diff --git a/lib/libcrypto/Symbols.namespace b/lib/libcrypto/Symbols.namespace
index 0abd5ef54..32c172990 100644
--- a/lib/libcrypto/Symbols.namespace
+++ b/lib/libcrypto/Symbols.namespace
@@ -3217,3 +3217,124 @@ _libre_EC_POINT_get_Jprojective_coordinates_GFp
 _libre_EC_POINT_set_affine_coordinates_GFp
 _libre_EC_POINT_get_affine_coordinates_GFp
 _libre_EC_POINT_set_compressed_coordinates_GFp
+_libre_BASIC_CONSTRAINTS_it
+_libre_AUTHORITY_KEYID_it
+_libre_PKEY_USAGE_PERIOD_it
+_libre_GENERAL_NAME_it
+_libre_GENERAL_NAMES_it
+_libre_OTHERNAME_it
+_libre_EDIPARTYNAME_it
+_libre_EXTENDED_KEY_USAGE_it
+_libre_CERTIFICATEPOLICIES_it
+_libre_POLICYINFO_it
+_libre_POLICYQUALINFO_it
+_libre_USERNOTICE_it
+_libre_NOTICEREF_it
+_libre_CRL_DIST_POINTS_it
+_libre_DIST_POINT_it
+_libre_DIST_POINT_NAME_it
+_libre_DIST_POINT_it
+_libre_ISSUING_DIST_POINT_it
+_libre_ACCESS_DESCRIPTION_it
+_libre_AUTHORITY_INFO_ACCESS_it
+_libre_POLICY_MAPPING_it
+_libre_POLICY_MAPPINGS_it
+_libre_GENERAL_SUBTREE_it
+_libre_NAME_CONSTRAINTS_it
+_libre_POLICY_CONSTRAINTS_it
+_libre_ASRange_it
+_libre_ASIdOrRange_it
+_libre_ASIdentifierChoice_it
+_libre_ASIdentifiers_it
+_libre_IPAddressRange_it
+_libre_IPAddressOrRange_it
+_libre_IPAddressChoice_it
+_libre_IPAddressFamily_it
+_libre_X509_ALGOR_it
+_libre_X509_ALGORS_it
+_libre_X509_VAL_it
+_libre_X509_PUBKEY_it
+_libre_X509_SIG_it
+_libre_X509_REQ_INFO_it
+_libre_X509_REQ_it
+_libre_X509_ATTRIBUTE_it
+_libre_X509_EXTENSION_it
+_libre_X509_EXTENSIONS_it
+_libre_X509_NAME_ENTRY_it
+_libre_X509_NAME_it
+_libre_X509_CINF_it
+_libre_X509_it
+_libre_X509_REVOKED_it
+_libre_X509_CRL_INFO_it
+_libre_X509_CRL_it
+_libre_NETSCAPE_SPKI_it
+_libre_NETSCAPE_SPKAC_it
+_libre_PBEPARAM_it
+_libre_PKCS8_PRIV_KEY_INFO_it
+_libre_ASN1_SEQUENCE_ANY_it
+_libre_ASN1_SET_ANY_it
+_libre_ASN1_ANY_it
+_libre_ASN1_OBJECT_it
+_libre_ASN1_BIT_STRING_it
+_libre_ASN1_INTEGER_it
+_libre_ASN1_ENUMERATED_it
+_libre_ASN1_OCTET_STRING_it
+_libre_ASN1_VISIBLESTRING_it
+_libre_ASN1_UNIVERSALSTRING_it
+_libre_ASN1_UTF8STRING_it
+_libre_ASN1_NULL_it
+_libre_ASN1_BMPSTRING_it
+_libre_ASN1_PRINTABLE_it
+_libre_DIRECTORYSTRING_it
+_libre_DISPLAYTEXT_it
+_libre_ASN1_PRINTABLESTRING_it
+_libre_ASN1_T61STRING_it
+_libre_ASN1_IA5STRING_it
+_libre_ASN1_GENERALSTRING_it
+_libre_ASN1_UTCTIME_it
+_libre_ASN1_GENERALIZEDTIME_it
+_libre_ASN1_TIME_it
+_libre_OCSP_RESPID_it
+_libre_OCSP_SINGLERESP_it
+_libre_OCSP_CERTSTATUS_it
+_libre_OCSP_REVOKEDINFO_it
+_libre_OCSP_BASICRESP_it
+_libre_OCSP_RESPDATA_it
+_libre_OCSP_RESPID_it
+_libre_OCSP_RESPONSE_it
+_libre_OCSP_RESPBYTES_it
+_libre_OCSP_ONEREQ_it
+_libre_OCSP_CERTID_it
+_libre_OCSP_REQUEST_it
+_libre_OCSP_SIGNATURE_it
+_libre_OCSP_REQINFO_it
+_libre_OCSP_CRLID_it
+_libre_OCSP_SERVICELOC_it
+_libre_PKCS7_ISSUER_AND_SERIAL_it
+_libre_PKCS7_SIGNER_INFO_it
+_libre_PKCS7_RECIP_INFO_it
+_libre_PKCS7_SIGNED_it
+_libre_PKCS7_ENC_CONTENT_it
+_libre_PKCS7_ENVELOPE_it
+_libre_PKCS7_SIGN_ENVELOPE_it
+_libre_PKCS7_DIGEST_it
+_libre_PKCS7_ENCRYPT_it
+_libre_PKCS7_it
+_libre_PKCS7_ATTR_SIGN_it
+_libre_PKCS7_ATTR_VERIFY_it
+_libre_ASN1_SEQUENCE_it
+_libre_CBIGNUM_it
+_libre_BIGNUM_it
+_libre_LONG_it
+_libre_ZLONG_it
+_libre_RSAPublicKey_it
+_libre_RSAPrivateKey_it
+_libre_RSA_PSS_PARAMS_it
+_libre_RSA_OAEP_PARAMS_it
+_libre_DSAPublicKey_it
+_libre_DSAPrivateKey_it
+_libre_DSAparams_it
+_libre_RSAPublicKey_it
+_libre_RSAPrivateKey_it
+_libre_RSA_PSS_PARAMS_it
+_libre_RSA_OAEP_PARAMS_it
diff --git a/lib/libcrypto/asn1/a_bitstr.c b/lib/libcrypto/asn1/a_bitstr.c
index 851a3a3d5..d5d00c4d4 100644
--- a/lib/libcrypto/asn1/a_bitstr.c
+++ b/lib/libcrypto/asn1/a_bitstr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_bitstr.c,v 1.42 2023/12/25 22:02:59 tb Exp $ */
+/* $OpenBSD: a_bitstr.c,v 1.43 2024/07/08 14:52:31 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -73,6 +73,7 @@ const ASN1_ITEM ASN1_BIT_STRING_it = {
 	.utype = V_ASN1_BIT_STRING,
 	.sname = "ASN1_BIT_STRING",
 };
+LCRYPTO_ALIAS(ASN1_BIT_STRING_it);
 
 ASN1_BIT_STRING *
 ASN1_BIT_STRING_new(void)
diff --git a/lib/libcrypto/asn1/a_enum.c b/lib/libcrypto/asn1/a_enum.c
index 483fe1c27..5d3a3dd0c 100644
--- a/lib/libcrypto/asn1/a_enum.c
+++ b/lib/libcrypto/asn1/a_enum.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_enum.c,v 1.29 2023/07/05 21:23:36 beck Exp $ */
+/* $OpenBSD: a_enum.c,v 1.30 2024/07/08 14:52:31 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -78,6 +78,7 @@ const ASN1_ITEM ASN1_ENUMERATED_it = {
 	.utype = V_ASN1_ENUMERATED,
 	.sname = "ASN1_ENUMERATED",
 };
+LCRYPTO_ALIAS(ASN1_ENUMERATED_it);
 
 ASN1_ENUMERATED *
 ASN1_ENUMERATED_new(void)
diff --git a/lib/libcrypto/asn1/a_int.c b/lib/libcrypto/asn1/a_int.c
index 643ad2e0f..0d9b6577d 100644
--- a/lib/libcrypto/asn1/a_int.c
+++ b/lib/libcrypto/asn1/a_int.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_int.c,v 1.47 2023/07/05 21:23:36 beck Exp $ */
+/* $OpenBSD: a_int.c,v 1.48 2024/07/08 14:52:31 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -73,6 +73,7 @@ const ASN1_ITEM ASN1_INTEGER_it = {
 	.utype = V_ASN1_INTEGER,
 	.sname = "ASN1_INTEGER",
 };
+LCRYPTO_ALIAS(ASN1_INTEGER_it);
 
 ASN1_INTEGER *
 ASN1_INTEGER_new(void)
diff --git a/lib/libcrypto/asn1/a_object.c b/lib/libcrypto/asn1/a_object.c
index ed9e9287c..2f3ca1398 100644
--- a/lib/libcrypto/asn1/a_object.c
+++ b/lib/libcrypto/asn1/a_object.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_object.c,v 1.54 2024/05/29 16:14:38 tb Exp $ */
+/* $OpenBSD: a_object.c,v 1.55 2024/07/08 14:52:31 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -73,6 +73,7 @@ const ASN1_ITEM ASN1_OBJECT_it = {
 	.utype = V_ASN1_OBJECT,
 	.sname = "ASN1_OBJECT",
 };
+LCRYPTO_ALIAS(ASN1_OBJECT_it);
 
 ASN1_OBJECT *
 ASN1_OBJECT_new(void)
diff --git a/lib/libcrypto/asn1/a_octet.c b/lib/libcrypto/asn1/a_octet.c
index 47eae5a4a..e82de62c5 100644
--- a/lib/libcrypto/asn1/a_octet.c
+++ b/lib/libcrypto/asn1/a_octet.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_octet.c,v 1.12 2023/07/05 21:23:36 beck Exp $ */
+/* $OpenBSD: a_octet.c,v 1.13 2024/07/08 14:52:31 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -66,6 +66,7 @@ const ASN1_ITEM ASN1_OCTET_STRING_it = {
 	.utype = V_ASN1_OCTET_STRING,
 	.sname = "ASN1_OCTET_STRING",
 };
+LCRYPTO_ALIAS(ASN1_OCTET_STRING_it);
 
 ASN1_OCTET_STRING *
 ASN1_OCTET_STRING_new(void)
diff --git a/lib/libcrypto/asn1/a_time.c b/lib/libcrypto/asn1/a_time.c
index f4ddb4d5d..15ac1af5c 100644
--- a/lib/libcrypto/asn1/a_time.c
+++ b/lib/libcrypto/asn1/a_time.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_time.c,v 1.37 2023/07/05 21:23:36 beck Exp $ */
+/* $OpenBSD: a_time.c,v 1.38 2024/07/08 14:52:31 beck Exp $ */
 /* ====================================================================
  * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
  *
@@ -78,6 +78,7 @@ const ASN1_ITEM ASN1_TIME_it = {
 	.size = sizeof(ASN1_STRING),
 	.sname = "ASN1_TIME",
 };
+LCRYPTO_ALIAS(ASN1_TIME_it);
 
 ASN1_TIME *
 ASN1_TIME_new(void)
diff --git a/lib/libcrypto/asn1/asn1t.h b/lib/libcrypto/asn1/asn1t.h
index 4d79f82ec..22cde4866 100644
--- a/lib/libcrypto/asn1/asn1t.h
+++ b/lib/libcrypto/asn1/asn1t.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1t.h,v 1.23 2023/07/28 10:00:10 tb Exp $ */
+/* $OpenBSD: asn1t.h,v 1.24 2024/07/08 16:24:22 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -885,10 +885,7 @@ extern const ASN1_ITEM ASN1_SEQUENCE_it;
 extern const ASN1_ITEM BIGNUM_it;
 extern const ASN1_ITEM LONG_it;
 extern const ASN1_ITEM ZLONG_it;
-
-#ifndef LIBRESSL_INTERNAL
 extern const ASN1_ITEM CBIGNUM_it;
-#endif
 
 DECLARE_STACK_OF(ASN1_VALUE)
 
diff --git a/lib/libcrypto/asn1/p5_pbe.c b/lib/libcrypto/asn1/p5_pbe.c
index 94daf3bed..582d2d9a9 100644
--- a/lib/libcrypto/asn1/p5_pbe.c
+++ b/lib/libcrypto/asn1/p5_pbe.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p5_pbe.c,v 1.27 2024/03/28 00:44:26 tb Exp $ */
+/* $OpenBSD: p5_pbe.c,v 1.28 2024/07/08 14:48:49 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -89,6 +89,7 @@ const ASN1_ITEM PBEPARAM_it = {
 	.size = sizeof(PBEPARAM),
 	.sname = "PBEPARAM",
 };
+LCRYPTO_ALIAS(PBEPARAM_it);
 
 
 PBEPARAM *
diff --git a/lib/libcrypto/asn1/p8_pkey.c b/lib/libcrypto/asn1/p8_pkey.c
index 149591414..bdb0c39ad 100644
--- a/lib/libcrypto/asn1/p8_pkey.c
+++ b/lib/libcrypto/asn1/p8_pkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: p8_pkey.c,v 1.24 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: p8_pkey.c,v 1.25 2024/07/08 14:48:49 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -113,6 +113,7 @@ const ASN1_ITEM PKCS8_PRIV_KEY_INFO_it = {
 	.size = sizeof(PKCS8_PRIV_KEY_INFO),
 	.sname = "PKCS8_PRIV_KEY_INFO",
 };
+LCRYPTO_ALIAS(PKCS8_PRIV_KEY_INFO_it);
 
 
 PKCS8_PRIV_KEY_INFO *
diff --git a/lib/libcrypto/asn1/tasn_typ.c b/lib/libcrypto/asn1/tasn_typ.c
index 21e388585..0f7fcb0e0 100644
--- a/lib/libcrypto/asn1/tasn_typ.c
+++ b/lib/libcrypto/asn1/tasn_typ.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tasn_typ.c,v 1.18 2023/07/05 21:23:37 beck Exp $ */
+/* $OpenBSD: tasn_typ.c,v 1.20 2024/07/08 16:24:22 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -66,6 +66,7 @@ const ASN1_ITEM ASN1_NULL_it = {
 	.utype = V_ASN1_NULL,
 	.sname = "ASN1_NULL",
 };
+LCRYPTO_ALIAS(ASN1_NULL_it);
 
 ASN1_NULL *
 d2i_ASN1_NULL(ASN1_NULL **a, const unsigned char **in, long len)
@@ -102,6 +103,7 @@ const ASN1_ITEM ASN1_UTF8STRING_it = {
 	.utype = V_ASN1_UTF8STRING,
 	.sname = "ASN1_UTF8STRING",
 };
+LCRYPTO_ALIAS(ASN1_UTF8STRING_it);
 
 ASN1_UTF8STRING *
 d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a, const unsigned char **in, long len)
@@ -138,6 +140,7 @@ const ASN1_ITEM ASN1_PRINTABLESTRING_it = {
 	.utype = V_ASN1_PRINTABLESTRING,
 	.sname = "ASN1_PRINTABLESTRING",
 };
+LCRYPTO_ALIAS(ASN1_PRINTABLESTRING_it);
 
 ASN1_PRINTABLESTRING *
 d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a, const unsigned char **in,
@@ -175,6 +178,7 @@ const ASN1_ITEM ASN1_T61STRING_it = {
 	.utype = V_ASN1_T61STRING,
 	.sname = "ASN1_T61STRING",
 };
+LCRYPTO_ALIAS(ASN1_T61STRING_it);
 
 ASN1_T61STRING *
 d2i_ASN1_T61STRING(ASN1_T61STRING **a, const unsigned char **in, long len)
@@ -211,6 +215,7 @@ const ASN1_ITEM ASN1_IA5STRING_it = {
 	.utype = V_ASN1_IA5STRING,
 	.sname = "ASN1_IA5STRING",
 };
+LCRYPTO_ALIAS(ASN1_IA5STRING_it);
 
 ASN1_IA5STRING *
 d2i_ASN1_IA5STRING(ASN1_IA5STRING **a, const unsigned char **in, long len)
@@ -247,6 +252,7 @@ const ASN1_ITEM ASN1_GENERALSTRING_it = {
 	.utype = V_ASN1_GENERALSTRING,
 	.sname = "ASN1_GENERALSTRING",
 };
+LCRYPTO_ALIAS(ASN1_GENERALSTRING_it);
 
 ASN1_GENERALSTRING *
 d2i_ASN1_GENERALSTRING(ASN1_GENERALSTRING **a, const unsigned char **in,
@@ -284,6 +290,7 @@ const ASN1_ITEM ASN1_UTCTIME_it = {
 	.utype = V_ASN1_UTCTIME,
 	.sname = "ASN1_UTCTIME",
 };
+LCRYPTO_ALIAS(ASN1_UTCTIME_it);
 
 ASN1_UTCTIME *
 d2i_ASN1_UTCTIME(ASN1_UTCTIME **a, const unsigned char **in, long len)
@@ -320,6 +327,7 @@ const ASN1_ITEM ASN1_GENERALIZEDTIME_it = {
 	.utype = V_ASN1_GENERALIZEDTIME,
 	.sname = "ASN1_GENERALIZEDTIME",
 };
+LCRYPTO_ALIAS(ASN1_GENERALIZEDTIME_it);
 
 ASN1_GENERALIZEDTIME *
 d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a, const unsigned char **in,
@@ -357,6 +365,7 @@ const ASN1_ITEM ASN1_VISIBLESTRING_it = {
 	.utype = V_ASN1_VISIBLESTRING,
 	.sname = "ASN1_VISIBLESTRING",
 };
+LCRYPTO_ALIAS(ASN1_VISIBLESTRING_it);
 
 ASN1_VISIBLESTRING *
 d2i_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING **a, const unsigned char **in,
@@ -394,6 +403,7 @@ const ASN1_ITEM ASN1_UNIVERSALSTRING_it = {
 	.utype = V_ASN1_UNIVERSALSTRING,
 	.sname = "ASN1_UNIVERSALSTRING",
 };
+LCRYPTO_ALIAS(ASN1_UNIVERSALSTRING_it);
 
 ASN1_UNIVERSALSTRING *
 d2i_ASN1_UNIVERSALSTRING(ASN1_UNIVERSALSTRING **a, const unsigned char **in,
@@ -431,6 +441,7 @@ const ASN1_ITEM ASN1_BMPSTRING_it = {
 	.utype = V_ASN1_BMPSTRING,
 	.sname = "ASN1_BMPSTRING",
 };
+LCRYPTO_ALIAS(ASN1_BMPSTRING_it);
 
 ASN1_BMPSTRING *
 d2i_ASN1_BMPSTRING(ASN1_BMPSTRING **a, const unsigned char **in, long len)
@@ -466,6 +477,7 @@ const ASN1_ITEM ASN1_ANY_it = {
 	.utype = V_ASN1_ANY,
 	.sname = "ASN1_ANY",
 };
+LCRYPTO_ALIAS(ASN1_ANY_it);
 
 
 /* Just swallow an ASN1_SEQUENCE in an ASN1_STRING */
@@ -475,6 +487,7 @@ const ASN1_ITEM ASN1_SEQUENCE_it = {
 	.utype = V_ASN1_SEQUENCE,
 	.sname = "ASN1_SEQUENCE",
 };
+LCRYPTO_ALIAS(ASN1_SEQUENCE_it);
 
 
 /* Multistring types */
@@ -489,6 +502,7 @@ const ASN1_ITEM ASN1_PRINTABLE_it = {
 	.size = sizeof(ASN1_STRING),
 	.sname = "ASN1_PRINTABLE",
 };
+LCRYPTO_ALIAS(ASN1_PRINTABLE_it);
 
 ASN1_STRING *
 d2i_ASN1_PRINTABLE(ASN1_STRING **a, const unsigned char **in, long len)
@@ -529,6 +543,7 @@ const ASN1_ITEM DISPLAYTEXT_it = {
 	.size = sizeof(ASN1_STRING),
 	.sname = "DISPLAYTEXT",
 };
+LCRYPTO_ALIAS(DISPLAYTEXT_it);
 
 ASN1_STRING *
 d2i_DISPLAYTEXT(ASN1_STRING **a, const unsigned char **in, long len)
@@ -569,6 +584,7 @@ const ASN1_ITEM DIRECTORYSTRING_it = {
 	.size = sizeof(ASN1_STRING),
 	.sname = "DIRECTORYSTRING",
 };
+LCRYPTO_ALIAS(DIRECTORYSTRING_it);
 
 ASN1_STRING *
 d2i_DIRECTORYSTRING(ASN1_STRING **a, const unsigned char **in, long len)
@@ -670,6 +686,7 @@ const ASN1_ITEM ASN1_SEQUENCE_ANY_it = {
 	.size = 0,
 	.sname = "ASN1_SEQUENCE_ANY",
 };
+LCRYPTO_ALIAS(ASN1_SEQUENCE_ANY_it);
 
 static const ASN1_TEMPLATE ASN1_SET_ANY_item_tt = {
 	.flags = ASN1_TFLG_SET_OF,
@@ -688,6 +705,7 @@ const ASN1_ITEM ASN1_SET_ANY_it = {
 	.size = 0,
 	.sname = "ASN1_SET_ANY",
 };
+LCRYPTO_ALIAS(ASN1_SET_ANY_it);
 
 
 ASN1_SEQUENCE_ANY *
diff --git a/lib/libcrypto/asn1/x_algor.c b/lib/libcrypto/asn1/x_algor.c
index 71430e1fd..b01ee982a 100644
--- a/lib/libcrypto/asn1/x_algor.c
+++ b/lib/libcrypto/asn1/x_algor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_algor.c,v 1.40 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_algor.c,v 1.41 2024/07/08 14:48:49 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -86,6 +86,7 @@ const ASN1_ITEM X509_ALGOR_it = {
 	.size = sizeof(X509_ALGOR),
 	.sname = "X509_ALGOR",
 };
+LCRYPTO_ALIAS(X509_ALGOR_it);
 
 static const ASN1_TEMPLATE X509_ALGORS_item_tt = {
 	.flags = ASN1_TFLG_SEQUENCE_OF,
@@ -104,6 +105,7 @@ const ASN1_ITEM X509_ALGORS_it = {
 	.size = 0,
 	.sname = "X509_ALGORS",
 };
+LCRYPTO_ALIAS(X509_ALGORS_it);
 
 X509_ALGOR *
 d2i_X509_ALGOR(X509_ALGOR **a, const unsigned char **in, long len)
diff --git a/lib/libcrypto/asn1/x_attrib.c b/lib/libcrypto/asn1/x_attrib.c
index 3e3ed3819..8e4f94094 100644
--- a/lib/libcrypto/asn1/x_attrib.c
+++ b/lib/libcrypto/asn1/x_attrib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_attrib.c,v 1.22 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_attrib.c,v 1.23 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -90,6 +90,7 @@ const ASN1_ITEM X509_ATTRIBUTE_it = {
 	.size = sizeof(X509_ATTRIBUTE),
 	.sname = "X509_ATTRIBUTE",
 };
+LCRYPTO_ALIAS(X509_ATTRIBUTE_it);
 
 
 X509_ATTRIBUTE *
diff --git a/lib/libcrypto/asn1/x_bignum.c b/lib/libcrypto/asn1/x_bignum.c
index 35b30da5b..3e265b9cb 100644
--- a/lib/libcrypto/asn1/x_bignum.c
+++ b/lib/libcrypto/asn1/x_bignum.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_bignum.c,v 1.14 2024/05/17 02:47:21 tb Exp $ */
+/* $OpenBSD: x_bignum.c,v 1.15 2024/07/08 16:24:22 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -99,6 +99,7 @@ const ASN1_ITEM BIGNUM_it = {
         .size = 0,
         .sname = "BIGNUM",
 };
+LCRYPTO_ALIAS(BIGNUM_it);
 
 const ASN1_ITEM CBIGNUM_it = {
         .itype = ASN1_ITYPE_PRIMITIVE,
@@ -109,6 +110,7 @@ const ASN1_ITEM CBIGNUM_it = {
         .size = 0,
         .sname = "BIGNUM",
 };
+LCRYPTO_ALIAS(CBIGNUM_it);
 
 static int
 bn_new(ASN1_VALUE **pval, const ASN1_ITEM *it)
diff --git a/lib/libcrypto/asn1/x_crl.c b/lib/libcrypto/asn1/x_crl.c
index 0e6047db0..4b19d756d 100644
--- a/lib/libcrypto/asn1/x_crl.c
+++ b/lib/libcrypto/asn1/x_crl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_crl.c,v 1.44 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_crl.c,v 1.45 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -99,6 +99,7 @@ const ASN1_ITEM X509_REVOKED_it = {
 	.size = sizeof(X509_REVOKED),
 	.sname = "X509_REVOKED",
 };
+LCRYPTO_ALIAS(X509_REVOKED_it);
 
 /* The X509_CRL_INFO structure needs a bit of customisation.
  * Since we cache the original encoding the signature wont be affected by
@@ -179,6 +180,7 @@ const ASN1_ITEM X509_CRL_INFO_it = {
 	.size = sizeof(X509_CRL_INFO),
 	.sname = "X509_CRL_INFO",
 };
+LCRYPTO_ALIAS(X509_CRL_INFO_it);
 
 /* Set CRL entry issuer according to CRL certificate issuer extension.
  * Check for unhandled critical CRL entry extensions.
@@ -412,6 +414,7 @@ const ASN1_ITEM X509_CRL_it = {
 	.size = sizeof(X509_CRL),
 	.sname = "X509_CRL",
 };
+LCRYPTO_ALIAS(X509_CRL_it);
 
 
 X509_REVOKED *
diff --git a/lib/libcrypto/asn1/x_exten.c b/lib/libcrypto/asn1/x_exten.c
index 323b53949..21ee48395 100644
--- a/lib/libcrypto/asn1/x_exten.c
+++ b/lib/libcrypto/asn1/x_exten.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_exten.c,v 1.21 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_exten.c,v 1.22 2024/07/08 14:48:49 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -90,6 +90,7 @@ const ASN1_ITEM X509_EXTENSION_it = {
 	.size = sizeof(X509_EXTENSION),
 	.sname = "X509_EXTENSION",
 };
+LCRYPTO_ALIAS(X509_EXTENSION_it);
 
 static const ASN1_TEMPLATE X509_EXTENSIONS_item_tt = {
 	.flags = ASN1_TFLG_SEQUENCE_OF,
@@ -108,6 +109,7 @@ const ASN1_ITEM X509_EXTENSIONS_it = {
 	.size = 0,
 	.sname = "X509_EXTENSIONS",
 };
+LCRYPTO_ALIAS(X509_EXTENSIONS_it);
 
 
 X509_EXTENSION *
diff --git a/lib/libcrypto/asn1/x_long.c b/lib/libcrypto/asn1/x_long.c
index 01a0811e7..5e673f452 100644
--- a/lib/libcrypto/asn1/x_long.c
+++ b/lib/libcrypto/asn1/x_long.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_long.c,v 1.20 2024/05/17 02:49:21 tb Exp $ */
+/* $OpenBSD: x_long.c,v 1.21 2024/07/08 16:24:22 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -101,6 +101,7 @@ const ASN1_ITEM LONG_it = {
 	.size = ASN1_LONG_UNDEF,
 	.sname = "LONG",
 };
+LCRYPTO_ALIAS(LONG_it);
 
 const ASN1_ITEM ZLONG_it = {
 	.itype = ASN1_ITYPE_PRIMITIVE,
@@ -111,6 +112,7 @@ const ASN1_ITEM ZLONG_it = {
 	.size = 0,
 	.sname = "ZLONG",
 };
+LCRYPTO_ALIAS(ZLONG_it);
 
 static void
 long_get(ASN1_VALUE **pval, long *out_val)
diff --git a/lib/libcrypto/asn1/x_name.c b/lib/libcrypto/asn1/x_name.c
index f7d28e86b..7bacd8334 100644
--- a/lib/libcrypto/asn1/x_name.c
+++ b/lib/libcrypto/asn1/x_name.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_name.c,v 1.43 2024/04/15 15:52:01 tb Exp $ */
+/* $OpenBSD: x_name.c,v 1.44 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -109,6 +109,7 @@ const ASN1_ITEM X509_NAME_ENTRY_it = {
 	.size = sizeof(X509_NAME_ENTRY),
 	.sname = "X509_NAME_ENTRY",
 };
+LCRYPTO_ALIAS(X509_NAME_ENTRY_it);
 
 
 X509_NAME_ENTRY *
@@ -212,6 +213,7 @@ const ASN1_ITEM X509_NAME_it = {
 	.size = 0,
 	.sname = "X509_NAME",
 };
+LCRYPTO_ALIAS(X509_NAME_it);
 
 X509_NAME *
 d2i_X509_NAME(X509_NAME **a, const unsigned char **in, long len)
diff --git a/lib/libcrypto/asn1/x_pubkey.c b/lib/libcrypto/asn1/x_pubkey.c
index 783e2630d..1e772a345 100644
--- a/lib/libcrypto/asn1/x_pubkey.c
+++ b/lib/libcrypto/asn1/x_pubkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_pubkey.c,v 1.36 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_pubkey.c,v 1.37 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -111,6 +111,7 @@ const ASN1_ITEM X509_PUBKEY_it = {
 	.size = sizeof(X509_PUBKEY),
 	.sname = "X509_PUBKEY",
 };
+LCRYPTO_ALIAS(X509_PUBKEY_it);
 
 X509_PUBKEY *
 d2i_X509_PUBKEY(X509_PUBKEY **a, const unsigned char **in, long len)
diff --git a/lib/libcrypto/asn1/x_req.c b/lib/libcrypto/asn1/x_req.c
index 7dd2dd7c3..50b55ecf5 100644
--- a/lib/libcrypto/asn1/x_req.c
+++ b/lib/libcrypto/asn1/x_req.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_req.c,v 1.22 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_req.c,v 1.23 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -135,6 +135,7 @@ const ASN1_ITEM X509_REQ_INFO_it = {
 	.size = sizeof(X509_REQ_INFO),
 	.sname = "X509_REQ_INFO",
 };
+LCRYPTO_ALIAS(X509_REQ_INFO_it);
 
 
 X509_REQ_INFO *
@@ -199,6 +200,7 @@ const ASN1_ITEM X509_REQ_it = {
 	.size = sizeof(X509_REQ),
 	.sname = "X509_REQ",
 };
+LCRYPTO_ALIAS(X509_REQ_it);
 
 
 X509_REQ *
diff --git a/lib/libcrypto/asn1/x_sig.c b/lib/libcrypto/asn1/x_sig.c
index 5148b5a22..be28e9722 100644
--- a/lib/libcrypto/asn1/x_sig.c
+++ b/lib/libcrypto/asn1/x_sig.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_sig.c,v 1.17 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_sig.c,v 1.18 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -84,6 +84,7 @@ const ASN1_ITEM X509_SIG_it = {
 	.size = sizeof(X509_SIG),
 	.sname = "X509_SIG",
 };
+LCRYPTO_ALIAS(X509_SIG_it);
 
 
 X509_SIG *
diff --git a/lib/libcrypto/asn1/x_spki.c b/lib/libcrypto/asn1/x_spki.c
index 545799e2a..e711b8061 100644
--- a/lib/libcrypto/asn1/x_spki.c
+++ b/lib/libcrypto/asn1/x_spki.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_spki.c,v 1.14 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_spki.c,v 1.15 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -86,6 +86,7 @@ const ASN1_ITEM NETSCAPE_SPKAC_it = {
 	.size = sizeof(NETSCAPE_SPKAC),
 	.sname = "NETSCAPE_SPKAC",
 };
+LCRYPTO_ALIAS(NETSCAPE_SPKAC_it);
 
 
 NETSCAPE_SPKAC *
@@ -150,6 +151,7 @@ const ASN1_ITEM NETSCAPE_SPKI_it = {
 	.size = sizeof(NETSCAPE_SPKI),
 	.sname = "NETSCAPE_SPKI",
 };
+LCRYPTO_ALIAS(NETSCAPE_SPKI_it);
 
 
 NETSCAPE_SPKI *
diff --git a/lib/libcrypto/asn1/x_val.c b/lib/libcrypto/asn1/x_val.c
index 47e175515..486304e42 100644
--- a/lib/libcrypto/asn1/x_val.c
+++ b/lib/libcrypto/asn1/x_val.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_val.c,v 1.14 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_val.c,v 1.15 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -82,6 +82,7 @@ const ASN1_ITEM X509_VAL_it = {
 	.size = sizeof(X509_VAL),
 	.sname = "X509_VAL",
 };
+LCRYPTO_ALIAS(X509_VAL_it);
 
 
 X509_VAL *
diff --git a/lib/libcrypto/asn1/x_x509.c b/lib/libcrypto/asn1/x_x509.c
index e3499f620..4ea45fe29 100644
--- a/lib/libcrypto/asn1/x_x509.c
+++ b/lib/libcrypto/asn1/x_x509.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x_x509.c,v 1.38 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x_x509.c,v 1.39 2024/07/08 14:48:49 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -141,6 +141,7 @@ const ASN1_ITEM X509_CINF_it = {
 	.size = sizeof(X509_CINF),
 	.sname = "X509_CINF",
 };
+LCRYPTO_ALIAS(X509_CINF_it);
 
 
 X509_CINF *
@@ -256,6 +257,7 @@ const ASN1_ITEM X509_it = {
 	.size = sizeof(X509),
 	.sname = "X509",
 };
+LCRYPTO_ALIAS(X509_it);
 
 
 X509 *
diff --git a/lib/libcrypto/dsa/dsa_asn1.c b/lib/libcrypto/dsa/dsa_asn1.c
index cdd113a0b..de6ec4619 100644
--- a/lib/libcrypto/dsa/dsa_asn1.c
+++ b/lib/libcrypto/dsa/dsa_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa_asn1.c,v 1.32 2024/04/15 15:49:37 tb Exp $ */
+/* $OpenBSD: dsa_asn1.c,v 1.33 2024/07/08 17:11:05 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -239,6 +239,7 @@ const ASN1_ITEM DSAPrivateKey_it = {
 	.size = sizeof(DSA),
 	.sname = "DSA",
 };
+LCRYPTO_ALIAS(DSAPrivateKey_it);
 
 
 DSA *
@@ -297,6 +298,7 @@ const ASN1_ITEM DSAparams_it = {
 	.size = sizeof(DSA),
 	.sname = "DSA",
 };
+LCRYPTO_ALIAS(DSAparams_it);
 
 
 DSA *
@@ -390,6 +392,7 @@ const ASN1_ITEM DSAPublicKey_it = {
 	.size = sizeof(DSA),
 	.sname = "DSA",
 };
+LCRYPTO_ALIAS(DSAPublicKey_it);
 
 DSA *
 d2i_DSAPublicKey(DSA **a, const unsigned char **in, long len)
diff --git a/lib/libcrypto/hidden/openssl/asn1.h b/lib/libcrypto/hidden/openssl/asn1.h
index 91595d1da..3325cf4be 100644
--- a/lib/libcrypto/hidden/openssl/asn1.h
+++ b/lib/libcrypto/hidden/openssl/asn1.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1.h,v 1.13 2024/04/10 14:55:12 beck Exp $ */
+/* $OpenBSD: asn1.h,v 1.15 2024/07/08 17:01:54 beck Exp $ */
 /*
  * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
  *
@@ -233,5 +233,30 @@ LCRYPTO_USED(SMIME_text);
 LCRYPTO_USED(ERR_load_ASN1_strings);
 LCRYPTO_UNUSED(ASN1_UTCTIME_cmp_time_t);
 LCRYPTO_UNUSED(ASN1_dup);
+#if defined(LIBRESSL_NAMESPACE)
+extern LCRYPTO_USED(ASN1_SEQUENCE_ANY_it);
+extern LCRYPTO_USED(ASN1_SET_ANY_it);
+extern LCRYPTO_USED(ASN1_ANY_it);
+extern LCRYPTO_USED(ASN1_OBJECT_it);
+extern LCRYPTO_USED(ASN1_BIT_STRING_it);
+extern LCRYPTO_USED(ASN1_INTEGER_it);
+extern LCRYPTO_USED(ASN1_ENUMERATED_it);
+extern LCRYPTO_USED(ASN1_OCTET_STRING_it);
+extern LCRYPTO_USED(ASN1_VISIBLESTRING_it);
+extern LCRYPTO_USED(ASN1_UNIVERSALSTRING_it);
+extern LCRYPTO_USED(ASN1_UTF8STRING_it);
+extern LCRYPTO_USED(ASN1_NULL_it);
+extern LCRYPTO_USED(ASN1_BMPSTRING_it);
+extern LCRYPTO_USED(ASN1_PRINTABLE_it);
+extern LCRYPTO_USED(DIRECTORYSTRING_it);
+extern LCRYPTO_USED(DISPLAYTEXT_it);
+extern LCRYPTO_USED(ASN1_PRINTABLESTRING_it);
+extern LCRYPTO_USED(ASN1_T61STRING_it);
+extern LCRYPTO_USED(ASN1_IA5STRING_it);
+extern LCRYPTO_USED(ASN1_GENERALSTRING_it);
+extern LCRYPTO_USED(ASN1_UTCTIME_it);
+extern LCRYPTO_USED(ASN1_GENERALIZEDTIME_it);
+extern LCRYPTO_USED(ASN1_TIME_it);
+#endif
 
 #endif /* _LIBCRYPTO_ASN1_H */
diff --git a/lib/libcrypto/hidden/openssl/asn1t.h b/lib/libcrypto/hidden/openssl/asn1t.h
index 666dea564..17bcb4e45 100644
--- a/lib/libcrypto/hidden/openssl/asn1t.h
+++ b/lib/libcrypto/hidden/openssl/asn1t.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1t.h,v 1.3 2023/07/28 10:00:10 tb Exp $ */
+/* $OpenBSD: asn1t.h,v 1.5 2024/07/08 17:01:54 beck Exp $ */
 /*
  * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
  *
@@ -29,5 +29,12 @@ LCRYPTO_USED(ASN1_item_ex_new);
 LCRYPTO_USED(ASN1_item_ex_free);
 LCRYPTO_USED(ASN1_item_ex_d2i);
 LCRYPTO_USED(ASN1_item_ex_i2d);
+#if defined(LIBRESSL_NAMESPACE)
+extern LCRYPTO_USED(ASN1_SEQUENCE_it);
+extern LCRYPTO_USED(BIGNUM_it);
+extern LCRYPTO_USED(LONG_it);
+extern LCRYPTO_USED(ZLONG_it);
+extern LCRYPTO_UNUSED(CBIGNUM_it);
+#endif
 
 #endif /* _LIBCRYPTO_ASN1T_H */
diff --git a/lib/libcrypto/hidden/openssl/dsa.h b/lib/libcrypto/hidden/openssl/dsa.h
index 40597abb6..c00c0af6d 100644
--- a/lib/libcrypto/hidden/openssl/dsa.h
+++ b/lib/libcrypto/hidden/openssl/dsa.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: dsa.h,v 1.2 2024/03/02 09:33:14 tb Exp $ */
+/* $OpenBSD: dsa.h,v 1.3 2024/07/08 17:11:05 beck Exp $ */
 /*
  * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
  *
@@ -89,5 +89,10 @@ LCRYPTO_USED(DSA_meth_set1_name);
 LCRYPTO_USED(DSA_meth_set_sign);
 LCRYPTO_USED(DSA_meth_set_finish);
 LCRYPTO_USED(ERR_load_DSA_strings);
+#if defined(LIBRESSL_NAMESPACE)
+extern LCRYPTO_USED(DSAPublicKey_it);
+extern LCRYPTO_USED(DSAPrivateKey_it);
+extern LCRYPTO_USED(DSAparams_it);
+#endif
 
 #endif /* _LIBCRYPTO_DSA_H */
diff --git a/lib/libcrypto/hidden/openssl/ocsp.h b/lib/libcrypto/hidden/openssl/ocsp.h
index 654696224..fa19c2861 100644
--- a/lib/libcrypto/hidden/openssl/ocsp.h
+++ b/lib/libcrypto/hidden/openssl/ocsp.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ocsp.h,v 1.1 2023/07/08 10:44:00 beck Exp $ */
+/* $OpenBSD: ocsp.h,v 1.3 2024/07/08 17:01:54 beck Exp $ */
 /*
  * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
  *
@@ -186,5 +186,23 @@ LCRYPTO_USED(OCSP_REQUEST_print);
 LCRYPTO_USED(OCSP_RESPONSE_print);
 LCRYPTO_USED(OCSP_basic_verify);
 LCRYPTO_USED(ERR_load_OCSP_strings);
+#if defined(LIBRESSL_NAMESPACE)
+extern LCRYPTO_USED(OCSP_RESPID_it);
+extern LCRYPTO_USED(OCSP_SINGLERESP_it);
+extern LCRYPTO_USED(OCSP_CERTSTATUS_it);
+extern LCRYPTO_USED(OCSP_REVOKEDINFO_it);
+extern LCRYPTO_USED(OCSP_BASICRESP_it);
+extern LCRYPTO_USED(OCSP_RESPDATA_it);
+extern LCRYPTO_USED(OCSP_RESPID_it);
+extern LCRYPTO_USED(OCSP_RESPONSE_it);
+extern LCRYPTO_USED(OCSP_RESPBYTES_it);
+extern LCRYPTO_USED(OCSP_ONEREQ_it);
+extern LCRYPTO_USED(OCSP_CERTID_it);
+extern LCRYPTO_USED(OCSP_REQUEST_it);
+extern LCRYPTO_USED(OCSP_SIGNATURE_it);
+extern LCRYPTO_USED(OCSP_REQINFO_it);
+extern LCRYPTO_USED(OCSP_CRLID_it);
+extern LCRYPTO_USED(OCSP_SERVICELOC_it);
+#endif
 
 #endif /* _LIBCRYPTO_OCSP_H */
diff --git a/lib/libcrypto/hidden/openssl/pkcs7.h b/lib/libcrypto/hidden/openssl/pkcs7.h
index f12b5df17..b531b298d 100644
--- a/lib/libcrypto/hidden/openssl/pkcs7.h
+++ b/lib/libcrypto/hidden/openssl/pkcs7.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: pkcs7.h,v 1.3 2023/07/05 21:14:54 bcook Exp $ */
+/* $OpenBSD: pkcs7.h,v 1.5 2024/07/08 17:01:54 beck Exp $ */
 /*
  * Copyright (c) 2022 Bob Beck <beck@openbsd.org>
  *
@@ -125,5 +125,19 @@ LCRYPTO_USED(SMIME_write_PKCS7);
 LCRYPTO_USED(SMIME_read_PKCS7);
 LCRYPTO_USED(BIO_new_PKCS7);
 LCRYPTO_USED(ERR_load_PKCS7_strings);
+#if defined(LIBRESSL_NAMESPACE)
+extern LCRYPTO_USED(PKCS7_ISSUER_AND_SERIAL_it);
+extern LCRYPTO_USED(PKCS7_SIGNER_INFO_it);
+extern LCRYPTO_USED(PKCS7_RECIP_INFO_it);
+extern LCRYPTO_USED(PKCS7_SIGNED_it);
+extern LCRYPTO_USED(PKCS7_ENC_CONTENT_it);
+extern LCRYPTO_USED(PKCS7_ENVELOPE_it);
+extern LCRYPTO_USED(PKCS7_SIGN_ENVELOPE_it);
+extern LCRYPTO_USED(PKCS7_DIGEST_it);
+extern LCRYPTO_USED(PKCS7_ENCRYPT_it);
+extern LCRYPTO_USED(PKCS7_it);
+extern LCRYPTO_USED(PKCS7_ATTR_SIGN_it);
+extern LCRYPTO_USED(PKCS7_ATTR_VERIFY_it);
+#endif
 
 #endif /* _LIBCRYPTO_PKCS7_H */
diff --git a/lib/libcrypto/hidden/openssl/rsa.h b/lib/libcrypto/hidden/openssl/rsa.h
index ff47101a0..a115684c9 100644
--- a/lib/libcrypto/hidden/openssl/rsa.h
+++ b/lib/libcrypto/hidden/openssl/rsa.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa.h,v 1.2 2023/07/28 10:05:16 tb Exp $ */
+/* $OpenBSD: rsa.h,v 1.3 2024/07/08 17:10:18 beck Exp $ */
 /*
  * Copyright (c) 2023 Bob Beck <beck@openbsd.org>
  *
@@ -137,5 +137,11 @@ LCRYPTO_USED(RSA_meth_set_sign);
 LCRYPTO_USED(RSA_meth_get_verify);
 LCRYPTO_USED(RSA_meth_set_verify);
 LCRYPTO_USED(ERR_load_RSA_strings);
+#if defined(LIBRESSL_NAMESPACE)
+extern LCRYPTO_USED(RSAPublicKey_it);
+extern LCRYPTO_USED(RSAPrivateKey_it);
+extern LCRYPTO_USED(RSA_PSS_PARAMS_it);
+extern LCRYPTO_USED(RSA_OAEP_PARAMS_it);
+#endif
 
 #endif /* _LIBCRYPTO_RSA_H */
diff --git a/lib/libcrypto/hidden/openssl/x509.h b/lib/libcrypto/hidden/openssl/x509.h
index 6cf6ca5f6..d80a3b257 100644
--- a/lib/libcrypto/hidden/openssl/x509.h
+++ b/lib/libcrypto/hidden/openssl/x509.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509.h,v 1.5 2024/04/09 13:55:02 beck Exp $ */
+/* $OpenBSD: x509.h,v 1.7 2024/07/08 17:01:54 beck Exp $ */
 /*
  * Copyright (c) 2022 Bob Beck <beck@openbsd.org>
  *
@@ -463,5 +463,28 @@ LCRYPTO_USED(PKCS8_pkey_get0_attrs);
 LCRYPTO_USED(PKCS8_pkey_add1_attr_by_NID);
 LCRYPTO_USED(X509_PUBKEY_set0_param);
 LCRYPTO_USED(X509_PUBKEY_get0_param);
+#if defined(LIBRESSL_NAMESPACE)
+extern LCRYPTO_USED(X509_ALGOR_it);
+extern LCRYPTO_USED(X509_ALGORS_it);
+extern LCRYPTO_USED(X509_VAL_it);
+extern LCRYPTO_USED(X509_PUBKEY_it);
+extern LCRYPTO_USED(X509_SIG_it);
+extern LCRYPTO_USED(X509_REQ_INFO_it);
+extern LCRYPTO_USED(X509_REQ_it);
+extern LCRYPTO_USED(X509_ATTRIBUTE_it);
+extern LCRYPTO_USED(X509_EXTENSION_it);
+extern LCRYPTO_USED(X509_EXTENSIONS_it);
+extern LCRYPTO_USED(X509_NAME_ENTRY_it);
+extern LCRYPTO_USED(X509_NAME_it);
+extern LCRYPTO_USED(X509_CINF_it);
+extern LCRYPTO_USED(X509_it);
+extern LCRYPTO_USED(X509_REVOKED_it);
+extern LCRYPTO_USED(X509_CRL_INFO_it);
+extern LCRYPTO_USED(X509_CRL_it);
+extern LCRYPTO_USED(NETSCAPE_SPKI_it);
+extern LCRYPTO_USED(NETSCAPE_SPKAC_it);
+extern LCRYPTO_USED(PBEPARAM_it);
+extern LCRYPTO_USED(PKCS8_PRIV_KEY_INFO_it);
+#endif
 
 #endif /* _LIBCRYPTO_X509_H */
diff --git a/lib/libcrypto/hidden/openssl/x509v3.h b/lib/libcrypto/hidden/openssl/x509v3.h
index a833ec9f4..1799d4811 100644
--- a/lib/libcrypto/hidden/openssl/x509v3.h
+++ b/lib/libcrypto/hidden/openssl/x509v3.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509v3.h,v 1.7 2024/03/02 10:40:05 tb Exp $ */
+/* $OpenBSD: x509v3.h,v 1.9 2024/07/08 17:01:54 beck Exp $ */
 /*
  * Copyright (c) 2022 Bob Beck <beck@openbsd.org>
  *
@@ -252,5 +252,40 @@ LCRYPTO_USED(X509v3_addr_validate_path);
 LCRYPTO_USED(X509v3_asid_validate_resource_set);
 LCRYPTO_USED(X509v3_addr_validate_resource_set);
 LCRYPTO_USED(ERR_load_X509V3_strings);
+#if defined(LIBRESSL_NAMESPACE)
+extern LCRYPTO_USED(BASIC_CONSTRAINTS_it);
+extern LCRYPTO_USED(AUTHORITY_KEYID_it);
+extern LCRYPTO_USED(PKEY_USAGE_PERIOD_it);
+extern LCRYPTO_USED(GENERAL_NAME_it);
+extern LCRYPTO_USED(GENERAL_NAMES_it);
+extern LCRYPTO_USED(OTHERNAME_it);
+extern LCRYPTO_USED(EDIPARTYNAME_it);
+extern LCRYPTO_USED(EXTENDED_KEY_USAGE_it);
+extern LCRYPTO_USED(CERTIFICATEPOLICIES_it);
+extern LCRYPTO_USED(POLICYINFO_it);
+extern LCRYPTO_USED(POLICYQUALINFO_it);
+extern LCRYPTO_USED(USERNOTICE_it);
+extern LCRYPTO_USED(NOTICEREF_it);
+extern LCRYPTO_USED(CRL_DIST_POINTS_it);
+extern LCRYPTO_USED(DIST_POINT_it);
+extern LCRYPTO_USED(DIST_POINT_NAME_it);
+extern LCRYPTO_USED(DIST_POINT_it);
+extern LCRYPTO_USED(ISSUING_DIST_POINT_it);
+extern LCRYPTO_USED(ACCESS_DESCRIPTION_it);
+extern LCRYPTO_USED(AUTHORITY_INFO_ACCESS_it);
+extern LCRYPTO_USED(POLICY_MAPPING_it);
+extern LCRYPTO_USED(POLICY_MAPPINGS_it);
+extern LCRYPTO_USED(GENERAL_SUBTREE_it);
+extern LCRYPTO_USED(NAME_CONSTRAINTS_it);
+extern LCRYPTO_USED(POLICY_CONSTRAINTS_it);
+extern LCRYPTO_USED(ASRange_it);
+extern LCRYPTO_USED(ASIdOrRange_it);
+extern LCRYPTO_USED(ASIdentifierChoice_it);
+extern LCRYPTO_USED(ASIdentifiers_it);
+extern LCRYPTO_USED(IPAddressRange_it);
+extern LCRYPTO_USED(IPAddressOrRange_it);
+extern LCRYPTO_USED(IPAddressChoice_it);
+extern LCRYPTO_USED(IPAddressFamily_it);
+#endif
 
 #endif /* _LIBCRYPTO_X509V3_H */
diff --git a/lib/libcrypto/man/openssl.cnf.5 b/lib/libcrypto/man/openssl.cnf.5
index 05295cbba..4047eb059 100644
--- a/lib/libcrypto/man/openssl.cnf.5
+++ b/lib/libcrypto/man/openssl.cnf.5
@@ -1,4 +1,4 @@
-.\" $OpenBSD: openssl.cnf.5,v 1.10 2023/11/19 10:23:53 tb Exp $
+.\" $OpenBSD: openssl.cnf.5,v 1.11 2024/07/08 15:02:28 jmc Exp $
 .\" full merge up to: OpenSSL man5/config b53338cb Feb 28 12:30:28 2017 +0100
 .\" selective merge up to: OpenSSL a8c5ed81 Jul 18 13:57:25 2017 -0400
 .\"
@@ -50,7 +50,7 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 .\" OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: November 19 2023 $
+.Dd $Mdocdate: July 8 2024 $
 .Dt OPENSSL.CNF 5
 .Os
 .Sh NAME
@@ -61,9 +61,7 @@ The OpenSSL CONF library can be used to read configuration files; see
 .Xr CONF_modules_load_file 3 .
 It is used for the OpenSSL master configuration file
 .Pa /etc/ssl/openssl.cnf
-and in a few other places like
-.Sy SPKAC
-files and certificate extension files for the
+and in a few other places such as certificate extension files for the
 .Xr openssl 1
 .Cm x509
 utility.
diff --git a/lib/libcrypto/ocsp/ocsp_asn.c b/lib/libcrypto/ocsp/ocsp_asn.c
index 4fbdd5fd7..abceaac83 100644
--- a/lib/libcrypto/ocsp/ocsp_asn.c
+++ b/lib/libcrypto/ocsp/ocsp_asn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ocsp_asn.c,v 1.11 2023/07/08 10:44:00 beck Exp $ */
+/* $OpenBSD: ocsp_asn.c,v 1.12 2024/07/08 14:53:11 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -94,6 +94,7 @@ const ASN1_ITEM OCSP_SIGNATURE_it = {
 	.size = sizeof(OCSP_SIGNATURE),
 	.sname = "OCSP_SIGNATURE",
 };
+LCRYPTO_ALIAS(OCSP_SIGNATURE_it);
 
 
 OCSP_SIGNATURE *
@@ -165,6 +166,7 @@ const ASN1_ITEM OCSP_CERTID_it = {
 	.size = sizeof(OCSP_CERTID),
 	.sname = "OCSP_CERTID",
 };
+LCRYPTO_ALIAS(OCSP_CERTID_it);
 
 
 OCSP_CERTID *
@@ -222,6 +224,7 @@ const ASN1_ITEM OCSP_ONEREQ_it = {
 	.size = sizeof(OCSP_ONEREQ),
 	.sname = "OCSP_ONEREQ",
 };
+LCRYPTO_ALIAS(OCSP_ONEREQ_it);
 
 
 OCSP_ONEREQ *
@@ -293,6 +296,7 @@ const ASN1_ITEM OCSP_REQINFO_it = {
 	.size = sizeof(OCSP_REQINFO),
 	.sname = "OCSP_REQINFO",
 };
+LCRYPTO_ALIAS(OCSP_REQINFO_it);
 
 
 OCSP_REQINFO *
@@ -350,6 +354,7 @@ const ASN1_ITEM OCSP_REQUEST_it = {
 	.size = sizeof(OCSP_REQUEST),
 	.sname = "OCSP_REQUEST",
 };
+LCRYPTO_ALIAS(OCSP_REQUEST_it);
 
 OCSP_REQUEST *
 d2i_OCSP_REQUEST(OCSP_REQUEST **a, const unsigned char **in, long len)
@@ -422,6 +427,7 @@ const ASN1_ITEM OCSP_RESPBYTES_it = {
 	.size = sizeof(OCSP_RESPBYTES),
 	.sname = "OCSP_RESPBYTES",
 };
+LCRYPTO_ALIAS(OCSP_RESPBYTES_it);
 
 
 OCSP_RESPBYTES *
@@ -479,6 +485,7 @@ const ASN1_ITEM OCSP_RESPONSE_it = {
 	.size = sizeof(OCSP_RESPONSE),
 	.sname = "OCSP_RESPONSE",
 };
+LCRYPTO_ALIAS(OCSP_RESPONSE_it);
 
 
 OCSP_RESPONSE *
@@ -550,6 +557,7 @@ const ASN1_ITEM OCSP_RESPID_it = {
 	.size = sizeof(OCSP_RESPID),
 	.sname = "OCSP_RESPID",
 };
+LCRYPTO_ALIAS(OCSP_RESPID_it);
 
 
 OCSP_RESPID *
@@ -607,6 +615,7 @@ const ASN1_ITEM OCSP_REVOKEDINFO_it = {
 	.size = sizeof(OCSP_REVOKEDINFO),
 	.sname = "OCSP_REVOKEDINFO",
 };
+LCRYPTO_ALIAS(OCSP_REVOKEDINFO_it);
 
 
 OCSP_REVOKEDINFO *
@@ -671,6 +680,7 @@ const ASN1_ITEM OCSP_CERTSTATUS_it = {
 	.size = sizeof(OCSP_CERTSTATUS),
 	.sname = "OCSP_CERTSTATUS",
 };
+LCRYPTO_ALIAS(OCSP_CERTSTATUS_it);
 
 
 OCSP_CERTSTATUS *
@@ -749,6 +759,7 @@ const ASN1_ITEM OCSP_SINGLERESP_it = {
 	.size = sizeof(OCSP_SINGLERESP),
 	.sname = "OCSP_SINGLERESP",
 };
+LCRYPTO_ALIAS(OCSP_SINGLERESP_it);
 
 
 OCSP_SINGLERESP *
@@ -827,6 +838,7 @@ const ASN1_ITEM OCSP_RESPDATA_it = {
 	.size = sizeof(OCSP_RESPDATA),
 	.sname = "OCSP_RESPDATA",
 };
+LCRYPTO_ALIAS(OCSP_RESPDATA_it);
 
 
 OCSP_RESPDATA *
@@ -898,6 +910,7 @@ const ASN1_ITEM OCSP_BASICRESP_it = {
 	.size = sizeof(OCSP_BASICRESP),
 	.sname = "OCSP_BASICRESP",
 };
+LCRYPTO_ALIAS(OCSP_BASICRESP_it);
 
 
 OCSP_BASICRESP *
@@ -962,6 +975,7 @@ const ASN1_ITEM OCSP_CRLID_it = {
 	.size = sizeof(OCSP_CRLID),
 	.sname = "OCSP_CRLID",
 };
+LCRYPTO_ALIAS(OCSP_CRLID_it);
 
 
 OCSP_CRLID *
@@ -1019,6 +1033,7 @@ const ASN1_ITEM OCSP_SERVICELOC_it = {
 	.size = sizeof(OCSP_SERVICELOC),
 	.sname = "OCSP_SERVICELOC",
 };
+LCRYPTO_ALIAS(OCSP_SERVICELOC_it);
 
 
 OCSP_SERVICELOC *
diff --git a/lib/libcrypto/pkcs7/pk7_asn1.c b/lib/libcrypto/pkcs7/pk7_asn1.c
index c0f8345df..02f3ab60b 100644
--- a/lib/libcrypto/pkcs7/pk7_asn1.c
+++ b/lib/libcrypto/pkcs7/pk7_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: pk7_asn1.c,v 1.17 2023/04/25 18:04:03 tb Exp $ */
+/* $OpenBSD: pk7_asn1.c,v 1.18 2024/07/08 16:23:27 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -214,6 +214,7 @@ const ASN1_ITEM PKCS7_it = {
 	.size = sizeof(PKCS7),
 	.sname = "PKCS7",
 };
+LCRYPTO_ALIAS(PKCS7_it);
 
 
 PKCS7 *
@@ -306,6 +307,7 @@ const ASN1_ITEM PKCS7_SIGNED_it = {
 	.size = sizeof(PKCS7_SIGNED),
 	.sname = "PKCS7_SIGNED",
 };
+LCRYPTO_ALIAS(PKCS7_SIGNED_it);
 
 
 PKCS7_SIGNED *
@@ -422,6 +424,7 @@ const ASN1_ITEM PKCS7_SIGNER_INFO_it = {
 	.size = sizeof(PKCS7_SIGNER_INFO),
 	.sname = "PKCS7_SIGNER_INFO",
 };
+LCRYPTO_ALIAS(PKCS7_SIGNER_INFO_it);
 
 
 PKCS7_SIGNER_INFO *
@@ -479,6 +482,7 @@ const ASN1_ITEM PKCS7_ISSUER_AND_SERIAL_it = {
 	.size = sizeof(PKCS7_ISSUER_AND_SERIAL),
 	.sname = "PKCS7_ISSUER_AND_SERIAL",
 };
+LCRYPTO_ALIAS(PKCS7_ISSUER_AND_SERIAL_it);
 
 
 PKCS7_ISSUER_AND_SERIAL *
@@ -543,6 +547,7 @@ const ASN1_ITEM PKCS7_ENVELOPE_it = {
 	.size = sizeof(PKCS7_ENVELOPE),
 	.sname = "PKCS7_ENVELOPE",
 };
+LCRYPTO_ALIAS(PKCS7_ENVELOPE_it);
 
 
 PKCS7_ENVELOPE *
@@ -633,6 +638,7 @@ const ASN1_ITEM PKCS7_RECIP_INFO_it = {
 	.size = sizeof(PKCS7_RECIP_INFO),
 	.sname = "PKCS7_RECIP_INFO",
 };
+LCRYPTO_ALIAS(PKCS7_RECIP_INFO_it);
 
 
 PKCS7_RECIP_INFO *
@@ -697,6 +703,7 @@ const ASN1_ITEM PKCS7_ENC_CONTENT_it = {
 	.size = sizeof(PKCS7_ENC_CONTENT),
 	.sname = "PKCS7_ENC_CONTENT",
 };
+LCRYPTO_ALIAS(PKCS7_ENC_CONTENT_it);
 
 
 PKCS7_ENC_CONTENT *
@@ -789,6 +796,7 @@ const ASN1_ITEM PKCS7_SIGN_ENVELOPE_it = {
 	.size = sizeof(PKCS7_SIGN_ENVELOPE),
 	.sname = "PKCS7_SIGN_ENVELOPE",
 };
+LCRYPTO_ALIAS(PKCS7_SIGN_ENVELOPE_it);
 
 
 PKCS7_SIGN_ENVELOPE *
@@ -846,6 +854,7 @@ const ASN1_ITEM PKCS7_ENCRYPT_it = {
 	.size = sizeof(PKCS7_ENCRYPT),
 	.sname = "PKCS7_ENCRYPT",
 };
+LCRYPTO_ALIAS(PKCS7_ENCRYPT_it);
 
 
 PKCS7_ENCRYPT *
@@ -917,6 +926,7 @@ const ASN1_ITEM PKCS7_DIGEST_it = {
 	.size = sizeof(PKCS7_DIGEST),
 	.sname = "PKCS7_DIGEST",
 };
+LCRYPTO_ALIAS(PKCS7_DIGEST_it);
 
 
 PKCS7_DIGEST *
@@ -971,6 +981,7 @@ const ASN1_ITEM PKCS7_ATTR_SIGN_it = {
 	.size = 0,
 	.sname = "PKCS7_ATTR_SIGN",
 };
+LCRYPTO_ALIAS(PKCS7_ATTR_SIGN_it);
 
 /* When verifying attributes we need to use the received order. So
  * we use SEQUENCE OF and tag it to SET OF
@@ -993,6 +1004,7 @@ const ASN1_ITEM PKCS7_ATTR_VERIFY_it = {
 	.size = 0,
 	.sname = "PKCS7_ATTR_VERIFY",
 };
+LCRYPTO_ALIAS(PKCS7_ATTR_VERIFY_it);
 
 
 int
diff --git a/lib/libcrypto/rsa/rsa_asn1.c b/lib/libcrypto/rsa/rsa_asn1.c
index 0f6d8c49f..1526e0793 100644
--- a/lib/libcrypto/rsa/rsa_asn1.c
+++ b/lib/libcrypto/rsa/rsa_asn1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_asn1.c,v 1.17 2023/07/08 12:26:45 beck Exp $ */
+/* $OpenBSD: rsa_asn1.c,v 1.18 2024/07/08 17:10:18 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2000.
  */
@@ -165,6 +165,7 @@ const ASN1_ITEM RSAPrivateKey_it = {
 	.size = sizeof(RSA),
 	.sname = "RSA",
 };
+LCRYPTO_ALIAS(RSAPrivateKey_it);
 
 
 static const ASN1_AUX RSAPublicKey_aux = {
@@ -201,6 +202,7 @@ const ASN1_ITEM RSAPublicKey_it = {
 	.size = sizeof(RSA),
 	.sname = "RSA",
 };
+LCRYPTO_ALIAS(RSAPublicKey_it);
 
 static int
 rsa_pss_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg)
@@ -262,6 +264,7 @@ const ASN1_ITEM RSA_PSS_PARAMS_it = {
 	.size = sizeof(RSA_PSS_PARAMS),
 	.sname = "RSA_PSS_PARAMS",
 };
+LCRYPTO_ALIAS(RSA_PSS_PARAMS_it);
 
 RSA_PSS_PARAMS *
 d2i_RSA_PSS_PARAMS(RSA_PSS_PARAMS **a, const unsigned char **in, long len)
@@ -345,6 +348,7 @@ const ASN1_ITEM RSA_OAEP_PARAMS_it = {
 	.size = sizeof(RSA_OAEP_PARAMS),
 	.sname = "RSA_OAEP_PARAMS",
 };
+LCRYPTO_ALIAS(RSA_OAEP_PARAMS_it);
 
 
 RSA_OAEP_PARAMS *
diff --git a/lib/libcrypto/x509/x509_addr.c b/lib/libcrypto/x509/x509_addr.c
index a3b28ac07..864b7bbf3 100644
--- a/lib/libcrypto/x509/x509_addr.c
+++ b/lib/libcrypto/x509/x509_addr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: x509_addr.c,v 1.91 2023/10/29 13:22:37 tb Exp $ */
+/*	$OpenBSD: x509_addr.c,v 1.92 2024/07/08 14:47:44 beck Exp $ */
 /*
  * Contributed to the OpenSSL Project by the American Registry for
  * Internet Numbers ("ARIN").
@@ -109,6 +109,7 @@ const ASN1_ITEM IPAddressRange_it = {
 	.size = sizeof(IPAddressRange),
 	.sname = "IPAddressRange",
 };
+LCRYPTO_ALIAS(IPAddressRange_it);
 
 static const ASN1_TEMPLATE IPAddressOrRange_ch_tt[] = {
 	{
@@ -136,6 +137,7 @@ const ASN1_ITEM IPAddressOrRange_it = {
 	.size = sizeof(IPAddressOrRange),
 	.sname = "IPAddressOrRange",
 };
+LCRYPTO_ALIAS(IPAddressOrRange_it);
 
 static const ASN1_TEMPLATE IPAddressChoice_ch_tt[] = {
 	{
@@ -163,6 +165,7 @@ const ASN1_ITEM IPAddressChoice_it = {
 	.size = sizeof(IPAddressChoice),
 	.sname = "IPAddressChoice",
 };
+LCRYPTO_ALIAS(IPAddressChoice_it);
 
 static const ASN1_TEMPLATE IPAddressFamily_seq_tt[] = {
 	{
@@ -190,6 +193,7 @@ const ASN1_ITEM IPAddressFamily_it = {
 	.size = sizeof(IPAddressFamily),
 	.sname = "IPAddressFamily",
 };
+LCRYPTO_ALIAS(IPAddressFamily_it);
 
 static const ASN1_TEMPLATE IPAddrBlocks_item_tt = {
 	.flags = ASN1_TFLG_SEQUENCE_OF,
diff --git a/lib/libcrypto/x509/x509_akeya.c b/lib/libcrypto/x509/x509_akeya.c
index 52eca42cf..e816e6b61 100644
--- a/lib/libcrypto/x509/x509_akeya.c
+++ b/lib/libcrypto/x509/x509_akeya.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_akeya.c,v 1.3 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_akeya.c,v 1.4 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -96,6 +96,7 @@ const ASN1_ITEM AUTHORITY_KEYID_it = {
 	.size = sizeof(AUTHORITY_KEYID),
 	.sname = "AUTHORITY_KEYID",
 };
+LCRYPTO_ALIAS(AUTHORITY_KEYID_it);
 
 
 AUTHORITY_KEYID *
diff --git a/lib/libcrypto/x509/x509_asid.c b/lib/libcrypto/x509/x509_asid.c
index 2fda58c3f..e3af67320 100644
--- a/lib/libcrypto/x509/x509_asid.c
+++ b/lib/libcrypto/x509/x509_asid.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: x509_asid.c,v 1.43 2024/02/20 14:58:16 tb Exp $ */
+/*	$OpenBSD: x509_asid.c,v 1.44 2024/07/08 14:47:44 beck Exp $ */
 /*
  * Contributed to the OpenSSL Project by the American Registry for
  * Internet Numbers ("ARIN").
@@ -102,6 +102,7 @@ const ASN1_ITEM ASRange_it = {
 	.size = sizeof(ASRange),
 	.sname = "ASRange",
 };
+LCRYPTO_ALIAS(ASRange_it);
 
 static const ASN1_TEMPLATE ASIdOrRange_ch_tt[] = {
 	{
@@ -129,6 +130,7 @@ const ASN1_ITEM ASIdOrRange_it = {
 	.size = sizeof(ASIdOrRange),
 	.sname = "ASIdOrRange",
 };
+LCRYPTO_ALIAS(ASIdOrRange_it);
 
 static const ASN1_TEMPLATE ASIdentifierChoice_ch_tt[] = {
 	{
@@ -156,6 +158,7 @@ const ASN1_ITEM ASIdentifierChoice_it = {
 	.size = sizeof(ASIdentifierChoice),
 	.sname = "ASIdentifierChoice",
 };
+LCRYPTO_ALIAS(ASIdentifierChoice_it);
 
 static const ASN1_TEMPLATE ASIdentifiers_seq_tt[] = {
 	{
@@ -183,6 +186,7 @@ const ASN1_ITEM ASIdentifiers_it = {
 	.size = sizeof(ASIdentifiers),
 	.sname = "ASIdentifiers",
 };
+LCRYPTO_ALIAS(ASIdentifiers_it);
 
 ASRange *
 d2i_ASRange(ASRange **a, const unsigned char **in, long len)
diff --git a/lib/libcrypto/x509/x509_bcons.c b/lib/libcrypto/x509/x509_bcons.c
index a39ae0aae..7ad65231e 100644
--- a/lib/libcrypto/x509/x509_bcons.c
+++ b/lib/libcrypto/x509/x509_bcons.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_bcons.c,v 1.3 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_bcons.c,v 1.4 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -113,6 +113,7 @@ const ASN1_ITEM BASIC_CONSTRAINTS_it = {
 	.size = sizeof(BASIC_CONSTRAINTS),
 	.sname = "BASIC_CONSTRAINTS",
 };
+LCRYPTO_ALIAS(BASIC_CONSTRAINTS_it);
 
 
 BASIC_CONSTRAINTS *
diff --git a/lib/libcrypto/x509/x509_cpols.c b/lib/libcrypto/x509/x509_cpols.c
index bab2e99a9..34c9345a4 100644
--- a/lib/libcrypto/x509/x509_cpols.c
+++ b/lib/libcrypto/x509/x509_cpols.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_cpols.c,v 1.11 2023/04/26 20:54:21 tb Exp $ */
+/* $OpenBSD: x509_cpols.c,v 1.12 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -116,6 +116,7 @@ const ASN1_ITEM CERTIFICATEPOLICIES_it = {
 	.size = 0,
 	.sname = "CERTIFICATEPOLICIES",
 };
+LCRYPTO_ALIAS(CERTIFICATEPOLICIES_it);
 
 
 CERTIFICATEPOLICIES *
@@ -173,6 +174,7 @@ const ASN1_ITEM POLICYINFO_it = {
 	.size = sizeof(POLICYINFO),
 	.sname = "POLICYINFO",
 };
+LCRYPTO_ALIAS(POLICYINFO_it);
 
 
 POLICYINFO *
@@ -270,6 +272,7 @@ const ASN1_ITEM POLICYQUALINFO_it = {
 	.size = sizeof(POLICYQUALINFO),
 	.sname = "POLICYQUALINFO",
 };
+LCRYPTO_ALIAS(POLICYQUALINFO_it);
 
 
 POLICYQUALINFO *
@@ -327,6 +330,7 @@ const ASN1_ITEM USERNOTICE_it = {
 	.size = sizeof(USERNOTICE),
 	.sname = "USERNOTICE",
 };
+LCRYPTO_ALIAS(USERNOTICE_it);
 
 
 USERNOTICE *
@@ -384,6 +388,7 @@ const ASN1_ITEM NOTICEREF_it = {
 	.size = sizeof(NOTICEREF),
 	.sname = "NOTICEREF",
 };
+LCRYPTO_ALIAS(NOTICEREF_it);
 
 
 NOTICEREF *
diff --git a/lib/libcrypto/x509/x509_crld.c b/lib/libcrypto/x509/x509_crld.c
index 7887ccd64..dfb5d27f6 100644
--- a/lib/libcrypto/x509/x509_crld.c
+++ b/lib/libcrypto/x509/x509_crld.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_crld.c,v 1.5 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_crld.c,v 1.6 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -417,6 +417,7 @@ const ASN1_ITEM DIST_POINT_NAME_it = {
 	.size = sizeof(DIST_POINT_NAME),
 	.sname = "DIST_POINT_NAME",
 };
+LCRYPTO_ALIAS(DIST_POINT_NAME_it);
 
 
 
@@ -482,6 +483,7 @@ const ASN1_ITEM DIST_POINT_it = {
 	.size = sizeof(DIST_POINT),
 	.sname = "DIST_POINT",
 };
+LCRYPTO_ALIAS(DIST_POINT_it);
 
 
 DIST_POINT *
@@ -530,6 +532,7 @@ const ASN1_ITEM CRL_DIST_POINTS_it = {
 	.size = 0,
 	.sname = "CRL_DIST_POINTS",
 };
+LCRYPTO_ALIAS(CRL_DIST_POINTS_it);
 
 
 CRL_DIST_POINTS *
@@ -615,6 +618,7 @@ const ASN1_ITEM ISSUING_DIST_POINT_it = {
 	.size = sizeof(ISSUING_DIST_POINT),
 	.sname = "ISSUING_DIST_POINT",
 };
+LCRYPTO_ALIAS(ISSUING_DIST_POINT_it);
 
 
 ISSUING_DIST_POINT *
diff --git a/lib/libcrypto/x509/x509_extku.c b/lib/libcrypto/x509/x509_extku.c
index 94032f624..f0f8d44aa 100644
--- a/lib/libcrypto/x509/x509_extku.c
+++ b/lib/libcrypto/x509/x509_extku.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_extku.c,v 1.3 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_extku.c,v 1.4 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -120,6 +120,7 @@ const ASN1_ITEM EXTENDED_KEY_USAGE_it = {
 	.size = 0,
 	.sname = "EXTENDED_KEY_USAGE",
 };
+LCRYPTO_ALIAS(EXTENDED_KEY_USAGE_it);
 
 
 EXTENDED_KEY_USAGE *
diff --git a/lib/libcrypto/x509/x509_genn.c b/lib/libcrypto/x509/x509_genn.c
index 556ba81c8..1ea715579 100644
--- a/lib/libcrypto/x509/x509_genn.c
+++ b/lib/libcrypto/x509/x509_genn.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_genn.c,v 1.6 2023/04/25 15:51:04 tb Exp $ */
+/* $OpenBSD: x509_genn.c,v 1.7 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -90,6 +90,7 @@ const ASN1_ITEM OTHERNAME_it = {
 	.size = sizeof(OTHERNAME),
 	.sname = "OTHERNAME",
 };
+LCRYPTO_ALIAS(OTHERNAME_it);
 
 
 OTHERNAME *
@@ -148,6 +149,7 @@ const ASN1_ITEM EDIPARTYNAME_it = {
 	.size = sizeof(EDIPARTYNAME),
 	.sname = "EDIPARTYNAME",
 };
+LCRYPTO_ALIAS(EDIPARTYNAME_it);
 
 
 EDIPARTYNAME *
@@ -256,6 +258,7 @@ const ASN1_ITEM GENERAL_NAME_it = {
 	.size = sizeof(GENERAL_NAME),
 	.sname = "GENERAL_NAME",
 };
+LCRYPTO_ALIAS(GENERAL_NAME_it);
 
 
 GENERAL_NAME *
@@ -304,6 +307,7 @@ const ASN1_ITEM GENERAL_NAMES_it = {
 	.size = 0,
 	.sname = "GENERAL_NAMES",
 };
+LCRYPTO_ALIAS(GENERAL_NAMES_it);
 
 
 GENERAL_NAMES *
diff --git a/lib/libcrypto/x509/x509_info.c b/lib/libcrypto/x509/x509_info.c
index a3d4d1bcc..9372b066a 100644
--- a/lib/libcrypto/x509/x509_info.c
+++ b/lib/libcrypto/x509/x509_info.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_info.c,v 1.3 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_info.c,v 1.4 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -131,6 +131,7 @@ const ASN1_ITEM ACCESS_DESCRIPTION_it = {
 	.size = sizeof(ACCESS_DESCRIPTION),
 	.sname = "ACCESS_DESCRIPTION",
 };
+LCRYPTO_ALIAS(ACCESS_DESCRIPTION_it);
 
 
 ACCESS_DESCRIPTION *
@@ -179,6 +180,7 @@ const ASN1_ITEM AUTHORITY_INFO_ACCESS_it = {
 	.size = 0,
 	.sname = "AUTHORITY_INFO_ACCESS",
 };
+LCRYPTO_ALIAS(AUTHORITY_INFO_ACCESS_it);
 
 
 AUTHORITY_INFO_ACCESS *
diff --git a/lib/libcrypto/x509/x509_ncons.c b/lib/libcrypto/x509/x509_ncons.c
index 159e3c256..f8c63886a 100644
--- a/lib/libcrypto/x509/x509_ncons.c
+++ b/lib/libcrypto/x509/x509_ncons.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_ncons.c,v 1.9 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_ncons.c,v 1.10 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -131,6 +131,7 @@ const ASN1_ITEM GENERAL_SUBTREE_it = {
 	.size = sizeof(GENERAL_SUBTREE),
 	.sname = "GENERAL_SUBTREE",
 };
+LCRYPTO_ALIAS(GENERAL_SUBTREE_it);
 
 static const ASN1_TEMPLATE NAME_CONSTRAINTS_seq_tt[] = {
 	{
@@ -158,6 +159,7 @@ const ASN1_ITEM NAME_CONSTRAINTS_it = {
 	.size = sizeof(NAME_CONSTRAINTS),
 	.sname = "NAME_CONSTRAINTS",
 };
+LCRYPTO_ALIAS(NAME_CONSTRAINTS_it);
 
 
 GENERAL_SUBTREE *
diff --git a/lib/libcrypto/x509/x509_pcons.c b/lib/libcrypto/x509/x509_pcons.c
index 0ee935540..8f2109eaa 100644
--- a/lib/libcrypto/x509/x509_pcons.c
+++ b/lib/libcrypto/x509/x509_pcons.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_pcons.c,v 1.3 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_pcons.c,v 1.4 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -114,6 +114,7 @@ const ASN1_ITEM POLICY_CONSTRAINTS_it = {
 	.size = sizeof(POLICY_CONSTRAINTS),
 	.sname = "POLICY_CONSTRAINTS",
 };
+LCRYPTO_ALIAS(POLICY_CONSTRAINTS_it);
 
 
 POLICY_CONSTRAINTS *
diff --git a/lib/libcrypto/x509/x509_pku.c b/lib/libcrypto/x509/x509_pku.c
index dd28077de..05c9ff243 100644
--- a/lib/libcrypto/x509/x509_pku.c
+++ b/lib/libcrypto/x509/x509_pku.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_pku.c,v 1.3 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_pku.c,v 1.4 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 1999.
  */
@@ -108,6 +108,7 @@ const ASN1_ITEM PKEY_USAGE_PERIOD_it = {
 	.size = sizeof(PKEY_USAGE_PERIOD),
 	.sname = "PKEY_USAGE_PERIOD",
 };
+LCRYPTO_ALIAS(PKEY_USAGE_PERIOD_it);
 
 
 PKEY_USAGE_PERIOD *
diff --git a/lib/libcrypto/x509/x509_pmaps.c b/lib/libcrypto/x509/x509_pmaps.c
index 39aebfee8..b2d74dce1 100644
--- a/lib/libcrypto/x509/x509_pmaps.c
+++ b/lib/libcrypto/x509/x509_pmaps.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_pmaps.c,v 1.3 2023/02/16 08:38:17 tb Exp $ */
+/* $OpenBSD: x509_pmaps.c,v 1.4 2024/07/08 14:47:44 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -112,6 +112,7 @@ const ASN1_ITEM POLICY_MAPPING_it = {
 	.size = sizeof(POLICY_MAPPING),
 	.sname = "POLICY_MAPPING",
 };
+LCRYPTO_ALIAS(POLICY_MAPPING_it);
 
 static const ASN1_TEMPLATE POLICY_MAPPINGS_item_tt = {
 	.flags = ASN1_TFLG_SEQUENCE_OF,
@@ -130,6 +131,7 @@ const ASN1_ITEM POLICY_MAPPINGS_it = {
 	.size = 0,
 	.sname = "POLICY_MAPPINGS",
 };
+LCRYPTO_ALIAS(POLICY_MAPPINGS_it);
 
 
 POLICY_MAPPING *
diff --git a/lib/libcrypto/x509/x509_utl.c b/lib/libcrypto/x509/x509_utl.c
index e5e95bfac..422e89989 100644
--- a/lib/libcrypto/x509/x509_utl.c
+++ b/lib/libcrypto/x509/x509_utl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_utl.c,v 1.18 2024/06/18 08:29:40 tb Exp $ */
+/* $OpenBSD: x509_utl.c,v 1.19 2024/07/08 06:57:37 jca Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project.
  */
@@ -1325,9 +1325,10 @@ ipv6_from_asc(unsigned char *v6, const char *in)
 	v6stat.zero_pos = -1;
 	v6stat.zero_cnt = 0;
 
-	/* Treat the IPv6 representation as a list of values
-	 * separated by ':'. The presence of a '::' will parse
-	 * as one, two or three zero length elements.
+	/*
+	 * Treat the IPv6 representation as a list of values separated by ':'.
+	 * The presence of a '::' will parse as one (e.g., "2001:db8::1"),
+	 * two (e.g., "2001:db8::") or three (e.g., "::") zero length elements.
 	 */
 	if (!CONF_parse_list(in, ':', 0, ipv6_cb, &v6stat))
 		return 0;
diff --git a/lib/libkvm/kvm_proc2.c b/lib/libkvm/kvm_proc2.c
index a9d156032..da093e8e5 100644
--- a/lib/libkvm/kvm_proc2.c
+++ b/lib/libkvm/kvm_proc2.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kvm_proc2.c,v 1.38 2022/02/22 17:35:01 deraadt Exp $	*/
+/*	$OpenBSD: kvm_proc2.c,v 1.39 2024/07/08 13:18:26 claudio Exp $	*/
 /*	$NetBSD: kvm_proc.c,v 1.30 1999/03/24 05:50:50 mrg Exp $	*/
 /*-
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -295,7 +295,7 @@ kvm_proclist(kvm_t *kd, int op, int arg, struct process *pr,
 #define do_copy_str(_d, _s, _l)	kvm_read(kd, (u_long)(_s), (_d), (_l)-1)
 		FILL_KPROC(&kp, do_copy_str, &proc, &process,
 		    &ucred, &pgrp, process.ps_mainproc, pr, &sess,
-		    vmp, limp, sap, 0, 1);
+		    vmp, limp, sap, &process.ps_tu, 0, 1);
 
 		/* stuff that's too painful to generalize */
 		kp.p_ppid = parent_pid;
@@ -388,7 +388,7 @@ kvm_proclist(kvm_t *kd, int op, int arg, struct process *pr,
 			}
 			FILL_KPROC(&kp, do_copy_str, &proc, &process,
 			    &ucred, &pgrp, p, pr, &sess, vmp, limp, sap,
-			    1, 1);
+			    &proc.p_tu, 1, 1);
 
 			/* see above */
 			kp.p_ppid = parent_pid;
diff --git a/regress/usr.bin/openssl/appstest.sh b/regress/usr.bin/openssl/appstest.sh
index 84004df94..572cc7361 100755
--- a/regress/usr.bin/openssl/appstest.sh
+++ b/regress/usr.bin/openssl/appstest.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# $OpenBSD: appstest.sh,v 1.63 2024/03/03 13:29:19 tb Exp $
+# $OpenBSD: appstest.sh,v 1.64 2024/07/08 06:00:34 tb Exp $
 #
 # Copyright (c) 2016 Kinichiro Inoguchi <inoguchi@openbsd.org>
 #
@@ -959,43 +959,6 @@ __EOF__
 
 	#---------#---------#---------#---------#---------#---------#---------
 
-	# --- Netscape SPKAC operations ---
-	section_message "Netscape SPKAC operations"
-
-	# server-admin generates SPKAC
-
-	start_message "spkac"
-	spkacfile=$server_dir/spkac.file
-
-	$openssl_bin spkac -key $genpkey_rsa -challenge hello -out $spkacfile
-	check_exit_status $?
-
-	$openssl_bin spkac -in $spkacfile -verify -out $spkacfile.out
-	check_exit_status $?
-
-	spkacreq=$server_dir/spkac.req
-	cat << __EOF__ > $spkacreq
-countryName = JP
-stateOrProvinceName = Tokyo
-organizationName = TEST_DUMMY_COMPANY
-commonName = spkac.test-dummy.com
-__EOF__
-	cat $spkacfile >> $spkacreq
-
-	# CA signs SPKAC
-	start_message "ca ... CA signs SPKAC csr"
-	spkaccert=$server_dir/spkac.cert
-	$openssl_bin ca -batch -cert $ca_cert -keyfile $ca_key -key $ca_pass \
-		-spkac $spkacreq -out $spkaccert > $spkaccert.log 2>&1
-	check_exit_status $?
-
-	start_message "x509 ... convert DER format SPKAC cert to PEM"
-	spkacpem=$server_dir/spkac.pem
-	$openssl_bin x509 -in $spkaccert -inform DER -out $spkacpem -outform PEM
-	check_exit_status $?
-
-	#---------#---------#---------#---------#---------#---------#---------
-
 	# --- user1 operations (generate user1 key and csr) ---
 	section_message "user1 operations (generate user1 key and csr)"
 
diff --git a/share/misc/airport b/share/misc/airport
index 2b3a12eb9..14e53e889 100644
--- a/share/misc/airport
+++ b/share/misc/airport
@@ -1,4 +1,4 @@
-#	$OpenBSD: airport,v 1.93 2024/01/11 07:59:43 deraadt Exp $
+#	$OpenBSD: airport,v 1.94 2024/07/08 14:15:33 op Exp $
 #	@(#)airport	8.1 (Berkeley) 6/8/93
 #
 # Some of this information from the Airport Search Engine at
@@ -1725,6 +1725,7 @@ TRV:Trivandrum, India
 TRZ:Civil, Tiruchirapally, India
 TSA:Sung Shan, Taipei, Taiwan
 TSE:Astana, Kazakhstan
+TSF:Antonio Canova, Treviso, Italy
 TSP:Tehachapi, California, USA
 TSR:Timisoara, Romania
 TSS:East 34Th Street Heliport, New York, New York, USA
diff --git a/sys/arch/amd64/amd64/identcpu.c b/sys/arch/amd64/amd64/identcpu.c
index 1c1df3a11..a6e31e502 100644
--- a/sys/arch/amd64/amd64/identcpu.c
+++ b/sys/arch/amd64/amd64/identcpu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: identcpu.c,v 1.145 2024/06/24 21:22:14 bluhm Exp $	*/
+/*	$OpenBSD: identcpu.c,v 1.146 2024/07/08 14:46:47 mpi Exp $	*/
 /*	$NetBSD: identcpu.c,v 1.1 2003/04/26 18:39:28 fvdl Exp $	*/
 
 /*
@@ -169,7 +169,7 @@ cpu_hz_update_sensor(void *args)
 		ci->ci_hz_sensor.value = val;
 	}
 
-	atomic_clearbits_int(&curproc->p_flag, P_CPUPEG);
+	sched_unpeg_curproc();
 }
 #endif
 
diff --git a/sys/dev/ic/nvme.c b/sys/dev/ic/nvme.c
index 62299a4de..dcbf40187 100644
--- a/sys/dev/ic/nvme.c
+++ b/sys/dev/ic/nvme.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: nvme.c,v 1.118 2024/06/30 12:03:17 krw Exp $ */
+/*	$OpenBSD: nvme.c,v 1.119 2024/07/08 16:07:36 krw Exp $ */
 
 /*
  * Copyright (c) 2014 David Gwynne <dlg@openbsd.org>
@@ -1538,7 +1538,7 @@ nvme_q_free(struct nvme_softc *sc, struct nvme_queue *q)
 	nvme_dmamem_sync(sc, q->q_cq_dmamem, BUS_DMASYNC_POSTREAD);
 	nvme_dmamem_sync(sc, q->q_sq_dmamem, BUS_DMASYNC_POSTWRITE);
 
-	if (sc->sc_ops->op_q_alloc != NULL)
+	if (sc->sc_ops->op_q_free != NULL)
 		sc->sc_ops->op_q_free(sc, q);
 
 	nvme_dmamem_free(sc, q->q_cq_dmamem);
diff --git a/sys/dev/kstat.c b/sys/dev/kstat.c
index 5da636a06..b5a4ddcea 100644
--- a/sys/dev/kstat.c
+++ b/sys/dev/kstat.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kstat.c,v 1.2 2022/01/31 05:09:17 dlg Exp $ */
+/* $OpenBSD: kstat.c,v 1.3 2024/07/08 14:46:47 mpi Exp $ */
 
 /*
  * Copyright (c) 2020 David Gwynne <dlg@openbsd.org>
@@ -593,7 +593,7 @@ kstat_cpu_enter(void *p)
 void
 kstat_cpu_leave(void *p)
 {
-	atomic_clearbits_int(&curproc->p_flag, P_CPUPEG);
+	sched_unpeg_curproc();
 }
 
 void
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_atomfirmware.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_atomfirmware.c
index 23651a973..6521d06c7 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_atomfirmware.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_atomfirmware.c
@@ -399,7 +399,7 @@ amdgpu_atomfirmware_get_vram_info(struct amdgpu_device *adev,
 					mem_channel_number = vram_info->v30.channel_num;
 					mem_channel_width = vram_info->v30.channel_width;
 					if (vram_width)
-						*vram_width = mem_channel_number * (1 << mem_channel_width);
+						*vram_width = mem_channel_number * 16;
 					break;
 				default:
 					return -EINVAL;
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
index 2d9660991..7e894d9a7 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_device.c
@@ -4803,11 +4803,14 @@ int amdgpu_device_mode1_reset(struct amdgpu_device *adev)
 
 	dev_info(adev->dev, "GPU mode1 reset\n");
 
+	/* Cache the state before bus master disable. The saved config space
+	 * values are used in other cases like restore after mode-2 reset.
+	 */
+	amdgpu_device_cache_pci_state(adev->pdev);
+
 	/* disable BM */
 	pci_clear_master(adev->pdev);
 
-	amdgpu_device_cache_pci_state(adev->pdev);
-
 	if (amdgpu_dpm_is_mode1_reset_supported(adev)) {
 		dev_info(adev->dev, "GPU smu mode1 reset\n");
 		ret = amdgpu_dpm_mode1_reset(adev);
diff --git a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_capability.c b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_capability.c
index 0d2d269e8..5101c9054 100644
--- a/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_capability.c
+++ b/sys/dev/pci/drm/amd/display/dc/link/protocols/link_dp_capability.c
@@ -1584,9 +1584,17 @@ static bool retrieve_link_cap(struct dc_link *link)
 			return false;
 	}
 
-	if (dp_is_lttpr_present(link))
+	if (dp_is_lttpr_present(link)) {
 		configure_lttpr_mode_transparent(link);
 
+		// Echo TOTAL_LTTPR_CNT back downstream
+		core_link_write_dpcd(
+				link,
+				DP_TOTAL_LTTPR_CNT,
+				&link->dpcd_caps.lttpr_caps.phy_repeater_cnt,
+				sizeof(link->dpcd_caps.lttpr_caps.phy_repeater_cnt));
+	}
+
 	/* Read DP tunneling information. */
 	status = dpcd_get_tunneling_device_data(link);
 
diff --git a/sys/dev/pci/drm/amd/display/include/dpcd_defs.h b/sys/dev/pci/drm/amd/display/include/dpcd_defs.h
index 914f28e9f..aee5170f5 100644
--- a/sys/dev/pci/drm/amd/display/include/dpcd_defs.h
+++ b/sys/dev/pci/drm/amd/display/include/dpcd_defs.h
@@ -177,4 +177,9 @@ enum dpcd_psr_sink_states {
 #define DP_SINK_PR_PIXEL_DEVIATION_PER_LINE     0x379
 #define DP_SINK_PR_MAX_NUMBER_OF_DEVIATION_LINE 0x37A
 
+/* Remove once drm_dp_helper.h is updated upstream */
+#ifndef DP_TOTAL_LTTPR_CNT
+#define DP_TOTAL_LTTPR_CNT                                  0xF000A /* 2.1 */
+#endif
+
 #endif /* __DAL_DPCD_DEFS_H__ */
diff --git a/sys/dev/pci/drm/drm_fb_helper.c b/sys/dev/pci/drm/drm_fb_helper.c
index 0911eb6cd..1a0be9cb2 100644
--- a/sys/dev/pci/drm/drm_fb_helper.c
+++ b/sys/dev/pci/drm/drm_fb_helper.c
@@ -532,6 +532,9 @@ struct fb_info *drm_fb_helper_alloc_info(struct drm_fb_helper *fb_helper)
 	if (!info)
 		return ERR_PTR(-ENOMEM);
 
+	if (!drm_leak_fbdev_smem)
+		info->flags |= FBINFO_HIDE_SMEM_START;
+
 #ifdef __linux__
 	ret = fb_alloc_cmap(&info->cmap, 256, 0);
 	if (ret)
@@ -1925,9 +1928,6 @@ __drm_fb_helper_initial_config_and_unlock(struct drm_fb_helper *fb_helper)
 	info = fb_helper->info;
 	info->var.pixclock = 0;
 
-	if (!drm_leak_fbdev_smem)
-		info->flags |= FBINFO_HIDE_SMEM_START;
-
 	/* Need to drop locks to avoid recursive deadlock in
 	 * register_framebuffer. This is ok because the only thing left to do is
 	 * register the fbdev emulation instance in kernel_fb_helper_list. */
diff --git a/sys/dev/pci/drm/drm_fbdev_dma.c b/sys/dev/pci/drm/drm_fbdev_dma.c
index 4ef5cbb3a..64e81c320 100644
--- a/sys/dev/pci/drm/drm_fbdev_dma.c
+++ b/sys/dev/pci/drm/drm_fbdev_dma.c
@@ -138,7 +138,10 @@ static int drm_fbdev_dma_helper_fb_probe(struct drm_fb_helper *fb_helper,
 		info->flags |= FBINFO_READS_FAST; /* signal caching */
 	info->screen_size = sizes->surface_height * fb->pitches[0];
 	info->screen_buffer = map.vaddr;
-	info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer));
+	if (!(info->flags & FBINFO_HIDE_SMEM_START)) {
+		if (!drm_WARN_ON(dev, is_vmalloc_addr(info->screen_buffer)))
+			info->fix.smem_start = page_to_phys(virt_to_page(info->screen_buffer));
+	}
 	info->fix.smem_len = info->screen_size;
 
 	return 0;
diff --git a/sys/dev/pci/drm/drm_file.c b/sys/dev/pci/drm/drm_file.c
index 1920e89d6..a4f3e5c81 100644
--- a/sys/dev/pci/drm/drm_file.c
+++ b/sys/dev/pci/drm/drm_file.c
@@ -551,14 +551,12 @@ void drm_file_update_pid(struct drm_file *filp)
 
 	dev = filp->minor->dev;
 	mutex_lock(&dev->filelist_mutex);
+	get_pid(pid);
 	old = rcu_replace_pointer(filp->pid, pid, 1);
 	mutex_unlock(&dev->filelist_mutex);
 
-	if (pid != old) {
-		get_pid(pid);
-		synchronize_rcu();
-		put_pid(old);
-	}
+	synchronize_rcu();
+	put_pid(old);
 #endif
 }
 
diff --git a/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c b/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
index 29727199a..bbb3987f0 100644
--- a/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
+++ b/sys/dev/pci/drm/i915/gt/intel_ggtt_fencing.c
@@ -298,6 +298,7 @@ void i915_vma_revoke_fence(struct i915_vma *vma)
 		return;
 
 	GEM_BUG_ON(fence->vma != vma);
+	i915_active_wait(&fence->active);
 	GEM_BUG_ON(!i915_active_is_idle(&fence->active));
 	GEM_BUG_ON(atomic_read(&fence->pin_count));
 
diff --git a/sys/dev/pci/drm/radeon/radeon.h b/sys/dev/pci/drm/radeon/radeon.h
index ff6a5ede5..afa0c1870 100644
--- a/sys/dev/pci/drm/radeon/radeon.h
+++ b/sys/dev/pci/drm/radeon/radeon.h
@@ -143,7 +143,6 @@ extern int radeon_cik_support;
 /* RADEON_IB_POOL_SIZE must be a power of 2 */
 #define RADEON_IB_POOL_SIZE			16
 #define RADEON_DEBUGFS_MAX_COMPONENTS		32
-#define RADEONFB_CONN_LIMIT			4
 #define RADEON_BIOS_NUM_SCRATCH			8
 
 /* internal ring indices */
diff --git a/sys/dev/pci/drm/radeon/radeon_display.c b/sys/dev/pci/drm/radeon/radeon_display.c
index 94132c37d..d12805c6d 100644
--- a/sys/dev/pci/drm/radeon/radeon_display.c
+++ b/sys/dev/pci/drm/radeon/radeon_display.c
@@ -683,7 +683,7 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
 	struct radeon_device *rdev = dev->dev_private;
 	struct radeon_crtc *radeon_crtc;
 
-	radeon_crtc = kzalloc(sizeof(struct radeon_crtc) + (RADEONFB_CONN_LIMIT * sizeof(struct drm_connector *)), GFP_KERNEL);
+	radeon_crtc = kzalloc(sizeof(*radeon_crtc), GFP_KERNEL);
 	if (radeon_crtc == NULL)
 		return;
 
@@ -709,12 +709,6 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
 	dev->mode_config.cursor_width = radeon_crtc->max_cursor_width;
 	dev->mode_config.cursor_height = radeon_crtc->max_cursor_height;
 
-#if 0
-	radeon_crtc->mode_set.crtc = &radeon_crtc->base;
-	radeon_crtc->mode_set.connectors = (struct drm_connector **)(radeon_crtc + 1);
-	radeon_crtc->mode_set.num_connectors = 0;
-#endif
-
 	if (rdev->is_atom_bios && (ASIC_IS_AVIVO(rdev) || radeon_r4xx_atom))
 		radeon_atombios_init_crtc(dev, radeon_crtc);
 	else
diff --git a/sys/kern/kern_acct.c b/sys/kern/kern_acct.c
index 1f56705d3..32c574e18 100644
--- a/sys/kern/kern_acct.c
+++ b/sys/kern/kern_acct.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_acct.c,v 1.48 2024/04/13 23:44:11 jsg Exp $	*/
+/*	$OpenBSD: kern_acct.c,v 1.49 2024/07/08 13:17:11 claudio Exp $	*/
 /*	$NetBSD: kern_acct.c,v 1.42 1996/02/04 02:15:12 christos Exp $	*/
 
 /*-
@@ -169,6 +169,7 @@ acct_process(struct proc *p)
 	struct acct acct;
 	struct process *pr = p->p_p;
 	struct rusage *r;
+	struct tusage tu;
 	struct timespec booted, elapsed, realstart, st, tmp, uptime, ut;
 	int t;
 	struct vnode *vp;
@@ -196,7 +197,8 @@ acct_process(struct proc *p)
 	memcpy(acct.ac_comm, pr->ps_comm, sizeof acct.ac_comm);
 
 	/* (2) The amount of user and system time that was used */
-	calctsru(&pr->ps_tu, &ut, &st, NULL);
+	tuagg_get_process(&tu, pr);
+	calctsru(&tu, &ut, &st, NULL);
 	acct.ac_utime = encode_comp_t(ut.tv_sec, ut.tv_nsec);
 	acct.ac_stime = encode_comp_t(st.tv_sec, st.tv_nsec);
 
@@ -231,7 +233,7 @@ acct_process(struct proc *p)
 	else
 		acct.ac_tty = -1;
 
-	/* (8) The boolean flags that tell how process terminated or misbehaved. */
+	/* (8) The flags that tell how process terminated or misbehaved. */
 	acct.ac_flag = pr->ps_acflag;
 
 	/* Extensions */
diff --git a/sys/kern/kern_clock.c b/sys/kern/kern_clock.c
index f851089aa..f166be765 100644
--- a/sys/kern/kern_clock.c
+++ b/sys/kern/kern_clock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_clock.c,v 1.123 2024/02/12 22:07:33 cheloha Exp $	*/
+/*	$OpenBSD: kern_clock.c,v 1.124 2024/07/08 13:17:11 claudio Exp $	*/
 /*	$NetBSD: kern_clock.c,v 1.34 1996/06/09 04:51:03 briggs Exp $	*/
 
 /*-
@@ -281,7 +281,9 @@ statclock(struct clockrequest *cr, void *cf, void *arg)
 		 * Came from user mode; CPU was in user state.
 		 * If this process is being profiled record the tick.
 		 */
-		p->p_uticks += count;
+		tu_enter(&p->p_tu);
+		p->p_tu.tu_uticks += count;
+		tu_leave(&p->p_tu);
 		if (pr->ps_nice > NZERO)
 			spc->spc_cp_time[CP_NICE] += count;
 		else
@@ -301,12 +303,17 @@ statclock(struct clockrequest *cr, void *cf, void *arg)
 		 * in ``non-process'' (i.e., interrupt) work.
 		 */
 		if (CLKF_INTR(frame)) {
-			if (p != NULL)
-				p->p_iticks += count;
+			if (p != NULL) {
+				tu_enter(&p->p_tu);
+				p->p_tu.tu_iticks += count;
+				tu_leave(&p->p_tu);
+			}
 			spc->spc_cp_time[spc->spc_spinning ?
 			    CP_SPIN : CP_INTR] += count;
 		} else if (p != NULL && p != spc->spc_idleproc) {
-			p->p_sticks += count;
+			tu_enter(&p->p_tu);
+			p->p_tu.tu_sticks += count;
+			tu_leave(&p->p_tu);
 			spc->spc_cp_time[spc->spc_spinning ?
 			    CP_SPIN : CP_SYS] += count;
 		} else
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 7d87a4cbc..df61b2c57 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exec.c,v 1.255 2024/04/02 08:39:16 deraadt Exp $	*/
+/*	$OpenBSD: kern_exec.c,v 1.256 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: kern_exec.c,v 1.75 1996/02/09 18:59:28 christos Exp $	*/
 
 /*-
@@ -699,6 +699,7 @@ sys_execve(struct proc *p, void *v, register_t *retval)
 	/* reset CPU time usage for the thread, but not the process */
 	timespecclear(&p->p_tu.tu_runtime);
 	p->p_tu.tu_uticks = p->p_tu.tu_sticks = p->p_tu.tu_iticks = 0;
+	p->p_tu.tu_gen = 0;
 
 	memset(p->p_name, 0, sizeof p->p_name);
 
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index af34d278d..ba87dcd42 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_exit.c,v 1.222 2024/06/03 12:48:25 claudio Exp $	*/
+/*	$OpenBSD: kern_exit.c,v 1.224 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: kern_exit.c,v 1.39 1996/04/22 01:38:25 christos Exp $	*/
 
 /*
@@ -118,7 +118,7 @@ exit1(struct proc *p, int xexit, int xsig, int flags)
 {
 	struct process *pr, *qr, *nqr;
 	struct rusage *rup;
-	struct timespec ts;
+	struct timespec ts, pts;
 
 	atomic_setbits_int(&p->p_flag, P_WEXIT);
 
@@ -168,6 +168,19 @@ exit1(struct proc *p, int xexit, int xsig, int flags)
 			wakeup(&pr->ps_singlecnt);
 	}
 
+	/* proc is off ps_threads list so update accounting of process now */
+	nanouptime(&ts);
+	if (timespeccmp(&ts, &curcpu()->ci_schedstate.spc_runtime, <))
+		timespecclear(&pts);
+	else
+		timespecsub(&ts, &curcpu()->ci_schedstate.spc_runtime, &pts);
+	tu_enter(&p->p_tu);
+	timespecadd(&p->p_tu.tu_runtime, &pts, &p->p_tu.tu_runtime);
+	tu_leave(&p->p_tu);
+	/* adjust spc_runtime to not double account the runtime from above */
+	curcpu()->ci_schedstate.spc_runtime = ts;
+	tuagg_add_process(p->p_p, p);
+
 	if ((p->p_flag & P_THREAD) == 0) {
 		/* main thread gotta wait because it has the pid, et al */
 		while (pr->ps_threadcnt + pr->ps_exitcnt > 1)
@@ -323,14 +336,6 @@ exit1(struct proc *p, int xexit, int xsig, int flags)
 
 	/* add thread's accumulated rusage into the process's total */
 	ruadd(rup, &p->p_ru);
-	nanouptime(&ts);
-	if (timespeccmp(&ts, &curcpu()->ci_schedstate.spc_runtime, <))
-		timespecclear(&ts);
-	else
-		timespecsub(&ts, &curcpu()->ci_schedstate.spc_runtime, &ts);
-	SCHED_LOCK();
-	tuagg_locked(pr, p, &ts);
-	SCHED_UNLOCK();
 
 	/*
 	 * clear %cpu usage during swap
@@ -340,7 +345,7 @@ exit1(struct proc *p, int xexit, int xsig, int flags)
 	if ((p->p_flag & P_THREAD) == 0) {
 		/*
 		 * Final thread has died, so add on our children's rusage
-		 * and calculate the total times
+		 * and calculate the total times.
 		 */
 		calcru(&pr->ps_tu, &rup->ru_utime, &rup->ru_stime, NULL);
 		ruadd(rup, &pr->ps_cru);
@@ -358,7 +363,7 @@ exit1(struct proc *p, int xexit, int xsig, int flags)
 		}
 	}
 
-	/* just a thread? detach it from its process */
+	/* just a thread? check if last one standing. */
 	if (p->p_flag & P_THREAD) {
 		/* scheduler_wait_hook(pr->ps_mainproc, p); XXX */
 		mtx_enter(&pr->ps_mtx);
@@ -398,12 +403,8 @@ struct mutex deadproc_mutex =
 struct proclist deadproc = LIST_HEAD_INITIALIZER(deadproc);
 
 /*
- * We are called from cpu_exit() once it is safe to schedule the
- * dead process's resources to be freed.
- *
- * NOTE: One must be careful with locking in this routine.  It's
- * called from a critical section in machine-dependent code, so
- * we should refrain from changing any interrupt state.
+ * We are called from sched_idle() once it is safe to schedule the
+ * dead process's resources to be freed. So this is not allowed to sleep.
  *
  * We lock the deadproc list, place the proc on that list (using
  * the p_hash member), and wake up the reaper.
@@ -411,6 +412,11 @@ struct proclist deadproc = LIST_HEAD_INITIALIZER(deadproc);
 void
 exit2(struct proc *p)
 {
+	/* account the remainder of time spent in exit1() */
+	mtx_enter(&p->p_p->ps_mtx);
+	tuagg_add_process(p->p_p, p);
+	mtx_leave(&p->p_p->ps_mtx);
+
 	mtx_enter(&deadproc_mutex);
 	LIST_INSERT_HEAD(&deadproc, p, p_hash);
 	mtx_leave(&deadproc_mutex);
diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
index 4890a75f2..7d6b90260 100644
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_proc.c,v 1.98 2024/05/20 10:32:20 claudio Exp $	*/
+/*	$OpenBSD: kern_proc.c,v 1.99 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: kern_proc.c,v 1.14 1996/02/09 18:59:41 christos Exp $	*/
 
 /*
@@ -503,9 +503,9 @@ proc_printit(struct proc *p, const char *modif,
 	(*pr)("    process=%p user=%p, vmspace=%p\n",
 	    p->p_p, p->p_addr, p->p_vmspace);
 	(*pr)("    estcpu=%u, cpticks=%d, pctcpu=%u.%u, "
-	    "user=%u, sys=%u, intr=%u\n",
+	    "user=%llu, sys=%llu, intr=%llu\n",
 	    p->p_estcpu, p->p_cpticks, p->p_pctcpu / 100, p->p_pctcpu % 100,
-	    p->p_uticks, p->p_sticks, p->p_iticks);
+	    p->p_tu.tu_uticks, p->p_tu.tu_sticks, p->p_tu.tu_iticks);
 }
 #include <machine/db_machdep.h>
 
diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
index bfacce9ad..c45d9a844 100644
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_resource.c,v 1.84 2024/06/03 12:48:25 claudio Exp $	*/
+/*	$OpenBSD: kern_resource.c,v 1.85 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: kern_resource.c,v 1.38 1996/10/23 07:19:38 matthias Exp $	*/
 
 /*-
@@ -64,7 +64,7 @@ struct plimit	*lim_copy(struct plimit *);
 struct plimit	*lim_write_begin(void);
 void		 lim_write_commit(struct plimit *);
 
-void	tuagg_sub(struct tusage *, struct proc *, const struct timespec *);
+void	tuagg_sumup(struct tusage *, const struct tusage *);
 
 /*
  * Patchable maximum data and stack limits.
@@ -368,36 +368,80 @@ sys_getrlimit(struct proc *p, void *v, register_t *retval)
 	return (error);
 }
 
+/* Add the counts from *from to *tu, ensuring a consistent read of *from. */ 
 void
-tuagg_sub(struct tusage *tup, struct proc *p, const struct timespec *ts)
+tuagg_sumup(struct tusage *tu, const struct tusage *from)
 {
-	if (ts != NULL)
-		timespecadd(&tup->tu_runtime, ts, &tup->tu_runtime);
-	tup->tu_uticks += p->p_uticks;
-	tup->tu_sticks += p->p_sticks;
-	tup->tu_iticks += p->p_iticks;
+	struct tusage	tmp;
+	uint64_t	enter, leave;
+
+	enter = from->tu_gen;
+	for (;;) {
+		/* the generation number is odd during an update */
+		while (enter & 1) {
+			CPU_BUSY_CYCLE();
+			enter = from->tu_gen;
+		}
+
+		membar_consumer();
+		tmp = *from;
+		membar_consumer();
+		leave = from->tu_gen;
+
+		if (enter == leave)
+			break;
+		enter = leave;
+	}
+
+	tu->tu_uticks += tmp.tu_uticks;
+	tu->tu_sticks += tmp.tu_sticks;
+	tu->tu_iticks += tmp.tu_iticks;
+	timespecadd(&tu->tu_runtime, &tmp.tu_runtime, &tu->tu_runtime);
+}
+
+void
+tuagg_get_proc(struct tusage *tu, struct proc *p)
+{
+	memset(tu, 0, sizeof(*tu));
+	tuagg_sumup(tu, &p->p_tu);
+}
+
+void
+tuagg_get_process(struct tusage *tu, struct process *pr)
+{
+	struct proc *q;
+
+	memset(tu, 0, sizeof(*tu));
+
+	mtx_enter(&pr->ps_mtx);
+	tuagg_sumup(tu, &pr->ps_tu);
+	/* add on all living threads */
+	TAILQ_FOREACH(q, &pr->ps_threads, p_thr_link)
+		tuagg_sumup(tu, &q->p_tu);
+	mtx_leave(&pr->ps_mtx);
 }
 
 /*
- * Aggregate a single thread's immediate time counts into the running
- * totals for the thread and process
+ * Update the process ps_tu usage with the values from proc p while
+ * doing so the times for proc p are reset.
+ * This requires that p is either curproc or SDEAD and that the
+ * IPL is higher than IPL_STATCLOCK. ps_mtx uses IPL_HIGH so
+ * this should always be the case.
  */
 void
-tuagg_locked(struct process *pr, struct proc *p, const struct timespec *ts)
+tuagg_add_process(struct process *pr, struct proc *p)
 {
-	tuagg_sub(&pr->ps_tu, p, ts);
-	tuagg_sub(&p->p_tu, p, ts);
-	p->p_uticks = 0;
-	p->p_sticks = 0;
-	p->p_iticks = 0;
-}
+	MUTEX_ASSERT_LOCKED(&pr->ps_mtx);
+	splassert(IPL_STATCLOCK);
+	KASSERT(curproc == p || p->p_stat == SDEAD);
 
-void
-tuagg(struct process *pr, struct proc *p)
-{
-	SCHED_LOCK();
-	tuagg_locked(pr, p, NULL);
-	SCHED_UNLOCK();
+	tu_enter(&pr->ps_tu);
+	tuagg_sumup(&pr->ps_tu, &p->p_tu);
+	tu_leave(&pr->ps_tu);
+
+	/* Now reset CPU time usage for the thread. */
+	timespecclear(&p->p_tu.tu_runtime);
+	p->p_tu.tu_uticks = p->p_tu.tu_sticks = p->p_tu.tu_iticks = 0;
 }
 
 /*
@@ -474,6 +518,7 @@ dogetrusage(struct proc *p, int who, struct rusage *rup)
 {
 	struct process *pr = p->p_p;
 	struct proc *q;
+	struct tusage tu = { 0 };
 
 	KERNEL_ASSERT_LOCKED();
 
@@ -484,14 +529,15 @@ dogetrusage(struct proc *p, int who, struct rusage *rup)
 			*rup = *pr->ps_ru;
 		else
 			memset(rup, 0, sizeof(*rup));
+		tuagg_sumup(&tu, &pr->ps_tu);
 
 		/* add on all living threads */
 		TAILQ_FOREACH(q, &pr->ps_threads, p_thr_link) {
 			ruadd(rup, &q->p_ru);
-			tuagg(pr, q);
+			tuagg_sumup(&tu, &q->p_tu);
 		}
 
-		calcru(&pr->ps_tu, &rup->ru_utime, &rup->ru_stime, NULL);
+		calcru(&tu, &rup->ru_utime, &rup->ru_stime, NULL);
 		break;
 
 	case RUSAGE_THREAD:
diff --git a/sys/kern/kern_sched.c b/sys/kern/kern_sched.c
index 1877d5730..bb92ded02 100644
--- a/sys/kern/kern_sched.c
+++ b/sys/kern/kern_sched.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sched.c,v 1.96 2024/06/03 12:48:25 claudio Exp $	*/
+/*	$OpenBSD: kern_sched.c,v 1.99 2024/07/08 16:15:42 mpi Exp $	*/
 /*
  * Copyright (c) 2007, 2008 Artur Grabowski <art@openbsd.org>
  *
@@ -213,9 +213,22 @@ void
 sched_exit(struct proc *p)
 {
 	struct schedstate_percpu *spc = &curcpu()->ci_schedstate;
+	struct timespec ts;
 
 	LIST_INSERT_HEAD(&spc->spc_deadproc, p, p_hash);
 
+	/* update the tu_runtime one last time */
+	nanouptime(&ts);
+	if (timespeccmp(&ts, &spc->spc_runtime, <))
+		timespecclear(&ts);
+	else
+		timespecsub(&ts, &spc->spc_runtime, &ts);
+
+	/* add the time counts for this thread */
+	tu_enter(&p->p_tu);
+	timespecadd(&p->p_tu.tu_runtime, &ts, &p->p_tu.tu_runtime);
+	tu_leave(&p->p_tu);
+
 	KERNEL_ASSERT_LOCKED();
 	sched_toidle();
 }
@@ -633,6 +646,14 @@ sched_peg_curproc(struct cpu_info *ci)
 	SCHED_UNLOCK();
 }
 
+void
+sched_unpeg_curproc(void)
+{
+	struct proc *p = curproc;
+
+	atomic_clearbits_int(&p->p_flag, P_CPUPEG);
+}
+
 #ifdef MULTIPROCESSOR
 
 void
@@ -699,7 +720,7 @@ sched_barrier_task(void *arg)
 
 	sched_peg_curproc(ci);
 	cond_signal(&sb->cond);
-	atomic_clearbits_int(&curproc->p_flag, P_CPUPEG);
+	sched_unpeg_curproc();
 }
 
 void
diff --git a/sys/kern/kern_smr.c b/sys/kern/kern_smr.c
index 6227c1df8..14dad2622 100644
--- a/sys/kern/kern_smr.c
+++ b/sys/kern/kern_smr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_smr.c,v 1.16 2022/08/14 01:58:27 jsg Exp $	*/
+/*	$OpenBSD: kern_smr.c,v 1.17 2024/07/08 14:46:47 mpi Exp $	*/
 
 /*
  * Copyright (c) 2019-2020 Visa Hankala
@@ -163,7 +163,7 @@ smr_grace_wait(void)
 		sched_peg_curproc(ci);
 		KASSERT(ci->ci_schedstate.spc_smrgp == smrgp);
 	}
-	atomic_clearbits_int(&curproc->p_flag, P_CPUPEG);
+	sched_unpeg_curproc();
 #endif /* MULTIPROCESSOR */
 }
 
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index a9a65e649..709b99a76 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_sysctl.c,v 1.427 2024/04/12 16:07:09 bluhm Exp $	*/
+/*	$OpenBSD: kern_sysctl.c,v 1.428 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: kern_sysctl.c,v 1.17 1996/05/20 17:49:05 mrg Exp $	*/
 
 /*-
@@ -1773,14 +1773,18 @@ fill_kproc(struct process *pr, struct kinfo_proc *ki, struct proc *p,
 	struct tty *tp;
 	struct vmspace *vm = pr->ps_vmspace;
 	struct timespec booted, st, ut, utc;
+	struct tusage tu;
 	int isthread;
 
 	isthread = p != NULL;
-	if (!isthread)
+	if (!isthread) {
 		p = pr->ps_mainproc;		/* XXX */
+		tuagg_get_process(&tu, pr);
+	} else
+		tuagg_get_proc(&tu, p);
 
 	FILL_KPROC(ki, strlcpy, p, pr, pr->ps_ucred, pr->ps_pgrp,
-	    p, pr, s, vm, pr->ps_limit, pr->ps_sigacts, isthread,
+	    p, pr, s, vm, pr->ps_limit, pr->ps_sigacts, &tu, isthread,
 	    show_pointers);
 
 	/* stuff that's too painful to generalize into the macros */
@@ -1803,7 +1807,7 @@ fill_kproc(struct process *pr, struct kinfo_proc *ki, struct proc *p,
 	if ((pr->ps_flags & PS_ZOMBIE) == 0) {
 		if ((pr->ps_flags & PS_EMBRYO) == 0 && vm != NULL)
 			ki->p_vm_rssize = vm_resident_count(vm);
-		calctsru(isthread ? &p->p_tu : &pr->ps_tu, &ut, &st, NULL);
+		calctsru(&tu, &ut, &st, NULL);
 		ki->p_uutime_sec = ut.tv_sec;
 		ki->p_uutime_usec = ut.tv_nsec/1000;
 		ki->p_ustime_sec = st.tv_sec;
diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c
index 6fdb082eb..690f4859c 100644
--- a/sys/kern/kern_time.c
+++ b/sys/kern/kern_time.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: kern_time.c,v 1.167 2023/10/17 00:04:02 cheloha Exp $	*/
+/*	$OpenBSD: kern_time.c,v 1.168 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: kern_time.c,v 1.20 1996/02/18 11:57:06 fvdl Exp $	*/
 
 /*
@@ -40,6 +40,7 @@
 #include <sys/rwlock.h>
 #include <sys/proc.h>
 #include <sys/ktrace.h>
+#include <sys/resourcevar.h>
 #include <sys/signalvar.h>
 #include <sys/stdint.h>
 #include <sys/pledge.h>
@@ -112,6 +113,7 @@ settime(const struct timespec *ts)
 int
 clock_gettime(struct proc *p, clockid_t clock_id, struct timespec *tp)
 {
+	struct tusage tu;
 	struct proc *q;
 	int error = 0;
 
@@ -128,13 +130,15 @@ clock_gettime(struct proc *p, clockid_t clock_id, struct timespec *tp)
 		break;
 	case CLOCK_PROCESS_CPUTIME_ID:
 		nanouptime(tp);
+		tuagg_get_process(&tu, p->p_p);
 		timespecsub(tp, &curcpu()->ci_schedstate.spc_runtime, tp);
-		timespecadd(tp, &p->p_p->ps_tu.tu_runtime, tp);
+		timespecadd(tp, &tu.tu_runtime, tp);
 		break;
 	case CLOCK_THREAD_CPUTIME_ID:
 		nanouptime(tp);
+		tuagg_get_proc(&tu, p);
 		timespecsub(tp, &curcpu()->ci_schedstate.spc_runtime, tp);
-		timespecadd(tp, &p->p_tu.tu_runtime, tp);
+		timespecadd(tp, &tu.tu_runtime, tp);
 		break;
 	default:
 		/* check for clock from pthread_getcpuclockid() */
diff --git a/sys/kern/sched_bsd.c b/sys/kern/sched_bsd.c
index 54ce3173e..d6b18d30b 100644
--- a/sys/kern/sched_bsd.c
+++ b/sys/kern/sched_bsd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched_bsd.c,v 1.93 2024/06/03 12:48:25 claudio Exp $	*/
+/*	$OpenBSD: sched_bsd.c,v 1.94 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: kern_synch.c,v 1.37 1996/04/22 01:38:37 christos Exp $	*/
 
 /*-
@@ -344,7 +344,6 @@ mi_switch(void)
 	struct schedstate_percpu *spc = &curcpu()->ci_schedstate;
 	struct proc *p = curproc;
 	struct proc *nextproc;
-	struct process *pr = p->p_p;
 	struct timespec ts;
 	int oldipl;
 #ifdef MULTIPROCESSOR
@@ -382,9 +381,9 @@ mi_switch(void)
 	} else {
 		timespecsub(&ts, &spc->spc_runtime, &ts);
 	}
-
-	/* add the time counts for this thread to the process's total */
-	tuagg_locked(pr, p, &ts);
+	tu_enter(&p->p_tu);
+	timespecadd(&p->p_tu.tu_runtime, &ts, &p->p_tu.tu_runtime);
+	tu_leave(&p->p_tu);
 
 	/* Stop any optional clock interrupts. */
 	if (ISSET(spc->spc_schedflags, SPCF_ITIMER)) {
diff --git a/sys/kern/tty.c b/sys/kern/tty.c
index ec1842483..14586e44c 100644
--- a/sys/kern/tty.c
+++ b/sys/kern/tty.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tty.c,v 1.176 2022/08/14 01:58:28 jsg Exp $	*/
+/*	$OpenBSD: tty.c,v 1.177 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: tty.c,v 1.68.4.2 1996/06/06 16:04:52 thorpej Exp $	*/
 
 /*-
@@ -2152,6 +2152,7 @@ ttyinfo(struct tty *tp)
 {
 	struct process *pr, *pickpr;
 	struct proc *p, *pick;
+	struct tusage tu;
 	struct timespec utime, stime;
 	int tmp;
 
@@ -2214,7 +2215,8 @@ update_pickpr:
 		    pickpr->ps_vmspace != NULL)
 			rss = vm_resident_count(pickpr->ps_vmspace);
 
-		calctsru(&pickpr->ps_tu, &utime, &stime, NULL);
+		tuagg_get_process(&tu, pickpr);
+		calctsru(&tu, &utime, &stime, NULL);
 
 		/* Round up and print user time. */
 		utime.tv_nsec += 5000000;
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 3d6719dc9..0a2a3989f 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.h,v 1.361 2024/05/20 10:32:20 claudio Exp $	*/
+/*	$OpenBSD: proc.h,v 1.362 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: proc.h,v 1.44 1996/04/22 01:23:21 christos Exp $	*/
 
 /*-
@@ -87,14 +87,19 @@ struct	pgrp {
 
 /*
  * time usage: accumulated times in ticks
- * Once a second, each thread's immediate counts (p_[usi]ticks) are
- * accumulated into these.
+ * Each thread is immediatly accumulated here. For processes only the
+ * time of exited threads is accumulated and to get the proper process
+ * time usage tuagg_get_process() needs to be called.
+ * Accounting of threads is done lockless by curproc using the tu_gen
+ * generation counter. Code should use tu_enter() and tu_leave() for this.
+ * The process ps_tu structure is locked by the ps_mtx.
  */
 struct tusage {
-	struct	timespec tu_runtime;	/* Realtime. */
+	uint64_t	tu_gen;		/* generation counter */
 	uint64_t	tu_uticks;	/* Statclock hits in user mode. */
 	uint64_t	tu_sticks;	/* Statclock hits in system mode. */
 	uint64_t	tu_iticks;	/* Statclock hits processing intr. */
+	struct	timespec tu_runtime;	/* Realtime. */
 };
 
 /*
@@ -197,7 +202,7 @@ struct process {
 	struct	ptrace_state *ps_ptstat;/* Ptrace state */
 
 	struct	rusage *ps_ru;		/* sum of stats for dead threads. */
-	struct	tusage ps_tu;		/* accumulated times. */
+	struct	tusage ps_tu;		/* [m] accumul times of dead threads. */
 	struct	rusage ps_cru;		/* sum of stats for reaped children */
 	struct	itimerspec ps_timer[3];	/* [m] ITIMER_REAL timer */
 					/* [T] ITIMER_{VIRTUAL,PROF} timers */
@@ -360,13 +365,10 @@ struct proc {
 	const char *p_wmesg;		/* [S] Reason for sleep. */
 	fixpt_t	p_pctcpu;		/* [S] %cpu for this thread */
 	u_int	p_slptime;		/* [S] Time since last blocked. */
-	u_int	p_uticks;		/* Statclock hits in user mode. */
-	u_int	p_sticks;		/* Statclock hits in system mode. */
-	u_int	p_iticks;		/* Statclock hits processing intr. */
 	struct	cpu_info * volatile p_cpu; /* [S] CPU we're running on. */
 
 	struct	rusage p_ru;		/* Statistics */
-	struct	tusage p_tu;		/* accumulated times. */
+	struct	tusage p_tu;		/* [o] accumulated times. */
 
 	struct	plimit	*p_limit;	/* [l] read ref. of p_p->ps_limit */
 	struct	kcov_dev *p_kd;		/* kcov device handle */
@@ -634,6 +636,20 @@ void cpuset_complement(struct cpuset *, struct cpuset *, struct cpuset *);
 int cpuset_cardinality(struct cpuset *);
 struct cpu_info *cpuset_first(struct cpuset *);
 
+static inline void
+tu_enter(struct tusage *tu)
+{
+	++tu->tu_gen; /* make the generation number odd */
+	membar_producer();
+}
+
+static inline void
+tu_leave(struct tusage *tu)
+{
+	membar_producer();
+	++tu->tu_gen; /* make the generation number even again */
+}
+
 #endif	/* _KERNEL */
 #endif	/* !_SYS_PROC_H_ */
 
diff --git a/sys/sys/resourcevar.h b/sys/sys/resourcevar.h
index 07201edcf..e850d76e1 100644
--- a/sys/sys/resourcevar.h
+++ b/sys/sys/resourcevar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: resourcevar.h,v 1.31 2023/10/17 00:04:02 cheloha Exp $	*/
+/*	$OpenBSD: resourcevar.h,v 1.32 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: resourcevar.h,v 1.12 1995/11/22 23:01:53 cgd Exp $	*/
 
 /*
@@ -66,9 +66,10 @@ void	 addupc_intr(struct proc *, u_long, u_long);
 void	 addupc_task(struct proc *, u_long, u_int);
 struct clockrequest;
 void	 profclock(struct clockrequest *, void *, void *);
-void	 tuagg_locked(struct process *, struct proc *, const struct timespec *);
-void	 tuagg(struct process *, struct proc *);
+void	 tuagg_add_process(struct process *, struct proc *);
 struct tusage;
+void	 tuagg_get_proc(struct tusage *, struct proc *);
+void	 tuagg_get_process(struct tusage *, struct process *);
 void	 calctsru(struct tusage *, struct timespec *, struct timespec *,
 	    struct timespec *);
 void	 calcru(struct tusage *, struct timeval *, struct timeval *,
@@ -108,5 +109,6 @@ rlim_t	 lim_cur_proc(struct proc *, int);
 
 void	 ruadd(struct rusage *, struct rusage *);
 void	 rucheck(void *);
+
 #endif
 #endif	/* !_SYS_RESOURCEVAR_H_ */
diff --git a/sys/sys/sched.h b/sys/sys/sched.h
index dcc9b6366..2bd5c4e59 100644
--- a/sys/sys/sched.h
+++ b/sys/sys/sched.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sched.h,v 1.72 2024/06/03 12:48:25 claudio Exp $	*/
+/*	$OpenBSD: sched.h,v 1.73 2024/07/08 14:46:47 mpi Exp $	*/
 /* $NetBSD: sched.h,v 1.2 1999/02/28 18:14:58 ross Exp $ */
 
 /*-
@@ -169,6 +169,7 @@ void cpu_idle_enter(void);
 void cpu_idle_cycle(void);
 void cpu_idle_leave(void);
 void sched_peg_curproc(struct cpu_info *ci);
+void sched_unpeg_curproc(void);
 void sched_barrier(struct cpu_info *ci);
 
 int sysctl_hwsetperf(void *, size_t *, void *, size_t);
diff --git a/sys/sys/sysctl.h b/sys/sys/sysctl.h
index 7e9f19805..bf9c5184b 100644
--- a/sys/sys/sysctl.h
+++ b/sys/sys/sysctl.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sysctl.h,v 1.235 2023/10/01 15:58:12 krw Exp $	*/
+/*	$OpenBSD: sysctl.h,v 1.236 2024/07/08 13:17:12 claudio Exp $	*/
 /*	$NetBSD: sysctl.h,v 1.16 1996/04/09 20:55:36 cgd Exp $	*/
 
 /*
@@ -589,7 +589,7 @@ struct kinfo_vmentry {
 #define	_FILL_KPROC_MIN(a,b) (((a)<(b))?(a):(b))
 
 #define FILL_KPROC(kp, copy_str, p, pr, uc, pg, paddr, \
-    praddr, sess, vm, lim, sa, isthread, show_addresses) \
+    praddr, sess, vm, lim, sa, tu, isthread, show_addresses) \
 do {									\
 	memset((kp), 0, sizeof(*(kp)));					\
 									\
@@ -625,21 +625,16 @@ do {									\
 									\
 	(kp)->p_estcpu = (p)->p_estcpu;					\
 	if (isthread) {							\
-		(kp)->p_rtime_sec = (p)->p_tu.tu_runtime.tv_sec;	\
-		(kp)->p_rtime_usec = (p)->p_tu.tu_runtime.tv_nsec/1000;	\
 		(kp)->p_tid = (p)->p_tid + THREAD_PID_OFFSET;		\
-		(kp)->p_uticks = (p)->p_tu.tu_uticks;			\
-		(kp)->p_sticks = (p)->p_tu.tu_sticks;			\
-		(kp)->p_iticks = (p)->p_tu.tu_iticks;			\
 		strlcpy((kp)->p_name, (p)->p_name, sizeof((kp)->p_name)); \
 	} else {							\
-		(kp)->p_rtime_sec = (pr)->ps_tu.tu_runtime.tv_sec;	\
-		(kp)->p_rtime_usec = (pr)->ps_tu.tu_runtime.tv_nsec/1000; \
 		(kp)->p_tid = -1;					\
-		(kp)->p_uticks = (pr)->ps_tu.tu_uticks;			\
-		(kp)->p_sticks = (pr)->ps_tu.tu_sticks;			\
-		(kp)->p_iticks = (pr)->ps_tu.tu_iticks;			\
 	}								\
+	(kp)->p_rtime_sec = (tu)->tu_runtime.tv_sec;			\
+	(kp)->p_rtime_usec = (tu)->tu_runtime.tv_nsec/1000;		\
+	(kp)->p_uticks = (tu)->tu_uticks;				\
+	(kp)->p_sticks = (tu)->tu_sticks;				\
+	(kp)->p_iticks = (tu)->tu_iticks;				\
 	(kp)->p_cpticks = (p)->p_cpticks;				\
 									\
 	if (show_addresses)						\
diff --git a/usr.bin/aucat/aucat.c b/usr.bin/aucat/aucat.c
index 201b50dcd..145a6d6ce 100644
--- a/usr.bin/aucat/aucat.c
+++ b/usr.bin/aucat/aucat.c
@@ -147,13 +147,18 @@ static void *
 allocbuf(int nfr, int nch, int bps)
 {
 	size_t fsize;
+	void *ptr;
 
 	if (nch < 0 || nch > NCHAN_MAX || bps < 0 || bps > 4) {
 		log_puts("allocbuf: bogus channels or bytes per sample count\n");
 		panic();
 	}
 	fsize = nch * bps;
-	return reallocarray(NULL, nfr, fsize);
+
+	ptr = reallocarray(NULL, nfr, fsize);
+	if (ptr == NULL)
+		err(1, "reallocarray");
+	return ptr;
 }
 
 static void
diff --git a/usr.bin/dig/lib/isc/sockaddr.c b/usr.bin/dig/lib/isc/sockaddr.c
index 04dbd8e2c..2b491bbed 100644
--- a/usr.bin/dig/lib/isc/sockaddr.c
+++ b/usr.bin/dig/lib/isc/sockaddr.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: sockaddr.c,v 1.16 2022/01/17 18:19:51 naddy Exp $ */
+/* $Id: sockaddr.c,v 1.17 2024/07/08 13:46:33 florian Exp $ */
 
 /*! \file */
 #include <sys/types.h>
@@ -248,7 +248,7 @@ isc_sockaddr_ismulticast(const struct sockaddr_storage *sockaddr) {
 	switch (sockaddr->ss_family) {
 	case AF_INET:
 		sin = (struct sockaddr_in *)sockaddr;
-		return (IN_MULTICAST(sin->sin_addr.s_addr));
+		return (IN_MULTICAST(ntohl(sin->sin_addr.s_addr)));
 	case AF_INET6:
 		sin6 = (struct sockaddr_in6 *)sockaddr;
 		return (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr));
diff --git a/usr.bin/mg/util.c b/usr.bin/mg/util.c
index dd42085a2..19b19a5b5 100644
--- a/usr.bin/mg/util.c
+++ b/usr.bin/mg/util.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: util.c,v 1.50 2023/04/28 10:02:03 op Exp $	*/
+/*	$OpenBSD: util.c,v 1.51 2024/07/08 14:33:29 op Exp $	*/
 
 /* This file is in the public domain. */
 
@@ -354,9 +354,9 @@ doindent(int cols)
 
 	if (curbp->b_flag & BFNOTAB)
 		return (linsert(cols, ' '));
-	if ((n = cols / 8) != 0 && linsert(n, '\t') == FALSE)
+	if ((n = cols / curbp->b_tabw) != 0 && linsert(n, '\t') == FALSE)
 		return (FALSE);
-	if ((n = cols % 8) != 0 && linsert(n, ' ') == FALSE)
+	if ((n = cols % curbp->b_tabw) != 0 && linsert(n, ' ') == FALSE)
 		return (FALSE);
 	return (TRUE);
 }
diff --git a/usr.bin/openssl/Makefile b/usr.bin/openssl/Makefile
index ac4236193..e35b78850 100644
--- a/usr.bin/openssl/Makefile
+++ b/usr.bin/openssl/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.13 2024/05/27 16:11:43 tb Exp $
+#	$OpenBSD: Makefile,v 1.14 2024/07/08 05:59:10 tb Exp $
 
 .include <bsd.own.mk>
 
@@ -25,7 +25,7 @@ SRCS=	apps.c apps_posix.c asn1pars.c ca.c certhash.c ciphers.c cms.c crl.c \
 	errstr.c gendh.c gendsa.c genpkey.c genrsa.c ocsp.c \
 	openssl.c passwd.c pkcs12.c pkcs7.c pkcs8.c pkey.c pkeyparam.c \
 	pkeyutl.c prime.c rand.c req.c rsa.c rsautl.c s_cb.c s_client.c \
-	s_server.c s_socket.c s_time.c sess_id.c smime.c speed.c spkac.c ts.c \
+	s_server.c s_socket.c s_time.c sess_id.c smime.c speed.c ts.c \
 	verify.c version.c x509.c
 
 .include <bsd.prog.mk>
diff --git a/usr.bin/openssl/ca.c b/usr.bin/openssl/ca.c
index c0e011e7a..80561712f 100644
--- a/usr.bin/openssl/ca.c
+++ b/usr.bin/openssl/ca.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ca.c,v 1.59 2024/06/23 07:50:52 tb Exp $ */
+/* $OpenBSD: ca.c,v 1.60 2024/07/08 05:56:17 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -135,12 +135,6 @@ static int certify_cert(X509 **xret, char *infile, EVP_PKEY *pkey,
     char *enddate, long days, int batch, char *ext_sect, CONF *conf,
     int verbose, unsigned long certopt, unsigned long nameopt, int default_op,
     int ext_copy);
-static int certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey,
-    X509 *x509, const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
-    STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
-    unsigned long chtype, int multirdn, int email_dn, char *startdate,
-    char *enddate, long days, char *ext_sect, CONF *conf, int verbose,
-    unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy);
 static int write_new_certificate(BIO *bp, X509 *x, int output_der,
     int notext);
 static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
@@ -202,7 +196,6 @@ static struct {
 	char *section;
 	int selfsign;
 	STACK_OF(OPENSSL_STRING) *sigopts;
-	char *spkac_file;
 	char *ss_cert_file;
 	char *startdate;
 	char *subj;
@@ -288,14 +281,6 @@ ca_opt_sigopt(char *arg)
 	return (0);
 }
 
-static int
-ca_opt_spkac(char *arg)
-{
-	cfg.spkac_file = arg;
-	cfg.req = 1;
-	return (0);
-}
-
 static int
 ca_opt_ss_cert(char *arg)
 {
@@ -551,13 +536,6 @@ static const struct option ca_options[] = {
 		.type = OPTION_ARG_FUNC,
 		.opt.argfunc = ca_opt_sigopt,
 	},
-	{
-		.name = "spkac",
-		.argname = "file",
-		.desc = "File contains DN and signed public key and challenge",
-		.type = OPTION_ARG_FUNC,
-		.opt.argfunc = ca_opt_spkac,
-	},
 	{
 		.name = "ss_cert",
 		.argname = "file",
@@ -621,7 +599,7 @@ ca_usage(void)
 	    "    [-md alg] [-multivalue-rdn] [-name section]\n"
 	    "    [-noemailDN] [-notext] [-out file] [-outdir directory]\n"
 	    "    [-passin arg] [-policy name] [-preserveDN] [-revoke file]\n"
-	    "    [-selfsign] [-sigopt nm:v] [-spkac file] [-ss_cert file]\n"
+	    "    [-selfsign] [-sigopt nm:v] [-ss_cert file]\n"
 	    "    [-startdate date] [-status serial] [-subj arg] [-updatedb]\n"
 	    "    [-utf8] [-verbose]\n\n");
 	options_usage(ca_options);
@@ -824,8 +802,7 @@ ca_main(int argc, char **argv)
 	}
 	/*****************************************************************/
 	/* we need a certificate */
-	if (!cfg.selfsign || cfg.spkac_file != NULL ||
-	    cfg.ss_cert_file != NULL || cfg.gencrl) {
+	if (!cfg.selfsign || cfg.ss_cert_file != NULL || cfg.gencrl) {
 		if ((cfg.certfile == NULL) &&
 		    ((cfg.certfile = NCONF_get_string(conf,
 		    cfg.section, ENV_CERTIFICATE)) == NULL)) {
@@ -1163,34 +1140,6 @@ ca_main(int argc, char **argv)
 			BIO_printf(bio_err, "Memory allocation failure\n");
 			goto err;
 		}
-		if (cfg.spkac_file != NULL) {
-			total++;
-			j = certify_spkac(&x, cfg.spkac_file, pkey, x509,
-			    dgst, cfg.sigopts, attribs, db, serial,
-			    cfg.subj, cfg.chtype,
-			    cfg.multirdn, cfg.email_dn,
-			    cfg.startdate, cfg.enddate,
-			    cfg.days, cfg.extensions, conf,
-			    cfg.verbose, certopt, nameopt, default_op,
-			    ext_copy);
-			if (j < 0)
-				goto err;
-			if (j > 0) {
-				total_done++;
-				BIO_printf(bio_err, "\n");
-				if (!BN_add_word(serial, 1))
-					goto err;
-				if (!sk_X509_push(cert_sk, x)) {
-					BIO_printf(bio_err,
-					    "Memory allocation failure\n");
-					goto err;
-				}
-				if (cfg.outfile != NULL) {
-					output_der = 1;
-					cfg.batch = 1;
-				}
-			}
-		}
 		if (cfg.ss_cert_file != NULL) {
 			total++;
 			j = certify_cert(&x, cfg.ss_cert_file, pkey, x509,
@@ -2294,139 +2243,6 @@ write_new_certificate(BIO *bp, X509 *x, int output_der, int notext)
 	return PEM_write_bio_X509(bp, x);
 }
 
-static int
-certify_spkac(X509 **xret, char *infile, EVP_PKEY *pkey, X509 *x509,
-    const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
-    STACK_OF(CONF_VALUE) *policy, CA_DB *db, BIGNUM *serial, char *subj,
-    unsigned long chtype, int multirdn, int email_dn, char *startdate,
-    char *enddate, long days, char *ext_sect, CONF *lconf, int verbose,
-    unsigned long certopt, unsigned long nameopt, int default_op, int ext_copy)
-{
-	STACK_OF(CONF_VALUE) *sk = NULL;
-	LHASH_OF(CONF_VALUE) *parms = NULL;
-	X509_REQ *req = NULL;
-	CONF_VALUE *cv = NULL;
-	NETSCAPE_SPKI *spki = NULL;
-	char *type, *buf;
-	EVP_PKEY *pktmp = NULL;
-	X509_NAME *n = NULL;
-	int ok = -1, i, j;
-	long errline;
-	int nid;
-
-	/*
-	 * Load input file into a hash table.  (This is just an easy
-	 * way to read and parse the file, then put it into a convenient
-	 * STACK format).
-	 */
-	parms = CONF_load(NULL, infile, &errline);
-	if (parms == NULL) {
-		BIO_printf(bio_err, "error on line %ld of %s\n",
-		    errline, infile);
-		ERR_print_errors(bio_err);
-		goto err;
-	}
-	sk = CONF_get_section(parms, "default");
-	if (sk_CONF_VALUE_num(sk) == 0) {
-		BIO_printf(bio_err, "no name/value pairs found in %s\n",
-		    infile);
-		goto err;
-	}
-	/*
-	 * Now create a dummy X509 request structure.  We don't actually
-	 * have an X509 request, but we have many of the components
-	 * (a public key, various DN components).  The idea is that we
-	 * put these components into the right X509 request structure
-	 * and we can use the same code as if you had a real X509 request.
-	 */
-	req = X509_REQ_new();
-	if (req == NULL) {
-		ERR_print_errors(bio_err);
-		goto err;
-	}
-	/*
-	 * Build up the subject name set.
-	 */
-	n = X509_REQ_get_subject_name(req);
-
-	for (i = 0;; i++) {
-		if (sk_CONF_VALUE_num(sk) <= i)
-			break;
-
-		cv = sk_CONF_VALUE_value(sk, i);
-		type = cv->name;
-		/*
-		 * Skip past any leading X. X: X, etc to allow for multiple
-		 * instances
-		 */
-		for (buf = cv->name; *buf; buf++) {
-			if ((*buf == ':') || (*buf == ',') || (*buf == '.')) {
-				buf++;
-				if (*buf)
-					type = buf;
-				break;
-			}
-		}
-
-		buf = cv->value;
-		if ((nid = OBJ_txt2nid(type)) == NID_undef) {
-			if (strcmp(type, "SPKAC") == 0) {
-				spki = NETSCAPE_SPKI_b64_decode(cv->value, -1);
-				if (spki == NULL) {
-					BIO_printf(bio_err,
-					    "unable to load Netscape SPKAC structure\n");
-					ERR_print_errors(bio_err);
-					goto err;
-				}
-			}
-			continue;
-		}
-		if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
-		    (unsigned char *)buf, -1, -1, 0))
-			goto err;
-	}
-	if (spki == NULL) {
-		BIO_printf(bio_err,
-		    "Netscape SPKAC structure not found in %s\n", infile);
-		goto err;
-	}
-	/*
-	 * Now extract the key from the SPKI structure.
-	 */
-
-	BIO_printf(bio_err,
-	    "Check that the SPKAC request matches the signature\n");
-
-	if ((pktmp = NETSCAPE_SPKI_get_pubkey(spki)) == NULL) {
-		BIO_printf(bio_err, "error unpacking SPKAC public key\n");
-		goto err;
-	}
-	j = NETSCAPE_SPKI_verify(spki, pktmp);
-	if (j <= 0) {
-		BIO_printf(bio_err,
-		    "signature verification failed on SPKAC public key\n");
-		goto err;
-	}
-	BIO_printf(bio_err, "Signature ok\n");
-
-	if (!X509_REQ_set_pubkey(req, pktmp)) {
-		EVP_PKEY_free(pktmp);
-		goto err;
-	}
-	EVP_PKEY_free(pktmp);
-	ok = do_body(xret, pkey, x509, dgst, sigopts, policy, db, serial,
-	    subj, chtype, multirdn, email_dn, startdate, enddate, days, 1,
-	    verbose, req, ext_sect, lconf, certopt, nameopt, default_op,
-	    ext_copy, 0);
-
- err:
-	X509_REQ_free(req);
-	CONF_free(parms);
-	NETSCAPE_SPKI_free(spki);
-
-	return (ok);
-}
-
 static int
 check_time_format(const char *str)
 {
diff --git a/usr.bin/openssl/openssl.1 b/usr.bin/openssl/openssl.1
index aef1dc5bb..903330980 100644
--- a/usr.bin/openssl/openssl.1
+++ b/usr.bin/openssl/openssl.1
@@ -1,4 +1,4 @@
-.\" $OpenBSD: openssl.1,v 1.156 2024/05/07 21:00:18 tb Exp $
+.\" $OpenBSD: openssl.1,v 1.157 2024/07/08 06:00:09 tb Exp $
 .\" ====================================================================
 .\" Copyright (c) 1998-2002 The OpenSSL Project.  All rights reserved.
 .\"
@@ -110,7 +110,7 @@
 .\" copied and put under another distribution licence
 .\" [including the GNU Public Licence.]
 .\"
-.Dd $Mdocdate: May 7 2024 $
+.Dd $Mdocdate: July 8 2024 $
 .Dt OPENSSL 1
 .Os
 .Sh NAME
@@ -338,7 +338,6 @@ into a nested structure.
 .Op Fl revoke Ar file
 .Op Fl selfsign
 .Op Fl sigopt Ar nm:v
-.Op Fl spkac Ar file
 .Op Fl ss_cert Ar file
 .Op Fl startdate Ar date
 .Op Fl status Ar serial
@@ -469,9 +468,7 @@ Don't output the text form of a certificate to the output file.
 The output file to output certificates to.
 The default is standard output.
 The certificate details will also be printed out to this file in
-PEM format, except that
-.Fl spkac
-outputs DER format.
+PEM format.
 .It Fl outdir Ar directory
 The
 .Ar directory
@@ -514,8 +511,7 @@ certificate requests were signed with, given with
 .Fl keyfile .
 Certificate requests signed with a different key are ignored.
 If
-.Fl gencrl ,
-.Fl spkac ,
+.Fl gencrl
 or
 .Fl ss_cert
 are given,
@@ -532,20 +528,6 @@ signed with the self-signed certificate.
 .It Fl sigopt Ar nm:v
 Pass options to the signature algorithm during sign or certify operations.
 The names and values of these options are algorithm-specific.
-.It Fl spkac Ar file
-A file containing a single Netscape signed public key and challenge,
-and additional field values to be signed by the CA.
-This will usually come from the
-KEYGEN tag in an HTML form to create a new private key.
-It is, however, possible to create SPKACs using the
-.Nm spkac
-utility.
-.Pp
-The file should contain the variable SPKAC set to the value of
-the SPKAC and also the required DN components as name value pairs.
-If it's necessary to include the same component twice,
-then it can be preceded by a number and a
-.Sq \&. .
 .It Fl ss_cert Ar file
 A single self-signed certificate to be signed by the CA.
 .It Fl startdate Ar date
@@ -5403,68 +5385,6 @@ bytes from the alignment provided by
 .Ar number
 should be between 0 and 16.
 .El
-.Tg spkac
-.Sh SPKAC
-.Bl -hang -width "openssl spkac"
-.It Nm openssl spkac
-.Bk -words
-.Op Fl challenge Ar string
-.Op Fl in Ar file
-.Op Fl key Ar keyfile
-.Op Fl noout
-.Op Fl out Ar file
-.Op Fl passin Ar arg
-.Op Fl pubkey
-.Op Fl spkac Ar spkacname
-.Op Fl spksect Ar section
-.Op Fl verify
-.Ek
-.El
-.Pp
-The
-.Nm spkac
-command processes signed public key and challenge (SPKAC) files.
-It can print out their contents, verify the signature,
-and produce its own SPKACs from a supplied private key.
-.Pp
-The options are as follows:
-.Bl -tag -width Ds
-.It Fl challenge Ar string
-The challenge string, if an SPKAC is being created.
-.It Fl in Ar file
-The input file to read from,
-or standard input if not specified.
-Ignored if the
-.Fl key
-option is used.
-.It Fl key Ar keyfile
-Create an SPKAC file using the private key in
-.Ar keyfile .
-The
-.Fl in , noout , spksect ,
-and
-.Fl verify
-options are ignored, if present.
-.It Fl noout
-Do not output the text version of the SPKAC.
-.It Fl out Ar file
-The output file to write to,
-or standard output if not specified.
-.It Fl passin Ar arg
-The key password source.
-.It Fl pubkey
-Output the public key of an SPKAC.
-.It Fl spkac Ar spkacname
-An alternative name for the variable containing the SPKAC.
-The default is "SPKAC".
-This option affects both generated and input SPKAC files.
-.It Fl spksect Ar section
-An alternative name for the
-.Ar section
-containing the SPKAC.
-.It Fl verify
-Verify the digital signature on the supplied SPKAC.
-.El
 .Tg ts
 .Sh TS
 .Bk -words
diff --git a/usr.bin/openssl/openssl.c b/usr.bin/openssl/openssl.c
index 7a42b70f2..adafb0bc7 100644
--- a/usr.bin/openssl/openssl.c
+++ b/usr.bin/openssl/openssl.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: openssl.c,v 1.36 2024/02/03 15:58:34 beck Exp $ */
+/* $OpenBSD: openssl.c,v 1.37 2024/07/08 05:59:10 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -184,7 +184,6 @@ FUNCTION functions[] = {
 #ifndef OPENSSL_NO_SPEED
 	{ FUNC_TYPE_GENERAL, "speed", speed_main },
 #endif
-	{ FUNC_TYPE_GENERAL, "spkac", spkac_main },
 	{ FUNC_TYPE_GENERAL, "ts", ts_main },
 	{ FUNC_TYPE_GENERAL, "verify", verify_main },
 	{ FUNC_TYPE_GENERAL, "version", version_main },
diff --git a/usr.bin/openssl/progs.h b/usr.bin/openssl/progs.h
index 2696f2014..6cbc9d7b5 100644
--- a/usr.bin/openssl/progs.h
+++ b/usr.bin/openssl/progs.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: progs.h,v 1.10 2024/05/18 08:47:13 jsg Exp $ */
+/* $OpenBSD: progs.h,v 1.11 2024/07/08 05:59:10 tb Exp $ */
 /* Public domain */
 
 int asn1parse_main(int argc, char **argv);
@@ -40,7 +40,6 @@ int s_time_main(int argc, char **argv);
 int sess_id_main(int argc, char **argv);
 int smime_main(int argc, char **argv);
 int speed_main(int argc, char **argv);
-int spkac_main(int argc, char **argv);
 int ts_main(int argc, char **argv);
 int verify_main(int argc, char **argv);
 int version_main(int argc, char **argv);
diff --git a/usr.bin/openssl/spkac.c b/usr.bin/openssl/spkac.c
deleted file mode 100644
index 12d530e3c..000000000
--- a/usr.bin/openssl/spkac.c
+++ /dev/null
@@ -1,311 +0,0 @@
-/* $OpenBSD: spkac.c,v 1.13 2023/03/06 14:32:06 tb Exp $ */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project 1999. Based on an original idea by Massimiliano Pala
- * (madwolf@openca.org).
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <time.h>
-
-#include "apps.h"
-#include "progs.h"
-
-#include <openssl/bio.h>
-#include <openssl/conf.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/lhash.h>
-#include <openssl/pem.h>
-#include <openssl/x509.h>
-
-static struct {
-	char *challenge;
-	char *infile;
-	char *keyfile;
-	int noout;
-	char *outfile;
-	char *passargin;
-	int pubkey;
-	char *spkac;
-	char *spksect;
-	int verify;
-} cfg;
-
-static const struct option spkac_options[] = {
-	{
-		.name = "challenge",
-		.argname = "string",
-		.desc = "Specify challenge string if SPKAC is generated",
-		.type = OPTION_ARG,
-		.opt.arg = &cfg.challenge,
-	},
-	{
-		.name = "in",
-		.argname = "file",
-		.desc = "Input file (default stdin)",
-		.type = OPTION_ARG,
-		.opt.arg = &cfg.infile,
-	},
-	{
-		.name = "key",
-		.argname = "file",
-		.desc = "Create SPKAC using private key file",
-		.type = OPTION_ARG,
-		.opt.arg = &cfg.keyfile,
-	},
-	{
-		.name = "noout",
-		.desc = "Do not print text version of SPKAC",
-		.type = OPTION_FLAG,
-		.opt.flag = &cfg.noout,
-	},
-	{
-		.name = "out",
-		.argname = "file",
-		.desc = "Output file (default stdout)",
-		.type = OPTION_ARG,
-		.opt.arg = &cfg.outfile,
-	},
-	{
-		.name = "passin",
-		.argname = "src",
-		.desc = "Input file passphrase source",
-		.type = OPTION_ARG,
-		.opt.arg = &cfg.passargin,
-	},
-	{
-		.name = "pubkey",
-		.desc = "Output public key of an SPKAC (not used if creating)",
-		.type = OPTION_FLAG,
-		.opt.flag = &cfg.pubkey,
-	},
-	{
-		.name = "spkac",
-		.argname = "name",
-		.desc = "SPKAC name (default \"SPKAC\")",
-		.type = OPTION_ARG,
-		.opt.arg = &cfg.spkac,
-	},
-	{
-		.name = "spksect",
-		.argname = "name",
-		.desc = "Name of the section containing SPKAC (default"
-		" \"default\")",
-		.type = OPTION_ARG,
-		.opt.arg = &cfg.spksect,
-	},
-	{
-		.name = "verify",
-		.desc = "Verify digital signature on supplied SPKAC",
-		.type = OPTION_FLAG,
-		.opt.flag = &cfg.verify,
-	},
-	{ NULL }
-};
-
-static void
-spkac_usage(void)
-{
-	fprintf(stderr,
-	    "usage: spkac [-challenge string] [-in file] "
-	    "[-key file] [-noout]\n"
-	    "    [-out file] [-passin src] [-pubkey] [-spkac name] "
-	    "[-spksect section]\n"
-	    "    [-verify]\n\n");
-	options_usage(spkac_options);
-}
-
-int
-spkac_main(int argc, char **argv)
-{
-	int i, ret = 1;
-	BIO *in = NULL, *out = NULL;
-	char *passin = NULL;
-	char *spkstr = NULL;
-	CONF *conf = NULL;
-	NETSCAPE_SPKI *spki = NULL;
-	EVP_PKEY *pkey = NULL;
-
-	if (pledge("stdio cpath wpath rpath tty", NULL) == -1) {
-		perror("pledge");
-		exit(1);
-	}
-
-	memset(&cfg, 0, sizeof(cfg));
-	cfg.spkac = "SPKAC";
-	cfg.spksect = "default";
-
-	if (options_parse(argc, argv, spkac_options, NULL, NULL) != 0) {
-		spkac_usage();
-		return (1);
-	}
-
-	if (!app_passwd(bio_err, cfg.passargin, NULL, &passin, NULL)) {
-		BIO_printf(bio_err, "Error getting password\n");
-		goto end;
-	}
-
-	if (cfg.keyfile) {
-		pkey = load_key(bio_err,
-		    strcmp(cfg.keyfile, "-") ? cfg.keyfile
-		    : NULL, FORMAT_PEM, 1, passin, "private key");
-		if (!pkey) {
-			goto end;
-		}
-		spki = NETSCAPE_SPKI_new();
-		if (cfg.challenge)
-			ASN1_STRING_set(spki->spkac->challenge,
-			    cfg.challenge,
-			    (int) strlen(cfg.challenge));
-		NETSCAPE_SPKI_set_pubkey(spki, pkey);
-		NETSCAPE_SPKI_sign(spki, pkey, EVP_md5());
-		spkstr = NETSCAPE_SPKI_b64_encode(spki);
-		if (spkstr == NULL) {
-			BIO_printf(bio_err, "Error encoding SPKAC\n");
-			ERR_print_errors(bio_err);
-			goto end;
-		}
-
-		if (cfg.outfile)
-			out = BIO_new_file(cfg.outfile, "w");
-		else
-			out = BIO_new_fp(stdout, BIO_NOCLOSE);
-
-		if (!out) {
-			BIO_printf(bio_err, "Error opening output file\n");
-			ERR_print_errors(bio_err);
-		} else {
-			BIO_printf(out, "SPKAC=%s\n", spkstr);
-			ret = 0;
-		}
-		free(spkstr);
-		goto end;
-	}
-	if (cfg.infile)
-		in = BIO_new_file(cfg.infile, "r");
-	else
-		in = BIO_new_fp(stdin, BIO_NOCLOSE);
-
-	if (!in) {
-		BIO_printf(bio_err, "Error opening input file\n");
-		ERR_print_errors(bio_err);
-		goto end;
-	}
-	conf = NCONF_new(NULL);
-	i = NCONF_load_bio(conf, in, NULL);
-
-	if (!i) {
-		BIO_printf(bio_err, "Error parsing config file\n");
-		ERR_print_errors(bio_err);
-		goto end;
-	}
-	spkstr = NCONF_get_string(conf, cfg.spksect,
-	    cfg.spkac);
-
-	if (!spkstr) {
-		BIO_printf(bio_err, "Can't find SPKAC called \"%s\"\n",
-		    cfg.spkac);
-		ERR_print_errors(bio_err);
-		goto end;
-	}
-	spki = NETSCAPE_SPKI_b64_decode(spkstr, -1);
-
-	if (!spki) {
-		BIO_printf(bio_err, "Error loading SPKAC\n");
-		ERR_print_errors(bio_err);
-		goto end;
-	}
-	if (cfg.outfile)
-		out = BIO_new_file(cfg.outfile, "w");
-	else {
-		out = BIO_new_fp(stdout, BIO_NOCLOSE);
-	}
-
-	if (!out) {
-		BIO_printf(bio_err, "Error opening output file\n");
-		ERR_print_errors(bio_err);
-		goto end;
-	}
-	if (!cfg.noout)
-		NETSCAPE_SPKI_print(out, spki);
-	pkey = NETSCAPE_SPKI_get_pubkey(spki);
-	if (cfg.verify) {
-		i = NETSCAPE_SPKI_verify(spki, pkey);
-		if (i > 0)
-			BIO_printf(bio_err, "Signature OK\n");
-		else {
-			BIO_printf(bio_err, "Signature Failure\n");
-			ERR_print_errors(bio_err);
-			goto end;
-		}
-	}
-	if (cfg.pubkey)
-		PEM_write_bio_PUBKEY(out, pkey);
-
-	ret = 0;
-
- end:
-	NCONF_free(conf);
-	NETSCAPE_SPKI_free(spki);
-	BIO_free(in);
-	BIO_free_all(out);
-	EVP_PKEY_free(pkey);
-	free(passin);
-
-	return (ret);
-}
diff --git a/usr.bin/ssh/sshd-session.c b/usr.bin/ssh/sshd-session.c
index 54b7a8f71..4e7841cd5 100644
--- a/usr.bin/ssh/sshd-session.c
+++ b/usr.bin/ssh/sshd-session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd-session.c,v 1.4 2024/06/26 23:16:52 deraadt Exp $ */
+/* $OpenBSD: sshd-session.c,v 1.5 2024/07/08 03:04:34 djm Exp $ */
 /*
  * SSH2 implementation:
  * Privilege Separation:
@@ -765,7 +765,6 @@ check_ip_options(struct ssh *ssh)
 		fatal("Connection from %.100s port %d with IP opts: %.800s",
 		    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), text);
 	}
-	return;
 }
 
 /* Set the routing domain for this process */
diff --git a/usr.sbin/rcctl/rcctl.sh b/usr.sbin/rcctl/rcctl.sh
index 951a010c5..b049e53ff 100644
--- a/usr.sbin/rcctl/rcctl.sh
+++ b/usr.sbin/rcctl/rcctl.sh
@@ -1,6 +1,6 @@
 #!/bin/ksh
 #
-# $OpenBSD: rcctl.sh,v 1.117 2023/07/13 13:54:27 ajacoutot Exp $
+# $OpenBSD: rcctl.sh,v 1.119 2024/07/08 14:47:42 ajacoutot Exp $
 #
 # Copyright (c) 2014, 2015-2022 Antoine Jacoutot <ajacoutot@openbsd.org>
 # Copyright (c) 2014 Ingo Schwarze <schwarze@openbsd.org>
@@ -127,8 +127,10 @@ rcconf_edit_end()
 {
 	sort -u -o ${_TMP_RCCONF} ${_TMP_RCCONF} || \
 		rcctl_err "cannot modify ${_TMP_RCCONF}"
-	cat ${_TMP_RCCONF} >/etc/rc.conf.local || \
-		rcctl_err "cannot append to /etc/rc.conf.local"
+	if ! cmp -s ${_TMP_RCCONF} /etc/rc.conf.local; then
+		install -F -m0644 -o0 -g0 ${_TMP_RCCONF} /etc/rc.conf.local ||
+			rcctl_err "cannot write to /etc/rc.conf.local"
+	fi
 	if [ ! -s /etc/rc.conf.local ]; then
 		rm /etc/rc.conf.local || \
 			rcctl_err "cannot remove /etc/rc.conf.local"
diff --git a/usr.sbin/relayd/relay_http.c b/usr.sbin/relayd/relay_http.c
index e62ece35f..ce7b6817f 100644
--- a/usr.sbin/relayd/relay_http.c
+++ b/usr.sbin/relayd/relay_http.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: relay_http.c,v 1.87 2023/12/01 16:48:40 millert Exp $	*/
+/*	$OpenBSD: relay_http.c,v 1.88 2024/07/08 14:22:09 florian Exp $	*/
 
 /*
  * Copyright (c) 2006 - 2016 Reyk Floeter <reyk@openbsd.org>
@@ -1972,7 +1972,6 @@ relay_test(struct protocol *proto, struct ctl_relay_event *cre)
 	struct http_descriptor	*desc = cre->desc;
 	struct relay_rule	*r = NULL, *rule = NULL;
 	struct relay_table	*tbl = NULL;
-	u_int			 cnt = 0;
 	u_int			 action = RES_PASS;
 	struct kvlist		 actions, matches;
 	struct kv		*kv;
@@ -1983,8 +1982,6 @@ relay_test(struct protocol *proto, struct ctl_relay_event *cre)
 
 	r = TAILQ_FIRST(&proto->rules);
 	while (r != NULL) {
-		cnt++;
-
 		TAILQ_INIT(&matches);
 		TAILQ_INIT(&r->rule_kvlist);
 
diff --git a/usr.sbin/rpki-client/cert.c b/usr.sbin/rpki-client/cert.c
index c6a762fa3..6d6d6efda 100644
--- a/usr.sbin/rpki-client/cert.c
+++ b/usr.sbin/rpki-client/cert.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cert.c,v 1.148 2024/06/12 10:03:09 tb Exp $ */
+/*	$OpenBSD: cert.c,v 1.150 2024/07/08 15:31:58 tb Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2021 Job Snijders <job@openbsd.org>
@@ -534,6 +534,16 @@ sbgp_sia(const char *fn, struct cert *cert, X509_EXTENSION *ext)
 				goto out;
 			if (cert->repo == NULL && strncasecmp(carepo,
 			    RSYNC_PROTO, RSYNC_PROTO_LEN) == 0) {
+				if (carepo[strlen(carepo) - 1] != '/') {
+					char *carepo_tmp;
+
+					if (asprintf(&carepo_tmp, "%s/",
+					    carepo) == -1)
+						errx(1, NULL);
+					free(carepo);
+					carepo = carepo_tmp;
+				}
+
 				cert->repo = carepo;
 				carepo = NULL;
 				continue;
@@ -605,7 +615,8 @@ sbgp_sia(const char *fn, struct cert *cert, X509_EXTENSION *ext)
 		goto out;
 	}
 
-	if (strstr(cert->mft, cert->repo) != cert->mft) {
+	if (strstr(cert->mft, cert->repo) != cert->mft ||
+	    cert->mft + strlen(cert->repo) != mftfilename) {
 		warnx("%s: RFC 6487 section 4.8.8: SIA: "
 		    "conflicting URIs for caRepository and rpkiManifest", fn);
 		goto out;
diff --git a/usr.sbin/rpki-client/x509.c b/usr.sbin/rpki-client/x509.c
index 049dd78ea..d63cb56b8 100644
--- a/usr.sbin/rpki-client/x509.c
+++ b/usr.sbin/rpki-client/x509.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: x509.c,v 1.99 2024/06/10 12:44:06 tb Exp $ */
+/*	$OpenBSD: x509.c,v 1.100 2024/07/08 16:11:47 tb Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
@@ -482,6 +482,7 @@ x509_pubkey_get_ski(X509_PUBKEY *pubkey, const char *fn)
 		return NULL;
 	}
 
+	/* XXX - should allow other keys as well. */
 	if ((nid = OBJ_obj2nid(obj)) != NID_rsaEncryption) {
 		warnx("%s: RFC 7935: wrong signature algorithm %s, want %s",
 		    fn, nid2str(nid), LN_rsaEncryption);