 2 * sizeof(test_buffer));
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    2 * sizeof(test_buffer));
 
 	ATF_REQUIRE_MSG(sbuf_finish(sb) == 0, "sbuf_finish failed: %s",
 	    strerror(errno));
@@ -113,16 +118,16 @@ ATF_TC_BODY(sbuf_bcpy_test, tc)
 
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(test_sbuf_len == (ssize_t)sizeof(test_buffer),
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, sizeof(test_buffer));
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    sizeof(test_buffer));
 
 	ATF_CHECK_MSG(sbuf_bcpy(sb, test_buffer, sizeof(test_buffer)) == 0,
 	    "sbuf_bcpy failed");
 
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(test_sbuf_len == (ssize_t)sizeof(test_buffer),
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, sizeof(test_buffer));
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    sizeof(test_buffer));
 
 	ATF_REQUIRE_MSG(sbuf_finish(sb) == 0, "sbuf_finish failed: %s",
 	    strerror(errno));
@@ -150,15 +155,15 @@ ATF_TC_BODY(sbuf_cat_test, tc)
 
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(test_sbuf_len == (ssize_t)strlen(test_string),
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, sizeof(test_string));
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    sizeof(test_string));
 
 	ATF_CHECK_MSG(sbuf_cat(sb, test_string) == 0, "sbuf_cat failed");
 
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(test_sbuf_len == (ssize_t)strlen(test_string_tmp),
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, strlen(test_string_tmp));
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    strlen(test_string_tmp));
 
 	ATF_REQUIRE_MSG(sbuf_finish(sb) == 0, "sbuf_finish failed: %s",
 	    strerror(errno));
@@ -186,15 +191,15 @@ ATF_TC_BODY(sbuf_cpy_test, tc)
 
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(test_sbuf_len == (ssize_t)strlen(test_string),
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, strlen(test_string));
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    strlen(test_string));
 
 	ATF_CHECK_MSG(sbuf_cpy(sb, test_string) == 0, "sbuf_cpy failed");
 
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(test_sbuf_len == (ssize_t)strlen(test_string),
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, strlen(test_string));
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    strlen(test_string));
 
 	ATF_REQUIRE_MSG(sbuf_finish(sb) == 0, "sbuf_finish failed: %s",
 	    strerror(errno));
@@ -217,7 +222,7 @@ ATF_TC_BODY(sbuf_putc_test, tc)
 	ATF_REQUIRE_MSG(sb != NULL, "sbuf_new_auto failed: %s",
 	    strerror(errno));
 
-	for (i = 0; i <= strlen(test_string); i++) {	/* Include the NUL */
+	for (i = 0; i <= strlen(test_string); i++) { /* Include the NUL */
 		ATF_REQUIRE_MSG(sbuf_putc(sb, test_string[i]) == 0,
 		    "sbuf_putc failed");
 
@@ -257,8 +262,8 @@ ATF_TC_BODY(sbuf_trim_test, tc)
 	    strlen(test_whitespace_string));
 	test_sbuf_len = sbuf_len(sb);
 	ATF_REQUIRE_MSG(exp_sbuf_len == test_sbuf_len,
-	    "sbuf_len(..) => %zd (actual) != %zu (expected)",
-	    test_sbuf_len, exp_sbuf_len);
+	    "sbuf_len(..) => %zd (actual) != %zu (expected)", test_sbuf_len,
+	    exp_sbuf_len);
 
 	ATF_REQUIRE_MSG(sbuf_trim(sb) == 0, "sbuf_trim failed");
 
@@ -274,7 +279,6 @@ ATF_TC_BODY(sbuf_trim_test, tc)
 
 ATF_TP_ADD_TCS(tp)
 {
-
 	ATF_TP_ADD_TC(tp, sbuf_bcat_test);
 	ATF_TP_ADD_TC(tp, sbuf_bcpy_test);
 	ATF_TP_ADD_TC(tp, sbuf_cat_test);
diff --git a/lib/libunbound/config.h b/lib/libunbound/config.h
index ca2916a6b5b0..c89724b6b8fc 100644
--- a/lib/libunbound/config.h
+++ b/lib/libunbound/config.h
@@ -796,7 +796,7 @@
 #define PACKAGE_NAME "unbound"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "unbound 1.22.0"
+#define PACKAGE_STRING "unbound 1.23.0"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "unbound"
@@ -805,7 +805,7 @@
 #define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "1.22.0"
+#define PACKAGE_VERSION "1.23.0"
 
 /* default pidfile location */
 #define PIDFILE "/var/unbound/unbound.pid"
@@ -828,7 +828,7 @@
 #define ROOT_CERT_FILE "/var/unbound/icannbundle.pem"
 
 /* version number for resource files */
-#define RSRC_PACKAGE_VERSION 1,22,0,0
+#define RSRC_PACKAGE_VERSION 1,23,0,0
 
 /* Directory to chdir to */
 #define RUN_DIR "/var/unbound"