src, branch release/14.3.0-p5

Add UPDATING entries and bump version

2025-10-22T15:51:48Z

Approved by: so

so_reuseport_lb_test: Add a test case for connected UDP sockets

2025-10-22T15:51:38Z

Approved by: so (cherry picked from commit 1dd66c6ac2c146f540b2ff825fbee442354aeee5) (cherry picked from commit 7272e2d029c20c3144d7aa49500dc86d70344030)

inpcb: Ignore SO_REUSEPORT_LB on connected sockets

2025-10-22T15:50:47Z

While TCP disallows connect()ing a socket with SO_REUSEPORT_LB, UDP does not. As a result, a connected UDP socket can be placed in the lbgroup hash and thus receive datagrams from sources other than the connected host. Reported by: Amit Klein Reported by: Omer Ben Simhon Reviewed by: glebius Approved by: so Security: FreeBSD-SA-25:09.netinet Security: CVE-2025-24934 (cherry picked from commit 320ad3dec5ff1b37f6907a47961c18b9d77e6a53) (cherry picked from commit e276759b368701a49e543c45d5d6ea08ed4fbc38)

Add UPDATING entries and bump version.

2025-09-30T15:35:49Z

Approved by: so

Fix multiple security issues in OpenSSL.

2025-09-30T15:31:43Z

Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) Out-of-bounds read in HTTP client no_proxy handling (CVE-2025-9232) Obtained from: OpenSSL Approved by: so Security: FreeBSD-SA-25:08.openssl Security: CVE-2025-9230 Security: CVE-2025-9232 (cherry picked from commit 270158508d7c55a0737c2a9915cd4afc8fabdaf0)

freebsd-update: Library ordering

2025-09-30T04:57:23Z

Upgrading from 14.x to 15.x with freebsd-update broke because libc depends on the new libsys library; freebsd-update installed the new libc before creating libsys, and every step after that failed because all the tools (including gunzip and install) are dynamically linked and need a working libc. Enforce ordering when installing shared objects: First libsys, then libc, then libthr, and then all the rest of the shared object files. This is a candidate for an Errata Notice since the issue this fixes breaks upgrades. PR: 289769 Reported by: Graham Perrin Reviewed by: kib MFC after: 3 days Sponsored by: https://www.patreon.com/cperciva Differential Revision: https://reviews.freebsd.org/D52688 Approved by: so Security: FreeBSD-EN-25:18.freebsd-update (cherry picked from commit 7ece602e00e85195fc426a2401c49921cd39735e) (cherry picked from commit e26928669f39c8683aea74040b9e2472e944c43a)

Correct release patch information.

2025-09-16T23:10:20Z

Pointy hat to: gordon Approved by: so

Add UPDATING entries and bump version.

2025-09-16T16:28:47Z

Approved by: so

bnxt: Fix BASE-T, 40G AOC, 1G-CX, autoneg and unknown media lists

2025-09-14T00:24:43Z

This was broken in c63d67e137f3, the early returns prevent building the media lists as expected. The BASE-T parts of the patch were suggested by "cyric@mm.st", while I am adding the additional 40G AOC, 1CX, autoneg and unknown PHY fixes based on code inspection. There may be additional work left here for Broadcom but this is certainly better than the returns. PR: 287395 Reported by: mickael.maillot@gmail.com, cyric@mm.st Tested by: Einar Bjarni Halldórsson Approved by: so Security: FreeBSD-EN-25:17.bnxt (cherry picked from commit 5e6e4f752833acc96f1efc893318d3f6b74b9689) (cherry picked from commit 33f65f12eba10588827a13d232337616f6f4facf)

vfs_syscalls.c: Fix handling of offset args for copy_file_range

2025-09-14T00:23:36Z

Commit 197997a broke handling of the offset arguments to copy_file_range() when specified non-NULL. The code fails to update the offsets and, as such, a loop like: do { len = copy_file_range(infd, &inpos, outfd, &outpos, SSIZE_MAX, 0); } while (len > 0); becomes an infinite loop, just doing the same copy over and over again. This patch fixes it. The clause "(foffsets_locked || foffsets_set)" in the if is not actually needed for correctness, but I thought it made the code a little more readable and might avoid some static analyzer from throwing a "used before being set" for the savinoff and savoutoff variables. Approved by: so Security: FreeBSD-EN-25:16.vfs (cherry picked from commit 4046ad6bb0ee542a42d89a48a7d6a56564ed7f33) (cherry picked from commit 2fd0083fcc23f4c25860b8890292448720a5961c)