24 files changed, 456 insertions, 65 deletions
diff --git a/share/man/man4/Makefile b/share/man/man4/Makefile
index 60ab6e8bdab6..b9c441e97597 100644
--- a/share/man/man4/Makefile
+++ b/share/man/man4/Makefile
@@ -1023,12 +1023,14 @@ _dtrace_provs=	dtrace_audit.4 \
 		dtrace_ip.4 \
 		dtrace_kinst.4 \
 		dtrace_lockstat.4 \
+		dtrace_mib.4 \
 		dtrace_pid.4 \
 		dtrace_priv.4 \
 		dtrace_proc.4 \
 		dtrace_profile.4 \
 		dtrace_sched.4 \
 		dtrace_sctp.4 \
+		dtrace_syscall.4 \
 		dtrace_tcp.4 \
 		dtrace_udp.4 \
 		dtrace_udplite.4 \
diff --git a/share/man/man4/dtrace_cam.4 b/share/man/man4/dtrace_cam.4
index e5b7ae34c391..8e2790e72d22 100644
--- a/share/man/man4/dtrace_cam.4
+++ b/share/man/man4/dtrace_cam.4
@@ -2,7 +2,7 @@
 .\"
 .\" SPDX-License-Identifier: BSD-2-Clause
 .\"
-.Dd December 26, 2025
+.Dd May 7, 2026
 .Dt DTRACE_CAM 4
 .Os
 .Sh NAME
@@ -25,11 +25,9 @@ probe fires when that request completes.
 The
 .Fn cam::xpt:async-cb
 probe fires just before an async callback is called.
-.Sh ARGUMENTS
-.Sh FILES
-.Sh EXAMPLES
 .Sh SEE ALSO
 .Xr dtrace 1 ,
+.Xr cam 4 ,
 .Xr SDT 9
 .Sh HISTORY
 The
diff --git a/share/man/man4/dtrace_ip.4 b/share/man/man4/dtrace_ip.4
index e9fbdfa3cf43..6faeb305ffc5 100644
--- a/share/man/man4/dtrace_ip.4
+++ b/share/man/man4/dtrace_ip.4
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd September 14, 2015
+.Dd May 7, 2026
 .Dt DTRACE_IP 4
 .Os
 .Sh NAME
@@ -266,6 +266,7 @@ This provider is compatible with the
 providers found in Solaris and Darwin.
 .Sh SEE ALSO
 .Xr dtrace 1 ,
+.Xr dtrace_mib 4 ,
 .Xr dtrace_tcp 4 ,
 .Xr dtrace_udp 4 ,
 .Xr ip 4 ,
diff --git a/share/man/man4/dtrace_mib.4 b/share/man/man4/dtrace_mib.4
new file mode 100644
index 000000000000..e8c2dd3a6f05
--- /dev/null
+++ b/share/man/man4/dtrace_mib.4
@@ -0,0 +1,123 @@
+.\"
+.\" Copyright (c) 2025-2026  Mateusz Piotrowski <0mp@FreeBSD.org>
+.\"
+.\" SPDX-License-Identifier: BSD-2-Clause
+.\"
+.Dd May 7, 2026
+.Dt DTRACE_MIB 4
+.Os
+.Sh NAME
+.Nm dtrace_mib
+.Nd a DTrace provider for Management Information Base
+.Sh SYNOPSIS
+.Cm mib: Ns Ar module Ns Cm \&:count: Ns Ar counter
+.Pp
+In
+.Xr config 5 :
+.Cd "options KDTRACE_MIB_SDT"
+.Sh DESCRIPTION
+The
+.Nm mib
+provider allows tracing of Management Information Base stats counters.
+.Pp
+The list of instrumented
+.Ar module Ns s
+includes:
+.Bl -tag -offset indent -width ipcomp -compact
+.It Cm ah
+IP Authentication Header (RFC 2402),
+.Xr ipsec 4
+.It Cm esp
+IP Encapsulating Security Payload (RFC 1827, RFC 2406),
+.Xr ipsec 4
+.It Cm icmp
+.Xr icmp 4
+.It Cm icmp6
+.Xr icmp6 4
+.It Cm ip
+.Xr ip 4
+.It Cm ip6
+.Xr ip6 4
+.It Cm ipcomp
+IP Payload Compression Protocol,
+.Xr ipsec 4
+.It Cm ipsec
+.Xr ipsec 4
+.It Cm tcp
+.Xr tcp 4
+.It Cm udp
+.Xr udp 4
+.El
+.Pp
+The
+.Cm mib: Ns Ar module Ns Cm \&:count: Ns Ar counter
+probes fire when the
+.Ar counter
+in
+.Ar module Ns s
+increases.
+.Pp
+The first probe argument,
+.Vt uint64_t Va args[0] ,
+is the increment that the
+.Ar counter
+will increase by.
+.Pp
+Note that some probes like
+.Cm mib:esp:count:esps_hist
+or
+.Cm mib:icmp6:count:icp6s_outhist
+provide additional probe-specific arguments.
+.Sh EXAMPLES
+.Ss Example 1 : Tracing IP Stats Counters
+When debugging network issues one common clue is an unexpectedly
+incrementing error counter.
+This is helpful, in that it gives us an
+idea of what might be going wrong, but often these counters may be
+incremented in different functions.
+.Pp
+Trace all
+.Nm mib
+probes in the
+.Xr ip 4
+module and print the current count and a stack trace:
+.Pp
+.Bd -literal -offset 2n
+# dtrace -n 'mib:ip:count: { printf("%d", arg0); stack(); }'
+dtrace: description 'mib:ip:count: ' matched 29 probes
+CPU     ID                    FUNCTION:NAME
+  7  98784               count:ips_localout 1
+              kernel`ip_output+0x17a2
+              kernel`udp_send+0xaca
+              kernel`sosend_dgram+0x315
+              kernel`sousrsend+0x79
+              kernel`kern_sendit+0x1be
+              kernel`sendit+0x1ab
+              kernel`sys_sendmsg+0x5b
+              kernel`amd64_syscall+0x169
+              kernel`0xffffffff81094b8b
+.Ed
+.Sh SEE ALSO
+.Xr dtrace 1 ,
+.Xr dtrace_ip 4 ,
+.Xr dtrace_tcp 4 ,
+.Xr dtrace_udp 4 ,
+.Xr tracing 7 ,
+.Xr sysctl 8
+.Sh STANDARDS
+The probe descriptions in
+the
+.Fx
+.Nm mib
+provider are not compatible with those in the Solaris/illumos mib provider.
+.Sh AUTHORS
+.An -nosplit
+The
+.Nm mib
+provider was added to
+.Fx
+by
+.An Kristof Provost Aq Mt kp@FreeBSD.org .
+.Pp
+This manual page was written by
+.An Mateusz Piotrowski Aq Mt 0mp@FreeBSD.org .
diff --git a/share/man/man4/dtrace_syscall.4 b/share/man/man4/dtrace_syscall.4
new file mode 100644
index 000000000000..e154e4c6046b
--- /dev/null
+++ b/share/man/man4/dtrace_syscall.4
@@ -0,0 +1,87 @@
+.\"
+.\" SPDX-License-Identifier: BSD-2-Clause
+.\"
+.\" Copyright (c) 2026 Mateusz Piotrowski <0mp@FreeBSD.org>
+.\"
+.Dd May 7, 2026
+.Dt DTRACE_SYSCALL 4
+.Os
+.Sh NAME
+.Nm dtrace_syscall
+.Nd a DTrace provider for system calls
+.Sh SYNOPSIS
+.Nm syscall Ns Cm \&: Ns Ar abi Ns Cm \&: Ns Ar syscall Ns Cm :entry
+.Nm syscall Ns Cm \&: Ns Ar abi Ns Cm \&: Ns Ar syscall Ns Cm :return
+.Sh DESCRIPTION
+The
+.Nm syscall
+provider provides entry and return probes for system calls.
+.Pp
+The module in the probe's description is
+.Ar abi ,
+which indicates what system call ABI a
+.Ar syscall
+belongs to.
+.Nm
+supports the following system call ABIs:
+.Pp
+.Bl -tag -offset indent -width freebsd32 -compact
+.It Cm freebsd
+Native ABI.
+.It Cm freebsd32
+Non-native, 32-bit ABI.
+.It Cm linux
+Refer to
+.Xr linux 4 .
+.It Cm linux32
+Refer to
+.Xr linux 4 .
+.El
+.Pp
+The arguments to the
+.Cm entry
+probes are the arguments passed to the system call.
+.Pp
+The
+.Cm return
+probe stores the system call's return value in both
+.Fa arg0
+and
+.Fa arg1 .
+.Pp
+Inspect the
+.Xr d 7 Ap s
+.Va errno
+variable to check if a system call failed.
+.Sh EXAMPLES
+.Ss Example 1 : Count Up System Calls
+The following script traces all system calls and counts them for every process
+on the system.
+.Bd -literal -offset 2n
+syscall:::entry {
+    @[execname, pid] = count();
+}
+.Ed
+.Sh SEE ALSO
+.Xr dtrace 1 ,
+.Xr intro 2 ,
+.Xr tracing 7
+.Rs
+.%B The illumos Dynamic Tracing Guide
+.%O Chapter syscall Provider
+.%D 2008
+.%U https://illumos.org/books/dtrace/chp-syscall.html
+.Re
+.Rs
+.%A Brendan Gregg
+.%A Jim Mauro
+.%B DTrace: Dynamic Tracing in Oracle Solaris, Mac OS X and FreeBSD
+.%I Prentice Hall
+.%O Chapter Syscall Provider
+.%P pp. 315\(en327
+.%D 2011
+.%U https://www.brendangregg.com/dtracebook/
+.Re
+.Sh AUTHORS
+This manual page was written by
+.An Mateusz Piotrowski Aq Mt 0mp@FreeBSD.org .
diff --git a/share/man/man4/dtrace_tcp.4 b/share/man/man4/dtrace_tcp.4
index af57f6e94a63..5570dd965706 100644
--- a/share/man/man4/dtrace_tcp.4
+++ b/share/man/man4/dtrace_tcp.4
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd July 2, 2023
+.Dd May 7, 2026
 .Dt DTRACE_TCP 4
 .Os
 .Sh NAME
@@ -501,6 +501,7 @@ provider in Solaris.
 .Sh SEE ALSO
 .Xr dtrace 1 ,
 .Xr dtrace_ip 4 ,
+.Xr dtrace_mib 4 ,
 .Xr dtrace_sctp 4 ,
 .Xr dtrace_udp 4 ,
 .Xr dtrace_udplite 4 ,
diff --git a/share/man/man4/icmp.4 b/share/man/man4/icmp.4
index c8c92a794e24..493d2d218cec 100644
--- a/share/man/man4/icmp.4
+++ b/share/man/man4/icmp.4
@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd December 11, 2024
+.Dd May 7, 2026
 .Dt ICMP 4
 .Os
 .Sh NAME
@@ -264,6 +264,7 @@ exists.
 .Xr recv 2 ,
 .Xr send 2 ,
 .Xr sysctl 3 ,
+.Xr dtrace_mib 4 ,
 .Xr inet 4 ,
 .Xr intro 4 ,
 .Xr ip 4 ,
diff --git a/share/man/man4/icmp6.4 b/share/man/man4/icmp6.4
index 8730e3fefacb..d9a8bd34a81a 100644
--- a/share/man/man4/icmp6.4
+++ b/share/man/man4/icmp6.4
@@ -28,7 +28,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd November 1, 2018
+.Dd May 7, 2026
 .Dt ICMP6 4
 .Os
 .Sh NAME
@@ -243,6 +243,7 @@ structure as the option value.
 .Xr setsockopt 2 ,
 .Xr socket 2 ,
 .Xr getprotobyname 3 ,
+.Xr dtrace_mib 4 ,
 .Xr inet6 4 ,
 .Xr ip6 4 ,
 .Xr netintro 4
diff --git a/share/man/man4/ifmib.4 b/share/man/man4/ifmib.4
index 20b5613b6873..48e79c1f9411 100644
--- a/share/man/man4/ifmib.4
+++ b/share/man/man4/ifmib.4
@@ -25,7 +25,7 @@
 .\" OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd December 26, 2020
+.Dd May 7, 2026
 .Dt IFMIB 4
 .Os
 .Sh NAME
@@ -165,6 +165,7 @@ and implements a superset of the
 MIB for Ethernet-like networks.
 .Sh SEE ALSO
 .Xr sysctl 3 ,
+.Xr dtrace_mib 4 ,
 .Xr intro 4 ,
 .Xr ifnet 9
 .\" .Xr ethermib 4 ,
diff --git a/share/man/man4/ip.4 b/share/man/man4/ip.4
index fb5ea398c840..140866f6fcf6 100644
--- a/share/man/man4/ip.4
+++ b/share/man/man4/ip.4
@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd August 9, 2021
+.Dd May 7, 2026
 .Dt IP 4
 .Os
 .Sh NAME
@@ -907,6 +907,7 @@ field was not equal to the length of the datagram written to the socket.
 .Xr byteorder 3 ,
 .Xr CMSG_DATA 3 ,
 .Xr sourcefilter 3 ,
+.Xr dtrace_mib 4 ,
 .Xr icmp 4 ,
 .Xr igmp 4 ,
 .Xr inet 4 ,
diff --git a/share/man/man4/ipsec.4 b/share/man/man4/ipsec.4
index 9fd6207c2f14..0c60e0e3c121 100644
--- a/share/man/man4/ipsec.4
+++ b/share/man/man4/ipsec.4
@@ -27,7 +27,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd March 4, 2025
+.Dd May 7, 2026
 .Dt IPSEC 4
 .Os
 .Sh NAME
@@ -336,6 +336,7 @@ routines from looking into the IP payload.
 .Xr socket 2 ,
 .Xr ipsec_set_policy 3 ,
 .Xr crypto 4 ,
+.Xr dtrace_mib 4 ,
 .Xr enc 4 ,
 .Xr icmp6 4 ,
 .Xr if_ipsec 4 ,
diff --git a/share/man/man4/linux.4 b/share/man/man4/linux.4
index 711ac11e8fce..ec8342efe705 100644
--- a/share/man/man4/linux.4
+++ b/share/man/man4/linux.4
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd May 19, 2024
+.Dd May 7, 2026
 .Dt LINUX 4
 .Os
 .Sh NAME
@@ -179,6 +179,7 @@ Linux kernel objects file system, see
 .El
 .Sh SEE ALSO
 .Xr brandelf 1 ,
+.Xr dtrace_syscall 4 ,
 .Xr fdescfs 4 ,
 .Xr linprocfs 4 ,
 .Xr linsysfs 4 ,
diff --git a/share/man/man4/rge.4 b/share/man/man4/rge.4
index 24c42f9106dc..5e338ebf9c87 100644
--- a/share/man/man4/rge.4
+++ b/share/man/man4/rge.4
@@ -3,7 +3,7 @@
 .\"
 .\" SPDX-License-Identifier: BSD-2-Clause
 .\"
-.Dd April 5, 2026
+.Dd May 11, 2026
 .Dt RGE 4
 .Os
 .Sh NAME
@@ -137,6 +137,8 @@ RealTek RTL8126 (up to 5 Gbps)
 RealTek RTL8127 (up to 10 Gbps)
 .It
 Killer E3000 (up to 2.5 Gbps)
+.It
+Killer E5000 (up to 5 Gbps)
 .El
 .Sh SYSCTL VARIABLES
 The following variables are available as both
diff --git a/share/man/man4/scsi.4 b/share/man/man4/scsi.4
index e66fccf53e64..b6390fec646e 100644
--- a/share/man/man4/scsi.4
+++ b/share/man/man4/scsi.4
@@ -22,7 +22,7 @@
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
-.Dd December 11, 2025
+.Dd May 7, 2026
 .Dt CAM 4
 .Os
 .Sh NAME
@@ -530,6 +530,8 @@ for details.
 .\" .Xr ps3cdrom 4 ,
 .Xr sbp 4 ,
 .Xr twa 4
+.It Sy DTrace Providers:
+.Xr dtrace_cam 4
 .El
 .Sh HISTORY
 The
diff --git a/share/man/man4/smartpqi.4 b/share/man/man4/smartpqi.4
index ef5f903fe422..ae85e184114d 100644
--- a/share/man/man4/smartpqi.4
+++ b/share/man/man4/smartpqi.4
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2019-2025, Microchip Technology Inc. and its subsidiaries
+.\" Copyright (C) 2019-2026, Microchip Technology Inc. and its subsidiaries
 .\" Copyright (C) 2016-2018, Microsemi Corporation
 .\" Copyright (C) 2016, PMC-Sierra, Inc.
 .\" Written by John Hall <john.hall@microchip.com>
@@ -24,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd August 28, 2025
+.Dd April 14, 2026
 .Dt SMARTPQI 4 amd64
 .Os
 .Sh NAME
@@ -64,11 +64,13 @@ OEM Controllers based on the Microchip Technology Inc. SmartROC
 and SmartIOC Chipsets
 .El
 .Sh DEBUGGING
-Driver diagnostic printing is controlled in
+Driver diagnostic printing is controlled at boot time in
 .Xr loader.conf 5
 by using the global
 .Va hw.smartpqi.debug_level
-tunable.
+tunable, or at runtime via the per-controller
+.Va dev.smartpqi.<unit>.debug_level
+sysctl.
 .Pp
 The
 .Va debug_level
@@ -82,11 +84,27 @@ The following levels are available:
 .It 0x0002 Ta info Ta Basic information
 .It 0x0004 Ta function Ta Used to show function entry and exit
 .It 0x0008 Ta io Ta Logging data from controller
-.It 0x0010 Ta discovery Ta Device discovery
+.It 0x0010 Ta discovery Ta Device discovery state transitions
 .It 0x0020 Ta warning Ta Operational warnings
 .It 0x0040 Ta error Ta Parameter errors and programming bugs
 .It 0x0080 Ta note Ta More detailed information
 .El
+.Pp
+In addition to the level-gated debug output, the driver always logs
+device addition, device removal, and controller events
+(hotplug, hardware, physical/logical device changes, AIO state and
+configuration changes) via
+.Xr device_printf 9 ,
+which appear in
+.Xr dmesg 8
+regardless of the
+.Va debug_level
+setting.
+.Pp
+For example, to enable discovery logging at runtime on the first controller:
+.Bd -literal -offset indent
+sysctl dev.smartpqi.0.debug_level=0x0070
+.Ed
 .Sh DEVICE HINTS
 The following tunable values can be set in
 .Pa /boot/device.hints
@@ -162,7 +180,9 @@ https://www.microchip.com/design-centers/storage
 .Xr xpt 4 ,
 .Xr loader.conf 5 ,
 .Xr camcontrol 8 ,
-.Xr kldload 8
+.Xr dmesg 8 ,
+.Xr kldload 8 ,
+.Xr sysctl 8
 .Sh HISTORY
 The
 .Nm
diff --git a/share/man/man4/spkr.4 b/share/man/man4/spkr.4
index 64dfee278de4..a2e55035408c 100644
--- a/share/man/man4/spkr.4
+++ b/share/man/man4/spkr.4
@@ -16,16 +16,6 @@ speaker on an
 machine running
 .Fx .
 .Pp
-Only one process may have this device open at any given time;
-.Xr open 2
-and
-.Xr close 2
-are used to lock and relinquish it.
-An attempt to open when
-another process has the device locked will return -1 with an
-.Er EBUSY
-error
-indication.
 Writes to the device are interpreted as `play strings' in a
 simple ASCII melody notation.
 An
@@ -34,6 +24,13 @@ request
 for tone generation at arbitrary
 frequencies is also supported.
 .Pp
+Only one string can be playing at a time.
+Concurrent
+.Xr write 2
+and
+.Xr ioctl 2
+calls from separate threads or processes are serialized per string.
+.Pp
 Sound-generation does not monopolize the processor; in fact, the driver
 spends most of its time sleeping while the PC hardware is emitting
 tones.
@@ -64,18 +61,25 @@ pointer to the first of an array of tone structures and plays them in
 continuous sequence; this array must be terminated by a final member with
 a zero duration.
 .Pp
-The play-string language is modeled on the PLAY statement conventions of
+The play-string language is a dialect of the Music Markup Language
+(MML) used in various computer and gaming systems since the 1970s.
+It is a subset of the MML variant supported by the PLAY statement of
 .Tn IBM
-Advanced BASIC 2.0.
-The
+Advanced BASIC 2.0,
+.Tn MS
+BASICA and GW-BASIC,
+as well as the Standard Musical Expression (SMX) supported in
+.Tn MS
+QBasic.
 .Li MB ,
 .Li MF ,
 and
 .Li X
-primitives of PLAY are not
-useful in a timesharing environment and are omitted.
+primitives of MML/SMX are not supported.
 The `octave-tracking'
-feature and the slur mark are new.
+feature and the slur mark are specific to the
+.Fx
+implementation.
 .Pp
 There are 84 accessible notes numbered 1-84 in 7 octaves, each running from
 C to B, numbered 0-6; the scale is equal-tempered A440 and octave 3 starts
@@ -115,10 +119,11 @@ Thus ``olbc'' will be played as
 ``olb>c'', and ``olcb'' as ``olc<b''.
 Octave locking is disabled for
 one letter note following >, < and O[0123456].
-(The octave-locking
-feature is not supported in
+The octave-locking feature is not supported in
 .Tn IBM
-BASIC.)
+and
+.Tn MS
+BASIC dialects.
 .It Li >
 Bump the current octave up one.
 .It Li <
@@ -201,9 +206,11 @@ dotted twice, it is held 9/4, and three times would give 27/8.
 A note and its sustain dots may also be followed by a slur mark (underscore).
 This causes the normal micro-rest after the note to be filled in, slurring it
 to the next one.
-(The slur feature is not supported in
+The slur feature is not supported in
 .Tn IBM
-BASIC.)
+and
+.Tn MS
+BASIC dialects.
 .Pp
 Whitespace in play strings is simply skipped and may be used to separate
 melody sections.
@@ -214,16 +221,63 @@ speaker device file
 .El
 .Sh SEE ALSO
 .Xr spkrtest 8
+.Pp
+Additional information about MML:
+.Bl -dash -offset indent
+.It
+.Lk https://electronicmusic.fandom.com/wiki/Music_Macro_Language "The Electronic Music Wiki  - Music Macro Language"
+.It
+.Rs
+.%T "IBM Personal Computer BASIC manual"
+.%I "IBM Corporation"
+.%D "1982"
+.Re
+.It
+.Rs
+.%T "BASICA manual"
+.%I "Microsoft Corporation"
+.%D "1982"
+.Re
+.It
+.Rs
+.%T "GW-BASIC manual"
+.%I "Microsoft Corporation"
+.%D "1987"
+.Re
+.It
+.Rs
+.%T "QBasic manual"
+.%I "Microsoft Corporation"
+.%D "1991"
+.Re
+.It
+.Rs
+.%A "Eleanor Selfridge-Field"
+.%T "Beyond MIDI: the handbook of musical codes"
+.%I "MIT Press"
+.%D "1997"
+.Re
+.El
 .Sh HISTORY
 The
 .Nm
 device appeared in
 .Fx 1.0 .
+.Pp
+Prior to
+.Fx 16 ,
+only one file descriptor could hold the device open.
 .Sh AUTHORS
-.An Eric S. Raymond Aq Mt esr@snark.thyrsus.com ,
+.An -nosplit
+The
+.Nm
+driver was written by
+.An Eric S. Raymond Aq Mt esr@snark.thyrsus.com in
 June 1990
-.Sh PORTED BY
-.An Andrew A. Chernov Aq Mt ache@astral.msk.su
+and ported by
+.An Andrew A. Chernov Aq Mt ache@astral.msk.su .
+Support for concurrent open was added by
+.An Raphael Poss Aq Mt knz@thaumogen.net .
 .Sh BUGS
 Due to roundoff in the pitch tables and slop in the tone-generation and timer
 hardware (neither of which was designed for precision), neither pitch accuracy
diff --git a/share/man/man4/tcp.4 b/share/man/man4/tcp.4
index 3c9f4ff83f3d..4c01daf4e14e 100644
--- a/share/man/man4/tcp.4
+++ b/share/man/man4/tcp.4
@@ -31,7 +31,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd September 5, 2025
+.Dd May 7, 2026
 .Dt TCP 4
 .Os
 .Sh NAME
@@ -1098,6 +1098,7 @@ when trying to use a TCP function block that is not available;
 .Xr stats 3 ,
 .Xr sysctl 3 ,
 .Xr blackhole 4 ,
+.Xr dtrace_mib 4 ,
 .Xr inet 4 ,
 .Xr intro 4 ,
 .Xr ip 4 ,
diff --git a/share/man/man4/udp.4 b/share/man/man4/udp.4
index b1dbff56154f..db9d0e0ae2c7 100644
--- a/share/man/man4/udp.4
+++ b/share/man/man4/udp.4
@@ -25,7 +25,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd January 20, 2025
+.Dd May 7, 2026
 .Dt UDP 4
 .Os
 .Sh NAME
@@ -175,6 +175,7 @@ exists.
 .Xr send 2 ,
 .Xr socket 2 ,
 .Xr blackhole 4 ,
+.Xr dtrace_mib 4 ,
 .Xr inet 4 ,
 .Xr intro 4 ,
 .Xr ip 4 ,
diff --git a/share/man/man7/d.7 b/share/man/man7/d.7
index 59b3389b121b..792f6d36ce73 100644
--- a/share/man/man7/d.7
+++ b/share/man/man7/d.7
@@ -1,9 +1,9 @@
 .\"
 .\" SPDX-License-Identifier: BSD-2-Clause
 .\"
-.\" Copyright (c) 2025 Mateusz Piotrowski <0mp@FreeBSD.org>
+.\" Copyright (c) 2025-2026 Mateusz Piotrowski <0mp@FreeBSD.org>
 .\"
-.Dd October 28, 2025
+.Dd May 7, 2026
 .Dt D 7
 .Os
 .Sh NAME
@@ -39,6 +39,41 @@ This manual page serves as a short reference of the language.
 Refer to books listed in
 .Sx SEE ALSO
 for a complete reference.
+.Sh MACRO VARIABLES
+.Bl -column "$1, $2, $3, ..." "Syntax"
+.It Sy Name Ta Sy Description
+.It  Va  $1 , $2 , $3 , .\&.\&.  Ta  Macro arguments
+.It  Va  $egid                   Ta  Effective group ID Pq Xr getegid 2
+.It  Va  $euid                   Ta  Effective user ID Pq Xr geteuid 2
+.It  Va  $gid                    Ta  Real group ID Pq Xr getgid 2
+.It  Va  $pid                    Ta  Process ID Pq Xr getpid 2
+.It  Va  $pgid                   Ta  Process group ID Pq Xr getpgrp 2
+.It  Va  $ppid                   Ta  Parent process ID Pq Xr getppid 2
+.It  Va  $sid                    Ta  Session ID Pq Xr getsid 2
+.It  Va  $target                 Ta  Target process ID of the process
+specified via the
+.Fl p
+flag or created via the
+.Fl c
+flag.
+.It  Va  $uid                    Ta  Real user ID Pq Xr getuid 2
+.El
+.Pp
+The macro arguments correspond to the command-line operands.
+They expand to an integer, identifier, or string depending on the context.
+Prepending a macro argument with an extra dollar sign
+.Pq Ql $
+forces string expansion.
+.Pp
+For example,
+.Bd -literal -compact -offset indent
+dtrace -n 'syscall::fstatat: /execname == $$1/ {}' -- ls
+.Ed
+uses
+.Va $$1
+instead of
+.Va $1
+to expand to a string instead rather than to a global variable identifier.
 .Sh PROBE'S DESCRIPTION
 A probe's description consists of four elements:
 .Sm off
@@ -411,3 +446,10 @@ variable which typically provides the current working directory is
 not supported on
 .Fx
 at the moment.
+.Pp
+Macro variables
+.Va $projid
+and
+.Va $taskid
+are always 0 on
+.Fx .
diff --git a/share/man/man7/freebsd-base.7 b/share/man/man7/freebsd-base.7
index 51de679ea9d1..b23d1ae44d34 100644
--- a/share/man/man7/freebsd-base.7
+++ b/share/man/man7/freebsd-base.7
@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
-.Dd April 14, 2026
+.Dd April 23, 2026
 .Dt FREEBSD-BASE 7
 .Os
 .Sh NAME
@@ -50,7 +50,7 @@ and
 .Dq CURRENT
 .\" re@ will provide their own repository before release, at which
 .\" point this text will need updating.
-branches are hosted on the Internet at 
+branches are hosted on the Internet at
 .Lk https://pkg.freebsd.org .
 These packages are updated when new errata or security updates are
 released (for supported release versions), or twice daily for
@@ -92,7 +92,8 @@ option was enabled when building the system, which is not the default.
 .El
 .Pp
 The exact set of available subpackages differs for each individual
-package.  For example, some packages may not provide any development
+package.
+For example, some packages may not provide any development
 files, in which case the
 .Sy -dev
 subpackage is not present.
@@ -217,6 +218,27 @@ for a different target than the host system):
 pkg -r /ppcdev -oABI=FreeBSD:16:powerpc64le \e
     install FreeBSD-set-devel
 .Ed
+.Ss Adding a locally built repository for snapshots
+Disable the predefined repository,
+and add a local repo for locally built base system packages:
+.Bd -literal -offset indent
+cat << EOF > /usr/local/etc/pkg/repos/FreeBSD.conf
+FreeBSD-base: { enabled: no }
+FreeBSD-local: {
+	url: "file:///usr/obj/usr/src/repo/${ABI}/latest",
+	enabled: yes
+}
+EOF
+.Ed
+.Pp
+The packages are created by the
+.Xr build 7
+system at
+.Pa ${REPODIR}/${PKG_ABI}/<VERSION> ,
+which defaults to the example directory.
+.Pp
+.Sy Note :
+The repo must have a different name than the predefined repository.
 .Ss Unregister a currently running system
 Systems managed through
 .Xr pkg 8
diff --git a/share/man/man7/stats.7 b/share/man/man7/stats.7
index 0b57d525522c..f81c2fef0155 100644
--- a/share/man/man7/stats.7
+++ b/share/man/man7/stats.7
@@ -24,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd October 28, 2025
+.Dd May 7, 2026
 .Dt STATS 7
 .Os
 .Sh NAME
@@ -44,6 +44,8 @@ are currently included in the base system, with more appearing periodically.
 Show Bluetooth socket information
 .It Nm ctlstat
 CAM Target Layer statistics utility
+.It Nm dtrace_mib
+Access the MIB stats counters with DTrace
 .It Nm dwatch
 Watch processes as they trigger a particular DTrace probe
 .It Nm fstat
@@ -99,6 +101,7 @@ Report ZFS I/O statistics
 .Xr sockstat 1 ,
 .Xr stat 1 ,
 .Xr systat 1 ,
+.Xr dtrace_mib 4 ,
 .Xr intro 7 ,
 .Xr tuning 7 ,
 .Xr ctlstat 8 ,
diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile
index 29c822c10eb2..fbb981891ce4 100644
--- a/share/man/man9/Makefile
+++ b/share/man/man9/Makefile
@@ -2333,6 +2333,7 @@ MLINKS+=uidinfo.9 uifind.9 \
 	uidinfo.9 uihold.9
 MLINKS+=uio.9 uiomove.9 \
 	uio.9 uiomove_frombuf.9 \
+	uio.9 uiomove_fromphys.9 \
 	uio.9 uiomove_nofault.9
 MLINKS+=unr.9 alloc_unr.9 \
 	unr.9 alloc_unrl.9 \
diff --git a/share/man/man9/cdefs.9 b/share/man/man9/cdefs.9
index cc56e34d070a..2bda50c3f875 100644
--- a/share/man/man9/cdefs.9
+++ b/share/man/man9/cdefs.9
@@ -3,7 +3,7 @@
 .\"
 .\" SPDX-License-Identifier: BSD-2-Clause
 .\"
-.Dd May 9, 2025
+.Dd May 6, 2026
 .Dt CDEFS 9
 .Os
 .Sh NAME
@@ -85,7 +85,9 @@ linkage.
 .It Sy __weak_symbol Ta Declare the symbol to be a weak symbol
 .It Sy __dead2 Ta Function will not return
 .It Sy __pure2 Ta Function has no side effects
-.It Sy __unused Ta To Variable may be unused (usually arguments), so do not
+.It Sy __unused Ta Variable may be unused (usually arguments), so do not
+warn about it
+.It Sy __maybe_unused Ta Variable may be unused (usually arguments), so do not
 warn about it
 .It Sy __used Ta Function really is used, so emit it even if it appears unused.
 .It Sy __deprecated Ta Function interface has been deprecated, and clients
diff --git a/share/man/man9/uio.9 b/share/man/man9/uio.9
index b143eb6e8e62..a7563125a351 100644
--- a/share/man/man9/uio.9
+++ b/share/man/man9/uio.9
@@ -23,13 +23,14 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd October 22, 2025
+.Dd May 7, 2026
 .Dt UIO 9
 .Os
 .Sh NAME
 .Nm uio ,
 .Nm uiomove ,
 .Nm uiomove_frombuf ,
+.Nm uiomove_fromphys ,
 .Nm uiomove_nofault
 .Nd device driver I/O routines
 .Sh SYNOPSIS
@@ -37,25 +38,29 @@
 .In sys/uio.h
 .Bd -literal
 struct uio {
-	struct	iovec *uio_iov;		/* scatter/gather list */
-	int	uio_iovcnt;		/* length of scatter/gather list */
-	off_t	uio_offset;		/* offset in target object */
-	ssize_t	uio_resid;		/* remaining bytes to copy */
-	enum	uio_seg uio_segflg;	/* address space */
-	enum	uio_rw uio_rw;		/* operation */
-	struct	thread *uio_td;		/* owner */
+	struct iovec	*uio_iov;	/* scatter/gather list */
+	int		 uio_iovcnt;	/* length of scatter/gather list */
+	off_t		 uio_offset;	/* offset in target object */
+	ssize_t		 uio_resid;	/* remaining bytes to process */
+	enum uio_seg	 uio_segflg;	/* address space */
+	enum uio_rw	 uio_rw;	/* operation */
+	struct thread	*uio_td;	/* owner */
 };
 .Ed
+.Pp
 .Ft int
 .Fn uiomove "void *buf" "int howmuch" "struct uio *uiop"
 .Ft int
 .Fn uiomove_frombuf "void *buf" "int howmuch" "struct uio *uiop"
 .Ft int
+.Fn uiomove_fromphys "vm_page_t ma[]" "vm_offset_t offset" "int howmuch" "struct uio *uiop"
+.Ft int
 .Fn uiomove_nofault "void *buf" "int howmuch" "struct uio *uiop"
 .Sh DESCRIPTION
 The functions
 .Fn uiomove ,
 .Fn uiomove_frombuf ,
+.Fn uiomove_fromphys ,
 and
 .Fn uiomove_nofault
 are used to transfer data between buffers and I/O vectors that might
@@ -152,10 +157,27 @@ When
 .Va uio_offset
 is greater than or equal to the buffer size, the result is success
 with no bytes transferred, effectively signaling EOF.
+.Pp
+The
+.Fn uiomove_fromphys
+function provides a machine-independent way to copy memory
+to and from the physical address space.
+The
+.Fa "ma[]"
+argument is an array of physical pages.
+Every physical page address in the array provides
+a page-sized chunk of the physical space.
+The
+.Fa "offset"
+argument is the offset into the
+.Fa "ma[]"
+array.
+In particular, the offset does not have to lie within the first page.
 .Sh RETURN VALUES
 On success
 .Fn uiomove ,
 .Fn uiomove_frombuf ,
+.Fn uiomove_fromphys ,
 and
 .Fn uiomove_nofault
 will return 0; on error they will return an appropriate error code.
@@ -168,7 +190,7 @@ will not work (the buffer pointer is not being advanced in case of a
 partial read), it is just here to demonstrate the
 .Nm
 handling.
-.Bd -literal
+.Bd -literal -offset 2n
 /* MIN() can be found there: */
 #include <sys/param.h>
 
@@ -200,7 +222,8 @@ fooread(struct cdev *dev, struct uio *uio, int flag)
 }
 .Ed
 .Sh ERRORS
-.Fn uiomove
+.Fn uiomove ,
+.Fn uiomove_fromphys
 and
 .Fn uiomove_nofault
 will fail and return the following error code if:
@@ -211,7 +234,7 @@ The invoked
 or
 .Xr copyout 9
 returned
-.Er EFAULT
+.Er EFAULT .
 .El
 .Pp
 In addition,