74.html

<!doctype html>
<html lang=en id=release>
<head>
<meta charset=utf-8>

<title>OpenBSD 7.4</title>
<meta name="description" content="OpenBSD 7.4">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="openbsd.css">
<link rel="canonical" href="https://www.openbsd.org/74.html">
</head><body>
<h2 id=OpenBSD>
<a href="index.html">
<i>Open</i><b>BSD</b></a>
7.4
</h2>

<table>
<tr>
<td>
<a href="images/ImHappyBecauseEveryoneLovesMe.jpg">
<img width="227" height="303" src="images/ImHappyBecauseEveryoneLovesMe-s.gif" alt="I'm mHappy Because Everyone Loves Me"></a>
<td>
Released Oct 16, 2023. (55th OpenBSD release)<br>
Copyright 1997-2023, Theo de Raadt.<br>
<br>
Artwork by Jessica Scott.
<br>
<ul>
<li>See the information on <a href="ftp.html">the FTP page</a> for
    a list of mirror machines.
<li>Go to the <code class=reldir>pub/OpenBSD/7.4/</code> directory on
    one of the mirror sites.
<li>Have a look at <a href="errata74.html">the 7.4 errata page</a> for a list
    of bugs and workarounds.
<li>See a <a href="plus74.html">detailed log of changes</a> between the
    7.3 and 7.4 releases.
<p>
<li><a href="https://man.openbsd.org/signify.1">signify(1)</a>
    pubkeys for this release:<p>

<table class=signify>
<tr><td>
openbsd-74-base.pub:
<td>
<a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/openbsd-74-base.pub">
RWRoyQmAD08ajTqgzK3UcWaVlwaJMckH9/CshU8Md5pN1GoIrcBdTF+c</a>
<tr><td>
openbsd-74-fw.pub:
<td>
RWTRA9KXRuZKunpXYK0ed5OxbE0K7rYWpDnTu+M8wZdqzRroFqed0U6I
<tr><td>
openbsd-74-pkg.pub:
<td>
RWR/h7gubZ9M/O46RNy3PzLTPevOCK24LGCPca41IHMwSH4YuVA+jnWO
<tr><td>
openbsd-74-syspatch.pub:
<td>
RWQqty2voy8V8afR9/v2RzuNr7r4y9cKwljABN7Tytd7JcPdBjnXg0Ue
</table>
</ul>
<p>
All applicable copyrights and credits are in the src.tar.gz,
sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
files fetched via <code>ports.tar.gz</code>.
</table>

<hr>

<section id=new>
<h3>What's New</h3>
<p>
This is a partial list of new features and systems included in OpenBSD 7.4.
For a comprehensive list, see the <a href="plus74.html">changelog</a> leading
to 7.4.

<ul>

<!--
<li>New/extended platforms:
  <ul>
  <li>...
  </ul>
-->

<li>Various kernel improvements:
  <ul>
  <li>On arm64, show BTI and SBSS features in
      <a href="https://man.openbsd.org/dmesg.8">dmesg(8)</a>.
  <li>New <a href="https://man.openbsd.org/kqueue1">kqueue1(2)</a>
      system call supporting the <code>O_CLOEXEC</code> flag.
  <li>Map device tree read/write to unbreak root on
      <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>.
  <li>Correctly recognize <a href="https://man.openbsd.org/umass.4">umass(4)</a>
      floppy disk devices as floppy disks.
  <li>In <a href="https://man.openbsd.org/wscons.4">wscons(4)</a>,
	catch up with box drawing characters which have
	been standardized in unicode after the original wscons code was
	written and chose placeholder values.
  <li>In <a href="https://man.openbsd.org/wscons.4">wscons(4)</a>,
	make sure we do not increase the escape sequence argument count beyond
	usable bounds.
  <li>Implement <a href="https://man.openbsd.org/dt.4">dt(4)</a>
	<a href="https://man.openbsd.org/utrace.2">utrace(2)</a>
	support on amd64 and i386.
  <li>Correct undefined behavior when using MS-DOS filesystems, fixes imported from FreeBSD.
  <li>Make the <a href="https://man.openbsd.org/fstab.5">softdep</a>
	<a href="https://man.openbsd.org/mount.8">mount(8)</a> option a no-op.
	Softdep was a significant impediment to improving the vfs layer.
  <li>Allow <a href="https://man.openbsd.org/unveil.2">unveil(2)</a>ed
	programs to dump <a href="https://man.openbsd.org/core.5">core(5)</a>
	into the current working directory.
  <li>Address incomplete validation of ELF program headers in <a
	href="https://man.openbsd.org/execve.2">execve(2)</a>.
  <li>On arm64, use the deep idle state available on Apple M1/M2 cores
	in the idle loop and for suspend, resulting in power savings.
  <li>Update AMD CPU microcode if a newer patch is available.
  <li>Enable a workaround for the 'Zenbleed' AMD CPU bug.
  <li>Report speculation control bits in
	<a href="https://man.openbsd.org/dmesg.8">dmesg(8)</a> CPU lines.
  <li>To give the primary CPU an opportunity to perform clock interrupt
	preparation in a machine-independent manner we need to separate the
	"initialization" parts of cpu_initclocks() from the "start the clock
	interrupt" parts. Separate cpu_initclocks() from cpu_startclock().
  <li>Fix a problem where CPU time accounting and RLIMIT_CPU was
	unreliable on idle systems.
  <li>Improve the output of the "show proc" command of the kernel
	debugger <a href="https://man.openbsd.org/ddb.4">ddb(4)</a> and show
	both the PID and TID of the proc.
  </ul>

<li>SMP Improvements
  <ul>
  <li>Rewrite <a href="https://man.openbsd.org/pfsync.4">pfsync(4)</a>,
	in particular to improve locking and to help with unlocking more
	of <a href="https://man.openbsd.org/pf.4">pf(4)</a> and with
	parallelisation of the network stack in the future.
	The protocol remains compatible with the older version.
  <li>Remove kernel locks from the ARP input path.
  <li>Pull MP-safe arprequest() out of kernel lock.
  <li>Remove the kernel lock from IPv6 neighbor discovery.
  <li>Unlock more parts of <a
	href="https://man.openbsd.org/ioctl.2">ioctl(2)</a> and the <a
	href="https://man.openbsd.org/route.4">routing</a> code in the network
	stack.
  </ul>

<li>Direct Rendering Manager and graphics drivers
  <ul>
  <li>Update <a href="https://man.openbsd.org/drm.4">drm(4)</a>
      to Linux 6.1.55.
  <li>Don't change end marker in sg_set_page().  Caused bad memory accesses
      when using page flipping on Alder Lake and Raptor Lake.
  </ul>

<li>VMM/VMD improvements
  <ul>
  <li>Allowed <a href="https://man.openbsd.org/vmm.4">vmm(4)</a> guests to 
	enable and use supervisor IBT.
  <li>Suppressed AMD hardware p-state visibility to
	<a href="https://man.openbsd.org/vmm.4">vmm(4)</a> guests. 
  <li>Avoid use of uninitialised memory in
      <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>.
  <li>Migrate vmd_vm.vm_ttyname to char array allowing a vmd_vm
        object to be transmitted over an ipc channel.
  <li>Cleaned up file descriptor closing in
	 <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> vmm process.
  <li>Fixed vm send/receive, restoring device virtqueue addresses on
	receive.
  <li>Introduced <a href="https://man.openbsd.org/execvp.3">execvp(3)</a>
	after fork for child vm processes.
  <li>No longer generate an error in
      <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> if
      <a href="https://man.openbsd.org/vm.conf.5">vm.conf(5)</a> is absent.
  <li>Split <a href="https://man.openbsd.org/vmm.4">vmm(4)</a> into MI/MD
	parts.
  <li>Introduced multi-process model for 
	<a href="https://man.openbsd.org/vmd.8">vmd(8)</a> virtio block and
	network devices.
  <li>Allowed vm owners to override boot kernel when using
	<a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a> to start a
	vm.
  <li>Changed staggered start of vms to number of online CPUs.
  <li>Fixed a segfault on vm creation.
  <li>Switched to anonymous shared memory mappings for
	<a href="https://man.openbsd.org/vmd.8">vmd(8)</a> vm processes,
	introducing a new <a href="https://man.openbsd.org/vmm.4">vmm(4)</a>
	<a href="https://man.openbsd.org/ioctl.2">ioctl(2)</a>.
  <li>Relaxed absolute path requirements for 
	<a href="https://man.openbsd.org/vmd.8">vmd(8)</a> configtest mode (-n).
  <li>Adjusted shutdown logic by vm id to function similarly as by name.
  <li>Moved validation of local network prefixes for the internal
	<a href="https://man.openbsd.org/vmd.8">vmd(8)</a> DHCP service into
	the config parser.
  <li>Fixed QCOW2 base images when used with the
	<a href="https://man.openbsd.org/vmd.8">vmd(8)</a> multi-process device
	model.
  <li>Fixed setting verbose logging in child processes.
  <li>Fixed a race condition related to the emulated i8259 interrupt controller
	by ignoring interrupt masks on assert.
  <li>Inlined pending interrupts in the 
	<a href="https://man.openbsd.org/vmm.4">vmm(4)</a>
	<a href="https://man.openbsd.org/ioctl.2">ioctl(2)</a> for running the
	vcpu, reducing vm latency.
  <li>Added zero-copy, vectored io to the
	<a href="https://man.openbsd.org/vmd.8">vmd(8)</a> virtio block device.
  <li>Changed to logging <a href="https://man.openbsd.org/vmd.8">vmd(8)</a>
	vm ids in the vcpu run loop on error and not the ids used by
	<a href="https://man.openbsd.org/vmm.4">vmm(4)</a>.
  <li>Fixed a vm pause deadlock.
  <li>Changed <a href="https://man.openbsd.org/vmd.8">vmd(8)</a> logging format
	to disambiguate vm and device process by names and indices.
  <li>Fixed dynamically toggling verbose logging mode with
	<a href="https://man.openbsd.org/vmctl.8">vmctl(8)</a>.
  </ul>

<li>Various new userland features:
  <ul>
  <li>New ISO C11 header <code>&lt;uchar.h&gt;</code> declaring the
      types <code>char32_t</code> and <code>char16_t</code> and the
      functions <a href="https://man.openbsd.org/c32rtomb.3">c32rtomb(3)</a>,
      <a href="https://man.openbsd.org/mbrtoc32.3">mbrtoc32(3)</a>,
      <a href="https://man.openbsd.org/c16rtomb.3">c16rtomb(3)</a>, and
      <a href="https://man.openbsd.org/mbrtoc16.3">mbrtoc16(3)</a>.
  <li>Introduce a new <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>
	option <a href="https://man.openbsd.org/malloc.3#D">D</a>
	for memory leak detection with
	<a href="https://man.openbsd.org/ktrace.1">ktrace(1)</a> and
	<a href="https://man.openbsd.org/kdump.1">kdump(1)</a>.
  <li>Support <code>${.VARIABLES}</code> in
      <a href="https://man.openbsd.org/make.1">make(1)</a>,
      listing the names of all global variables that have been set.
  <li>New <a href="https://man.openbsd.org/kdump.1">kdump(1)</a>
      <code>-u</code> option to select
      <a href="https://man.openbsd.org/utrace.2">utrace(2)</a>
      tracepoints by label.
  <li>In <a href="https://man.openbsd.org/openrsync.1">openrsync(1)</a>,
      support the options <code>--size-only</code> and
      <code>--ignore-times</code>.
  <li>Update <a href="https://man.openbsd.org/tzset.3">zoneinfo</a>
      to tzdata2023c.
  <li>Accept the <a href="https://man.openbsd.org/ucom.4">ucom(4)</a> fixed
      name format as a valid format for the
      <a href="https://man.openbsd.org/cu.1">cu(1)</a> -l option.
  <li>In <a href="https://man.openbsd.org/cron.8">cron(8)</a> and
	<a href="https://man.openbsd.org/crontab.5">crontab(5)</a>,
	add support for random offsets when
	using ranges with a step value in cron.  This extends the random range
	syntax to support step values.  Instead of choosing a random number
	between the high and low values, the field is treated as a range with
	a random offset less than the step value.  This can be used to avoid
	thundering herd problems where multiple machines contact a server all
	at the same time via cron jobs.
  <li>Extend and improve the
	<a href="https://man.openbsd.org/ibuf_add.3">ibuf</a> API in libutil
	and add functions for more specific data types,
	for modifying data at specific
	offsets, for getting and setting the file descriptor stored on the ibuf
	and for efficient wrapping of ibufs into imsgs. The ibuf API is
	mostly used in network daemons.
  <li>In <a href="https://man.openbsd.org/wsconsctl.8">wsconsctl(8)</a>,
	add button mappings for two- and three-finger clicks on clickpads.
  </ul>

<li>Various bugfixes and tweaks in userland:
  <ul>
  <li>In <a href="https://man.openbsd.org/pax.1">pax(1)</a> and
      <a href="https://man.openbsd.org/tar.1">tar(1)</a>,
      do not open files that will be skipped,
      speeding up archive creation when many files are skipped.
  <li>In <a href="https://man.openbsd.org/pax.1">pax(1)</a>,
      <a href="https://man.openbsd.org/tar.1">tar(1)</a>, and
      <a href="https://man.openbsd.org/cpio.1">cpio(1)</a> terminal
      output, escape non-printable characters in messages that may
      include file names, and truncate times to the correct maximum value.
  <li>Better diagnostics from
      <a href="https://man.openbsd.org/make.1">make(1)</a>
      when a makefile exists but cannot be opened.
  <li>Prevent a buffer underflow in
      <a href="https://man.openbsd.org/patch.1">patch(1)</a>
      that could occur with lines longer than 32kB.
  <li>Prevent a segmentation fault in
      <a href="https://man.openbsd.org/patch.1">patch(1)</a>
      that occurred when a patch specified a file name so long that
      <a href="https://man.openbsd.org/basename.3">basename(3)</a> failed.
  <li>Prevent a read buffer overrun in
      <a href="https://man.openbsd.org/patch.1">patch(1)</a>
      that could occur when a patch specified a file name ending in a slash.
  <li>Let <a href="https://man.openbsd.org/stat.1">stat(1)</a>
      correctly print mtimes after 2038.
  <li>Refactoring and documenting of
      <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> code,
      to make it easier to maintain.
  <li><a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
       no longer adds extra blanks at the end of lines, eliminating
       spurious line wrapping.
  <li>In <a href="https://man.openbsd.org/clang.1">clang(1)</a>,
      allow out-of-class defaulting of comparison operators,
	by ways of backporting an upstream commit.

  <li>Many changes in <a href="https://man.openbsd.org/mg.1">mg(1)</a>:
    <ul>
    <li>New command
        <a href="https://man.openbsd.org/mg.1#set-tab-width">set-tab-width</a>
        to change the tabulator width on a per-buffer basis.
    <li>Let the <a href="https://man.openbsd.org/mg.1#space-to-tabstop"
        >space-to-tabstop</a> command move to the right
        position even if the line contains tabs, control characters,
        or non-ASCII bytes.
    <li>Fall back to <code>/bin/sh</code> if <code>$SHELL</code> is undefined.
    <li>Fix parsing of <a href="https://man.openbsd.org/mg.1#TAGS">tag
        files</a> with duplicate entries.
        Instead of erroring out, ignore duplicates. Fixes using
        <code>/var/db/libc.tags</code> again.
    <li>Change the <a href="https://man.openbsd.org/mg.1#visit-tags-table"
        >visit-tags-table</a> command to immediately
	load the tag file, and drop the lazy mechanics.
    <li>Do not leak memory in
        <a href="https://man.openbsd.org/mg.1#pop-tag-mark">pop-tag-mark</a>
        if it fails to switch buffers.
    <li>Fix a read buffer overrun caused by
        <a href="https://man.openbsd.org/mg.1#u">-u</a> arguments
        longer than 1023 bytes.
    <li>Fix a write buffer overrun on the stack caused by
        <a href="https://man.openbsd.org/mg.1#blink-and-insert"
        >blink-and-insert</a> matching a very long line
        that is not currently visible in the window.
    <li>Skip checking permissions of conffile with
        <a href="https://man.openbsd.org/access.2">access(2)</a>.
    <li>Resurrect
	<a href="https://man.openbsd.org/mg.1#no-tab-mode">no-tab-mode</a>
	and add it to the list of modes that can
	be set with
	<a href="https://man.openbsd.org/mg.1#set-default-mode"
	>set-default-mode</a>.
    </ul>

  <li>Fix a segfault when the
      <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
	    simple editor encounters an incomplete partition line.
  <li>Fix <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
      handling of templates with partitions after a "N-* 100" entry.
  <li>Enable <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
      regress tests to work on sparc64.
  <li>Fix <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a>
      initialization of CHS/LBA fields in an MBR, allowing machines with
      a BIOS that uses CHS to boot from disks >8G.
  <li>Retire <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
      -E expert mode.
  <li>When displaying GPT partition attributes
      <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> prefixes
      Microsoft partition attribute names with 'MS'.
  <li>In the absence of the 'disktype' command line parameter
      <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a>
      always uses the current media type provided by the kernel.
  <li>Ensure <a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> handles
      the case where a GPT partition name is not a valid C string.

  <li>When creating new crypto volumes with
      <a href="https://man.openbsd.org/bioctl.8">bioctl(8)</a>,
      by default use a hardware based number of KDF rounds for passphrases.
  <li>Let <a href="https://man.openbsd.org/bioctl.8">bioctl(8)</a>
      gracefully prompt again during interactive creation and
      passphrase change on CRYPTO and 1C volumes.
  <li>Let <a href="https://man.openbsd.org/bioctl.8">bioctl(8)</a>
      read passphrases without prompts or confirmation
      in <code>-s</code> mode, allowing non-interactive use.

  <li>Allow the <a href="https://man.openbsd.org/atactl.8">atactl(8)</a>
      command <a href="https://man.openbsd.org/atactl.8#readattr">readattr</a>
      to succeed even for disks where <code>ATA_SMART_READ</code> and
      <code>ATA_SMART_THRESHOLD</code> revisions mismatch, as long as
      checksums are OK.
  <li>In <a href="https://man.openbsd.org/ld.so.1">ld.so(1)</a>, treat
	symlinks in $ORIGIN determination the same way as other OS linkers do.
  <li>In <a href="https://man.openbsd.org/ld.so.1">ld.so(1)</a>,
	avoid an overflow in the ELF SYSV ABI hash function.
  <li>Make sure <a href="https://man.openbsd.org/modf.3">modf(3)</a> and
	<a href="https://man.openbsd.org/modff.3">modff(3)</a>
	return correct values for infinities.
  <li>Do not fail in
	<a href="https://man.openbsd.org/ober_scanf_elements.3"
	>ober_scanf_elements(3)</a> when encountering empty sequences.
  <li>Remove broken special handling of <code>test -t</code> in
	<a href="https://man.openbsd.org/ksh.1">ksh(1)</a>.
  <li>The caching mechanism used by
	<a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a>
	to speed up <code>pkg_add -u</code> now also works if -stable packages
	are available.
  <li>Significantly increase the speed of <a
	href="https://man.openbsd.org/pkg-config.1">pkg-config(1)</a>.
  <li>In <a href="https://man.openbsd.org/seq.1">seq(1)</a>,
	fix a check for rounding error and truncation.
  <li>In <a href="https://man.openbsd.org/cron.8">cron(8)</a>,
	introduce upstream fixes in the handling of @yearly, @monthly,
	@weekly, @daily and @hourly entries.
  <li>Fix a bug in <a
	href="https://man.openbsd.org/cron.8">cron(8)</a> where whitespace
	after usernames would not be completely skipped while parsing the
	<a href="https://man.openbsd.org/crontab.5">crontab(5)</a> file.
  <li>Make <a href="https://man.openbsd.org/rcctl.8">rcctl(8)</a>
	check if a daemon exists before trying to disable it, thereby avoiding
	parsing and printing of bogus characters.
  <li>Print to the console the fingerprint of a newly generated <a
	href="https://man.openbsd.org/ssh.1">ssh(1)</a> host key of the
	preferred type (currently ED25519), typically when booting for the
	first time.  This simplifies a secure first ssh connection to a
	freshly installed machine.
  </ul>

<li>Improved hardware support and driver bugfixes, including:
  <ul>
<!-- new drivers -->
  <li>Add <a href="https://man.openbsd.org/rkiovd.4">rkiovd(4)</a>,
      a driver for the I/O voltage domains on Rockchip SoCs.
  <li>Add support for TEMPerGold 3.4 temperature sensor to
      <a href="https://man.openbsd.org/ugold.4">ugold(4)</a>.
  <li>Add <a href="https://man.openbsd.org/qcrng.4">qcrng(4)</a>,
	a driver for the Qualcomm RNG device found on the ThinkPad X13s.
  <li>Add <a href="https://man.openbsd.org/rkusbphy.4">rkusbphy(4)</a>,
      a driver for the usb2phy on Rockchip SoCs.
  <li>Support AP806/CP110 SoCs in
	<a href="https://man.openbsd.org/mvtemp.4">mvtemp(4)</a>.
  <li>Add <a href="https://man.openbsd.org/dwmshc.4">dwmshc(4)</a>
	to support Designware Mobile Storage Host Controllers
	found on rk356x and rk3588 SoCs.
  <li>Add <a href="https://man.openbsd.org/iosf.4">iosf(4)</a>,
	a driver for the Intel OnChip System Fabric.
  <li>Add support for the RTL8153D chipset in
	<a href="https://man.openbsd.org/ure.4">ure(4)</a>.
  <li>Add support for the Peripheral Authentication Service SMC
	interface in <a href="https://man.openbsd.org/qcscm.4">qcscm(4)</a>.
  <li>Add <a href="https://man.openbsd.org/qcmtx.4">qcmtx(4)</a>,
	a driver for the hardware spinlock on Qualcomm
	SoCs that is used to synchronize access to the shared memory table.
  <li>Add <a href="https://man.openbsd.org/qcsmptp.4">qcsmptp(4)</a>,
	a driver to share 32-bit values between (co-)processors.
  <li>Add <a href="https://man.openbsd.org/qcaoss.4">qcaoss(4)</a>,
	a driver for the Always On Subsystem found on Qualcomm SoCs.
  <li>Add <a href="https://man.openbsd.org/qcpas.4">qcpas(4)</a>,
	a driver for the Peripheral Authentication Service
	found on Qualcomm SoCs.  Enable AC detection.
  <li>Add <a href="https://man.openbsd.org/qctsens.4">qctsens(4)</a>,
	a driver for the Temperature Sensor found on Qualcomm SoCs.
  <li>Add driver <a href="https://man.openbsd.org/qccpu.4">qccpu(4)</a>
	for QC CPU Power States.
  <li>Add <a href="https://man.openbsd.org/qcsdam.4">qcsdam(4)</a>,
	a driver for the PMIC Shared Direct Access Memory found on
	Qualcomm SoCs.
  <li>Add <a href="https://man.openbsd.org/stfrng.4">stfrng(4)</a>, a
	driver for the random number generator on the StarFive JH7110 SoC.
  <li>Add support for the PCIe controller on the JH7110 SoC with <a
	href="https://man.openbsd.org/stfpciephy.4">stfpciephy(4)</a>


<!-- other -->
  <li>New <a href="https://man.openbsd.org/sysctl.2">sysctl(2)</a>
      nodes for battery management, <code>hw.battery.charge*</code>.
      Support them with
      <a href="https://man.openbsd.org/acpithinkpad.4">acpithinkpad(4)</a>
      and <a href="https://man.openbsd.org/aplsmc.4">aplsmc(4)</a>.
  <li>Define fixed names for
      <a href="https://man.openbsd.org/ucom.4">ucom(4)</a> USB serial
      ports, display them in attach messages and via the new
      <code>hw.ucomnames</code>
      <a href="https://man.openbsd.org/sysctl.2#HW_UCOMNAMES~2">sysctl(2)</a>.
  <li>Add support for the RK3568 32k RTC, RK3588, and other clocks in
      <a href="https://man.openbsd.org/rkclock.4">rkclock(4)</a>.
  <li>In <a href="https://man.openbsd.org/dwpcie.4">dwpcie(4)</a>,
      attach Baikal-M PCIe.
  <li>In openfirmware, implement regulator notifiers which get called
	when the voltage/current for a regulator is changed or when the
	regulator gets initialized when it attaches for the first time. The
	latter makes it possible to register a notifier for a regulator that
	hasn't attached yet.
  <li>Ignore duplicate ACPI lid transitions as they can happen on Dell
	Precision 5510 systems.
  <li>Make RK3568 PCIe controllers run at the maximum possible speed
	by using dwpcie_link_config() when initializing.
  <li>In the Universal Flash Storage Host Controller Interface
      (<a href="https://man.openbsd.org/ufshci.4">ufshci(4)</a>),
      enable Force Unit Access (FUA) for write commands.
  <li>Make SATA (<a href="https://man.openbsd.org/ahci.4">ahci(4)</a>)
	work on a Banana Pi BPI-R2 Pro.
  <li>In <a href="https://man.openbsd.org/umcs.4">umcs(4)</a>, set
	parity bits correctly.
  <li>Enable the caps lock LED on modern Apple laptop keyboards.
  <li>Add support for Rockchip "cryptov2-rng" random number generator in
	<a href="https://man.openbsd.org/rkrng.4">rkrng(4)</a>.
  <li>Fix cpuperf on the Apple M2 Pro/Max.
  <li>Add support for the PCIe controller found on Apple M2 Pro/Max SoCs.
  <li>Add support for enabling both the USB2 and USB3 PHYs in
      <a href="https://man.openbsd.org/xhci.4">xhci(4)</a> with device tree.
  <li>In the SCSI tape driver
	<a href="https://man.openbsd.org/st.4">st(4)</a>, add support
	for I/O statistics so that tape speeds can be observed with
	<a href="https://man.openbsd.org/iostat.8">iostat(8)</a>.
  <li>Fix use of MMC/SD/SDIO on RK3588 ARM SoC in
	<a href="https://man.openbsd.org/dwmmc.4">dwmmc(4)</a>.
  <li>Support thermal sensors on Ryzen 9 79xx in
	<a href="https://man.openbsd.org/ksmn.4">ksmn(4)</a>.
  <li>Add support for JH7110 to
	<a href="https://man.openbsd.org/dwmmc.4">dwmmc(4)</a>,
	making eMMC and microSD mostly work on the Starfive VisionFive 2.
  <li>Add support for the RK3588 PCIe3 PHY to
	<a href="https://man.openbsd.org/rkpciephy.4">rkpciephy(4)</a>.
	The PHY controls 4 lanes that can be routed to 4 of 5 PCIe controllers.
  <li>Add mute control to
	<a href="https://man.openbsd.org/sncodec.4">sncodec(4)</a>.
	This makes the mute button work on laptops using this driver.
  <li>Add mute control to <a
	href="https://man.openbsd.org/tascodec.4">tascodec(4)</a>. This makes
	the mute button on laptops that use tascodec(4) work.
  <li>Improve the suspend/resume behavior of several drivers, reducing
	power consumption during suspend.
  <li>Add support for the Synopsys DesignWare I2C controller
	(<a href="https://man.openbsd.org/dwiic.4">dwiic(4)</a>) and the
	X-Powers AXP Power Management IC
	(<a href="https://man.openbsd.org/axppmic.4">axppmic(4)</a>).
  <li>Enable the <a href="https://man.openbsd.org/mbg.4">mbg(4)</a>
	timedelta sensor on amd64 and match the Meinberg PZF180PEX.
  </ul>

<li>New or improved network hardware support:
  <ul>
  <li>Fix <a href="https://man.openbsd.org/dwqe.4">dwqe(4)</a>
      on several boards that use
      <a href="https://man.openbsd.org/rgephy.4">rgephy(4)</a> by configuring
	the RGMII interface before taking the PHY out of reset.
  <li>Improve <a href="https://man.openbsd.org/dwqe.4">dwqe(4)</a> and
	determine PHY mode and pass the appropriate flags down to the PHY when
	attaching.
  <li>Report in <a href="https://man.openbsd.org/dmesg.8">dmesg(8)</a> on
      which gmac the <a href="https://man.openbsd.org/dwqe.4">dwqe(4)</a>
      driver is attaching to.
  <li>Document that Intel i226 adapters are supported by
      <a href="https://man.openbsd.org/igc.4">igc(4)</a>.
  <li>Add <a href="https://man.openbsd.org/ngbe.4">ngbe(4)</a>,
      a driver for WangXun WX1860 PCI Express 10/100/1Gb Ethernet devices.
      Also support it on amd64 install media.
  <li>Add support for the RTL8211F-VD PHY in
      <a href="https://man.openbsd.org/rgephy.4">rgephy(4)</a>.
  <li>In openfirmware, add glue for network interfaces to be found by
	fdt/ofw node or phandle in order to support "switch chips" like the
	marvell link street.
  <li>Add support for RTL8153D devices to
      <a href="https://man.openbsd.org/ure.4">ure(4)</a>.
  <li>Provide byte and packet counter statistics in some
	<a href="https://man.openbsd.org/dwge.4">dwge(4)</a> implementations.
  <li>On <a href="https://man.openbsd.org/bge.4">bge(4)</a>, make hardware
	counters available via kstats for BCM5705 and newer controller chips.
  <li>Make several improvements to <a
	href="https://man.openbsd.org/vmx.4">vmx(4)</a>, the VMware VMXNET3
	Virtual Interface Controller.
  <li>In <a href="https://man.openbsd.org/em.4">em(4)</a>, stop
	putting multicast addresses into the Receive Address Registers.
	Instead hash them all into the Multicast Table Array. 
  <li>Support Mellanox ConnectX-6 Lx in <a
	href="https://man.openbsd.org/mcx.4">mcx(4)</a>.
  <li>In <a href="https://man.openbsd.org/mcx.4">mcx(4)</a>, add 100GB
	LR4 Ethernet capability and map it to IFM_100G_LR4.
  <li>Add initial support for Atlantic 2 hardware in
      <a href="https://man.openbsd.org/aq.4">aq(4)</a>.
  </ul>

<li>Added or improved wireless network drivers:
  <ul>
  <li>Improve how Quectel LTE&5G devices attach to
      <a href="https://man.openbsd.org/umb.4">umb(4)</a>.
  </ul>

<li>IEEE 802.11 wireless stack improvements and bugfixes:
  <ul>
  <li> Add support for RTL8188FTV devices to the
      <a href="https://man.openbsd.org/urtwn.4">urtwn(4)</a> driver.
  <li>Attach Intel wireless devices with PCI product ID 0x51f1 to
      <a href="https://man.openbsd.org/iwx.4">iwx(4)</a>.
  <li>Fix a bug where <a href="https://man.openbsd.org/iwm.4">iwm(4)</a> and
      <a href="https://man.openbsd.org/iwx.4">iwx(4)</a> background
      scan tasks were added to the wrong task queue.
  <li>Fix a firmware error that occurred when an
      <a href="https://man.openbsd.org/iwx.4">iwx(4)</a> interface
      was brought down.
  <li>Fix <a href="https://man.openbsd.org/iwx.4">iwx(4)</a> firmware errors
      triggered during background scans.
  <li>Fix a crash in the <a href="https://man.openbsd.org/iwm.4">iwm(4)</a>
      driver when userland attempts to inject frames via bpf in monitor mode.
  </ul>

<li>Installer, upgrade and bootloader improvements:
  <ul>
  <li>In the arm64 ramdisk, simplify apple firmware copying to make it
	easier to add new firmware.
  <li>On armv7 and arm64, silence informational messages from
      <a href="https://man.openbsd.org/dd.1">dd(1)</a>
	when zeroing a disk's first 1MB. Use character not block devices with
	dd(1) like on other architectures.
  <li>Refactor the code of md_installboot() on armv7 and arm64 to be
	more in line with other architectures.
  <li>Improve the dialogue of the installer without affecting
      <a href="https://man.openbsd.org/autoinstall.8">autoinstall(8)</a>
       files.
  <li>Enable <a href="https://man.openbsd.org/ufshci.4">ufshci(4)</a>
      on arm64 install media.
  <li>On arm64 pine64 boards, stop writing pine64 firmware to disk.
  <li>When media has neither a GPT nor an MBR
      <a href="https://man.openbsd.org/installboot.8">installboot(8)</a>,
      assume OpenBSD occupies the entire disk starting at sector 0.
  <li>Attempt to not overflow the ramdisk when extracting firmware on
	Apple arm64 systems.
  <li>Add support for loading files from the EFI System Partition.
  <li>Fix a bug in the handling of SCSI drives in the bootloader on the luna88k architecture.
  <li>On luna88k, implement the chmod() signaling mechanism for
	<code>/bsd.upgrade</code> to prevent re-upgrade, like other
	architectures.


  <li>Support for <a
	href="https://man.openbsd.org/softraid.4">softraid(4)</a> disks in the
	installer was improved:
    <ul>
    <li>Make root on
      <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>
      installations boot out of the box on Raspberry Pis (arm64).
    <li>Support installations with root on
      <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>
      on arm64, tested on Pinebook Pro, Raspberry Pi 4b, and SolidRun CEX7.
    <li>On riscv64, enable softraid(4) in the ramdisk kernel and support
	installations with root on  
      <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>
    <li>When installing on encrypted
	<a href="https://man.openbsd.org/softraid.4">softraid(4)</a>, determine
	the disk for placing the root device automatically and make it default
	as it is the only legit choice.
    <li>Add arm64 to the list of architectures with support for guided disk
        encryption.
    <li>Retain existing EFI System partitions on systems with APFSISC
      partitions (arm64 Apple M1/M2) during installation with root on
      <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>.
    <li>Enable <a
	href="https://man.openbsd.org/softraid.4">softraid(4)</a> in ramdisk
	on the powerpc64 architecture.
    </ul>
  </ul>

<li>Security improvements:
  <ul>
  <li>Enable indirect branch tracking (IBT) on amd64 and branch target
      identification (BTI) on arm64 in both the kernel and in userland.
      On hardware that supports this feature, it helps enforcing
      control flow integrity by making sure malicious code
      cannot jump into the middle of a function. 
  <li>On the arm64 architecture, enable pointer authentication (PAC)
      in userland on those machines where it works correctly.
      It helps enforcing control flow integrity by making sure
      malicious code cannot manipulate a function's return address.
  <li>Together with retguard these two features protect against ROP attacks.
      Compiler defaults for base clang, ports clang and ports gcc (as well
      as some other non-C language family compilers in ports) have been
      changed to enable these features by default.  As a result the vast
      majority of programs on OpenBSD (and all programs in the base system)
      run with these security features enabled.
  <li>Change <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>
      chunk sizes to be fine grained: chunk sizes are closer to the
      requested allocation size.
  <li>In <a href="https://man.openbsd.org/malloc.3">malloc(3)</a>,
      check all chunks in the delayed free list for write-after-free.
  <li>The <a href="https://man.openbsd.org/shutdown.8">shutdown(8)</a>
      program can now only be executed by members of the new
      <code>_shutdown</code> group.  The idea is that system
      administrators can now remove most users from the excessively
      powerful <code>operator</code> group, which in particular
      provides read access to disk device nodes.
  <li>Using <a href="https://man.openbsd.org/unveil.2">unveil(2)</a>,
	restrict <a href="https://man.openbsd.org/patch.1">patch(1)</a>
	filesystem access to the current directory including subdirectories,
	TMPDIR, and file names given on the command line.
  <li>In <a href="https://man.openbsd.org/ksh.1">ksh(1)</a>, consistently
      escape control characters when displaying file name completions,
      even when there are multiple matches.
  </ul>

<li>Changes in the network stack:
  <ul>
 <li>Sync the use of
     <a href="https://man.openbsd.org/getuptime.9">getuptime(9)</a>
     in the Neighbour Discovery (ND) code with ARP.
 <li>In the IPv6 forwarding code, call
     <a href="https://man.openbsd.org/getuptime.9">getuptime(9)</a>
     once for consistency with IPv4.
 <li>ARP has a queue of packets that should be sent after name
	resolution. Neighbor discovery (ND6) did only hold a single packet.
	Unified the code, added a queue to ND6 and made the code MP safe.
 <li>Implement a new <a href="https://man.openbsd.org/sysctl.2">sysctl(2)</a>
     <code>net.inet6.icmp6.nd6_queued</code> to show the number of packets
     waiting for an ND6 response, analogous to ARP.
 <li>When configuring a new IPv6 address on an interface, an upstream router
	doesn't know where to send traffic.  Send an unsolicited
	neighbor advertisement, as described in RFC9131, to the all-routers
	multicast address so all routers on the same link will learn the path
	back to the address.
 <li>Implement the inbound portion of RFC9131.  Let routers create new
	neighbor cache entries when receiving valid neighbor advertisements.

 <li>Initial support for TCP segmentation offload (TSO) and TCP large receive offload (LRO) was implemented:
   <ul>
   <li>If the driver of a network interface supports TSO,
	do not chop the packet in the network stack,
	but pass it down to the interface layer for TSO.
   <li>Provide a software TSO implementation, to be used as a fallback
	if network hardware does not support TSO.
   <li>Provide a new <a href="https://man.openbsd.org/sysctl.2">sysctl(2)</a>
	node <a href="https://man.openbsd.org/sysctl.2#tcp.tso"
	>net.inet.tcp.tso</a> such that TSO can be globally disabled.
	By default, it is enabled on all interfaces supporting it.
   <li>In <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>,
	display separate
	<a href="https://man.openbsd.org/ifconfig.8#hwfeatures">hwfeatures</a>
	for TSOv4, TSOv6, and LRO and provide a
	<a href="https://man.openbsd.org/ifconfig.8#tcplro">-tcplro</a>
	parameter to disable LRO on a per-interface basis.
   <li>Enable TSO and forwarding of LRO packets via TSO in
	<a href="https://man.openbsd.org/ix.4">ix(4)</a>.
   <li>In <a href="https://man.openbsd.org/ix.4">ix(4)</a>, allocate
	less memory for tx buffers.
   <li>Speed up TCP transfer on
	<a href="https://man.openbsd.org/lo.4">lo(4)</a>
	interfaces by using TSO and LRO.
   <li>Enable LRO per default in network
	drivers. LRO allows to receive aggregated packets larger than the MTU.
	Receiving TCP streams becomes much faster. Currently only <a
	href="https://man.openbsd.org/ix.4">ix(4)</a> and <a
	href="https://man.openbsd.org/lo.4">lo(4)</a> devices support LRO, and
	ix(4) is limited to IPv4 and hardware newer than the old 82598 model.
   </ul>

 <li>The following changes were made to the <a
	href="https://man.openbsd.org/pf.4">pf(4)</a> firewall:
   <ul>
   <li>Speed up the
	<a href="https://man.openbsd.org/ioctl.2">ioctl(2)</a> request
	<a href="https://man.openbsd.org/pf.4#DIOCGETRULE">DIOCGETRULE</a>
	such that <a href="https://man.openbsd.org/pfctl.8">pfctl(8)</a>
	can retrieve all <a href="https://man.openbsd.org/pf.4">pf(4)</a>
	rules from the kernel in linear rather than in quadratic time.
	To protect the kernel from memory exhaustion,
	userland processes now have to release tickets obtained with
	<a href="https://man.openbsd.org/pf.4#DIOCGETRULES">DIOCGETRULES</a>
	by issuing the new
	<a href="https://man.openbsd.org/ioctl.2">ioctl(2)</a> request
	<a href="https://man.openbsd.org/pf.4#DIOCXEND">DIOCXEND</a>.
	In particular, <a href="https://man.openbsd.org/snmpd.8">snmpd(8)</a>
	and <a href="https://man.openbsd.org/systat.1">systat(1)</a>
	now do that.
   <li>Relax the implementation of the <code>pass all</code> rule so all
	forms of neighbor advertisements are allowed in either direction.
   <li>When redirecting locally generated IP packets to userland with
	<a href="https://man.openbsd.org/pf.conf.5#divert-packet"
	>divert-packet</a> rules, the packets may have no checksum
	due to hardware offloading.  Calculate the checksum in that case.
   <li>Fix a bug where
	<a href="https://man.openbsd.org/pf.conf.5#nat-to">nat-to</a>
	could fail to insert a state
	due to conflict on chosen source port number.
   <li>No longer ignore <code>keep state</code> and <code>nat-to</code>
	actions for unsolicited ICMP error responses. 
	Tighten the rule matching logic so ICMP error responses
	no longer match <code>keep state</code> rule.
	In typical scenarios, ICMP errors (if solicited) should match
	existing state.  The change is going to bite firewalls which deal
	with asymmetric routes. In those cases the <code>keep state</code>
	action should be relaxed to sloppy or new <code>no state</code>
	rule to explicitly match ICMP errors should be added.
   </ul>
 <li>Do not calculate IP, TCP, and UDP checksums on
	<a href="https://man.openbsd.org/lo.4">lo(4)</a> interfaces.
 <li>Convert the tcp_now() time counter to 64 bits to avoid 32 bits
	wrap around after changing tcp_now() ticks to milliseconds.
 <li>Add initial support for route-based IPsec VPNs.<br>
	Rather than use IPsec flows (aka, entries in the IPsec security
	policy database) to decide which traffic should be encapsulated in
	IPsec and sent to a peer, this changes security associations (SAs)
	so they can also refer to a tunnel interface. When traffic is routed
	over that tunnel interface, an IPsec SA is looked up and used to
	encapsulate traffic before being sent to the peer on the SA. When
	traffic is received from a peer using an interface SA, the specified
	interface is looked up and the packet is handed to it so it looks
	like packets come out of the tunnel.
 <li>Add <a href="https://man.openbsd.org/sec.4">sec(4)</a> to support
	route-based IPsec VPNs.
 <li>Introduce reference counting for TCP syn cache entries.
 <li>Have <a href="https://man.openbsd.org/wg.4">wg(4)</a> copy the
	priority from the inner packet to the outer encrypted packet, so that
	higher priority packets are picked from hfsc queues for earlier
	transmission.
 </ul>

<li>Routing daemons and other userland network improvements:
  <ul>
  <li>IPsec support was improved:
  <ul>
	<li>In <a href="https://man.openbsd.org/iked.8">iked(8)</a>,
	    support route-based
	    <a href="https://man.openbsd.org/sec.4">sec(4)</a> tunnels.
	<li>In <a href="https://man.openbsd.org/iked.8">iked(8)</a>,
	    add support to verify X.509 chain from CERT payloads.
	<li>In <a href="https://man.openbsd.org/iked.8">iked(8)</a>,
	    do not leak memory when receiving a CERT payload for pubkey auth
	    or for an invalid CERT Encoding.
	<li>In <a href="https://man.openbsd.org/iked.8">iked(8)</a>,
	    do not leak a file descriptor if
	    <a href="https://man.openbsd.org/open_memstream.3"
	    >open_memstream(3)</a> fails while trying to enable a child SA.
	<li>While trying to verify an ECDSA signature in
            <a href="https://man.openbsd.org/iked.8">iked(8)</a>,
	    correctly detect failure of DER encoding with
	    <a href="https://man.openbsd.org/i2d_ECDSA_SIG.3"
	    >i2d_ECDSA_SIG(3)</a>.
	<li>In <a href="https://man.openbsd.org/ipsecctl.8">ipsecctl(8)</a>,
	    support route-based IPsec VPN negotiation with
	    <a href="https://man.openbsd.org/sec.4">sec(4)</a>.
	<li>In <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>,
	    support configuring interface SAs for route-based IPsec VPNs.
	<li>In <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>
	    quick mode, do not crash with a <code>NULL</code> pointer
	    access when a group description is specified but it is invalid,
	    unsupported, or memory allocation or key generation fails.
	<li>In <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>,
	    avoid a double free in the unlikely event that
	    <a href="https://man.openbsd.org/EC_KEY_check_key.3"
	    >EC_KEY_check_key(3)</a> fails right after generating
	    a new key pair.
	<li>Allow building
	    <a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>
	    with a libcrypto library that has
	    <a href="https://man.openbsd.org/OpenBSD-7.3/EC_GROUP_new.3"
	    >binary field support</a> ("GF2m") removed.
  </ul>

  <li>In <a href="https://man.openbsd.org/bgpd.8">bgpd(8)</a>,
  <ul>
	<li>Add first version of flowspec support. Right now only announcement
	    of flowspec rules is possible.
	<li>Update ASPA support to follow draft-ietf-sidrops-aspa-verification-16
	    and draft-ietf-sidrops-aspa-profile-16 by making the ASPA lookup
	    tables AFI-agnostic.
	<li>Rework UPDATE message generation to use the new ibuf API instead
	    of the hand-rolled solution before.
	<li>Fix <code>ext-community * *</code> matching which also affects
	    filters removing all ext-communities.
	<li>Improve and extend the bgpctl parser to handle commands like
	    <code>bgpctl show rib 192.0.2.0/24 detail</code>.
	    Also add various flowspec specific commands.
	<li>Introduce a semaphore to protect intermittent RTR session data
	    from being published to the RDE.
	<li>Limit the socket buffer size to 64k for all sessions.
	    Limiting the buffer size to a reasonable size ensures that not
	    too many updates end up queued in the TCP stack.
	<li>Adjust example <code>GRACEFUL_SHUTDOWN</code> filter rule in
	    the example config to only match on ebgp sessions.
  </ul>

  <li><a href="https://man.openbsd.org/rpki-client.8">rpki-client(8)</a> saw some changes:
  <ul>
	<li>A 30%-50% performance improvement was achieved through libcrypto's
	    partial chains certificate validation feature. Already validated
	    non-inheriting CA certificates are now marked as trusted roots. This
	    way it can be ensured that a leaf's delegated resources are properly
	    covered, and at the same time most validation paths are
	    significantly shortened.
	<li>Support for gzip and deflate HTTP Content-Encoding compression was
	    added. This allows web servers to send RRDP XML in compressed form,
	    saving around 50% of bandwidth.
	<li>ASPA support was updated to draft-ietf-sidrops-aspa-profile-16.
	    As part of supporting AFI-agnostic ASPAs, the JSON syntax for
	    Validated ASPA Payloads changed in both filemode and normal output.
	<li>In filemode (-f option) the applicable manifests are now shown as
	    part of the signature path.
	<li>A new -P option was added to manually specify a moment in time
	    to use when parsing the validity window of certificates. Useful
	    for regression testing. Default is invocation time of rpki-client.
	<li>The -A option will now also exclude ASPA data from the JSON output.
	<li>The synchronisation protocol used to sync the repository is now
	    included in the OpenMetrics output.
	<li>Improved accounting by tracking objects both by repo and tal.
	<li>Check whether products listed on a manifest were issued by the same
	    authority as the manifest itself.
	<li>File modification timestamps of objects retrieved via RRDP are now
	    deterministically set to prepare the on-disk cache for seamless
	    failovers from RRDP to RSYNC.
	<li>Improved detection of RRDP session desynchronization: a check was
	    added to compare whether the delta hashes associated to previously
	    seen serials are different in newly fetched notification files.
	<li>Improved handling of RRDP deltas in which objects are published,
	    withdrawn, and published again.
	<li>Disallow X.509 v2 issuer and subject unique identifiers in certs.
	    RPKI CAs will never issue certificates with V2 unique identifiers.
	<li>A check to disallow duplicate X.509 certificate extensions was
	    added.
	<li>A check to disallow empty sets of IP Addresses or AS numbers in RFC
	    3779 extensions was added.
	<li>A warning is printed when the CMS signing-time attribute in a Signed
	    Object is missing.
	<li>Warnings about unrecoverable message digest mismatches now include
	    the manifestNumber to aid debugging the cause.
	<li>A check was added to disallow multiple RRDP publish elements for the
	    same file in RRDP snapshots. If this error condition is encountered,
	    the RRDP transfer is failed and the RP falls back to rsync.
	<li>A compliance check for the proper X.509 Certificate version and CRL
	    version was added.
	<li>A compliance check was added to ensure CMS Signed Objects contain
	    SignedData, in accordance to RFC 6488 section 3 checklist item 1a.
	<li>Compliance checks were added for the version, KeyUsage, and
	    ExtendedKeyUsage of EE certificates in Manifest, TAK, and GBR Signed
	    Objects.
	<li>A CMS signing-time value being after the X.509 notAfter timestamp
	    was downgraded from an error to a warning.
	<li>A bug was fixed in the handling of CA certificates which inherit IP
	    resources.
	<li>A compliance check was added to ensure the X.509 Subject only
	    contains commonName and optionally serialNumber.
	<li>A compliance check was added to ensure the CMS SignedData and
	    SignerInfo versions to be 3.
	<li>Fisher-Yates shuffle the order in which Manifest entries are
	    processed. Previously, work items were enqueued in the order the CA
	    intended them to appear on a Manifest. However, there is no obvious
	    benefit to third parties deciding the order in which things are
	    processed.
  </ul>

  <li>In <a href="https://man.openbsd.org/smtpd.8">smtpd(8)</a>,
  <ul>
	<li>Swapped link-auth filter arguments to avoid ambiguities with user
	    names containing a "|" character.
	<li>Bumped <a href="https://man.openbsd.org/smtpd-filters.7">smtpd-filters(7)</a>
	    protocol version.
	<li>Fixed potential truncation of filtered data lines.
	<li>Allowed arguments on NOOP.
  </ul>

  <li>Many other changes in various network programs and libraries:
  <ul>
	<li>Let <a href="https://man.openbsd.org/pcap_fopen_offline.3"
	      >pcap_fopen_offline(3)</a> correctly interpret some
	      <code>LINKTYPE_*</code> values in pcap headers written
	      on foreign operating systems.
	  <li>Make <a href="https://man.openbsd.org/dig.1">dig(1)</a>
	      use less deprecated LibreSSL API.

	  <li>Remove stylistic differences between
	      <a href="https://man.openbsd.org/arp.8">arp(8)</a> and
	      <a href="https://man.openbsd.org/ndp.8">ndp(8)</a> delete()
		function.  This makes it easier to spot real changes in behavior.
	  <li>Make <a href="https://man.openbsd.org/ndp.8">ndp(8)</a>
	      not remove cloning routes when no neighbor entry is
		found with <code>ndp -d</code>.


	  <li>Improved error handling in the <a
		href="https://man.openbsd.org/asr_run.3">asr</a> resolver.

	  <li>In <a href="https://man.openbsd.org/unwind.8">unwind(8)</a>,
		handle SERVFAIL results on name resolution better.
	  <li>In <a href="https://man.openbsd.org/unwind.8">unwind(8)</a>,
		fix a use-after-free bug triggered by fatal write errors
		while sending TCP responses.

	  <li>In the router advertisement daemon
		<a href="https://man.openbsd.org/rad.8">rad(8)</a>, update the default
		timers for prefix preferred and valid lifetimes to use the values from
		RFC 9096.
	  <li>In <a href="https://man.openbsd.org/slaacd.8">slaacd(8)</a>,
		remove artificial limit of 2 hours on a PIO lifetime.

	  <li>In <a href="https://man.openbsd.org/ypldap.8">ypldap(8)</a>,
	      reduce memory usage when updating larger directories.
	  <li>Make <a href="https://man.openbsd.org/ypldap.8">ypldap(8)</a>
		more resilient when some servers are
		misbehaving: keep trying LDAP servers until full results arrive
		rather than just until one accepts the TCP connection.

	  <li>New <a href="https://man.openbsd.org/ifconfig.8#wgdescription"
	      >wgdescription</a> parameter to
	      <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>
	      to set a string describing the
	      <a href="https://man.openbsd.org/wg.4">wg(4)</a> peer.

	  <li>Let <a href="https://man.openbsd.org/ifconfig.8">ifconfig(8)</a>
	      prefix the interface name to many error and warning messages.

	  <li>Make the <code>tlsv1.0</code> and <code>tlsv1.1</code> options
		in <a href="https://man.openbsd.org/relayd.8">relayd(8)</a>
		do nothing, as one should use the default <code>tlsv1.2</code>
		instead.
	  <li>Fix IPv6 routes being changed by
		<a href="https://man.openbsd.org/relayd.8">relayd(8)</a>
		with Routers configuration.

	  <li>In <a
		href="https://man.openbsd.org/dhcrelay6.8">dhcrelay6(8)</a>, do not
		ignore the AF_LINK entries of <a
		href="https://man.openbsd.org/carp.4">carp(4)</a> interfaces.

	  <li>Improve the config parser of
		<a href="https://man.openbsd.org/radiusd.8">radiusd(8)</a>
		to better handle
		comments, improve error messages and plug a memory leak.
	  <li>In <a href="https://man.openbsd.org/radiusd.8">radiusd(8)</a>,
		add request or response decoration feature which is used through the
		radiusd module interface.  This makes additional modules can modify
		RADIUS request or response messages.  Also add new "radius_standard"
		module which uses this new feature, provides some generic features
		like "strip-atmark-realm" which removes the realm part from the
		User-Name attribute.

	  <li>Allow UDP for built-in <a
		href="https://man.openbsd.org/inetd.8">inetd(8)</a> services on
		127.0.0.1. This restriction was added in year 2000 due to IPv6 compatible and
		mapped addresses.  Nowadays our kernel does not support these IPv6
		features and blocks localhost addresses on non-loopback interfaces.
		Make IPv4 127.0.0.1/8 and IPv6 ::1 behave identically and provide
		local services if configured.

	  <li>In <a href="https://man.openbsd.org/spamd.8">spamd(8)</a>, log a
		dummy "&lt;unknown>" IP address in the unlikely event that getnameinfo(3)
		fails.
  </ul>
  </ul>

<li><a href="https://man.openbsd.org/tmux.1">tmux(1)</a> improvements and bug fixes:
  <ul>
  <li>For passthrough, don't write to clients attached to different sessions.
  <li>Add a format to show if there are unseen changes while in a mode.
  <li>Discard mouse sequences that have the right form but actually
	are invalid.
  <li>Invalidate cached tty state after changing features since they may
	change what the terminal can do and need mouse sequences or similar to
	be sent again.
  <li>Add options to change the confirm key and default behaviour of
	confirm-before.
  <li>Add an option menu-selected-style to configure the currently
	selected menu item.
  <li>Add -c to run-shell to set working directory.
  <li>Add detach-on-destroy previous and next,
  <li>Set visited flag on last windows when linking session.
  </ul>

<li>LibreSSL version 3.8.2
  <ul>
  <li>Security fixes
    <ul>
    <li>Disabled TLSv1.0 and TLSv1.1 in libssl so that they may no longer
      be selected for use.
    <li><a href="https://man.openbsd.org/BN_is_prime_ex.3">BN_is_prime_ex(3)</a>
      and BN_is_prime_fasttest_ex(3) refuse to check numbers larger than
      32 kbits for primality. This mitigates various DoS vectors.
    <li>Restricted the RFC 3779 code to IPv4 and IPv6. It was not written
      to be able to deal with anything else.
    </ul>
  <li>Portable changes
    <ul>
    <li>Extended the endian.h compat header with hto* and *toh macros.
    <li>Adapted more tests to the portable framework.
    <li>Internal tools are now statically linked.
    <li>Applications bundled as part of the LibreSSL package internally,
      <a href="https://man.openbsd.org/nc.1">nc(1)</a> and
      <a href="https://man.openbsd.org/openssl.1">openssl(1)</a>,
      now are linked statically if static libraries are built.
    <li>Internal compatibility function symbols are no longer exported from
      libcrypto. Instead, the libcompat library is linked to libcrypto,
      libssl, and libtls separately. This increases size a little, but
      ensures that the libraries are not exporting symbols to programs
      unintentionally.
    <li>Selective removal of CET implementation on platforms where it is
      not supported (macOS).
    <li>Integrated four more tests.
    <li>Added Windows ARM64 architecture to tested platforms.
    <li>Removed Solaris 10 support, fixed Solaris 11.
    <li>libtls no longer links statically to libcrypto / libssl unless
	    <code>--enable-libtls-only</code> is specified at configure time.
    <li>Improved Windows compatibility library, namely handling of files vs
      sockets, correcting an exception when operating on a closed socket.
    <li>CMake builds no longer hardcode <code>-O2</code> into the compiler flags,
      instead using flags from the CMake build type instead.
    <li>Set the CMake default build type to <code>Release</code>. This can be overridden
      during configuration.
    <li>Fixed broken ASM support with MinGW builds.
    </ul>
  <li>New features
    <ul>
    <li>Added support for
      <a href="https://man.openbsd.org/EVP_sha512_224.3">truncated SHA-2</a>
      and for <a href="https://man.openbsd.org/EVP_sha3_224.3">SHA-3</a>.
    <li>The BPSW primality test performs additional Miller-Rabin rounds
      with random bases to reduce the likelihood of composites passing.
    <li>Allow testing of ciphers and digests using badly aligned buffers
      in openssl speed using -unalign.
    <li>Ed25519 certificates are now supported in openssl(1)
      <a href="https://man.openbsd.org/openssl.1#ca">ca</a> and
      <a href="https://man.openbsd.org/openssl.1#req">req</a>.
      Prepared Ed25519 support in libssl.
    <li>Add branch target information (BTI) support to amd64 and arm64
      assembly.
    </ul>
  <li>Compatibility changes
    <ul>
    <li>Added a workaround for a poorly thought-out change in OpenSSL 3 that
      broke privilege separation support in libtls.
    <li>Moved libtls from ECDSA_METHOD to EC_KEY_METHOD.
    <li>Removed GF2m support: BIGNUM no longer supports binary extension
      field arithmetic and all binary elliptic builtin curves were removed.
    <li>Removed dangerous, "fast" NIST prime and elliptic curve implementations.
      In particular, EC_GFp_nist_method() is no longer available.
    <li>Removed most public symbols that were deprecated in OpenSSL 0.9.8.
    <li>Removed the public X9.31 API (RSA_X931_PADDING is still available).
    <li>Removed Cipher Text Stealing mode.
    <li>Removed ENGINE support, including ECDH_METHOD and ECDSA_METHOD.
    <li>Removed COMP, DSO, dynamic loading of conf modules and support for
      custom ex_data and error stacks.
    <li>Removed proxy certificate (RFC 3820) support.
    <li>Removed SXNET and NETSCAPE_CERT_SEQUENCE support including the
      openssl(1) nseq command.
    <li>ENGINE support was removed and OPENSSL_NO_ENGINE is set. In spite
      of this, some stub functions are provided to avoid patching some
      applications that do not honor OPENSSL_NO_ENGINE.
    <li>The POLICY_TREE and its related structures and API were removed.
    <li>In <a href="https://man.openbsd.org/X509_VERIFY_PARAM_inherit.3"
      >X509_VERIFY_PARAM_inherit(3)</a>, copy hostflags independently of the
      host list.
    <li>Made <a href="https://man.openbsd.org/CRYPTO_get_ex_new_index.3"
      >CRYPTO_get_ex_new_index(3)</a> not return 0 to allow applications
      to use *_{get,set}_app_data() and *_{get,set}_ex_data() alongside
      each other.
    <li><a href="https://man.openbsd.org/X509_NAME_get_text_by_NID.3"
      >X509_NAME_get_text_by_NID(3)</a> and
      <a href="https://man.openbsd.org/X509_NAME_get_text_by_OBJ.3"
      >X509_NAME_get_text_by_OBJ(3)</a> now only succeed if they contain
      valid UTF-8 without embedded NUL.
    <li>The explicitText user notice uses UTF8String instead of VisibleString
      to reduce the risk of emitting certificates with invalid DER-encoding.
    <li>Initial fixes for RSA-PSS support to make the TLSv1.3 stack more
      compliant with RFC 8446.
    <li>Fixed <a href="https://man.openbsd.org/EVP_CIPHER_CTX_iv_length.3"
      >EVP_CIPHER_CTX_iv_length(3)</a> to return what was set with
      EVP_CTRL_AEAD_SET_IVLEN or one of its aliases.
    </ul>
  <li>Internal improvements
    <ul>
    <li>Improved sieve of Eratosthenes script used for generating a table
      of small primes.
    <li>Removed incomplete and dangerous BN_RECURSION code.
    <li>Imported RFC 5280 policy checking code from BoringSSL and used it
      to replace the old exponential time code.
    <li>Converted more of libcrypto to use CBB/CBS.
    <li>Started cleaning up and rewriting SHA internals.
    <li>Reduced the dependency of hash implementations on many layers of
      macros. This results in significant speedups since modern compilers
      are now less confused.
    <li>Improved BIGNUM internals and performance.
    <li>Significantly simplified the BN_BLINDING internals used in RSA.
    <li>Made <a href="https://man.openbsd.org/BN_num_bits.3">BN_num_bits(3)</a>
      independent of bn->top.
    <li>Rewrote and simplified bn_sqr().
    <li>Significantly improved Montgomery multiplication performance.
    <li>Rewrote and improved
      <a href="https://man.openbsd.org/BN_exp.3">BN_exp(3)</a> and
      <a href="https://man.openbsd.org/BN_copy.3">BN_copy(3)</a>.
    <li>Changed <a href="https://man.openbsd.org/ASN1_item_sign_ctx.3"
      >ASN1_item_sign_ctx(3)</a> and
      <a href="https://man.openbsd.org/ASN1_item_verify.3"
      >ASN1_item_verify(3)</a> to work with
      Ed25519 and fixed a few bugs in there.
    <li>Lots of cleanup for DH, DSA, EC, RSA internals.  Plugged numerous
      memory leaks, fixed logic errors and inconsistencies.
    <li>Cleaned up and simplified various ECDH and ECDSA internals.
    <li>Removed EC_GROUP precomp machinery.
    <li>Fixed various issues with
      <a href="https://man.openbsd.org/EVP_PKEY_CTX_new.3"
      >EVP_PKEY_CTX_new(3)</a> and EVP_PKEY_CTX_dup(3).
    <li>Rewrote <a href="https://man.openbsd.org/OBJ_find_sigid_algs"
      >OBJ_find_sigid_algs(3)</a> and OBJ_find_sigid_by_algs(3).
    <li>Improved X.509 certificate version checks.
    <li>Ensure no X.509v3 extensions appear more than once in certificates.
    <li>Replaced ASN1_bn_print with a cleaner internal implementation.
    <li>Fix OPENSSL_cpuid_setup() invocations on arm/aarch64.
    <li>Improved checks for commonName in libtls.
    <li>Fixed error check for
      <a href="https://man.openbsd.org/X509_get_ext_d2i.3"
      >X509_get_ext_d2i(3)</a> failure in libtls.
    <li>Removed code guarded by #ifdef ZLIB.
    <li>Plug a potential memory leak in
      <a href="https://man.openbsd.org/ASN1_TIME_normalize.3"
      >ASN1_TIME_normalize(3)</a>.
    <li>Fixed a use of uninitialized in i2r_IPAddrBlocks().
    <li>Rewrote <a href="https://man.openbsd.org/CMS_SignerInfo_sign.3"
      >CMS_SignerInfo_sign(3)</a> and CMS_SignerInfo_verify(3).
    </ul>
  <li>Bug fixes
    <ul>
    <li>Correctly handle negative input to various BIGNUM functions.
    <li>Ensure ERR_load_ERR_strings() does not set errno unexpectedly.
    <li>Fix error checking of
      <a href="https://man.openbsd.org/i2d_ECDSA_SIG.3">i2d_ECDSA_SIG(3)</a>
      in ossl_ecdsa_sign().
    <li>Fixed aliasing issue in
      <a href="https://man.openbsd.org/BN_mod_inverse.3"
      >BN_mod_inverse(3)</a>.  Disallowed aliasing of result
      and modulus in various BN_mod_* functions.
    <li>Fixed detection of extended operations (XOP) on AMD hardware.
    <li>Ensure Montgomery exponentiation is used for the initial RSA blinding.
    <li>Policy is always checked in X509 validation. Critical policy extensions
      are no longer silently ignored.
    <li>Fixed error handling in tls_check_common_name().
    <li>Add missing pointer invalidation in
      <a href="https://man.openbsd.org/SSL_free.3">SSL_free(3)</a>.
    <li>Fixed X509err() and X509V3err() and their internal versions.
    <li>Ensure that
      <a href="https://man.openbsd.org/OBJ_obj2txt.3">OBJ_obj2txt(3)</a>
      always returns a C string again.
    <li>Made <a href="https://man.openbsd.org/EVP_PKEY_CTX_set1_hkdf_key"
      >EVP_PKEY_CTX_set1_hkdf_key(3)</a> fail on a NULL key.
    <li>On socket errors in the poll loop, netcat could issue system calls
      on invalidated file descriptors.
    <li>Allow IP addresses to be specified in a URI.
    <li>Fixed a copy-paste error in
      <a href="https://man.openbsd.org/ASN1_TIME_compare.3"
      >ASN1_TIME_compare(3)</a> that could lead to two UTCTimes
      or two GeneralizedTimes incorrectly being compared as equal.
    </ul>
  <li>Documentation improvements
    <ul>
    <li>Improved documentation of BIO_ctrl(3), BIO_set_info_callback(3),
      BIO_get_info_callback(3), BIO_method_type(3), and BIO_method_name(3).
    <li>Marked BIO_CB_return(), BIO_cb_pre(), and BIO_cb_post() as intentionally
      undocumented.
    <li>Made it very explicit that the verify callback should not be used.
    <li>Called out that the CRL lastUpdate is standardized as thisUpdate.
    <li>Documented the RFC 3779 API and its shortcomings.
    </ul>
  <li>Testing and Proactive Security
    <ul>
    <li>Significantly improved test coverage of
      <a href="https://man.openbsd.org/BN_mod_sqrt.3">BN_mod_sqrt(3)</a>
      and GCD.
    <li>As always, new test coverage is added as bugs are fixed and subsystems
      are cleaned up.
    </ul>
  </ul>

<li>OpenSSH 9.5 and OpenSSH 9.4
  <ul>
  <li>Potentially incompatible changes
    <ul>
    <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
        generate Ed25519 keys by default. Ed25519 public keys
        are very convenient due to their small size. Ed25519 keys are
        specified in RFC 8709 and OpenSSH has supported them since version 6.5
        (January 2014).
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        the Subsystem directive now accurately preserves quoting of
        subsystem commands and arguments. This may change behaviour for exotic
        configurations, but the most common subsystem configuration
        (sftp-server) is unlikely to be affected.
    <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:
        PKCS#11 modules must now be specified by their full
        paths. Previously dlopen(3) could search for them in system
        library directories.
    </ul>
  <li>New features
    <ul>
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        add keystroke timing obfuscation to the client. This attempts
        to hide inter-keystroke timings by sending interactive traffic at
        fixed intervals (default: every 20ms) when there is only a small
        amount of data being sent. It also sends fake "chaff" keystrokes for
        a random interval after the last real keystroke. These are
        controlled by a new ssh_config ObscureKeystrokeTiming keyword.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
        <a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        Introduce a transport-level ping facility. This adds
        a pair of SSH transport protocol messages SSH2_MSG_PING/PONG to
        implement a ping capability. These messages use numbers in the "local
        extensions" number space and are advertised using a "ping@openssh.com"
        ext-info message with a string version number of "0".
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        allow override of Subsystem directives in sshd Match blocks.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        allow forwarding Unix Domain sockets via ssh -W.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        add support for configuration tags to ssh(1).
        This adds a ssh_config(5) "Tag" directive and corresponding
        "Match tag" predicate that may be used to select blocks of
        configuration similar to the pf.conf(5) keywords of the same
        name.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
         add a "match localnetwork" predicate. This allows matching
         on the addresses of available network interfaces and may be used to
         vary the effective client configuration based on network location.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
        <a href="https://man.openbsd.org/sshd.8">sshd(8)</a>,
        <a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
        infrastructure support for KRL
        extensions.  This defines wire formats for optional KRL extensions
        and implements parsing of the new submessages. No actual extensions
        are supported at this point.
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        AuthorizedPrincipalsCommand and AuthorizedKeysCommand now
        accept two additional %-expansion sequences: %D which expands to
        the routing domain of the connected session and %C which expands
        to the addresses and port numbers for the source and destination
        of the connection.
    <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
        increase the default work factor (rounds) for the
        bcrypt KDF used to derive symmetric encryption keys for passphrase
        protected key files by 50%.
    </ul>
  <li>Bugfixes
    <ul>
    <li><a href="https://man.openbsd.org/scp.1">scp(1)</a>:
        fix scp in SFTP mode recursive upload and download of
        directories that contain symlinks to other directories. In scp mode,
        the links would be followed, but in SFTP mode they were not.
    <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
        handle cr+lf (instead of just cr) line endings in
        sshsig signature files.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        interactive mode for ControlPersist sessions if they
        originally requested a tty.
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        make PerSourceMaxStartups first-match-wins
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        limit artificial login delay to a reasonable maximum (5s)
        and don't delay at all for the "none" authentication mechanism.
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        Log errors in kex_exchange_identification() with level
        verbose instead of error to reduce preauth log spam. All of those
        get logged with a more generic error message by sshpkt_fatal().
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        correct math for ClientAliveInterval that caused the probes
        to be sent less frequently than configured.
    <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:
        improve isolation between loaded PKCS#11 modules
        by running separate ssh-pkcs11-helpers for each loaded provider.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        make -f (fork after authentication) work correctly with
        multiplexed connections, including ControlPersist.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        make ConnectTimeout apply to multiplexing sockets and not
        just to network connections.
    <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>,
        <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        improve defences against invalid PKCS#11
        modules being loaded by checking that the requested module
        contains the required symbol before loading it.
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:
        fix AuthorizedPrincipalsCommand when AuthorizedKeysCommand
        appears before it in sshd_config. Since OpenSSH 8.7 the
        AuthorizedPrincipalsCommand directive was incorrectly ignored in
        this situation.
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>,
        <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,
        <a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
        remove vestigial support for KRL
        signatures When the KRL format was originally defined, it included
        support for signing of KRL objects. However, the code to sign KRLs
        and verify KRL signatures was never completed in OpenSSH. This
        release removes the partially-implemented code to verify KRLs.
        All OpenSSH tools now ignore KRL_SECTION_SIGNATURE sections in
        KRL files.
     <li>All: fix a number of memory leaks and unreachable/harmless integer
        overflows.
    <li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>,
        <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        don't truncate strings logged from PKCS#11 modules
    <li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>,
        <a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        better validate CASignatureAlgorithms in
        ssh_config and sshd_config. Previously this directive would accept
        certificate algorithm names, but these were unusable in practice as
        OpenSSH does not support CA chains.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        make <code>ssh -Q CASignatureAlgorithms</code> only list signature
        algorithms that are valid for CA signing. Previous behaviour was
        to list all signing algorithms, including certificate algorithms.
    <li><a href="https://man.openbsd.org/ssh-keyscan.1">ssh-keyscan(1)</a>:
        gracefully handle systems where rlimits or the
        maximum number of open files is larger than INT_MAX
    <li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:
        fix "no comment" not showing on when running
        <code>ssh-keygen -l</code> on multiple keys where one has a comment
        and other following keys do not.
    <li><a href="https://man.openbsd.org/scp.1">scp(1)</a>,
        <a href="https://man.openbsd.org/sftp.1">sftp(1)</a>:
        adjust ftruncate() logic to handle servers that
        reorder requests. Previously, if the server reordered requests then
        the resultant file would be erroneously truncated.
    <li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:
        don't incorrectly disable hostname canonicalization when
        CanonicalizeHostname=yes and ProxyJump was explicitly set to
        "none".
    <li><a href="https://man.openbsd.org/scp.1">scp(1)</a>:
        when copying local to remote, check that the source file
        exists before opening an SFTP connection to the server.
    </ul>
  </ul>

<li>Ports and packages:
  <p>Many pre-built packages for each architecture:
  <!-- number of FTP packages minus SHA256, SHA256.sig, index.txt -->
  <ul style="column-count: 3">
    <li>aarch64:    11508
    <li>amd64:      11845
    <li>arm:        7705
    <li>i386:       10603
    <li>mips64:     8995
    <li>powerpc:    9683
    <li>powerpc64:  8351
    <li>riscv64:    10170
    <li>sparc64:    8469
  </ul>

  <p>Some highlights:
  <ul style="column-count: 3"><!-- XXX all need to be checked/updated 2023-03-04 -->
    <li>Asterisk 16.30.1, 18.19.0 and 20.4.0
    <li>Audacity 3.3.3
    <li>CMake 3.27.5
    <li>Chromium 117.0.5938.149
    <li>Emacs 29.1
    <li>FFmpeg 4.4.4
    <li>GCC 8.4.0 and 11.2.0
    <li>GHC 9.2.7
    <li>GNOME 44
    <li>Go 1.21.1
    <li>JDK 8u382, 11.0.20 and 17.0.8
    <li>KDE Applications 23.08.0
    <li>KDE Frameworks 5.110.0
    <li>Krita 5.1.5
    <li>LLVM/Clang 13.0.0 and 16.0.6
    <li>LibreOffice 7.6.2.1
    <li>Lua 5.1.5, 5.2.4, 5.3.6 and 5.4.6
    <li>MariaDB 10.9.6
    <li>Mono 6.12.0.199
    <li>Mozilla Firefox 118.0.1 and ESR 115.3.1
    <li>Mozilla Thunderbird 115.3.1
    <li>Mutt 2.2.12 and NeoMutt 20230517
    <li>Node.js 18.18.0
    <li>OCaml 4.12.1
    <li>OpenLDAP 2.6.6
    <li>PHP 7.4.33, 8.0.30, 8.1.24 and 8.2.11
    <li>Postfix 3.7.3
    <li>PostgreSQL 15.4
    <li>Python 2.7.18, 3.9.18, 3.10.13 and 3.11.5
    <li>Qt 5.15.10 and 6.5.2
    <li>R 4.2.3
    <li>Ruby 3.0.6, 3.1.4 and 3.2.2
    <li>Rust 1.72.1
    <li>SQLite 3.42.0
    <li>Shotcut 23.07.29
    <li>Sudo 1.9.14.2
    <li>Suricata 6.0.12
    <li>Tcl/Tk 8.5.19 and 8.6.13
    <li>TeX Live 2022
    <li>Vim 9.0.1897 and Neovim 0.9.1
    <li>Xfce 4.18
  </ul>
  <p>

<li>As usual, steady improvements in manual pages and other documentation.

<li>The system includes the following major components from outside suppliers:
  <ul><!-- XXX all need to be checked/updated 2023-03-04 -->
    <li>Xenocara (based on X.Org 7.7 with xserver 21.1.8 + patches,
        freetype 2.13.0, fontconfig 2.14.2, Mesa 22.3.7, xterm 378,
        xkeyboard-config 2.20, fonttosfnt 1.2.2 and more)
    <li>LLVM/Clang 13.0.0 (+ patches)
    <li>GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
    <li>Perl 5.36.1 (+ patches)
    <li>NSD 4.7.0
    <li>Unbound 1.18.0
    <li>Ncurses 5.7
    <li>Binutils 2.17 (+ patches)
    <li>Gdb 6.3 (+ patches)
    <li>Awk September 12, 2023
    <li>Expat 2.5.0
    <li>zlib 1.3 (+ patches)
  </ul>

</ul>
</section>

<hr>

<section id=install>
<h3>How to install</h3>
<p>
Please refer to the following files on the mirror site for
extensive details on how to install OpenBSD 7.4 on your machine:

<ul>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/alpha/INSTALL.alpha">
	.../OpenBSD/7.4/alpha/INSTALL.alpha</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/amd64/INSTALL.amd64">
	.../OpenBSD/7.4/amd64/INSTALL.amd64</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/arm64/INSTALL.arm64">
	.../OpenBSD/7.4/arm64/INSTALL.arm64</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/armv7/INSTALL.armv7">
	.../OpenBSD/7.4/armv7/INSTALL.armv7</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/hppa/INSTALL.hppa">
	.../OpenBSD/7.4/hppa/INSTALL.hppa</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/i386/INSTALL.i386">
	.../OpenBSD/7.4/i386/INSTALL.i386</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/landisk/INSTALL.landisk">
	.../OpenBSD/7.4/landisk/INSTALL.landisk</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/loongson/INSTALL.loongson">
	.../OpenBSD/7.4/loongson/INSTALL.loongson</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/luna88k/INSTALL.luna88k">
	.../OpenBSD/7.4/luna88k/INSTALL.luna88k</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/macppc/INSTALL.macppc">
	.../OpenBSD/7.4/macppc/INSTALL.macppc</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/octeon/INSTALL.octeon">
	.../OpenBSD/7.4/octeon/INSTALL.octeon</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/powerpc64/INSTALL.powerpc64">
	.../OpenBSD/7.4/powerpc64/INSTALL.powerpc64</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/riscv64/INSTALL.riscv64">
	.../OpenBSD/7.4/riscv64/INSTALL.riscv64</a>
<li><a href="https://ftp.openbsd.org/pub/OpenBSD/7.4/sparc64/INSTALL.sparc64">
	.../OpenBSD/7.4/sparc64/INSTALL.sparc64</a>
</ul>
</section>

<hr>

<section id=quickinstall>
<p>
Quick installer information for people familiar with OpenBSD, and the use of
the "<a href="https://man.openbsd.org/disklabel.8">disklabel</a> -E" command.
If you are at all confused when installing OpenBSD, read the relevant
INSTALL.* file as listed above!

<h3>OpenBSD/alpha:</h3>

<p>
If your machine can boot from CD, you can write <i>install74.iso</i> or
<i>cd74.iso</i> to a CD and boot from it.
Refer to INSTALL.alpha for more details.

<h3>OpenBSD/amd64:</h3>

<p>
If your machine can boot from CD, you can write <i>install74.iso</i> or
<i>cd74.iso</i> to a CD and boot from it.
You may need to adjust your BIOS options first.

<p>
If your machine can boot from USB, you can write <i>install74.img</i> or
<i>miniroot74.img</i> to a USB stick and boot from it.

<p>
If you can't boot from a CD, floppy disk, or USB,
you can install across the network using PXE as described in the included
INSTALL.amd64 document.

<p>
If you are planning to dual boot OpenBSD with another OS, you will need to
read INSTALL.amd64.

<h3>OpenBSD/arm64:</h3>

<p>
Write <i>install74.img</i> or <i>miniroot74.img</i> to a disk and boot from it
after connecting to the serial console.  Refer to INSTALL.arm64 for more
details.

<h3>OpenBSD/armv7:</h3>

<p>
Write a system specific miniroot to an SD card and boot from it after connecting
to the serial console.  Refer to INSTALL.armv7 for more details.

<h3>OpenBSD/hppa:</h3>

<p>
Boot over the network by following the instructions in INSTALL.hppa or the
<a href="hppa.html#install">hppa platform page</a>.

<h3>OpenBSD/i386:</h3>

<p>
If your machine can boot from CD, you can write <i>install74.iso</i> or
<i>cd74.iso</i> to a CD and boot from it.
You may need to adjust your BIOS options first.

<p>
If your machine can boot from USB, you can write <i>install74.img</i> or
<i>miniroot74.img</i> to a USB stick and boot from it.

<p>
If you can't boot from a CD, floppy disk, or USB,
you can install across the network using PXE as described in
the included INSTALL.i386 document.

<p>
If you are planning on dual booting OpenBSD with another OS, you will need to
read INSTALL.i386.

<h3>OpenBSD/landisk:</h3>

<p>
Write <i>miniroot74.img</i> to the start of the CF
or disk, and boot normally.

<h3>OpenBSD/loongson:</h3>

<p>
Write <i>miniroot74.img</i> to a USB stick and boot bsd.rd from it
or boot bsd.rd via tftp.
Refer to the instructions in INSTALL.loongson for more details.

<h3>OpenBSD/luna88k:</h3>

<p>
Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the bootloader
from the PROM, and then bsd.rd from the bootloader.
Refer to the instructions in INSTALL.luna88k for more details.

<h3>OpenBSD/macppc:</h3>

<p>
Burn the image from a mirror site to a CDROM, and power on your machine
while holding down the <i>C</i> key until the display turns on and
shows <i>OpenBSD/macppc boot</i>.

<p>
Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
/7.4/macppc/bsd.rd</i>

<h3>OpenBSD/octeon:</h3>

<p>
After connecting a serial port, boot bsd.rd over the network via DHCP/tftp.
Refer to the instructions in INSTALL.octeon for more details.

<h3>OpenBSD/powerpc64:</h3>

<p>
To install, write <i>install74.img</i> or <i>miniroot74.img</i> to a
USB stick, plug it into the machine and choose the <i>OpenBSD
install</i> menu item in Petitboot.
Refer to the instructions in INSTALL.powerpc64 for more details.

<h3>OpenBSD/riscv64:</h3>

<p>
To install, write <i>install74.img</i> or <i>miniroot74.img</i> to a
USB stick, and boot with that drive plugged in.
Make sure you also have the microSD card plugged in that shipped with the
HiFive Unmatched board.
Refer to the instructions in INSTALL.riscv64 for more details.

<h3>OpenBSD/sparc64:</h3>

<p>
Burn the image from a mirror site to a CDROM, boot from it, and type
<i>boot cdrom</i>.

<p>
If this doesn't work, or if you don't have a CDROM drive, you can write
<i>floppy74.img</i> or <i>floppyB74.img</i>
(depending on your machine) to a floppy and boot it with <i>boot
floppy</i>. Refer to INSTALL.sparc64 for details.

<p>
Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install
will most likely fail.

<p>
You can also write <i>miniroot74.img</i> to the swap partition on
the disk and boot with <i>boot disk:b</i>.

<p>
If nothing works, you can boot over the network as described in INSTALL.sparc64.
</section>

<hr>

<section id=upgrade>
<h3>How to upgrade</h3>
<p>
If you already have an OpenBSD 7.3 system, and do not want to reinstall,
upgrade instructions and advice can be found in the
<a href="faq/upgrade74.html">Upgrade Guide</a>.
</section>

<hr>

<section id=sourcecode>
<h3>Notes about the source code</h3>
<p>
<code>src.tar.gz</code> contains a source archive starting at <code>/usr/src</code>.
This file contains everything you need except for the kernel sources,
which are in a separate archive.
To extract:
<blockquote><pre>
# <kbd>mkdir -p /usr/src</kbd>
# <kbd>cd /usr/src</kbd>
# <kbd>tar xvfz /tmp/src.tar.gz</kbd>
</pre></blockquote>
<p>
<code>sys.tar.gz</code> contains a source archive starting at <code>/usr/src/sys</code>.
This file contains all the kernel sources you need to rebuild kernels.
To extract:
<blockquote><pre>
# <kbd>mkdir -p /usr/src/sys</kbd>
# <kbd>cd /usr/src</kbd>
# <kbd>tar xvfz /tmp/sys.tar.gz</kbd>
</pre></blockquote>
<p>
Both of these trees are a regular CVS checkout.  Using these trees it
is possible to get a head-start on using the anoncvs servers as
described <a href="anoncvs.html">here</a>.
Using these files
results in a much faster initial CVS update than you could expect from
a fresh checkout of the full OpenBSD source tree.
</section>

<hr>

<section id=ports>
<h3>Ports Tree</h3>
<p>
A ports tree archive is also provided.  To extract:
<blockquote><pre>
# <kbd>cd /usr</kbd>
# <kbd>tar xvfz /tmp/ports.tar.gz</kbd>
</pre></blockquote>
<p>
Go read the <a href="faq/ports/index.html">ports</a> page
if you know nothing about ports
at this point.  This text is not a manual of how to use ports.
Rather, it is a set of notes meant to kickstart the user on the
OpenBSD ports system.
<p>
The <i>ports/</i> directory represents a CVS checkout of our ports.
As with our complete source tree, our ports tree is available via
<a href="anoncvs.html">AnonCVS</a>.
So, in order to keep up to date with the -stable branch, you must make
the <i>ports/</i> tree available on a read-write medium and update the tree
with a command like:
<blockquote><pre>
# <kbd>cd /usr/ports</kbd>
# <kbd>cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_7_4</kbd>
</pre></blockquote>
<p>
[Of course, you must replace the server name here with a nearby anoncvs
server.]
<p>
Note that most ports are available as packages on our mirrors. Updated
ports for the 7.4 release will be made available if problems arise.
<p>
If you're interested in seeing a port added, would like to help out, or just
would like to know more, the mailing list
<a href="mail.html">ports@openbsd.org</a> is a good place to know.
</section>
</body>
</html>