26 files changed, 253 insertions, 228 deletions

diff --git a/Makefile.inc1 b/Makefile.inc1
index 6ace6a6b5eaf..9dc4f2db4a6c 100644
--- a/Makefile.inc1
+++ b/Makefile.inc1
@@ -2842,6 +2842,15 @@ bootstrap-tools: ${_bt}-links .PHONY
     ${_mkesdb} \
     ${_zic} \
     ${LOCAL_BSTOOL_DIRS}
+# We don't enforce any particular uniqueness of targets in the above list; it
+# may be the case that different bootstrap tools may have shared dependencies
+# at different BOOTSTRAPPING points, so we don't object to them using their own
+# conditionals and duplicating them into their ${_foo} variable to ease future
+# maintenance if we purge some entries.  These target names are purposefully
+# unique and this is the only place that should be generating commands for them,
+# but the target may have been defined earlier to express dependencies -- thus,
+# we specifically want commands() here.
+.if !commands(${_bt}-${_tool})
 ${_bt}-${_tool}: ${_bt}-links .PHONY .MAKE
 	${_+_}@${ECHODIR} "===> ${_tool} (obj,all,install)"; \
 		cd ${.CURDIR}/${_tool}; \
@@ -2851,8 +2860,8 @@ ${_bt}-${_tool}: ${_bt}-links .PHONY .MAKE
 		fi; \
 		${MAKE} DIRPRFX=${_tool}/ all; \
 		${MAKE} DIRPRFX=${_tool}/ DESTDIR=${WORLDTMP}/legacy install
-
 bootstrap-tools: ${_bt}-${_tool}
+.endif
 .endfor
 .if target(${_bt}-lib/libmd)
 # If we are bootstrapping libmd (e.g. when building on macOS/Linux) add the
diff --git a/lib/libc/gen/_rand48.c b/lib/libc/gen/_rand48.c
index 990e2c86949b..114c1595b33d 100644
--- a/lib/libc/gen/_rand48.c
+++ b/lib/libc/gen/_rand48.c
@@ -13,34 +13,6 @@
 
 #include "rand48.h"
 
-unsigned short _rand48_seed[3] = {
-	RAND48_SEED_0,
-	RAND48_SEED_1,
-	RAND48_SEED_2
-};
-unsigned short _rand48_mult[3] = {
-	RAND48_MULT_0,
-	RAND48_MULT_1,
-	RAND48_MULT_2
-};
-unsigned short _rand48_add = RAND48_ADD;
-
-void
-_dorand48(unsigned short xseed[3])
-{
-	unsigned long accu;
-	unsigned short temp[2];
-
-	accu = (unsigned long) _rand48_mult[0] * (unsigned long) xseed[0] +
-	 (unsigned long) _rand48_add;
-	temp[0] = (unsigned short) accu;	/* lower 16 bits */
-	accu >>= sizeof(unsigned short) * 8;
-	accu += (unsigned long) _rand48_mult[0] * (unsigned long) xseed[1] +
-	 (unsigned long) _rand48_mult[1] * (unsigned long) xseed[0];
-	temp[1] = (unsigned short) accu;	/* middle 16 bits */
-	accu >>= sizeof(unsigned short) * 8;
-	accu += _rand48_mult[0] * xseed[2] + _rand48_mult[1] * xseed[1] + _rand48_mult[2] * xseed[0];
-	xseed[0] = temp[0];
-	xseed[1] = temp[1];
-	xseed[2] = (unsigned short) accu;
-}
+uint48 _rand48_seed = RAND48_SEED;
+uint48 _rand48_mult = RAND48_MULT;
+uint48 _rand48_add = RAND48_ADD;
diff --git a/lib/libc/gen/drand48.c b/lib/libc/gen/drand48.c
index cec04a6a2425..f7f43ff20468 100644
--- a/lib/libc/gen/drand48.c
+++ b/lib/libc/gen/drand48.c
@@ -13,10 +13,10 @@
 
 #include "rand48.h"
 
-extern unsigned short _rand48_seed[3];
-
 double
 drand48(void)
 {
-	return erand48(_rand48_seed);
+	ERAND48_BEGIN;
+	_DORAND48(_rand48_seed);
+	ERAND48_END(_rand48_seed);
 }
diff --git a/lib/libc/gen/erand48.c b/lib/libc/gen/erand48.c
index 286904c27839..38d4774a9fe6 100644
--- a/lib/libc/gen/erand48.c
+++ b/lib/libc/gen/erand48.c
@@ -16,8 +16,9 @@
 double
 erand48(unsigned short xseed[3])
 {
-	_dorand48(xseed);
-	return ldexp((double) xseed[0], -48) +
-	       ldexp((double) xseed[1], -32) +
-	       ldexp((double) xseed[2], -16);
+	uint48 tmp;
+
+	ERAND48_BEGIN;
+	DORAND48(tmp, xseed);
+	ERAND48_END(tmp);
 }
diff --git a/lib/libc/gen/jrand48.c b/lib/libc/gen/jrand48.c
index 0a9f780a9e5c..93442439d49e 100644
--- a/lib/libc/gen/jrand48.c
+++ b/lib/libc/gen/jrand48.c
@@ -11,14 +11,13 @@
  * to anyone/anything when using this software.
  */
 
-#include <stdint.h>
-
 #include "rand48.h"
 
 long
 jrand48(unsigned short xseed[3])
 {
+	uint48 tmp;
 
-	_dorand48(xseed);
-	return ((int32_t)(((uint32_t)xseed[2] << 16) | (uint32_t)xseed[1]));
+	DORAND48(tmp, xseed);
+	return ((int)((tmp >> 16) & 0xffffffff));
 }
diff --git a/lib/libc/gen/lcong48.c b/lib/libc/gen/lcong48.c
index f13826b3d3f3..871b2110ed94 100644
--- a/lib/libc/gen/lcong48.c
+++ b/lib/libc/gen/lcong48.c
@@ -13,18 +13,10 @@
 
 #include "rand48.h"
 
-extern unsigned short _rand48_seed[3];
-extern unsigned short _rand48_mult[3];
-extern unsigned short _rand48_add;
-
 void
 lcong48(unsigned short p[7])
 {
-	_rand48_seed[0] = p[0];
-	_rand48_seed[1] = p[1];
-	_rand48_seed[2] = p[2];
-	_rand48_mult[0] = p[3];
-	_rand48_mult[1] = p[4];
-	_rand48_mult[2] = p[5];
+	LOADRAND48(_rand48_seed, &p[0]);
+	LOADRAND48(_rand48_mult, &p[3]);
 	_rand48_add = p[6];
 }
diff --git a/lib/libc/gen/lrand48.c b/lib/libc/gen/lrand48.c
index a3d0111cf4d5..cc07044b8af9 100644
--- a/lib/libc/gen/lrand48.c
+++ b/lib/libc/gen/lrand48.c
@@ -13,11 +13,9 @@
 
 #include "rand48.h"
 
-extern unsigned short _rand48_seed[3];
-
 long
 lrand48(void)
 {
-	_dorand48(_rand48_seed);
-	return ((long) _rand48_seed[2] << 15) + ((long) _rand48_seed[1] >> 1);
+	_DORAND48(_rand48_seed);
+	return (_rand48_seed >> 17) & 0x7fffffff;
 }
diff --git a/lib/libc/gen/mrand48.c b/lib/libc/gen/mrand48.c
index 15b0bfb1bd6e..f9128a6d4188 100644
--- a/lib/libc/gen/mrand48.c
+++ b/lib/libc/gen/mrand48.c
@@ -15,13 +15,9 @@
 
 #include "rand48.h"
 
-extern unsigned short _rand48_seed[3];
-
 long
 mrand48(void)
 {
-
-	_dorand48(_rand48_seed);
-	return ((int32_t)(((uint32_t)_rand48_seed[2] << 16) |
-	    (uint32_t)_rand48_seed[1]));
+	_DORAND48(_rand48_seed);
+	return ((int)((_rand48_seed >> 16) & 0xffffffff));
 }
diff --git a/lib/libc/gen/nrand48.c b/lib/libc/gen/nrand48.c
index 6c54065e7e0f..f6f4e231105c 100644
--- a/lib/libc/gen/nrand48.c
+++ b/lib/libc/gen/nrand48.c
@@ -16,6 +16,8 @@
 long
 nrand48(unsigned short xseed[3])
 {
-	_dorand48(xseed);
-	return ((long) xseed[2] << 15) + ((long) xseed[1] >> 1);
+	uint48 tmp;
+
+	DORAND48(tmp, xseed);
+	return ((tmp >> 17) & 0x7fffffff);
 }
diff --git a/lib/libc/gen/rand48.3 b/lib/libc/gen/rand48.3
index 1e47c843058e..3ea649354270 100644
--- a/lib/libc/gen/rand48.3
+++ b/lib/libc/gen/rand48.3
@@ -9,7 +9,7 @@
 .\" of any kind. I shall in no event be liable for anything that happens
 .\" to anyone/anything when using this software.
 .\"
-.Dd September 4, 2012
+.Dd September 11, 2025
 .Dt RAND48 3
 .Os
 .Sh NAME
@@ -183,5 +183,8 @@ generator calls.
 .Xr arc4random 3 ,
 .Xr rand 3 ,
 .Xr random 3
+.Sh STANDARDS
+The functions described in this page are expected to conform to
+.St -p1003.1-2008 .
 .Sh AUTHORS
 .An Martin Birgmeier
diff --git a/lib/libc/gen/rand48.h b/lib/libc/gen/rand48.h
index 9861e99683cb..d3326e851491 100644
--- a/lib/libc/gen/rand48.h
+++ b/lib/libc/gen/rand48.h
@@ -14,10 +14,11 @@
 #ifndef _RAND48_H_
 #define _RAND48_H_
 
+#include <sys/types.h>
 #include <math.h>
 #include <stdlib.h>
 
-void		_dorand48(unsigned short[3]);
+#include "fpmath.h"
 
 #define	RAND48_SEED_0	(0x330e)
 #define	RAND48_SEED_1	(0xabcd)
@@ -27,4 +28,62 @@ void		_dorand48(unsigned short[3]);
 #define	RAND48_MULT_2	(0x0005)
 #define	RAND48_ADD	(0x000b)
 
+typedef uint64_t uint48;
+
+extern uint48 _rand48_seed;
+extern uint48 _rand48_mult;
+extern uint48 _rand48_add;
+
+#define	TOUINT48(x, y, z)						\
+	((uint48)(x) + (((uint48)(y)) << 16) + (((uint48)(z)) << 32))
+
+#define	RAND48_SEED	TOUINT48(RAND48_SEED_0, RAND48_SEED_1, RAND48_SEED_2)
+#define	RAND48_MULT	TOUINT48(RAND48_MULT_0, RAND48_MULT_1, RAND48_MULT_2)
+
+#define	LOADRAND48(l, x) do {						\
+	(l) = TOUINT48((x)[0], (x)[1], (x)[2]);				\
+} while (0)
+
+#define	STORERAND48(l, x) do {						\
+	(x)[0] = (unsigned short)(l);					\
+	(x)[1] = (unsigned short)((l) >> 16);				\
+	(x)[2] = (unsigned short)((l) >> 32);				\
+} while (0)
+
+#define	_DORAND48(l) do {						\
+	(l) = (l) * _rand48_mult + _rand48_add;				\
+} while (0)
+
+#define	DORAND48(l, x) do {						\
+	LOADRAND48(l, x);						\
+	_DORAND48(l);							\
+	STORERAND48(l, x);						\
+} while (0)
+
+#define	ERAND48_BEGIN							\
+	union {								\
+		union IEEEd2bits ieee;					\
+		uint64_t u64;						\
+	} u;								\
+	int s
+
+/*
+ * Optimization for speed: assume doubles are IEEE 754 and use bit fiddling
+ * rather than converting to double.  Specifically, clamp the result to 48 bits
+ * and convert to a double in [0.0, 1.0) via division by 2^48.  Normalize by
+ * shifting the most significant bit into the implicit one position and
+ * adjusting the exponent accordingly.  The store to the exponent field
+ * overwrites the implicit one.
+ */
+#define	ERAND48_END(x) do {						\
+	u.u64 = ((x) & 0xffffffffffffULL);				\
+	if (u.u64 == 0)							\
+		return (0.0);						\
+	u.u64 <<= 5;							\
+	for (s = 0; !(u.u64 & (1LL << 52)); s++, u.u64 <<= 1)		\
+		;							\
+	u.ieee.bits.exp = 1022 - s;					\
+	return (u.ieee.d);						\
+} while (0)
+
 #endif /* _RAND48_H_ */
diff --git a/lib/libc/gen/seed48.c b/lib/libc/gen/seed48.c
index 258c4bac3c9f..f57656ce1121 100644
--- a/lib/libc/gen/seed48.c
+++ b/lib/libc/gen/seed48.c
@@ -13,24 +13,14 @@
 
 #include "rand48.h"
 
-extern unsigned short _rand48_seed[3];
-extern unsigned short _rand48_mult[3];
-extern unsigned short _rand48_add;
-
 unsigned short *
 seed48(unsigned short xseed[3])
 {
 	static unsigned short sseed[3];
 
-	sseed[0] = _rand48_seed[0];
-	sseed[1] = _rand48_seed[1];
-	sseed[2] = _rand48_seed[2];
-	_rand48_seed[0] = xseed[0];
-	_rand48_seed[1] = xseed[1];
-	_rand48_seed[2] = xseed[2];
-	_rand48_mult[0] = RAND48_MULT_0;
-	_rand48_mult[1] = RAND48_MULT_1;
-	_rand48_mult[2] = RAND48_MULT_2;
+	STORERAND48(_rand48_seed, sseed);
+	LOADRAND48(_rand48_seed, xseed);
+	_rand48_mult = RAND48_MULT;
 	_rand48_add = RAND48_ADD;
-	return sseed;
+	return (sseed);
 }
diff --git a/lib/libc/gen/srand48.c b/lib/libc/gen/srand48.c
index fd369a094c51..4b82ece72db8 100644
--- a/lib/libc/gen/srand48.c
+++ b/lib/libc/gen/srand48.c
@@ -13,18 +13,11 @@
 
 #include "rand48.h"
 
-extern unsigned short _rand48_seed[3];
-extern unsigned short _rand48_mult[3];
-extern unsigned short _rand48_add;
-
 void
 srand48(long seed)
 {
-	_rand48_seed[0] = RAND48_SEED_0;
-	_rand48_seed[1] = (unsigned short) seed;
-	_rand48_seed[2] = (unsigned short) (seed >> 16);
-	_rand48_mult[0] = RAND48_MULT_0;
-	_rand48_mult[1] = RAND48_MULT_1;
-	_rand48_mult[2] = RAND48_MULT_2;
+	_rand48_seed = TOUINT48(RAND48_SEED_0, (unsigned short)seed,
+	    (unsigned short)(seed >> 16));
+	_rand48_mult = RAND48_MULT;
 	_rand48_add = RAND48_ADD;
 }
diff --git a/release/tools/ec2-builder.conf b/release/tools/ec2-builder.conf
index cf4276fc80ec..a55485fec0cd 100644
--- a/release/tools/ec2-builder.conf
+++ b/release/tools/ec2-builder.conf
@@ -7,17 +7,16 @@
 export VMSIZE=8000m
 
 # Flags to installworld/kernel: We don't want debug symbols (kernel or
-# userland), 32-bit libraries, tests, or the debugger.
+# userland), 32-bit libraries, or tests.
 export INSTALLOPTS="WITHOUT_DEBUG_FILES=YES WITHOUT_KERNEL_SYMBOLS=YES \
-    WITHOUT_LIB32=YES WITHOUT_TESTS=YES WITHOUT_LLDB=YES"
+    WITHOUT_LIB32=YES WITHOUT_TESTS=YES"
 
 # Equivalent to INSTALLOPTS for pkgbase
 vm_extra_filter_base_packages() {
 	grep -v \
 		-e '.*-dbg$' \
 		-e '.*-lib32$' \
-		-e '^FreeBSD-tests.*' \
-		-e '^FreeBSD-lldb.*'
+		-e '^FreeBSD-set-tests'
 }
 
 # Packages to install into the image we're creating.  In addition to packages
diff --git a/release/tools/ec2-small.conf b/release/tools/ec2-small.conf
index 32d02cbb79e4..acaffbbc0c42 100644
--- a/release/tools/ec2-small.conf
+++ b/release/tools/ec2-small.conf
@@ -10,17 +10,16 @@
 export VMSIZE=5000m
 
 # Flags to installworld/kernel: We don't want debug symbols (kernel or
-# userland), 32-bit libraries, tests, or the debugger.
+# userland), 32-bit libraries, or tests.
 export INSTALLOPTS="WITHOUT_DEBUG_FILES=YES WITHOUT_KERNEL_SYMBOLS=YES \
-    WITHOUT_LIB32=YES WITHOUT_TESTS=YES WITHOUT_LLDB=YES"
+    WITHOUT_LIB32=YES WITHOUT_TESTS=YES"
 
 # Equivalent to INSTALLOPTS for pkgbase
 vm_extra_filter_base_packages() {
 	grep -v \
 		-e '.*-dbg$' \
 		-e '.*-lib32$' \
-		-e '^FreeBSD-tests.*' \
-		-e '^FreeBSD-lldb.*'
+		-e '^FreeBSD-set-tests'
 }
 
 # Packages to install into the image we're creating.  In addition to packages
diff --git a/release/tools/vmimage.subr b/release/tools/vmimage.subr
index cae8a113871e..131ebe37db6c 100644
--- a/release/tools/vmimage.subr
+++ b/release/tools/vmimage.subr
@@ -70,15 +70,15 @@ vm_copy_base() {
 	return 0
 }
 
-vm_filter_base_packages() {
-	# Reads a list of all base system packages from stdin.
-	# Writes a list of base system packages to install to stdout.
-	grep -v -e '^FreeBSD-src.*' -e '^FreeBSD-kernel.*'
-	# There are several kernel variants available in separate packages.
-	# For VMs it is sufficient to install only the generic kernel.
-	echo "FreeBSD-kernel-man"
-	echo "FreeBSD-kernel-generic"
-	echo "FreeBSD-kernel-generic-dbg"
+vm_base_packages_list() {
+	# Output a list of package sets equivalent to what we get from
+	# "installworld installkernel distribution", aka. the full base
+	# system.
+	for S in base lib32 kernels; do
+		echo FreeBSD-set-$S
+		echo FreeBSD-set-$S-dbg
+	done
+	echo FreeBSD-set-tests
 }
 
 vm_extra_filter_base_packages() {
@@ -99,8 +99,7 @@ vm_install_base() {
 			pkg_cmd="$pkg_cmd -o METALOG=METALOG"
 		fi
 		$pkg_cmd update
-		selected=$($pkg_cmd rquery -U -r FreeBSD-base %n | \
-			vm_filter_base_packages | vm_extra_filter_base_packages)
+		selected=$(vm_base_packages_list | vm_extra_filter_base_packages)
 		$pkg_cmd install -U -r FreeBSD-base $selected
 	else
 		cd ${WORLDDIR} && \
diff --git a/share/man/man4/ice.4 b/share/man/man4/ice.4
index 13ad304a2d5a..c7675e627726 100644
--- a/share/man/man4/ice.4
+++ b/share/man/man4/ice.4
@@ -39,18 +39,28 @@
 .Nm ice
 .Nd Intel Ethernet 800 Series Driver
 .Sh SYNOPSIS
-To compile this driver into the kernel, place the following lines in your
-kernel configuration file:
-.Bd -literal -offset indent
 .Cd device iflib
 .Cd device ice
-.Ed
 .Pp
-To load the driver as a module at boot time, place the following lines in
+In
 .Xr loader.conf 5 :
-.Bd -literal -offset indent
-if_ice_load="YES"
-.Ed
+.Cd if_ice_load
+.Cd hw.ice.enable_health_events
+.Cd hw.ice.irdma
+.Cd hw.ice.irdma_max_msix
+.Cd hw.ice.debug.enable_tx_fc_filter
+.Cd hw.ice.debug.enable_tx_lldp_filter
+.Cd hw.ice.debug.ice_tx_balance_en
+.Pp
+In
+.Xr sysctl.conf 5
+or
+.Xr loader.conf 5 :
+.Cd dev.ice.#.current_speed
+.Cd dev.ice.#.fw_version
+.Cd dev.ice.#.ddp_version
+.Cd dev.ice.#.pba_number
+.Cd dev.ice.#.hw.mac.*
 .Sh DESCRIPTION
 .Ss Features
 The
diff --git a/sys/dev/ahci/ahci_pci.c b/sys/dev/ahci/ahci_pci.c
index 82f56fc0d19e..2b4cb37275a6 100644
--- a/sys/dev/ahci/ahci_pci.c
+++ b/sys/dev/ahci/ahci_pci.c
@@ -467,28 +467,6 @@ ahci_ata_probe(device_t dev)
 }
 
 static int
-ahci_pci_read_msix_bars(device_t dev, uint8_t *table_bar, uint8_t *pba_bar)
-{
-	int cap_offset = 0, ret;
-	uint32_t val;
-
-	if ((table_bar == NULL) || (pba_bar == NULL))
-		return (EINVAL);
-
-	ret = pci_find_cap(dev, PCIY_MSIX, &cap_offset);
-	if (ret != 0)
-		return (EINVAL);
-
-	val = pci_read_config(dev, cap_offset + PCIR_MSIX_TABLE, 4);
-	*table_bar = PCIR_BAR(val & PCIM_MSIX_BIR_MASK);
-
-	val = pci_read_config(dev, cap_offset + PCIR_MSIX_PBA, 4);
-	*pba_bar = PCIR_BAR(val & PCIM_MSIX_BIR_MASK);
-
-	return (0);
-}
-
-static int
 ahci_pci_attach(device_t dev)
 {
 	struct ahci_controller *ctlr = device_get_softc(dev);
@@ -496,7 +474,6 @@ ahci_pci_attach(device_t dev)
 	uint32_t devid = pci_get_devid(dev);
 	uint8_t revid = pci_get_revid(dev);
 	int msi_count, msix_count;
-	uint8_t table_bar = 0, pba_bar = 0;
 	uint32_t caps, pi;
 
 	msi_count = pci_msi_count(dev);
@@ -584,20 +561,11 @@ ahci_pci_attach(device_t dev)
 	if (ctlr->quirks & AHCI_Q_NOMSIX)
 		msix_count = 0;
 
-	/* Read MSI-x BAR IDs if supported */
-	if (msix_count > 0) {
-		error = ahci_pci_read_msix_bars(dev, &table_bar, &pba_bar);
-		if (error == 0) {
-			ctlr->r_msix_tab_rid = table_bar;
-			ctlr->r_msix_pba_rid = pba_bar;
-		} else {
-			/* Failed to read BARs, disable MSI-x */
-			msix_count = 0;
-		}
-	}
-
 	/* Allocate resources for MSI-x table and PBA */
 	if (msix_count > 0) {
+		ctlr->r_msix_tab_rid = pci_msix_table_bar(dev);
+		ctlr->r_msix_pba_rid = pci_msix_pba_bar(dev);
+
 		/*
 		 * Allocate new MSI-x table only if not
 		 * allocated before.
@@ -608,8 +576,8 @@ ahci_pci_attach(device_t dev)
 			ctlr->r_msix_table = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 			    &ctlr->r_msix_tab_rid, RF_ACTIVE);
 			if (ctlr->r_msix_table == NULL) {
-				ahci_free_mem(dev);
-				return (ENXIO);
+				msix_count = 0;
+				goto no_msix;
 			}
 		}
 
@@ -624,12 +592,12 @@ ahci_pci_attach(device_t dev)
 			ctlr->r_msix_pba = bus_alloc_resource_any(dev, SYS_RES_MEMORY,
 			    &ctlr->r_msix_pba_rid, RF_ACTIVE);
 			if (ctlr->r_msix_pba == NULL) {
-				ahci_free_mem(dev);
-				return (ENXIO);
+				msix_count = 0;
 			}
 		}
 	}
 
+no_msix:
 	pci_enable_busmaster(dev);
 	/* Reset controller */
 	if ((error = ahci_pci_ctlr_reset(dev)) != 0) {
diff --git a/sys/fs/nullfs/null.h b/sys/fs/nullfs/null.h
index aa7a689bec34..ad3f7779e108 100644
--- a/sys/fs/nullfs/null.h
+++ b/sys/fs/nullfs/null.h
@@ -53,7 +53,7 @@ struct null_mount {
  * A cache of vnode references
  */
 struct null_node {
-	CK_LIST_ENTRY(null_node) null_hash;	/* Hash list */
+	CK_SLIST_ENTRY(null_node) null_hash;	/* Hash list */
 	struct vnode	        *null_lowervp;	/* VREFed once */
 	struct vnode		*null_vnode;	/* Back pointer */
 	u_int			null_flags;
diff --git a/sys/fs/nullfs/null_subr.c b/sys/fs/nullfs/null_subr.c
index 146d3bbdaedd..d7f847d449d0 100644
--- a/sys/fs/nullfs/null_subr.c
+++ b/sys/fs/nullfs/null_subr.c
@@ -36,12 +36,12 @@
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/rwlock.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
-#include <sys/vnode.h>
+#include <sys/rwlock.h>
 #include <sys/smr.h>
+#include <sys/vnode.h>
 
 #include <fs/nullfs/null.h>
 
@@ -59,7 +59,7 @@ VFS_SMR_DECLARE;
 
 #define	NULL_NHASH(vp) (&null_node_hashtbl[vfs_hash_index(vp) & null_hash_mask])
 
-static CK_LIST_HEAD(null_node_hashhead, null_node) *null_node_hashtbl;
+static CK_SLIST_HEAD(null_node_hashhead, null_node) *null_node_hashtbl;
 static struct rwlock null_hash_lock;
 static u_long null_hash_mask;
 
@@ -116,7 +116,7 @@ null_hashget_locked(struct mount *mp, struct vnode *lowervp)
 	 * reference count (but NOT the lower vnode's VREF counter).
 	 */
 	hd = NULL_NHASH(lowervp);
-	CK_LIST_FOREACH(a, hd, null_hash) {
+	CK_SLIST_FOREACH(a, hd, null_hash) {
 		if (a->null_lowervp != lowervp)
 			continue;
 		/*
@@ -143,12 +143,12 @@ null_hashget(struct mount *mp, struct vnode *lowervp)
 	struct vnode *vp;
 	enum vgetstate vs;
 
-	ASSERT_VOP_LOCKED(lowervp, "null_hashget");
+	ASSERT_VOP_LOCKED(lowervp, __func__);
 	rw_assert(&null_hash_lock, RA_UNLOCKED);
 
 	vfs_smr_enter();
 	hd = NULL_NHASH(lowervp);
-	CK_LIST_FOREACH(a, hd, null_hash) {
+	CK_SLIST_FOREACH(a, hd, null_hash) {
 		if (a->null_lowervp != lowervp)
 			continue;
 		/*
@@ -181,7 +181,7 @@ null_hashins(struct mount *mp, struct null_node *xp)
 
 	hd = NULL_NHASH(xp->null_lowervp);
 #ifdef INVARIANTS
-	CK_LIST_FOREACH(oxp, hd, null_hash) {
+	CK_SLIST_FOREACH(oxp, hd, null_hash) {
 		if (oxp->null_lowervp == xp->null_lowervp &&
 		    NULLTOV(oxp)->v_mount == mp) {
 			VNASSERT(0, NULLTOV(oxp),
@@ -189,7 +189,7 @@ null_hashins(struct mount *mp, struct null_node *xp)
 		}
 	}
 #endif
-	CK_LIST_INSERT_HEAD(hd, xp, null_hash);
+	CK_SLIST_INSERT_HEAD(hd, xp, null_hash);
 }
 
 static void
@@ -305,9 +305,11 @@ null_nodeget(struct mount *mp, struct vnode *lowervp, struct vnode **vpp)
 void
 null_hashrem(struct null_node *xp)
 {
+	struct null_node_hashhead *hd;
 
+	hd = NULL_NHASH(xp->null_lowervp);
 	rw_wlock(&null_hash_lock);
-	CK_LIST_REMOVE(xp, null_hash);
+	CK_SLIST_REMOVE(hd, xp, null_node, null_hash);
 	rw_wunlock(&null_hash_lock);
 }
 
diff --git a/sys/fs/nullfs/null_vnops.c b/sys/fs/nullfs/null_vnops.c
index 375b6aa27531..ec8a6b10b13f 100644
--- a/sys/fs/nullfs/null_vnops.c
+++ b/sys/fs/nullfs/null_vnops.c
@@ -788,10 +788,10 @@ null_lock_prep_with_smr(struct vop_lock1_args *ap)
 	struct null_node *nn;
 	struct vnode *lvp;
 
-	vfs_smr_enter();
-
 	lvp = NULL;
 
+	vfs_smr_enter();
+
 	nn = VTONULL_SMR(ap->a_vp);
 	if (__predict_true(nn != NULL)) {
 		lvp = nn->null_lowervp;
@@ -855,6 +855,8 @@ null_lock(struct vop_lock1_args *ap)
 	 * case by reacquiring correct lock in requested mode.
 	 */
 	if (VTONULL(ap->a_vp) == NULL && error == 0) {
+		VOP_UNLOCK(lvp);
+
 		flags = ap->a_flags;
 		ap->a_flags &= ~LK_TYPE_MASK;
 		switch (flags & LK_TYPE_MASK) {
@@ -869,7 +871,6 @@ null_lock(struct vop_lock1_args *ap)
 			panic("Unsupported lock request %d\n",
 			    flags);
 		}
-		VOP_UNLOCK(lvp);
 		error = vop_stdlock(ap);
 	}
 	vdrop(lvp);
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index a32b5a1b3354..ab8ed32ad189 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -127,6 +127,27 @@ proc_realparent(struct proc *child)
 	return (parent);
 }
 
+static void
+reaper_clear(struct proc *p, struct proc *rp)
+{
+	struct proc *p1;
+	bool clear;
+
+	sx_assert(&proctree_lock, SX_XLOCKED);
+	LIST_REMOVE(p, p_reapsibling);
+	if (p->p_reapsubtree == 1)
+		return;
+	clear = true;
+	LIST_FOREACH(p1, &rp->p_reaplist, p_reapsibling) {
+		if (p1->p_reapsubtree == p->p_reapsubtree) {
+			clear = false;
+			break;
+		}
+	}
+	if (clear)
+		proc_id_clear(PROC_ID_REAP, p->p_reapsubtree);
+}
+
 void
 reaper_abandon_children(struct proc *p, bool exiting)
 {
@@ -138,7 +159,7 @@ reaper_abandon_children(struct proc *p, bool exiting)
 		return;
 	p1 = p->p_reaper;
 	LIST_FOREACH_SAFE(p2, &p->p_reaplist, p_reapsibling, ptmp) {
-		LIST_REMOVE(p2, p_reapsibling);
+		reaper_clear(p2, p);
 		p2->p_reaper = p1;
 		p2->p_reapsubtree = p->p_reapsubtree;
 		LIST_INSERT_HEAD(&p1->p_reaplist, p2, p_reapsibling);
@@ -152,27 +173,6 @@ reaper_abandon_children(struct proc *p, bool exiting)
 	p->p_treeflag &= ~P_TREE_REAPER;
 }
 
-static void
-reaper_clear(struct proc *p)
-{
-	struct proc *p1;
-	bool clear;
-
-	sx_assert(&proctree_lock, SX_LOCKED);
-	LIST_REMOVE(p, p_reapsibling);
-	if (p->p_reapsubtree == 1)
-		return;
-	clear = true;
-	LIST_FOREACH(p1, &p->p_reaper->p_reaplist, p_reapsibling) {
-		if (p1->p_reapsubtree == p->p_reapsubtree) {
-			clear = false;
-			break;
-		}
-	}
-	if (clear)
-		proc_id_clear(PROC_ID_REAP, p->p_reapsubtree);
-}
-
 void
 proc_clear_orphan(struct proc *p)
 {
@@ -972,7 +972,7 @@ proc_reap(struct thread *td, struct proc *p, int *status, int options)
 	sx_xunlock(PIDHASHLOCK(p->p_pid));
 	LIST_REMOVE(p, p_sibling);
 	reaper_abandon_children(p, true);
-	reaper_clear(p);
+	reaper_clear(p, p->p_reaper);
 	PROC_LOCK(p);
 	proc_clear_orphan(p);
 	PROC_UNLOCK(p);
diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c
index def6bc886617..1fb6104a2944 100644
--- a/sys/netinet/tcp_syncache.c
+++ b/sys/netinet/tcp_syncache.c
@@ -1272,7 +1272,7 @@ syncache_expand(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
 			syncache_send_challenge_ack(sc, m);
 			SCH_UNLOCK(sch);
 			free(s, M_TCPLOG);
-			return (-1);  /* Do not send RST */;
+			return (-1);  /* Do not send RST */
 		}
 
 		/*
@@ -1285,7 +1285,8 @@ syncache_expand(struct in_conninfo *inc, struct tcpopt *to, struct tcphdr *th,
 				    "segment rejected\n",
 				    s, __func__, th->th_ack, sc->sc_iss + 1);
 			SCH_UNLOCK(sch);
-			goto failed;
+			free(s, M_TCPLOG);
+			return (0);  /* Do send RST, do not free sc. */;
 		}
 
 		TAILQ_REMOVE(&sch->sch_bucket, sc, sc_hash);
diff --git a/sys/x86/x86/mca.c b/sys/x86/x86/mca.c
index 1851df8d00a0..e43c88b3a27b 100644
--- a/sys/x86/x86/mca.c
+++ b/sys/x86/x86/mca.c
@@ -131,8 +131,10 @@ static STAILQ_HEAD(, mca_internal) mca_pending;
 static int mca_ticks = 300;
 static struct taskqueue *mca_tq;
 static struct task mca_resize_task;
+static struct task mca_postscan_task;
 static struct timeout_task mca_scan_task;
 static struct mtx mca_lock;
+static bool mca_startup_done = false;
 
 /* Statistics on number of MCA events by type, updated atomically. */
 static uint64_t mca_stats[MCA_T_COUNT];
@@ -1016,6 +1018,16 @@ mca_process_records(enum scan_mode mode)
 {
 	struct mca_internal *mca;
 
+	/*
+	 * If in an interrupt context, defer the post-scan activities to a
+	 * task queue.
+	 */
+	if (mode != POLLED) {
+		if (mca_startup_done)
+			taskqueue_enqueue(mca_tq, &mca_postscan_task);
+		return;
+	}
+
 	mtx_lock_spin(&mca_lock);
 	while ((mca = STAILQ_FIRST(&mca_pending)) != NULL) {
 		STAILQ_REMOVE_HEAD(&mca_pending, link);
@@ -1023,10 +1035,19 @@ mca_process_records(enum scan_mode mode)
 		mca_store_record(mca);
 	}
 	mtx_unlock_spin(&mca_lock);
-	if (mode == POLLED)
-		mca_resize_freelist();
-	else if (!cold)
-		taskqueue_enqueue(mca_tq, &mca_resize_task);
+	mca_resize_freelist();
+}
+
+/*
+ * Emit log entries and resize the free list. This is intended to be called
+ * from a task queue to handle work which does not need to be done (or cannot
+ * be done) in an interrupt context.
+ */
+static void
+mca_postscan(void *context __unused, int pending __unused)
+{
+
+	mca_process_records(POLLED);
 }
 
 /*
@@ -1097,7 +1118,7 @@ sysctl_mca_maxcount(SYSCTL_HANDLER_ARGS)
 			doresize = true;
 		}
 	mtx_unlock_spin(&mca_lock);
-	if (doresize && !cold)
+	if (doresize && mca_startup_done)
 		taskqueue_enqueue(mca_tq, &mca_resize_task);
 	return (error);
 }
@@ -1109,12 +1130,16 @@ mca_startup(void *dummy)
 	if (mca_banks <= 0)
 		return;
 
-	/* CMCIs during boot may have claimed items from the freelist. */
-	mca_resize_freelist();
-
 	taskqueue_start_threads(&mca_tq, 1, PI_SWI(SWI_TQ), "mca taskq");
 	taskqueue_enqueue_timeout_sbt(mca_tq, &mca_scan_task,
 	    mca_ticks * SBT_1S, 0, C_PREL(1));
+	mca_startup_done = true;
+
+	/*
+	 * CMCIs during boot may have recorded entries. Conduct the post-scan
+	 * activities now.
+	 */
+	mca_postscan(NULL, 0);
 }
 SYSINIT(mca_startup, SI_SUB_KICK_SCHEDULER, SI_ORDER_ANY, mca_startup, NULL);
 
@@ -1174,6 +1199,7 @@ mca_setup(uint64_t mcg_cap)
 	TIMEOUT_TASK_INIT(mca_tq, &mca_scan_task, 0, mca_scan_cpus, NULL);
 	STAILQ_INIT(&mca_freelist);
 	TASK_INIT(&mca_resize_task, 0, mca_resize, NULL);
+	TASK_INIT(&mca_postscan_task, 0, mca_postscan, NULL);
 	mca_resize_freelist();
 	SYSCTL_ADD_INT(NULL, SYSCTL_STATIC_CHILDREN(_hw_mca), OID_AUTO,
 	    "count", CTLFLAG_RD, (int *)(uintptr_t)&mca_count, 0,
@@ -1577,6 +1603,9 @@ mca_intr(void)
 		panic("Unrecoverable machine check exception");
 	}
 
+	if (count)
+		mca_process_records(MCE);
+
 	/* Clear MCIP. */
 	wrmsr(MSR_MCG_STATUS, mcg_status & ~MCG_STATUS_MCIP);
 }
diff --git a/usr.bin/lsvfs/lsvfs.c b/usr.bin/lsvfs/lsvfs.c
index 5477d96434ac..8925b8988cd3 100644
--- a/usr.bin/lsvfs/lsvfs.c
+++ b/usr.bin/lsvfs/lsvfs.c
@@ -5,10 +5,12 @@
  *
  */
 
+#include <sys/capsicum.h>
 #include <sys/param.h>
 #include <sys/mount.h>
 #include <sys/sysctl.h>
 
+#include <capsicum_helpers.h>
 #include <err.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -38,41 +40,42 @@ static const char *fmt_flags(int);
 int
 main(int argc, char **argv)
 {
-	struct xvfsconf vfc, *xvfsp;
+	struct xvfsconf *xvfsp;
 	size_t cnt, buflen;
 	int rv = 0;
 
 	argc--, argv++;
 
+	if (sysctlbyname("vfs.conflist", NULL, &buflen, NULL, 0) < 0)
+		err(EXIT_FAILURE, "sysctl(vfs.conflist)");
+	if ((xvfsp = malloc(buflen)) == NULL)
+		errx(EXIT_FAILURE, "malloc failed");
+	if (sysctlbyname("vfs.conflist", xvfsp, &buflen, NULL, 0) < 0)
+		err(EXIT_FAILURE, "sysctl(vfs.conflist)");
+	cnt = buflen / sizeof(struct xvfsconf);
+
+	caph_cache_catpages();
+	if (caph_enter() != 0)
+		err(EXIT_FAILURE, "failed to enter capability mode");
+
 	printf(HDRFMT, "Filesystem", "Num", "Refs", "Flags");
 	fputs(DASHES, stdout);
 
-	if (argc > 0) {
-		for (; argc > 0; argc--, argv++) {
-			if (getvfsbyname(*argv, &vfc) == 0) {
-				printf(FMT, vfc.vfc_name, vfc.vfc_typenum,
-				    vfc.vfc_refcount, fmt_flags(vfc.vfc_flags));
-			} else {
-				warnx("VFS %s unknown or not loaded", *argv);
-				rv++;
+	for (size_t i = 0; i < cnt; i++) {
+		if (argc > 0) {
+			int j;
+			for (j = 0; j < argc; j++) {
+				if (strcmp(argv[j], xvfsp[i].vfc_name) == 0)
+					break;
 			}
+			if (j == argc)
+				continue;
 		}
-	} else {
-		if (sysctlbyname("vfs.conflist", NULL, &buflen, NULL, 0) < 0)
-			err(EXIT_FAILURE, "sysctl(vfs.conflist)");
-		if ((xvfsp = malloc(buflen)) == NULL)
-			errx(EXIT_FAILURE, "malloc failed");
-		if (sysctlbyname("vfs.conflist", xvfsp, &buflen, NULL, 0) < 0)
-			err(EXIT_FAILURE, "sysctl(vfs.conflist)");
-		cnt = buflen / sizeof(struct xvfsconf);
-
-		for (size_t i = 0; i < cnt; i++) {
-			printf(FMT, xvfsp[i].vfc_name, xvfsp[i].vfc_typenum,
-			    xvfsp[i].vfc_refcount,
-			    fmt_flags(xvfsp[i].vfc_flags));
-		}
-		free(xvfsp);
+
+		printf(FMT, xvfsp[i].vfc_name, xvfsp[i].vfc_typenum,
+		    xvfsp[i].vfc_refcount, fmt_flags(xvfsp[i].vfc_flags));
 	}
+	free(xvfsp);
 
 	return (rv);
 }
diff --git a/usr.sbin/iovctl/iovctl.8 b/usr.sbin/iovctl/iovctl.8
index 5c7b01c249a0..2574503e5ae7 100644
--- a/usr.sbin/iovctl/iovctl.8
+++ b/usr.sbin/iovctl/iovctl.8
@@ -95,7 +95,7 @@ and
 options, this file will only be used to specify the name of the PF device.
 .Pp
 See
-.Xr iovctl.conf
+.Xr iovctl.conf 5
 for a description of the config file format and documentation of the
 configuration parameters that apply to all PF drivers.
 See the PF driver manual page for configuration parameters specific to