diff --git a/lib/libc/dlfcn/init.c b/lib/libc/dlfcn/init.c
index dd38ba9dd..9fc63c97f 100644
--- a/lib/libc/dlfcn/init.c
+++ b/lib/libc/dlfcn/init.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: init.c,v 1.21 2024/01/19 14:15:51 deraadt Exp $ */
+/*	$OpenBSD: init.c,v 1.22 2024/01/21 17:18:13 kettenis Exp $ */
 /*
  * Copyright (c) 2014,2015 Philip Guenther <guenther@openbsd.org>
  *
@@ -129,7 +129,6 @@ _libc_preinit(int argc, char **argv, char **envp, dl_cb_cb *cb)
 		 * Static non-PIE processes don't get an AUX vector,
 		 * so find the phdrs through the ELF header
 		 */
-		_static_phdr_info.dlpi_addr = (Elf_Addr)__executable_start;
 		phdr = (void *)((char *)__executable_start +
 		    __executable_start->e_phoff);
 		phnum = __executable_start->e_phnum;
diff --git a/lib/libc/sys/madvise.2 b/lib/libc/sys/madvise.2
index eed34f56f..d62f110f6 100644
--- a/lib/libc/sys/madvise.2
+++ b/lib/libc/sys/madvise.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: madvise.2,v 1.22 2019/12/26 01:01:06 jsg Exp $
+.\"	$OpenBSD: madvise.2,v 1.23 2024/01/21 17:46:03 deraadt Exp $
 .\"	$NetBSD: madvise.2,v 1.7 1995/12/27 21:17:02 jtc Exp $
 .\"
 .\" Copyright (c) 1991, 1993
@@ -30,7 +30,7 @@
 .\"
 .\"	@(#)madvise.2	8.1 (Berkeley) 6/9/93
 .\"
-.Dd $Mdocdate: December 26 2019 $
+.Dd $Mdocdate: January 21 2024 $
 .Dt MADVISE 2
 .Os
 .Sh NAME
@@ -88,7 +88,31 @@ If successful, the
 .Fn posix_madvise
 function will return zero.
 Otherwise an error number will be returned to indicate the error.
+.Sh ERRORS
+.Fn madvise
+will fail if:
+.Bl -tag -width Er
+.It Bq Er EINVAL
+The specified
+.Fa behav
+argument was invalid.
+.It Bq Er EINVAL
+The
+.Fa addr
+parameter was not page aligned or
+.Fa addr
+and
+.Fa size
+specify a region that would extend beyond the end of the address space.
+.It Bq Er EPERM
+The
+.Fa addr
+and
+.Fa len
+parameters specify a region which contains at least one page marked immutable.
+.El
 .Sh SEE ALSO
+.Xr mimmutable 2 ,
 .Xr minherit 2 ,
 .Xr mprotect 2 ,
 .Xr msync 2 ,
@@ -98,6 +122,10 @@ The
 .Fn posix_madvise
 system call conforms to
 .St -p1003.1-2008 .
+.Pp
+The
+.Er EPERM
+failure conditions described are an extension to this specification.
 .Sh HISTORY
 The
 .Fn madvise
diff --git a/lib/libc/sys/mimmutable.2 b/lib/libc/sys/mimmutable.2
index 03fff5cc7..96b7641ae 100644
--- a/lib/libc/sys/mimmutable.2
+++ b/lib/libc/sys/mimmutable.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: mimmutable.2,v 1.4 2024/01/20 13:19:37 deraadt Exp $
+.\"	$OpenBSD: mimmutable.2,v 1.5 2024/01/21 17:46:03 deraadt Exp $
 .\"
 .\" Copyright (c) 1991, 1993
 .\"	The Regents of the University of California.  All rights reserved.
@@ -29,7 +29,7 @@
 .\"
 .\"	@(#)mimmutable.2	8.1 (Berkeley) 6/9/93
 .\"
-.Dd $Mdocdate: January 20 2024 $
+.Dd $Mdocdate: January 21 2024 $
 .Dt MIMMUTABLE 2
 .Os
 .Sh NAME
@@ -45,9 +45,12 @@ The
 system call
 changes currently mapped pages in the region to be marked immutable,
 which means their protection or mapping may not be changed in the future.
+Most requests to
+.Xr madvise 2 ,
+.Xr minherit 2 ,
 .Xr mmap 2 ,
 .Xr mprotect 2 ,
-and
+.Xr msync 2 , and
 .Xr munmap 2
 to pages marked immutable will return with error
 .Er EPERM .
@@ -71,8 +74,12 @@ The virtual address range specified by the
 and
 .Fa len
 arguments is not valid.
+.It Bq Er EPERM
+At least one page has inheritance of
+.Dv MAP_INHERIT_ZERO .
 .El
 .Sh SEE ALSO
+.Xr minherit 2 ,
 .Xr mmap 2 ,
 .Xr mprotect 2 ,
 .Xr munmap 2
diff --git a/lib/libc/sys/minherit.2 b/lib/libc/sys/minherit.2
index 7c9dce7f4..e814a0a7f 100644
--- a/lib/libc/sys/minherit.2
+++ b/lib/libc/sys/minherit.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: minherit.2,v 1.16 2019/01/11 18:46:30 deraadt Exp $
+.\"	$OpenBSD: minherit.2,v 1.17 2024/01/21 17:46:03 deraadt Exp $
 .\"
 .\" Copyright (c) 1991, 1993
 .\"	The Regents of the University of California.  All rights reserved.
@@ -29,7 +29,7 @@
 .\"
 .\"	@(#)minherit.2	8.1 (Berkeley) 6/9/93
 .\"
-.Dd $Mdocdate: January 11 2019 $
+.Dd $Mdocdate: January 21 2024 $
 .Dt MINHERIT 2
 .Os
 .Sh NAME
@@ -73,6 +73,17 @@ The
 .Fn minherit
 system call will fail if:
 .Bl -tag -width Er
+.It Bq Er EPERM
+The
+.Fa addr
+and
+.Fa len
+parameters specify a region that contains
+at least one page which is immutable, or
+.Dv MAP_INHERIT_ZERO
+is being requested on a page without
+.Dv PROT_WRITE
+permission.
 .It Bq Er EINVAL
 The virtual address range specified by the
 .Fa addr
@@ -86,6 +97,7 @@ argument is invalid.
 .El
 .Sh SEE ALSO
 .Xr madvise 2 ,
+.Xr mimmutable 2 ,
 .Xr mprotect 2 ,
 .Xr msync 2 ,
 .Xr munmap 2
diff --git a/lib/libc/sys/mprotect.2 b/lib/libc/sys/mprotect.2
index f8d964f03..1c33f68bd 100644
--- a/lib/libc/sys/mprotect.2
+++ b/lib/libc/sys/mprotect.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: mprotect.2,v 1.27 2022/10/07 15:21:04 deraadt Exp $
+.\"	$OpenBSD: mprotect.2,v 1.28 2024/01/21 17:00:42 deraadt Exp $
 .\"	$NetBSD: mprotect.2,v 1.6 1995/10/12 15:41:08 jtc Exp $
 .\"
 .\" Copyright (c) 1991, 1993
@@ -30,7 +30,7 @@
 .\"
 .\"	@(#)mprotect.2	8.1 (Berkeley) 6/9/93
 .\"
-.Dd $Mdocdate: October 7 2022 $
+.Dd $Mdocdate: January 21 2024 $
 .Dt MPROTECT 2
 .Os
 .Sh NAME
@@ -121,6 +121,7 @@ specify a region which contains at least one page marked immutable.
 .El
 .Sh SEE ALSO
 .Xr madvise 2 ,
+.Xr mimmutable 2 ,
 .Xr msync 2 ,
 .Xr munmap 2
 .Sh STANDARDS
diff --git a/lib/libc/sys/msync.2 b/lib/libc/sys/msync.2
index 9293653e9..2660fa69b 100644
--- a/lib/libc/sys/msync.2
+++ b/lib/libc/sys/msync.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: msync.2,v 1.29 2021/06/30 18:46:49 schwarze Exp $
+.\"	$OpenBSD: msync.2,v 1.30 2024/01/21 17:46:03 deraadt Exp $
 .\"	$NetBSD: msync.2,v 1.8 1995/10/12 15:41:09 jtc Exp $
 .\"
 .\" Copyright (c) 1991, 1993
@@ -30,7 +30,7 @@
 .\"
 .\"	@(#)msync.2	8.1 (Berkeley) 6/9/93
 .\"
-.Dd $Mdocdate: June 30 2021 $
+.Dd $Mdocdate: January 21 2024 $
 .Dt MSYNC 2
 .Os
 .Sh NAME
@@ -88,6 +88,12 @@ parameter was not page aligned or
 and
 .Fa size
 specify a region that would extend beyond the end of the address space.
+.It Bq Er EPERM
+The
+.Fa addr
+and
+.Fa len
+parameters specify a region which contains at least one page marked immutable.
 .It Bq Er ENOMEM
 Addresses in the specified region are outside the range allowed
 for the address space of the process, or specify one or more pages
@@ -97,6 +103,7 @@ An I/O error occurred while writing.
 .El
 .Sh SEE ALSO
 .Xr madvise 2 ,
+.Xr mimmutable 2 ,
 .Xr minherit 2 ,
 .Xr mprotect 2 ,
 .Xr munmap 2
diff --git a/lib/libc/sys/munmap.2 b/lib/libc/sys/munmap.2
index 9b5df7653..23d965242 100644
--- a/lib/libc/sys/munmap.2
+++ b/lib/libc/sys/munmap.2
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: munmap.2,v 1.20 2022/10/07 15:21:04 deraadt Exp $
+.\"	$OpenBSD: munmap.2,v 1.21 2024/01/21 17:00:42 deraadt Exp $
 .\"	$NetBSD: munmap.2,v 1.5 1995/02/27 12:35:03 cgd Exp $
 .\"
 .\" Copyright (c) 1991, 1993
@@ -30,7 +30,7 @@
 .\"
 .\"	@(#)munmap.2	8.2 (Berkeley) 4/15/94
 .\"
-.Dd $Mdocdate: October 7 2022 $
+.Dd $Mdocdate: January 21 2024 $
 .Dt MUNMAP 2
 .Os
 .Sh NAME
@@ -72,6 +72,7 @@ specify a region which contains at least one page marked immutable.
 .El
 .Sh SEE ALSO
 .Xr madvise 2 ,
+.Xr mimmutable 2 ,
 .Xr mlock 2 ,
 .Xr mlockall 2 ,
 .Xr mmap 2 ,
diff --git a/lib/libz/Makefile b/lib/libz/Makefile
index 467668b08..19f858934 100644
--- a/lib/libz/Makefile
+++ b/lib/libz/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.21 2021/07/04 14:24:49 tb Exp $
+#	$OpenBSD: Makefile,v 1.22 2024/01/21 07:33:46 tb Exp $
 
 LIB=	z
 HDRS=	zconf.h zlib.h
@@ -10,6 +10,8 @@ MAN=	compress.3
 PC_FILES=zlib.pc
 CLEANFILES+=${PC_FILES}
 
+CFLAGS += -DHAVE_HIDDEN
+
 includes:
 	@cd ${.CURDIR}; for i in $(HDRS); do \
 		j="cmp -s $$i ${DESTDIR}/usr/include/$$i || \
diff --git a/lib/libz/deflate.c b/lib/libz/deflate.c
index f878ebc99..a29653e6b 100644
--- a/lib/libz/deflate.c
+++ b/lib/libz/deflate.c
@@ -489,11 +489,7 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
      * symbols from which it is being constructed.
      */
 
-#ifdef LIT_MEM
-    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 5);
-#else
-    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
-#endif
+    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, LIT_BUFS);
     s->pending_buf_size = (ulg)s->lit_bufsize * 4;
 
     if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
@@ -1306,7 +1302,7 @@ int ZEXPORT deflateCopy(z_streamp dest, z_streamp source) {
     ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
     ds->prev   = (Posf *)  ZALLOC(dest, ds->w_size, sizeof(Pos));
     ds->head   = (Posf *)  ZALLOC(dest, ds->hash_size, sizeof(Pos));
-    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
+    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, LIT_BUFS);
 
     if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
         ds->pending_buf == Z_NULL) {
@@ -1317,7 +1313,7 @@ int ZEXPORT deflateCopy(z_streamp dest, z_streamp source) {
     zmemcpy(ds->window, ss->window, ds->w_size * 2 * sizeof(Byte));
     zmemcpy((voidpf)ds->prev, (voidpf)ss->prev, ds->w_size * sizeof(Pos));
     zmemcpy((voidpf)ds->head, (voidpf)ss->head, ds->hash_size * sizeof(Pos));
-    zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
+    zmemcpy(ds->pending_buf, ss->pending_buf, ds->lit_bufsize * LIT_BUFS);
 
     ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
 #ifdef LIT_MEM
@@ -1556,13 +1552,21 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
  */
 local void check_match(deflate_state *s, IPos start, IPos match, int length) {
     /* check that the match is indeed a match */
-    if (zmemcmp(s->window + match,
-                s->window + start, length) != EQUAL) {
-        fprintf(stderr, " start %u, match %u, length %d\n",
-                start, match, length);
+    Bytef *back = s->window + (int)match, *here = s->window + start;
+    IPos len = length;
+    if (match == (IPos)-1) {
+        /* match starts one byte before the current window -- just compare the
+           subsequent length-1 bytes */
+        back++;
+        here++;
+        len--;
+    }
+    if (zmemcmp(back, here, len) != EQUAL) {
+        fprintf(stderr, " start %u, match %d, length %d\n",
+                start, (int)match, length);
         do {
-            fprintf(stderr, "%c%c", s->window[match++], s->window[start++]);
-        } while (--length != 0);
+            fprintf(stderr, "(%02x %02x)", *back++, *here++);
+        } while (--len != 0);
         z_error("invalid match");
     }
     if (z_verbose > 1) {
diff --git a/lib/libz/deflate.h b/lib/libz/deflate.h
index eb28c625a..0c95a0a33 100644
--- a/lib/libz/deflate.h
+++ b/lib/libz/deflate.h
@@ -220,9 +220,11 @@ typedef struct internal_state {
      */
 
 #ifdef LIT_MEM
+#   define LIT_BUFS 5
     ushf *d_buf;          /* buffer for distances */
     uchf *l_buf;          /* buffer for literals/lengths */
 #else
+#   define LIT_BUFS 4
     uchf *sym_buf;        /* buffer for distances and literals/lengths */
 #endif
 
diff --git a/lib/libz/gzguts.h b/lib/libz/gzguts.h
index f9375047e..adc2b34fe 100644
--- a/lib/libz/gzguts.h
+++ b/lib/libz/gzguts.h
@@ -210,9 +210,5 @@ char ZLIB_INTERNAL *gz_strwinerror(DWORD error);
 /* GT_OFF(x), where x is an unsigned value, is true if x > maximum z_off64_t
    value -- needed when comparing unsigned to z_off64_t, which is signed
    (possible z_off64_t types off_t, off64_t, and long are all signed) */
-#ifdef INT_MAX
-#  define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > INT_MAX)
-#else
 unsigned ZLIB_INTERNAL gz_intmax(void);
-#  define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > gz_intmax())
-#endif
+#define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > gz_intmax())
diff --git a/lib/libz/gzlib.c b/lib/libz/gzlib.c
index 29fc4486f..9c103dbd1 100644
--- a/lib/libz/gzlib.c
+++ b/lib/libz/gzlib.c
@@ -563,20 +563,20 @@ void ZLIB_INTERNAL gz_error(gz_statep state, int err, const char *msg) {
 #endif
 }
 
-#ifndef INT_MAX
 /* portably return maximum value for an int (when limits.h presumed not
    available) -- we need to do this to cover cases where 2's complement not
    used, since C standard permits 1's complement and sign-bit representations,
    otherwise we could just use ((unsigned)-1) >> 1 */
 unsigned ZLIB_INTERNAL gz_intmax(void) {
-    unsigned p, q;
-
-    p = 1;
+#ifdef INT_MAX
+    return INT_MAX;
+#else
+    unsigned p = 1, q;
     do {
         q = p;
         p <<= 1;
         p++;
     } while (p > q);
     return q >> 1;
-}
 #endif
+}
diff --git a/lib/libz/trees.c b/lib/libz/trees.c
index 6bbbb21c3..670316689 100644
--- a/lib/libz/trees.c
+++ b/lib/libz/trees.c
@@ -936,7 +936,7 @@ local void compress_block(deflate_state *s, const ct_data *ltree,
 
         /* Check for no overlay of pending_buf on needed symbols */
 #ifdef LIT_MEM
-        Assert(s->pending < (s->lit_bufsize << 1) + sx, "pendingBuf overflow");
+        Assert(s->pending < 2 * (s->lit_bufsize + sx), "pendingBuf overflow");
 #else
         Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
 #endif
diff --git a/lib/libz/zconf.h b/lib/libz/zconf.h
index 7c1dc4fc6..5b8331ab8 100644
--- a/lib/libz/zconf.h
+++ b/lib/libz/zconf.h
@@ -298,14 +298,6 @@
 #  endif
 #endif
 
-#ifndef Z_ARG /* function prototypes for stdarg */
-#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
-#    define Z_ARG(args)  args
-#  else
-#    define Z_ARG(args)  ()
-#  endif
-#endif
-
 /* The following definitions for FAR are needed only for MSDOS mixed
  * model programming (small or medium model with some far allocations).
  * This was tested only with MSC; for other MSDOS compilers you may have
diff --git a/lib/libz/zlib.h b/lib/libz/zlib.h
index b3e19fce8..39991a418 100644
--- a/lib/libz/zlib.h
+++ b/lib/libz/zlib.h
@@ -1758,14 +1758,14 @@ ZEXTERN uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2);
    seq1 and seq2 with lengths len1 and len2, CRC-32 check values were
    calculated for each, crc1 and crc2.  crc32_combine() returns the CRC-32
    check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and
-   len2.
+   len2. len2 must be non-negative.
 */
 
 /*
 ZEXTERN uLong ZEXPORT crc32_combine_gen(z_off_t len2);
 
      Return the operator corresponding to length len2, to be used with
-   crc32_combine_op().
+   crc32_combine_op(). len2 must be non-negative.
 */
 
 ZEXTERN uLong ZEXPORT crc32_combine_op(uLong crc1, uLong crc2, uLong op);
diff --git a/lib/libz/zutil.h b/lib/libz/zutil.h
index b851bc9de..9b288c653 100644
--- a/lib/libz/zutil.h
+++ b/lib/libz/zutil.h
@@ -58,7 +58,7 @@ typedef unsigned long  ulg;
 extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
 /* (size given to avoid silly warnings with Visual C++) */
 
-#define ERR_MSG(err) z_errmsg[Z_NEED_DICT-(err)]
+#define ERR_MSG(err) z_errmsg[(err) < -6 || (err) > 2 ? 9 : 2 - (err)]
 
 #define ERR_RETURN(strm,err) \
   return (strm->msg = ERR_MSG(err), (err))
@@ -139,17 +139,8 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
 #  endif
 #endif
 
-#if defined(MACOS) || defined(TARGET_OS_MAC)
+#if defined(MACOS)
 #  define OS_CODE  7
-#  ifndef Z_SOLO
-#    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
-#      include <unix.h> /* for fdopen */
-#    else
-#      ifndef fdopen
-#        define fdopen(fd,mode) NULL /* No fdopen() */
-#      endif
-#    endif
-#  endif
 #endif
 
 #ifdef __acorn
@@ -172,18 +163,6 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
 #  define OS_CODE 19
 #endif
 
-#if defined(_BEOS_) || defined(RISCOS)
-#  define fdopen(fd,mode) NULL /* No fdopen() */
-#endif
-
-#if (defined(_MSC_VER) && (_MSC_VER > 600)) && !defined __INTERIX
-#  if defined(_WIN32_WCE)
-#    define fdopen(fd,mode) NULL /* No fdopen() */
-#  else
-#    define fdopen(fd,type)  _fdopen(fd,type)
-#  endif
-#endif
-
 #if defined(__BORLANDC__) && !defined(MSDOS)
   #pragma warn -8004
   #pragma warn -8008
diff --git a/libexec/ld.so/dl_printf.c b/libexec/ld.so/dl_printf.c
index 330462cbc..089d9af5c 100644
--- a/libexec/ld.so/dl_printf.c
+++ b/libexec/ld.so/dl_printf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dl_printf.c,v 1.22 2022/01/08 06:49:41 guenther Exp $	*/
+/*	$OpenBSD: dl_printf.c,v 1.23 2024/01/22 02:08:31 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 1993
@@ -69,7 +69,7 @@ static void kprintn(int, u_long, int);
 static void kdoprnt(int, const char *, va_list);
 static void _dl_flushbuf(void);
 
-static void putcharfd(int, int );
+static void putcharfd(int, int);
 
 static void
 putcharfd(int c, int fd)
diff --git a/libexec/ld.so/dlfcn.c b/libexec/ld.so/dlfcn.c
index 9a4bfde57..478c948b9 100644
--- a/libexec/ld.so/dlfcn.c
+++ b/libexec/ld.so/dlfcn.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dlfcn.c,v 1.116 2023/12/19 16:13:22 deraadt Exp $ */
+/*	$OpenBSD: dlfcn.c,v 1.117 2024/01/22 02:08:31 deraadt Exp $ */
 
 /*
  * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
@@ -119,7 +119,7 @@ dlopen(const char *libname, int flags)
 	/* this add_object should not be here, XXX */
 	_dl_add_object(object);
 
-	DL_DEB(("head [%s]\n", object->load_name ));
+	DL_DEB(("head [%s]\n", object->load_name));
 
 	if ((failed = _dl_load_dep_libs(object, obj_flags, 0)) == 1) {
 		_dl_real_close(object);
@@ -127,7 +127,7 @@ dlopen(const char *libname, int flags)
 		_dl_errno = DL_CANT_LOAD_OBJ;
 	} else {
 		int err;
-		DL_DEB(("tail %s\n", object->load_name ));
+		DL_DEB(("tail %s\n", object->load_name));
 		if (_dl_traceld) {
 			_dl_show_objects(object);
 			_dl_unload_shlib(object);
diff --git a/libexec/ld.so/loader.c b/libexec/ld.so/loader.c
index 7a9d57ed0..d64580ee0 100644
--- a/libexec/ld.so/loader.c
+++ b/libexec/ld.so/loader.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: loader.c,v 1.222 2024/01/19 14:16:41 deraadt Exp $ */
+/*	$OpenBSD: loader.c,v 1.223 2024/01/22 02:08:31 deraadt Exp $ */
 
 /*
  * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
@@ -157,7 +157,7 @@ _dl_run_all_dtors(void)
 		}
 		for (node = _dl_objects;
 		    node != NULL;
-		    node = node->next ) {
+		    node = node->next) {
 			if ((node->dyn.fini || node->dyn.fini_array) &&
 			    (OBJECT_REF_CNT(node) == 0) &&
 			    (node->status & STAT_INIT_DONE) &&
@@ -174,7 +174,7 @@ _dl_run_all_dtors(void)
 
 		for (node = _dl_objects;
 		    node != NULL;
-		    node = node->next ) {
+		    node = node->next) {
 			if (node->status & STAT_FINI_READY) {
 				fini_complete = 0;
 				node->status |= STAT_FINI_DONE;
diff --git a/libexec/ld.so/resolve.c b/libexec/ld.so/resolve.c
index b6e21f9d0..5b655a048 100644
--- a/libexec/ld.so/resolve.c
+++ b/libexec/ld.so/resolve.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: resolve.c,v 1.101 2024/01/16 19:07:31 deraadt Exp $ */
+/*	$OpenBSD: resolve.c,v 1.102 2024/01/22 02:08:31 deraadt Exp $ */
 
 /*
  * Copyright (c) 1998 Per Fogelstrom, Opsycon AB
@@ -321,7 +321,7 @@ _dl_finalize_object(const char *objname, Elf_Dyn *dynp, Elf_Phdr *phdrp,
 			gnu_hash = dynp->d_un.d_val;
 		dynp++;
 	}
-	DL_DEB((" flags %s = 0x%x\n", objname, object->obj_flags ));
+	DL_DEB((" flags %s = 0x%x\n", objname, object->obj_flags));
 	object->obj_type = objtype;
 
 	if (_dl_loading_object == NULL) {
@@ -441,7 +441,7 @@ _dl_finalize_object(const char *objname, Elf_Dyn *dynp, Elf_Phdr *phdrp,
 	if (object->load_object == object)
 		DL_DEB(("head %s\n", object->load_name));
 	DL_DEB(("obj %s has %s as head\n", object->load_name,
-	    _dl_loading_object->load_name ));
+	    _dl_loading_object->load_name));
 	object->refcount = 0;
 	object->opencount = 0;	/* # dlopen() & exe */
 	object->grprefcount = 0;
@@ -733,7 +733,7 @@ found:
 
 	if (ref_sym != NULL && ref_sym->st_size != 0 &&
 	    (ref_sym->st_size != sl.sl_out.sym->st_size) &&
-	    (ELF_ST_TYPE(sl.sl_out.sym->st_info) != STT_FUNC) ) {
+	    (ELF_ST_TYPE(sl.sl_out.sym->st_info) != STT_FUNC)) {
 		_dl_printf("%s:%s: %s : WARNING: "
 		    "symbol(%s) size mismatch, relink your program\n",
 		    __progname, req_obj->load_name, sl.sl_out.obj->load_name,
diff --git a/regress/lib/libcrypto/evp/evp_test.c b/regress/lib/libcrypto/evp/evp_test.c
index 3bd4fb11c..2c9aee2ad 100644
--- a/regress/lib/libcrypto/evp/evp_test.c
+++ b/regress/lib/libcrypto/evp/evp_test.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: evp_test.c,v 1.15 2024/01/15 15:00:13 tb Exp $ */
+/*	$OpenBSD: evp_test.c,v 1.16 2024/01/21 19:08:59 tb Exp $ */
 /*
  * Copyright (c) 2022 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2023 Theo Buehler <tb@openbsd.org>
@@ -727,18 +727,15 @@ obj_name_do_all_test(void)
 	int failure = 0;
 
 	memset(&arg, 0, sizeof(arg));
-	/* XXX - replace with OBJ_NAME_do_all() after next bump. */
-	OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH, obj_name_cb, &arg);
+	OBJ_NAME_do_all(OBJ_NAME_TYPE_CIPHER_METH, obj_name_cb, &arg);
 	failure |= arg.failure;
 
 	memset(&arg, 0, sizeof(arg));
-	/* XXX - replace with OBJ_NAME_do_all() after next bump. */
-	OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_MD_METH, obj_name_cb, &arg);
+	OBJ_NAME_do_all(OBJ_NAME_TYPE_MD_METH, obj_name_cb, &arg);
 	failure |= arg.failure;
 
 	memset(&arg, 0, sizeof(arg));
-	/* XXX - replace with OBJ_NAME_do_all() after next bump. */
-	OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_PKEY_METH, obj_name_cb, &arg);
+	OBJ_NAME_do_all(OBJ_NAME_TYPE_PKEY_METH, obj_name_cb, &arg);
 	failure |= arg.failure;
 
 	return failure;
diff --git a/sys/dev/pci/drm/amd/amdgpu/amdgpu_debugfs.c b/sys/dev/pci/drm/amd/amdgpu/amdgpu_debugfs.c
index 05405da51..3f2126f99 100644
--- a/sys/dev/pci/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/sys/dev/pci/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -638,6 +638,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf,
 	if (size & 0x3 || *pos & 0x3)
 		return -EINVAL;
 
+	if (!adev->didt_rreg)
+		return -EOPNOTSUPP;
+
 	r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
 	if (r < 0) {
 		pm_runtime_put_autosuspend(adev_to_drm(adev)->dev);
@@ -694,6 +697,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user
 	if (size & 0x3 || *pos & 0x3)
 		return -EINVAL;
 
+	if (!adev->didt_wreg)
+		return -EOPNOTSUPP;
+
 	r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
 	if (r < 0) {
 		pm_runtime_put_autosuspend(adev_to_drm(adev)->dev);
diff --git a/sys/dev/pci/drm/amd/amdgpu/nbio_v7_9.c b/sys/dev/pci/drm/amd/amdgpu/nbio_v7_9.c
index 97ef1d24b..48effaa2d 100644
--- a/sys/dev/pci/drm/amd/amdgpu/nbio_v7_9.c
+++ b/sys/dev/pci/drm/amd/amdgpu/nbio_v7_9.c
@@ -604,11 +604,6 @@ static void nbio_v7_9_handle_ras_controller_intr_no_bifring(struct amdgpu_device
 
 		dev_info(adev->dev, "RAS controller interrupt triggered "
 					"by NBIF error\n");
-
-		/* ras_controller_int is dedicated for nbif ras error,
-		 * not the global interrupt for sync flood
-		 */
-		amdgpu_ras_reset_gpu(adev);
 	}
 }
 
diff --git a/sys/dev/pci/drm/amd/amdgpu/soc15.c b/sys/dev/pci/drm/amd/amdgpu/soc15.c
index 48eee60a0..3a152a76d 100644
--- a/sys/dev/pci/drm/amd/amdgpu/soc15.c
+++ b/sys/dev/pci/drm/amd/amdgpu/soc15.c
@@ -1160,6 +1160,11 @@ static int soc15_common_early_init(void *handle)
 			AMD_PG_SUPPORT_VCN_DPG |
 			AMD_PG_SUPPORT_JPEG;
 		adev->external_rev_id = adev->rev_id + 0x46;
+		/* GC 9.4.3 uses MMIO register region hole at a different offset */
+		if (!amdgpu_sriov_vf(adev)) {
+			adev->rmmio_remap.reg_offset = 0x1A000;
+			adev->rmmio_remap.bus_addr = adev->rmmio_base + 0x1A000;
+		}
 		break;
 	default:
 		/* FIXME: not supported yet */
@@ -1417,9 +1422,11 @@ static void soc15_common_get_clockgating_state(void *handle, u64 *flags)
 	if (amdgpu_sriov_vf(adev))
 		*flags = 0;
 
-	adev->nbio.funcs->get_clockgating_state(adev, flags);
+	if (adev->nbio.funcs && adev->nbio.funcs->get_clockgating_state)
+		adev->nbio.funcs->get_clockgating_state(adev, flags);
 
-	adev->hdp.funcs->get_clock_gating_state(adev, flags);
+	if (adev->hdp.funcs && adev->hdp.funcs->get_clock_gating_state)
+		adev->hdp.funcs->get_clock_gating_state(adev, flags);
 
 	if (adev->ip_versions[MP0_HWIP][0] != IP_VERSION(13, 0, 2)) {
 
@@ -1435,9 +1442,11 @@ static void soc15_common_get_clockgating_state(void *handle, u64 *flags)
 	}
 
 	/* AMD_CG_SUPPORT_ROM_MGCG */
-	adev->smuio.funcs->get_clock_gating_state(adev, flags);
+	if (adev->smuio.funcs && adev->smuio.funcs->get_clock_gating_state)
+		adev->smuio.funcs->get_clock_gating_state(adev, flags);
 
-	adev->df.funcs->get_clockgating_state(adev, flags);
+	if (adev->df.funcs && adev->df.funcs->get_clockgating_state)
+		adev->df.funcs->get_clockgating_state(adev, flags);
 }
 
 static int soc15_common_set_powergating_state(void *handle,
diff --git a/sys/dev/pci/drm/amd/amdkfd/kfd_priv.h b/sys/dev/pci/drm/amd/amdkfd/kfd_priv.h
index fa24e1852..df7a5cdb8 100644
--- a/sys/dev/pci/drm/amd/amdkfd/kfd_priv.h
+++ b/sys/dev/pci/drm/amd/amdkfd/kfd_priv.h
@@ -1128,7 +1128,7 @@ static inline struct kfd_node *kfd_node_by_irq_ids(struct amdgpu_device *adev,
 	struct kfd_dev *dev = adev->kfd.dev;
 	uint32_t i;
 
-	if (adev->ip_versions[GC_HWIP][0] != IP_VERSION(9, 4, 3))
+	if (KFD_GC_VERSION(dev) != IP_VERSION(9, 4, 3))
 		return dev->nodes[0];
 
 	for (i = 0; i < dev->num_nodes; i++)
diff --git a/sys/dev/pci/drm/amd/amdkfd/kfd_process_queue_manager.c b/sys/dev/pci/drm/amd/amdkfd/kfd_process_queue_manager.c
index 77649392e..77f493262 100644
--- a/sys/dev/pci/drm/amd/amdkfd/kfd_process_queue_manager.c
+++ b/sys/dev/pci/drm/amd/amdkfd/kfd_process_queue_manager.c
@@ -169,16 +169,43 @@ int pqm_init(struct process_queue_manager *pqm, struct kfd_process *p)
 	return 0;
 }
 
+static void pqm_clean_queue_resource(struct process_queue_manager *pqm,
+				     struct process_queue_node *pqn)
+{
+	struct kfd_node *dev;
+	struct kfd_process_device *pdd;
+
+	dev = pqn->q->device;
+
+	pdd = kfd_get_process_device_data(dev, pqm->process);
+	if (!pdd) {
+		pr_err("Process device data doesn't exist\n");
+		return;
+	}
+
+	if (pqn->q->gws) {
+		if (KFD_GC_VERSION(pqn->q->device) != IP_VERSION(9, 4, 3) &&
+		    !dev->kfd->shared_resources.enable_mes)
+			amdgpu_amdkfd_remove_gws_from_process(
+				pqm->process->kgd_process_info, pqn->q->gws);
+		pdd->qpd.num_gws = 0;
+	}
+
+	if (dev->kfd->shared_resources.enable_mes) {
+		amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->gang_ctx_bo);
+		if (pqn->q->wptr_bo)
+			amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->wptr_bo);
+	}
+}
+
 void pqm_uninit(struct process_queue_manager *pqm)
 {
 	struct process_queue_node *pqn, *next;
 
 	list_for_each_entry_safe(pqn, next, &pqm->queues, process_queue_list) {
-		if (pqn->q && pqn->q->gws &&
-		    KFD_GC_VERSION(pqn->q->device) != IP_VERSION(9, 4, 3) &&
-		    !pqn->q->device->kfd->shared_resources.enable_mes)
-			amdgpu_amdkfd_remove_gws_from_process(pqm->process->kgd_process_info,
-				pqn->q->gws);
+		if (pqn->q)
+			pqm_clean_queue_resource(pqm, pqn);
+
 		kfd_procfs_del_queue(pqn->q);
 		uninit_queue(pqn->q);
 		list_del(&pqn->process_queue_list);
@@ -461,22 +488,7 @@ int pqm_destroy_queue(struct process_queue_manager *pqm, unsigned int qid)
 				goto err_destroy_queue;
 		}
 
-		if (pqn->q->gws) {
-			if (KFD_GC_VERSION(pqn->q->device) != IP_VERSION(9, 4, 3) &&
-			    !dev->kfd->shared_resources.enable_mes)
-				amdgpu_amdkfd_remove_gws_from_process(
-						pqm->process->kgd_process_info,
-						pqn->q->gws);
-			pdd->qpd.num_gws = 0;
-		}
-
-		if (dev->kfd->shared_resources.enable_mes) {
-			amdgpu_amdkfd_free_gtt_mem(dev->adev,
-						   pqn->q->gang_ctx_bo);
-			if (pqn->q->wptr_bo)
-				amdgpu_amdkfd_free_gtt_mem(dev->adev, pqn->q->wptr_bo);
-
-		}
+		pqm_clean_queue_resource(pqm, pqn);
 		uninit_queue(pqn->q);
 	}
 
diff --git a/sys/dev/pci/drm/amd/amdkfd/kfd_svm.c b/sys/dev/pci/drm/amd/amdkfd/kfd_svm.c
index 63ce30ea6..8e368e465 100644
--- a/sys/dev/pci/drm/amd/amdkfd/kfd_svm.c
+++ b/sys/dev/pci/drm/amd/amdkfd/kfd_svm.c
@@ -1632,18 +1632,24 @@ static int svm_range_validate_and_map(struct mm_struct *mm,
 			if (test_bit(gpuidx, prange->bitmap_access))
 				bitmap_set(ctx->bitmap, gpuidx, 1);
 		}
+
+		/*
+		 * If prange is already mapped or with always mapped flag,
+		 * update mapping on GPUs with ACCESS attribute
+		 */
+		if (bitmap_empty(ctx->bitmap, MAX_GPU_INSTANCE)) {
+			if (prange->mapped_to_gpu ||
+			    prange->flags & KFD_IOCTL_SVM_FLAG_GPU_ALWAYS_MAPPED)
+				bitmap_copy(ctx->bitmap, prange->bitmap_access, MAX_GPU_INSTANCE);
+		}
 	} else {
 		bitmap_or(ctx->bitmap, prange->bitmap_access,
 			  prange->bitmap_aip, MAX_GPU_INSTANCE);
 	}
 
 	if (bitmap_empty(ctx->bitmap, MAX_GPU_INSTANCE)) {
-		bitmap_copy(ctx->bitmap, prange->bitmap_access, MAX_GPU_INSTANCE);
-		if (!prange->mapped_to_gpu ||
-		    bitmap_empty(ctx->bitmap, MAX_GPU_INSTANCE)) {
-			r = 0;
-			goto free_ctx;
-		}
+		r = 0;
+		goto free_ctx;
 	}
 
 	if (prange->actual_loc && !prange->ttm_res) {
diff --git a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
index b0813138d..cb0142f3a 100644
--- a/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+++ b/sys/dev/pci/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
@@ -63,6 +63,12 @@ static void apply_edid_quirks(struct edid *edid, struct dc_edid_caps *edid_caps)
 		DRM_DEBUG_DRIVER("Disabling FAMS on monitor with panel id %X\n", panel_id);
 		edid_caps->panel_patch.disable_fams = true;
 		break;
+	/* Workaround for some monitors that do not clear DPCD 0x317 if FreeSync is unsupported */
+	case drm_edid_encode_panel_id('A', 'U', 'O', 0xA7AB):
+	case drm_edid_encode_panel_id('A', 'U', 'O', 0xE69B):
+		DRM_DEBUG_DRIVER("Clearing DPCD 0x317 on monitor with panel id %X\n", panel_id);
+		edid_caps->panel_patch.remove_sink_ext_caps = true;
+		break;
 	default:
 		return;
 	}
diff --git a/sys/dev/pci/drm/amd/display/dc/bios/bios_parser2.c b/sys/dev/pci/drm/amd/display/dc/bios/bios_parser2.c
index 484d62bcf..bbf2a465f 100644
--- a/sys/dev/pci/drm/amd/display/dc/bios/bios_parser2.c
+++ b/sys/dev/pci/drm/amd/display/dc/bios/bios_parser2.c
@@ -1015,13 +1015,20 @@ static enum bp_result get_ss_info_v4_5(
 		DC_LOG_BIOS("AS_SIGNAL_TYPE_HDMI ss_percentage: %d\n", ss_info->spread_spectrum_percentage);
 		break;
 	case AS_SIGNAL_TYPE_DISPLAY_PORT:
-		ss_info->spread_spectrum_percentage =
+		if (bp->base.integrated_info) {
+			DC_LOG_BIOS("gpuclk_ss_percentage (unit of 0.001 percent): %d\n", bp->base.integrated_info->gpuclk_ss_percentage);
+			ss_info->spread_spectrum_percentage =
+					bp->base.integrated_info->gpuclk_ss_percentage;
+			ss_info->type.CENTER_MODE =
+					bp->base.integrated_info->gpuclk_ss_type;
+		} else {
+			ss_info->spread_spectrum_percentage =
 				disp_cntl_tbl->dp_ss_percentage;
-		ss_info->spread_spectrum_range =
+			ss_info->spread_spectrum_range =
 				disp_cntl_tbl->dp_ss_rate_10hz * 10;
-		if (disp_cntl_tbl->dp_ss_mode & ATOM_SS_CENTRE_SPREAD_MODE)
-			ss_info->type.CENTER_MODE = true;
-
+			if (disp_cntl_tbl->dp_ss_mode & ATOM_SS_CENTRE_SPREAD_MODE)
+				ss_info->type.CENTER_MODE = true;
+		}
 		DC_LOG_BIOS("AS_SIGNAL_TYPE_DISPLAY_PORT ss_percentage: %d\n", ss_info->spread_spectrum_percentage);
 		break;
 	case AS_SIGNAL_TYPE_GPU_PLL:
@@ -1692,7 +1699,7 @@ static enum bp_result bios_parser_enable_disp_power_gating(
 static enum bp_result bios_parser_enable_lvtma_control(
 	struct dc_bios *dcb,
 	uint8_t uc_pwr_on,
-	uint8_t panel_instance,
+	uint8_t pwrseq_instance,
 	uint8_t bypass_panel_control_wait)
 {
 	struct bios_parser *bp = BP_FROM_DCB(dcb);
@@ -1700,7 +1707,7 @@ static enum bp_result bios_parser_enable_lvtma_control(
 	if (!bp->cmd_tbl.enable_lvtma_control)
 		return BP_RESULT_FAILURE;
 
-	return bp->cmd_tbl.enable_lvtma_control(bp, uc_pwr_on, panel_instance, bypass_panel_control_wait);
+	return bp->cmd_tbl.enable_lvtma_control(bp, uc_pwr_on, pwrseq_instance, bypass_panel_control_wait);
 }
 
 static bool bios_parser_is_accelerated_mode(
@@ -2826,6 +2833,8 @@ static enum bp_result get_integrated_info_v2_2(
 	info->ma_channel_number = info_v2_2->umachannelnumber;
 	info->dp_ss_control =
 		le16_to_cpu(info_v2_2->reserved1);
+	info->gpuclk_ss_percentage = info_v2_2->gpuclk_ss_percentage;
+	info->gpuclk_ss_type = info_v2_2->gpuclk_ss_type;
 
 	for (i = 0; i < NUMBER_OF_UCHAR_FOR_GUID; ++i) {
 		info->ext_disp_conn_info.gu_id[i] =
diff --git a/sys/dev/pci/drm/amd/display/dc/bios/command_table2.c b/sys/dev/pci/drm/amd/display/dc/bios/command_table2.c
index 90a02d7bd..ab0adabf9 100644
--- a/sys/dev/pci/drm/amd/display/dc/bios/command_table2.c
+++ b/sys/dev/pci/drm/amd/display/dc/bios/command_table2.c
@@ -976,7 +976,7 @@ static unsigned int get_smu_clock_info_v3_1(struct bios_parser *bp, uint8_t id)
 static enum bp_result enable_lvtma_control(
 	struct bios_parser *bp,
 	uint8_t uc_pwr_on,
-	uint8_t panel_instance,
+	uint8_t pwrseq_instance,
 	uint8_t bypass_panel_control_wait);
 
 static void init_enable_lvtma_control(struct bios_parser *bp)
@@ -989,7 +989,7 @@ static void init_enable_lvtma_control(struct bios_parser *bp)
 static void enable_lvtma_control_dmcub(
 	struct dc_dmub_srv *dmcub,
 	uint8_t uc_pwr_on,
-	uint8_t panel_instance,
+	uint8_t pwrseq_instance,
 	uint8_t bypass_panel_control_wait)
 {
 
@@ -1002,8 +1002,8 @@ static void enable_lvtma_control_dmcub(
 			DMUB_CMD__VBIOS_LVTMA_CONTROL;
 	cmd.lvtma_control.data.uc_pwr_action =
 			uc_pwr_on;
-	cmd.lvtma_control.data.panel_inst =
-			panel_instance;
+	cmd.lvtma_control.data.pwrseq_inst =
+			pwrseq_instance;
 	cmd.lvtma_control.data.bypass_panel_control_wait =
 			bypass_panel_control_wait;
 	dm_execute_dmub_cmd(dmcub->ctx, &cmd, DM_DMUB_WAIT_TYPE_WAIT);
@@ -1012,7 +1012,7 @@ static void enable_lvtma_control_dmcub(
 static enum bp_result enable_lvtma_control(
 	struct bios_parser *bp,
 	uint8_t uc_pwr_on,
-	uint8_t panel_instance,
+	uint8_t pwrseq_instance,
 	uint8_t bypass_panel_control_wait)
 {
 	enum bp_result result = BP_RESULT_FAILURE;
@@ -1021,7 +1021,7 @@ static enum bp_result enable_lvtma_control(
 	    bp->base.ctx->dc->debug.dmub_command_table) {
 		enable_lvtma_control_dmcub(bp->base.ctx->dmub_srv,
 				uc_pwr_on,
-				panel_instance,
+				pwrseq_instance,
 				bypass_panel_control_wait);
 		return BP_RESULT_OK;
 	}
diff --git a/sys/dev/pci/drm/amd/display/dc/bios/command_table2.h b/sys/dev/pci/drm/amd/display/dc/bios/command_table2.h
index b6d09bf6c..41c8c0143 100644
--- a/sys/dev/pci/drm/amd/display/dc/bios/command_table2.h
+++ b/sys/dev/pci/drm/amd/display/dc/bios/command_table2.h
@@ -96,7 +96,7 @@ struct cmd_tbl {
 			struct bios_parser *bp, uint8_t id);
 	enum bp_result (*enable_lvtma_control)(struct bios_parser *bp,
 			uint8_t uc_pwr_on,
-			uint8_t panel_instance,
+			uint8_t pwrseq_instance,
 			uint8_t bypass_panel_control_wait);
 };
 
diff --git a/sys/dev/pci/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c b/sys/dev/pci/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
index b2c4f97af..8776055bb 100644
--- a/sys/dev/pci/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
+++ b/sys/dev/pci/drm/amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c
@@ -334,7 +334,7 @@ static struct wm_table lpddr5_wm_table = {
 		{
 			.wm_inst = WM_A,
 			.wm_type = WM_TYPE_PSTATE_CHG,
-			.pstate_latency_us = 11.65333,
+			.pstate_latency_us = 129.0,
 			.sr_exit_time_us = 11.5,
 			.sr_enter_plus_exit_time_us = 14.5,
 			.valid = true,
@@ -342,7 +342,7 @@ static struct wm_table lpddr5_wm_table = {
 		{
 			.wm_inst = WM_B,
 			.wm_type = WM_TYPE_PSTATE_CHG,
-			.pstate_latency_us = 11.65333,
+			.pstate_latency_us = 129.0,
 			.sr_exit_time_us = 11.5,
 			.sr_enter_plus_exit_time_us = 14.5,
 			.valid = true,
@@ -350,7 +350,7 @@ static struct wm_table lpddr5_wm_table = {
 		{
 			.wm_inst = WM_C,
 			.wm_type = WM_TYPE_PSTATE_CHG,
-			.pstate_latency_us = 11.65333,
+			.pstate_latency_us = 129.0,
 			.sr_exit_time_us = 11.5,
 			.sr_enter_plus_exit_time_us = 14.5,
 			.valid = true,
@@ -358,7 +358,7 @@ static struct wm_table lpddr5_wm_table = {
 		{
 			.wm_inst = WM_D,
 			.wm_type = WM_TYPE_PSTATE_CHG,
-			.pstate_latency_us = 11.65333,
+			.pstate_latency_us = 129.0,
 			.sr_exit_time_us = 11.5,
 			.sr_enter_plus_exit_time_us = 14.5,
 			.valid = true,
diff --git a/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c b/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
index a1be93f63..8cdf380bf 100644
--- a/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
+++ b/sys/dev/pci/drm/amd/display/dc/core/amdgpu_dc.c
@@ -4865,18 +4865,28 @@ void dc_mclk_switch_using_fw_based_vblank_stretch_shut_down(struct dc *dc)
  */
 bool dc_is_dmub_outbox_supported(struct dc *dc)
 {
-	/* DCN31 B0 USB4 DPIA needs dmub notifications for interrupts */
-	if (dc->ctx->asic_id.chip_family == FAMILY_YELLOW_CARP &&
-	    dc->ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0 &&
-	    !dc->debug.dpia_debug.bits.disable_dpia)
-		return true;
+	switch (dc->ctx->asic_id.chip_family) {
 
-	if (dc->ctx->asic_id.chip_family == AMDGPU_FAMILY_GC_11_0_1 &&
-	    !dc->debug.dpia_debug.bits.disable_dpia)
-		return true;
+	case FAMILY_YELLOW_CARP:
+		/* DCN31 B0 USB4 DPIA needs dmub notifications for interrupts */
+		if (dc->ctx->asic_id.hw_internal_rev == YELLOW_CARP_B0 &&
+		    !dc->debug.dpia_debug.bits.disable_dpia)
+			return true;
+	break;
+
+	case AMDGPU_FAMILY_GC_11_0_1:
+	case AMDGPU_FAMILY_GC_11_5_0:
+		if (!dc->debug.dpia_debug.bits.disable_dpia)
+			return true;
+	break;
+
+	default:
+		break;
+	}
 
 	/* dmub aux needs dmub notifications to be enabled */
 	return dc->debug.enable_dmub_aux_for_legacy_ddc;
+
 }
 
 /**
diff --git a/sys/dev/pci/drm/amd/display/dc/dc_bios_types.h b/sys/dev/pci/drm/amd/display/dc/dc_bios_types.h
index be9aa1a71..26940d94d 100644
--- a/sys/dev/pci/drm/amd/display/dc/dc_bios_types.h
+++ b/sys/dev/pci/drm/amd/display/dc/dc_bios_types.h
@@ -140,7 +140,7 @@ struct dc_vbios_funcs {
 	enum bp_result (*enable_lvtma_control)(
 		struct dc_bios *bios,
 		uint8_t uc_pwr_on,
-		uint8_t panel_instance,
+		uint8_t pwrseq_instance,
 		uint8_t bypass_panel_control_wait);
 
 	enum bp_result (*get_soc_bb_info)(
diff --git a/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm.c b/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm.c
index d3e654402..930fd929e 100644
--- a/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm.c
+++ b/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm.c
@@ -145,7 +145,11 @@ static bool dmub_abm_save_restore_ex(
 	return ret;
 }
 
-static bool dmub_abm_set_pipe_ex(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst)
+static bool dmub_abm_set_pipe_ex(struct abm *abm,
+		uint32_t otg_inst,
+		uint32_t option,
+		uint32_t panel_inst,
+		uint32_t pwrseq_inst)
 {
 	bool ret = false;
 	unsigned int feature_support;
@@ -153,7 +157,7 @@ static bool dmub_abm_set_pipe_ex(struct abm *abm, uint32_t otg_inst, uint32_t op
 	feature_support = abm_feature_support(abm, panel_inst);
 
 	if (feature_support == ABM_LCD_SUPPORT)
-		ret = dmub_abm_set_pipe(abm, otg_inst, option, panel_inst);
+		ret = dmub_abm_set_pipe(abm, otg_inst, option, panel_inst, pwrseq_inst);
 
 	return ret;
 }
diff --git a/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm_lcd.c b/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm_lcd.c
index 592a8f7a1..42c802afc 100644
--- a/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm_lcd.c
+++ b/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm_lcd.c
@@ -254,7 +254,11 @@ bool dmub_abm_save_restore(
 	return true;
 }
 
-bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst)
+bool dmub_abm_set_pipe(struct abm *abm,
+		uint32_t otg_inst,
+		uint32_t option,
+		uint32_t panel_inst,
+		uint32_t pwrseq_inst)
 {
 	union dmub_rb_cmd cmd;
 	struct dc_context *dc = abm->ctx;
@@ -264,6 +268,7 @@ bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint
 	cmd.abm_set_pipe.header.type = DMUB_CMD__ABM;
 	cmd.abm_set_pipe.header.sub_type = DMUB_CMD__ABM_SET_PIPE;
 	cmd.abm_set_pipe.abm_set_pipe_data.otg_inst = otg_inst;
+	cmd.abm_set_pipe.abm_set_pipe_data.pwrseq_inst = pwrseq_inst;
 	cmd.abm_set_pipe.abm_set_pipe_data.set_pipe_option = option;
 	cmd.abm_set_pipe.abm_set_pipe_data.panel_inst = panel_inst;
 	cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary;
diff --git a/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm_lcd.h b/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm_lcd.h
index 853564d7f..07ea6c8d4 100644
--- a/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm_lcd.h
+++ b/sys/dev/pci/drm/amd/display/dc/dce/dmub_abm_lcd.h
@@ -44,7 +44,7 @@ bool dmub_abm_save_restore(
 		struct dc_context *dc,
 		unsigned int panel_inst,
 		struct abm_save_restore *pData);
-bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst);
+bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst, uint32_t pwrseq_inst);
 bool dmub_abm_set_backlight_level(struct abm *abm,
 		unsigned int backlight_pwm_u16_16,
 		unsigned int frame_ramp,
diff --git a/sys/dev/pci/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/sys/dev/pci/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index 6054b8df1..a95b2fea4 100644
--- a/sys/dev/pci/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/sys/dev/pci/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -788,7 +788,7 @@ void dce110_edp_power_control(
 	struct dc_context *ctx = link->ctx;
 	struct bp_transmitter_control cntl = { 0 };
 	enum bp_result bp_result;
-	uint8_t panel_instance;
+	uint8_t pwrseq_instance;
 
 
 	if (dal_graphics_object_id_get_connector_id(link->link_enc->connector)
@@ -871,7 +871,7 @@ void dce110_edp_power_control(
 		cntl.coherent = false;
 		cntl.lanes_number = LANE_COUNT_FOUR;
 		cntl.hpd_sel = link->link_enc->hpd_source;
-		panel_instance = link->panel_cntl->inst;
+		pwrseq_instance = link->panel_cntl->pwrseq_inst;
 
 		if (ctx->dc->ctx->dmub_srv &&
 				ctx->dc->debug.dmub_command_table) {
@@ -879,11 +879,11 @@ void dce110_edp_power_control(
 			if (cntl.action == TRANSMITTER_CONTROL_POWER_ON) {
 				bp_result = ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios,
 						LVTMA_CONTROL_POWER_ON,
-						panel_instance, link->link_powered_externally);
+						pwrseq_instance, link->link_powered_externally);
 			} else {
 				bp_result = ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios,
 						LVTMA_CONTROL_POWER_OFF,
-						panel_instance, link->link_powered_externally);
+						pwrseq_instance, link->link_powered_externally);
 			}
 		}
 
@@ -954,7 +954,7 @@ void dce110_edp_backlight_control(
 {
 	struct dc_context *ctx = link->ctx;
 	struct bp_transmitter_control cntl = { 0 };
-	uint8_t panel_instance;
+	uint8_t pwrseq_instance;
 	unsigned int pre_T11_delay = OLED_PRE_T11_DELAY;
 	unsigned int post_T7_delay = OLED_POST_T7_DELAY;
 
@@ -1007,7 +1007,7 @@ void dce110_edp_backlight_control(
 	 */
 	/* dc_service_sleep_in_milliseconds(50); */
 		/*edp 1.2*/
-	panel_instance = link->panel_cntl->inst;
+	pwrseq_instance = link->panel_cntl->pwrseq_inst;
 
 	if (cntl.action == TRANSMITTER_CONTROL_BACKLIGHT_ON) {
 		if (!link->dc->config.edp_no_power_sequencing)
@@ -1032,11 +1032,11 @@ void dce110_edp_backlight_control(
 		if (cntl.action == TRANSMITTER_CONTROL_BACKLIGHT_ON)
 			ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios,
 					LVTMA_CONTROL_LCD_BLON,
-					panel_instance, link->link_powered_externally);
+					pwrseq_instance, link->link_powered_externally);
 		else
 			ctx->dc_bios->funcs->enable_lvtma_control(ctx->dc_bios,
 					LVTMA_CONTROL_LCD_BLOFF,
-					panel_instance, link->link_powered_externally);
+					pwrseq_instance, link->link_powered_externally);
 	}
 
 	link_transmitter_control(ctx->dc_bios, &cntl);
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn21/dcn21_hwseq.c b/sys/dev/pci/drm/amd/display/dc/dcn21/dcn21_hwseq.c
index 43463d08f..f99b1bc49 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn21/dcn21_hwseq.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn21/dcn21_hwseq.c
@@ -137,7 +137,8 @@ void dcn21_PLAT_58856_wa(struct dc_state *context, struct pipe_ctx *pipe_ctx)
 	pipe_ctx->stream->dpms_off = true;
 }
 
-static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t option, uint32_t panel_inst)
+static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst,
+		uint32_t option, uint32_t panel_inst, uint32_t pwrseq_inst)
 {
 	union dmub_rb_cmd cmd;
 	struct dc_context *dc = abm->ctx;
@@ -147,6 +148,7 @@ static bool dmub_abm_set_pipe(struct abm *abm, uint32_t otg_inst, uint32_t optio
 	cmd.abm_set_pipe.header.type = DMUB_CMD__ABM;
 	cmd.abm_set_pipe.header.sub_type = DMUB_CMD__ABM_SET_PIPE;
 	cmd.abm_set_pipe.abm_set_pipe_data.otg_inst = otg_inst;
+	cmd.abm_set_pipe.abm_set_pipe_data.pwrseq_inst = pwrseq_inst;
 	cmd.abm_set_pipe.abm_set_pipe_data.set_pipe_option = option;
 	cmd.abm_set_pipe.abm_set_pipe_data.panel_inst = panel_inst;
 	cmd.abm_set_pipe.abm_set_pipe_data.ramping_boundary = ramping_boundary;
@@ -179,7 +181,6 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx)
 	struct abm *abm = pipe_ctx->stream_res.abm;
 	uint32_t otg_inst = pipe_ctx->stream_res.tg->inst;
 	struct panel_cntl *panel_cntl = pipe_ctx->stream->link->panel_cntl;
-
 	struct dmcu *dmcu = pipe_ctx->stream->ctx->dc->res_pool->dmcu;
 
 	if (dmcu) {
@@ -190,9 +191,13 @@ void dcn21_set_abm_immediate_disable(struct pipe_ctx *pipe_ctx)
 	if (abm && panel_cntl) {
 		if (abm->funcs && abm->funcs->set_pipe_ex) {
 			abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_IMMEDIATELY_DISABLE,
-			panel_cntl->inst);
+					panel_cntl->inst, panel_cntl->pwrseq_inst);
 		} else {
-			dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_IMMEDIATELY_DISABLE, panel_cntl->inst);
+				dmub_abm_set_pipe(abm,
+						otg_inst,
+						SET_ABM_PIPE_IMMEDIATELY_DISABLE,
+						panel_cntl->inst,
+						panel_cntl->pwrseq_inst);
 		}
 		panel_cntl->funcs->store_backlight_level(panel_cntl);
 	}
@@ -212,9 +217,16 @@ void dcn21_set_pipe(struct pipe_ctx *pipe_ctx)
 
 	if (abm && panel_cntl) {
 		if (abm->funcs && abm->funcs->set_pipe_ex) {
-			abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst);
+			abm->funcs->set_pipe_ex(abm,
+					otg_inst,
+					SET_ABM_PIPE_NORMAL,
+					panel_cntl->inst,
+					panel_cntl->pwrseq_inst);
 		} else {
-			dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst);
+				dmub_abm_set_pipe(abm, otg_inst,
+						SET_ABM_PIPE_NORMAL,
+						panel_cntl->inst,
+						panel_cntl->pwrseq_inst);
 		}
 	}
 }
@@ -237,9 +249,17 @@ bool dcn21_set_backlight_level(struct pipe_ctx *pipe_ctx,
 
 		if (abm && panel_cntl) {
 			if (abm->funcs && abm->funcs->set_pipe_ex) {
-				abm->funcs->set_pipe_ex(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst);
+				abm->funcs->set_pipe_ex(abm,
+						otg_inst,
+						SET_ABM_PIPE_NORMAL,
+						panel_cntl->inst,
+						panel_cntl->pwrseq_inst);
 			} else {
-				dmub_abm_set_pipe(abm, otg_inst, SET_ABM_PIPE_NORMAL, panel_cntl->inst);
+					dmub_abm_set_pipe(abm,
+							otg_inst,
+							SET_ABM_PIPE_NORMAL,
+							panel_cntl->inst,
+							panel_cntl->pwrseq_inst);
 			}
 		}
 	}
diff --git a/sys/dev/pci/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c b/sys/dev/pci/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c
index 217acd4e2..d849b1eaa 100644
--- a/sys/dev/pci/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c
+++ b/sys/dev/pci/drm/amd/display/dc/dcn31/dcn31_panel_cntl.c
@@ -50,7 +50,7 @@ static bool dcn31_query_backlight_info(struct panel_cntl *panel_cntl, union dmub
 	cmd->panel_cntl.header.type = DMUB_CMD__PANEL_CNTL;
 	cmd->panel_cntl.header.sub_type = DMUB_CMD__PANEL_CNTL_QUERY_BACKLIGHT_INFO;
 	cmd->panel_cntl.header.payload_bytes = sizeof(cmd->panel_cntl.data);
-	cmd->panel_cntl.data.inst = dcn31_panel_cntl->base.inst;
+	cmd->panel_cntl.data.pwrseq_inst = dcn31_panel_cntl->base.pwrseq_inst;
 
 	return dm_execute_dmub_cmd(dc_dmub_srv->ctx, cmd, DM_DMUB_WAIT_TYPE_WAIT_WITH_REPLY);
 }
@@ -78,7 +78,7 @@ static uint32_t dcn31_panel_cntl_hw_init(struct panel_cntl *panel_cntl)
 	cmd.panel_cntl.header.type = DMUB_CMD__PANEL_CNTL;
 	cmd.panel_cntl.header.sub_type = DMUB_CMD__PANEL_CNTL_HW_INIT;
 	cmd.panel_cntl.header.payload_bytes = sizeof(cmd.panel_cntl.data);
-	cmd.panel_cntl.data.inst = dcn31_panel_cntl->base.inst;
+	cmd.panel_cntl.data.pwrseq_inst = dcn31_panel_cntl->base.pwrseq_inst;
 	cmd.panel_cntl.data.bl_pwm_cntl = panel_cntl->stored_backlight_registers.BL_PWM_CNTL;
 	cmd.panel_cntl.data.bl_pwm_period_cntl = panel_cntl->stored_backlight_registers.BL_PWM_PERIOD_CNTL;
 	cmd.panel_cntl.data.bl_pwm_ref_div1 =
@@ -157,4 +157,5 @@ void dcn31_panel_cntl_construct(
 	dcn31_panel_cntl->base.funcs = &dcn31_link_panel_cntl_funcs;
 	dcn31_panel_cntl->base.ctx = init_data->ctx;
 	dcn31_panel_cntl->base.inst = init_data->inst;
+	dcn31_panel_cntl->base.pwrseq_inst = init_data->pwrseq_inst;
 }
diff --git a/sys/dev/pci/drm/amd/display/dc/inc/hw/abm.h b/sys/dev/pci/drm/amd/display/dc/inc/hw/abm.h
index 33db15d69..9f521cf0f 100644
--- a/sys/dev/pci/drm/amd/display/dc/inc/hw/abm.h
+++ b/sys/dev/pci/drm/amd/display/dc/inc/hw/abm.h
@@ -64,7 +64,8 @@ struct abm_funcs {
 	bool (*set_pipe_ex)(struct abm *abm,
 			unsigned int otg_inst,
 			unsigned int option,
-			unsigned int panel_inst);
+			unsigned int panel_inst,
+			unsigned int pwrseq_inst);
 };
 
 #endif
diff --git a/sys/dev/pci/drm/amd/display/dc/inc/hw/panel_cntl.h b/sys/dev/pci/drm/amd/display/dc/inc/hw/panel_cntl.h
index 24af9d80b..248adc170 100644
--- a/sys/dev/pci/drm/amd/display/dc/inc/hw/panel_cntl.h
+++ b/sys/dev/pci/drm/amd/display/dc/inc/hw/panel_cntl.h
@@ -56,12 +56,14 @@ struct panel_cntl_funcs {
 struct panel_cntl_init_data {
 	struct dc_context *ctx;
 	uint32_t inst;
+	uint32_t pwrseq_inst;
 };
 
 struct panel_cntl {
 	const struct panel_cntl_funcs *funcs;
 	struct dc_context *ctx;
 	uint32_t inst;
+	uint32_t pwrseq_inst;
 	/* registers setting needs to be saved and restored at InitBacklight */
 	struct panel_cntl_backlight_registers stored_backlight_registers;
 };
diff --git a/sys/dev/pci/drm/amd/display/dc/link/link_factory.c b/sys/dev/pci/drm/amd/display/dc/link/link_factory.c
index e406561c2..2c366866f 100644
--- a/sys/dev/pci/drm/amd/display/dc/link/link_factory.c
+++ b/sys/dev/pci/drm/amd/display/dc/link/link_factory.c
@@ -367,6 +367,27 @@ static enum transmitter translate_encoder_to_transmitter(
 	}
 }
 
+static uint8_t translate_dig_inst_to_pwrseq_inst(struct dc_link *link)
+{
+	uint8_t pwrseq_inst = 0xF;
+
+	switch (link->eng_id) {
+	case ENGINE_ID_DIGA:
+		pwrseq_inst = 0;
+		break;
+	case ENGINE_ID_DIGB:
+		pwrseq_inst = 1;
+		break;
+	default:
+		DC_LOG_WARNING("Unsupported pwrseq engine id: %d!\n", link->eng_id);
+		ASSERT(false);
+		break;
+	}
+
+	return pwrseq_inst;
+}
+
+
 static void link_destruct(struct dc_link *link)
 {
 	int i;
@@ -594,24 +615,6 @@ static bool construct_phy(struct dc_link *link,
 	link->ddc_hw_inst =
 		dal_ddc_get_line(get_ddc_pin(link->ddc));
 
-
-	if (link->dc->res_pool->funcs->panel_cntl_create &&
-		(link->link_id.id == CONNECTOR_ID_EDP ||
-			link->link_id.id == CONNECTOR_ID_LVDS)) {
-		panel_cntl_init_data.ctx = dc_ctx;
-		panel_cntl_init_data.inst =
-			panel_cntl_init_data.ctx->dc_edp_id_count;
-		link->panel_cntl =
-			link->dc->res_pool->funcs->panel_cntl_create(
-								&panel_cntl_init_data);
-		panel_cntl_init_data.ctx->dc_edp_id_count++;
-
-		if (link->panel_cntl == NULL) {
-			DC_ERROR("Failed to create link panel_cntl!\n");
-			goto panel_cntl_create_fail;
-		}
-	}
-
 	enc_init_data.ctx = dc_ctx;
 	bp_funcs->get_src_obj(dc_ctx->dc_bios, link->link_id, 0,
 			      &enc_init_data.encoder);
@@ -642,6 +645,23 @@ static bool construct_phy(struct dc_link *link,
 	link->dc->res_pool->dig_link_enc_count++;
 
 	link->link_enc_hw_inst = link->link_enc->transmitter;
+
+	if (link->dc->res_pool->funcs->panel_cntl_create &&
+		(link->link_id.id == CONNECTOR_ID_EDP ||
+			link->link_id.id == CONNECTOR_ID_LVDS)) {
+		panel_cntl_init_data.ctx = dc_ctx;
+		panel_cntl_init_data.inst = panel_cntl_init_data.ctx->dc_edp_id_count;
+		panel_cntl_init_data.pwrseq_inst = translate_dig_inst_to_pwrseq_inst(link);
+		link->panel_cntl =
+			link->dc->res_pool->funcs->panel_cntl_create(
+								&panel_cntl_init_data);
+		panel_cntl_init_data.ctx->dc_edp_id_count++;
+
+		if (link->panel_cntl == NULL) {
+			DC_ERROR("Failed to create link panel_cntl!\n");
+			goto panel_cntl_create_fail;
+		}
+	}
 	for (i = 0; i < 4; i++) {
 		if (bp_funcs->get_device_tag(dc_ctx->dc_bios,
 					     link->link_id, i,
diff --git a/sys/dev/pci/drm/amd/display/dmub/inc/dmub_cmd.h b/sys/dev/pci/drm/amd/display/dmub/inc/dmub_cmd.h
index 8b10e75b6..387a2c8e8 100644
--- a/sys/dev/pci/drm/amd/display/dmub/inc/dmub_cmd.h
+++ b/sys/dev/pci/drm/amd/display/dmub/inc/dmub_cmd.h
@@ -3303,6 +3303,16 @@ struct dmub_cmd_abm_set_pipe_data {
 	 * TODO: Remove.
 	 */
 	uint8_t ramping_boundary;
+
+	/**
+	 * PwrSeq HW Instance.
+	 */
+	uint8_t pwrseq_inst;
+
+	/**
+	 * Explicit padding to 4 byte boundary.
+	 */
+	uint8_t pad[3];
 };
 
 /**
@@ -3717,7 +3727,7 @@ enum dmub_cmd_panel_cntl_type {
  * struct dmub_cmd_panel_cntl_data - Panel control data.
  */
 struct dmub_cmd_panel_cntl_data {
-	uint32_t inst; /**< panel instance */
+	uint32_t pwrseq_inst; /**< pwrseq instance */
 	uint32_t current_backlight; /* in/out */
 	uint32_t bl_pwm_cntl; /* in/out */
 	uint32_t bl_pwm_period_cntl; /* in/out */
@@ -3744,7 +3754,7 @@ struct dmub_cmd_lvtma_control_data {
 	uint8_t uc_pwr_action; /**< LVTMA_ACTION */
 	uint8_t bypass_panel_control_wait;
 	uint8_t reserved_0[2]; /**< For future use */
-	uint8_t panel_inst; /**< LVTMA control instance */
+	uint8_t pwrseq_inst; /**< LVTMA control instance */
 	uint8_t reserved_1[3]; /**< For future use */
 };
 
diff --git a/sys/dev/pci/drm/amd/display/include/grph_object_ctrl_defs.h b/sys/dev/pci/drm/amd/display/include/grph_object_ctrl_defs.h
index bc96d0211..813463ffe 100644
--- a/sys/dev/pci/drm/amd/display/include/grph_object_ctrl_defs.h
+++ b/sys/dev/pci/drm/amd/display/include/grph_object_ctrl_defs.h
@@ -417,6 +417,8 @@ struct integrated_info {
 	/* V2.1 */
 	struct edp_info edp1_info;
 	struct edp_info edp2_info;
+	uint32_t gpuclk_ss_percentage;
+	uint32_t gpuclk_ss_type;
 };
 
 /*
diff --git a/sys/dev/pci/drm/drm_crtc.c b/sys/dev/pci/drm/drm_crtc.c
index 0d2cbbf07..ee349e64a 100644
--- a/sys/dev/pci/drm/drm_crtc.c
+++ b/sys/dev/pci/drm/drm_crtc.c
@@ -715,8 +715,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 	struct drm_mode_set set;
 	uint32_t __user *set_connectors_ptr;
 	struct drm_modeset_acquire_ctx ctx;
-	int ret;
-	int i;
+	int ret, i, num_connectors = 0;
 
 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
 		return -EOPNOTSUPP;
@@ -871,6 +870,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 					connector->name);
 
 			connector_set[i] = connector;
+			num_connectors++;
 		}
 	}
 
@@ -879,7 +879,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
 	set.y = crtc_req->y;
 	set.mode = mode;
 	set.connectors = connector_set;
-	set.num_connectors = crtc_req->count_connectors;
+	set.num_connectors = num_connectors;
 	set.fb = fb;
 
 	if (drm_drv_uses_atomic_modeset(dev))
@@ -892,7 +892,7 @@ out:
 		drm_framebuffer_put(fb);
 
 	if (connector_set) {
-		for (i = 0; i < crtc_req->count_connectors; i++) {
+		for (i = 0; i < num_connectors; i++) {
 			if (connector_set[i])
 				drm_connector_put(connector_set[i]);
 		}
diff --git a/sys/dev/pci/drm/drm_linux.c b/sys/dev/pci/drm/drm_linux.c
index 1fa71c54c..28033379c 100644
--- a/sys/dev/pci/drm/drm_linux.c
+++ b/sys/dev/pci/drm/drm_linux.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: drm_linux.c,v 1.108 2024/01/16 23:37:51 jsg Exp $	*/
+/*	$OpenBSD: drm_linux.c,v 1.109 2024/01/21 13:36:40 kettenis Exp $	*/
 /*
  * Copyright (c) 2013 Jonathan Gray <jsg@openbsd.org>
  * Copyright (c) 2015, 2016 Mark Kettenis <kettenis@openbsd.org>
@@ -3421,23 +3421,32 @@ component_bind_all(struct device *dev, void *data)
 	return ret;
 }
 
-struct component_match {
+struct component_match_entry {
 	int (*compare)(struct device *, void *);
 	void *data;
 };
 
+struct component_match {
+	struct component_match_entry match[4];
+	int nmatches;
+};
+
 int
 component_master_add_with_match(struct device *dev,
     const struct component_master_ops *ops, struct component_match *match)
 {
 	struct component *component;
 	int found = 0;
-	int ret;
+	int i, ret;
 
 	SLIST_FOREACH(component, &component_list, next) {
-		if (match->compare(component->dev, match->data)) {
-			component->adev = dev;
-			found = 1;
+		for (i = 0; i < match->nmatches; i++) {
+			struct component_match_entry *m = &match->match[i];
+			if (m->compare(component->dev, m->data)) {
+				component->adev = dev;
+				found = 1;
+				break;
+			}
 		}
 	}
 
@@ -3883,15 +3892,18 @@ drm_of_component_match_add(struct device *master,
 			   int (*compare)(struct device *, void *),
 			   struct device_node *np)
 {
-	struct component_match *match;
+	struct component_match *match = *matchptr;
 
-	if (*matchptr == NULL) {
+	if (match == NULL) {
 		match = malloc(sizeof(struct component_match),
 		    M_DEVBUF, M_WAITOK | M_ZERO);
-		match->compare = compare;
-		match->data = np;
 		*matchptr = match;
 	}
+
+	KASSERT(match->nmatches < nitems(match->match));
+	match->match[match->nmatches].compare = compare;
+	match->match[match->nmatches].data = np;
+	match->nmatches++;
 }
 
 #endif
diff --git a/sys/dev/pci/drm/drm_prime.c b/sys/dev/pci/drm/drm_prime.c
index 4197c3ba9..d526e6104 100644
--- a/sys/dev/pci/drm/drm_prime.c
+++ b/sys/dev/pci/drm/drm_prime.c
@@ -280,7 +280,7 @@ void drm_gem_dmabuf_release(struct dma_buf *dma_buf)
 }
 EXPORT_SYMBOL(drm_gem_dmabuf_release);
 
-/*
+/**
  * drm_gem_prime_fd_to_handle - PRIME import function for GEM drivers
  * @dev: drm_device to import into
  * @file_priv: drm file-private structure
@@ -294,9 +294,9 @@ EXPORT_SYMBOL(drm_gem_dmabuf_release);
  *
  * Returns 0 on success or a negative error code on failure.
  */
-static int drm_gem_prime_fd_to_handle(struct drm_device *dev,
-				      struct drm_file *file_priv, int prime_fd,
-				      uint32_t *handle)
+int drm_gem_prime_fd_to_handle(struct drm_device *dev,
+			       struct drm_file *file_priv, int prime_fd,
+			       uint32_t *handle)
 {
 	struct dma_buf *dma_buf;
 	struct drm_gem_object *obj;
@@ -362,6 +362,7 @@ out_put:
 	dma_buf_put(dma_buf);
 	return ret;
 }
+EXPORT_SYMBOL(drm_gem_prime_fd_to_handle);
 
 int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, void *data,
 				 struct drm_file *file_priv)
@@ -410,7 +411,7 @@ static struct dma_buf *export_and_register_object(struct drm_device *dev,
 	return dmabuf;
 }
 
-/*
+/**
  * drm_gem_prime_handle_to_fd - PRIME export function for GEM drivers
  * @dev: dev to export the buffer from
  * @file_priv: drm file-private structure
@@ -423,10 +424,10 @@ static struct dma_buf *export_and_register_object(struct drm_device *dev,
  * The actual exporting from GEM object to a dma-buf is done through the
  * &drm_gem_object_funcs.export callback.
  */
-static int drm_gem_prime_handle_to_fd(struct drm_device *dev,
-				      struct drm_file *file_priv, uint32_t handle,
-				      uint32_t flags,
-				      int *prime_fd)
+int drm_gem_prime_handle_to_fd(struct drm_device *dev,
+			       struct drm_file *file_priv, uint32_t handle,
+			       uint32_t flags,
+			       int *prime_fd)
 {
 	struct drm_gem_object *obj;
 	int ret = 0;
@@ -510,6 +511,7 @@ out_unlock:
 
 	return ret;
 }
+EXPORT_SYMBOL(drm_gem_prime_handle_to_fd);
 
 int drm_prime_handle_to_fd_ioctl(struct drm_device *dev, void *data,
 				 struct drm_file *file_priv)
@@ -898,9 +900,9 @@ EXPORT_SYMBOL(drm_prime_get_contiguous_size);
  * @obj: GEM object to export
  * @flags: flags like DRM_CLOEXEC and DRM_RDWR
  *
- * This is the implementation of the &drm_gem_object_funcs.export functions
- * for GEM drivers using the PRIME helpers. It is used as the default for
- * drivers that do not set their own.
+ * This is the implementation of the &drm_gem_object_funcs.export functions for GEM drivers
+ * using the PRIME helpers. It is used as the default in
+ * drm_gem_prime_handle_to_fd().
  */
 struct dma_buf *drm_gem_prime_export(struct drm_gem_object *obj,
 				     int flags)
@@ -1007,9 +1009,10 @@ EXPORT_SYMBOL(drm_gem_prime_import_dev);
  * @dev: drm_device to import into
  * @dma_buf: dma-buf object to import
  *
- * This is the implementation of the gem_prime_import functions for GEM
- * drivers using the PRIME helpers. It is the default for drivers that do
- * not set their own &drm_driver.gem_prime_import.
+ * This is the implementation of the gem_prime_import functions for GEM drivers
+ * using the PRIME helpers. Drivers can use this as their
+ * &drm_driver.gem_prime_import implementation. It is used as the default
+ * implementation in drm_gem_prime_fd_to_handle().
  *
  * Drivers must arrange to call drm_prime_gem_destroy() from their
  * &drm_gem_object_funcs.free hook when using this function.
diff --git a/sys/dev/pci/drm/include/drm/drm_prime.h b/sys/dev/pci/drm/include/drm/drm_prime.h
index 91e6df193..8b6ed713b 100644
--- a/sys/dev/pci/drm/include/drm/drm_prime.h
+++ b/sys/dev/pci/drm/include/drm/drm_prime.h
@@ -60,12 +60,19 @@ enum dma_data_direction;
 
 struct drm_device;
 struct drm_gem_object;
+struct drm_file;
 
 /* core prime functions */
 struct dma_buf *drm_gem_dmabuf_export(struct drm_device *dev,
 				      struct dma_buf_export_info *exp_info);
 void drm_gem_dmabuf_release(struct dma_buf *dma_buf);
 
+int drm_gem_prime_fd_to_handle(struct drm_device *dev,
+			       struct drm_file *file_priv, int prime_fd, uint32_t *handle);
+int drm_gem_prime_handle_to_fd(struct drm_device *dev,
+			       struct drm_file *file_priv, uint32_t handle, uint32_t flags,
+			       int *prime_fd);
+
 /* helper functions for exporting */
 int drm_gem_map_attach(struct dma_buf *dma_buf,
 		       struct dma_buf_attachment *attach);
diff --git a/sys/lib/libz/deflate.c b/sys/lib/libz/deflate.c
index 4e1decbfd..9b5593ff3 100644
--- a/sys/lib/libz/deflate.c
+++ b/sys/lib/libz/deflate.c
@@ -489,11 +489,7 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
      * symbols from which it is being constructed.
      */
 
-#ifdef LIT_MEM
-    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 5);
-#else
-    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4);
-#endif
+    s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, LIT_BUFS);
     s->pending_buf_size = (ulg)s->lit_bufsize * 4;
 
     if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL ||
@@ -1306,7 +1302,7 @@ int ZEXPORT deflateCopy(z_streamp dest, z_streamp source) {
     ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte));
     ds->prev   = (Posf *)  ZALLOC(dest, ds->w_size, sizeof(Pos));
     ds->head   = (Posf *)  ZALLOC(dest, ds->hash_size, sizeof(Pos));
-    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4);
+    ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, LIT_BUFS);
 
     if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL ||
         ds->pending_buf == Z_NULL) {
@@ -1317,7 +1313,7 @@ int ZEXPORT deflateCopy(z_streamp dest, z_streamp source) {
     zmemcpy(ds->window, ss->window, ds->w_size * 2 * sizeof(Byte));
     zmemcpy((voidpf)ds->prev, (voidpf)ss->prev, ds->w_size * sizeof(Pos));
     zmemcpy((voidpf)ds->head, (voidpf)ss->head, ds->hash_size * sizeof(Pos));
-    zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size);
+    zmemcpy(ds->pending_buf, ss->pending_buf, ds->lit_bufsize * LIT_BUFS);
 
     ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf);
 #ifdef LIT_MEM
@@ -1556,13 +1552,21 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
  */
 local void check_match(deflate_state *s, IPos start, IPos match, int length) {
     /* check that the match is indeed a match */
-    if (zmemcmp(s->window + match,
-                s->window + start, length) != EQUAL) {
-        fprintf(stderr, " start %u, match %u, length %d\n",
-                start, match, length);
+    Bytef *back = s->window + (int)match, *here = s->window + start;
+    IPos len = length;
+    if (match == (IPos)-1) {
+        /* match starts one byte before the current window -- just compare the
+           subsequent length-1 bytes */
+        back++;
+        here++;
+        len--;
+    }
+    if (zmemcmp(back, here, len) != EQUAL) {
+        fprintf(stderr, " start %u, match %d, length %d\n",
+                start, (int)match, length);
         do {
-            fprintf(stderr, "%c%c", s->window[match++], s->window[start++]);
-        } while (--length != 0);
+            fprintf(stderr, "(%02x %02x)", *back++, *here++);
+        } while (--len != 0);
         z_error("invalid match");
     }
     if (z_verbose > 1) {
diff --git a/sys/lib/libz/deflate.h b/sys/lib/libz/deflate.h
index eb28c625a..0c95a0a33 100644
--- a/sys/lib/libz/deflate.h
+++ b/sys/lib/libz/deflate.h
@@ -220,9 +220,11 @@ typedef struct internal_state {
      */
 
 #ifdef LIT_MEM
+#   define LIT_BUFS 5
     ushf *d_buf;          /* buffer for distances */
     uchf *l_buf;          /* buffer for literals/lengths */
 #else
+#   define LIT_BUFS 4
     uchf *sym_buf;        /* buffer for distances and literals/lengths */
 #endif
 
diff --git a/sys/lib/libz/trees.c b/sys/lib/libz/trees.c
index 6bbbb21c3..670316689 100644
--- a/sys/lib/libz/trees.c
+++ b/sys/lib/libz/trees.c
@@ -936,7 +936,7 @@ local void compress_block(deflate_state *s, const ct_data *ltree,
 
         /* Check for no overlay of pending_buf on needed symbols */
 #ifdef LIT_MEM
-        Assert(s->pending < (s->lit_bufsize << 1) + sx, "pendingBuf overflow");
+        Assert(s->pending < 2 * (s->lit_bufsize + sx), "pendingBuf overflow");
 #else
         Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow");
 #endif
diff --git a/sys/lib/libz/zconf.h b/sys/lib/libz/zconf.h
index 7bc5562f1..58cc93959 100644
--- a/sys/lib/libz/zconf.h
+++ b/sys/lib/libz/zconf.h
@@ -298,14 +298,6 @@
 #  endif
 #endif
 
-#ifndef Z_ARG /* function prototypes for stdarg */
-#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
-#    define Z_ARG(args)  args
-#  else
-#    define Z_ARG(args)  ()
-#  endif
-#endif
-
 /* The following definitions for FAR are needed only for MSDOS mixed
  * model programming (small or medium model with some far allocations).
  * This was tested only with MSC; for other MSDOS compilers you may have
diff --git a/sys/lib/libz/zlib.h b/sys/lib/libz/zlib.h
index 4d077ae20..b29af2ad0 100644
--- a/sys/lib/libz/zlib.h
+++ b/sys/lib/libz/zlib.h
@@ -1758,14 +1758,14 @@ ZEXTERN uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2);
    seq1 and seq2 with lengths len1 and len2, CRC-32 check values were
    calculated for each, crc1 and crc2.  crc32_combine() returns the CRC-32
    check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and
-   len2.
+   len2. len2 must be non-negative.
 */
 
 /*
 ZEXTERN uLong ZEXPORT crc32_combine_gen(z_off_t len2);
 
      Return the operator corresponding to length len2, to be used with
-   crc32_combine_op().
+   crc32_combine_op(). len2 must be non-negative.
 */
 
 ZEXTERN uLong ZEXPORT crc32_combine_op(uLong crc1, uLong crc2, uLong op);
diff --git a/sys/lib/libz/zutil.h b/sys/lib/libz/zutil.h
index 72902a8a4..b0860149c 100644
--- a/sys/lib/libz/zutil.h
+++ b/sys/lib/libz/zutil.h
@@ -72,7 +72,7 @@ typedef unsigned long  ulg;
 extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
 /* (size given to avoid silly warnings with Visual C++) */
 
-#define ERR_MSG(err) z_errmsg[Z_NEED_DICT-(err)]
+#define ERR_MSG(err) z_errmsg[(err) < -6 || (err) > 2 ? 9 : 2 - (err)]
 
 #define ERR_RETURN(strm,err) \
   return (strm->msg = ERR_MSG(err), (err))
@@ -153,17 +153,8 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
 #  endif
 #endif
 
-#if defined(MACOS) || defined(TARGET_OS_MAC)
+#if defined(MACOS)
 #  define OS_CODE  7
-#  ifndef Z_SOLO
-#    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
-#      include <unix.h> /* for fdopen */
-#    else
-#      ifndef fdopen
-#        define fdopen(fd,mode) NULL /* No fdopen() */
-#      endif
-#    endif
-#  endif
 #endif
 
 #ifdef __acorn
@@ -186,18 +177,6 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
 #  define OS_CODE 19
 #endif
 
-#if defined(_BEOS_) || defined(RISCOS)
-#  define fdopen(fd,mode) NULL /* No fdopen() */
-#endif
-
-#if (defined(_MSC_VER) && (_MSC_VER > 600)) && !defined __INTERIX
-#  if defined(_WIN32_WCE)
-#    define fdopen(fd,mode) NULL /* No fdopen() */
-#  else
-#    define fdopen(fd,type)  _fdopen(fd,type)
-#  endif
-#endif
-
 #if defined(__BORLANDC__) && !defined(MSDOS)
   #pragma warn -8004
   #pragma warn -8008
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index 05e13b135..5ba59f461 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip.c,v 1.153 2023/12/15 00:24:56 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip.c,v 1.154 2024/01/21 01:17:20 bluhm Exp $	*/
 /*	$NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $	*/
 
 /*
@@ -171,12 +171,10 @@ rip_input(struct mbuf **mp, int *offp, int proto, int af)
 	rw_enter_write(&rawcbtable.inpt_notify);
 	mtx_enter(&rawcbtable.inpt_mtx);
 	TAILQ_FOREACH(inp, &rawcbtable.inpt_queue, inp_queue) {
+		KASSERT(!ISSET(inp->inp_flags, INP_IPV6));
+
 		if (inp->inp_socket->so_rcv.sb_state & SS_CANTRCVMORE)
 			continue;
-#ifdef INET6
-		if (inp->inp_flags & INP_IPV6)
-			continue;
-#endif
 		if (rtable_l2(inp->inp_rtableid) !=
 		    rtable_l2(m->m_pkthdr.ph_rtableid))
 			continue;
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 06a56ca35..1064f8bd2 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: udp_usrreq.c,v 1.314 2024/01/19 02:24:07 bluhm Exp $	*/
+/*	$OpenBSD: udp_usrreq.c,v 1.315 2024/01/21 01:17:20 bluhm Exp $	*/
 /*	$NetBSD: udp_usrreq.c,v 1.28 1996/03/16 23:54:03 christos Exp $	*/
 
 /*
@@ -381,7 +381,7 @@ udp_input(struct mbuf **mp, int *offp, int proto, int af)
 
 	if (m->m_flags & (M_BCAST|M_MCAST)) {
 		SIMPLEQ_HEAD(, inpcb) inpcblist;
-		struct inpcbtable *tb;
+		struct inpcbtable *table;
 
 		/*
 		 * Deliver a multicast or broadcast datagram to *all* sockets
@@ -406,23 +406,21 @@ udp_input(struct mbuf **mp, int *offp, int proto, int af)
 		SIMPLEQ_INIT(&inpcblist);
 #ifdef INET6
 		if (ip6)
-			tb = &udb6table;
+			table = &udb6table;
 		else
 #endif
-			tb = &udbtable;
+			table = &udbtable;
 
-		rw_enter_write(&tb->inpt_notify);
-		mtx_enter(&tb->inpt_mtx);
-		TAILQ_FOREACH(inp, &tb->inpt_queue, inp_queue) {
-			if (inp->inp_socket->so_rcv.sb_state & SS_CANTRCVMORE)
-				continue;
-#ifdef INET6
-			/* table is per AF, panic if it does not match */
+		rw_enter_write(&table->inpt_notify);
+		mtx_enter(&table->inpt_mtx);
+		TAILQ_FOREACH(inp, &table->inpt_queue, inp_queue) {
 			if (ip6)
 				KASSERT(ISSET(inp->inp_flags, INP_IPV6));
 			else
 				KASSERT(!ISSET(inp->inp_flags, INP_IPV6));
-#endif
+
+			if (inp->inp_socket->so_rcv.sb_state & SS_CANTRCVMORE)
+				continue;
 			if (rtable_l2(inp->inp_rtableid) !=
 			    rtable_l2(m->m_pkthdr.ph_rtableid))
 				continue;
@@ -481,10 +479,10 @@ udp_input(struct mbuf **mp, int *offp, int proto, int af)
 			    SO_REUSEADDR)) == 0)
 				break;
 		}
-		mtx_leave(&tb->inpt_mtx);
+		mtx_leave(&table->inpt_mtx);
 
 		if (SIMPLEQ_EMPTY(&inpcblist)) {
-			rw_exit_write(&tb->inpt_notify);
+			rw_exit_write(&table->inpt_notify);
 
 			/*
 			 * No matching pcb found; discard datagram.
@@ -509,7 +507,7 @@ udp_input(struct mbuf **mp, int *offp, int proto, int af)
 			}
 			in_pcbunref(inp);
 		}
-		rw_exit_write(&tb->inpt_notify);
+		rw_exit_write(&table->inpt_notify);
 
 		return IPPROTO_DONE;
 	}
@@ -1098,7 +1096,7 @@ release:
 int
 udp_attach(struct socket *so, int proto, int wait)
 {
-	struct inpcbtable *tb;
+	struct inpcbtable *table;
 	int error;
 
 	if (so->so_pcb != NULL)
@@ -1110,11 +1108,11 @@ udp_attach(struct socket *so, int proto, int wait)
 	NET_ASSERT_LOCKED();
 #ifdef INET6
 	if (so->so_proto->pr_domain->dom_family == PF_INET6)
-		tb = &udb6table;
+		table = &udb6table;
 	else
 #endif
-		tb = &udbtable;
-	if ((error = in_pcballoc(so, tb, wait)))
+		table = &udbtable;
+	if ((error = in_pcballoc(so, table, wait)))
 		return error;
 #ifdef INET6
 	if (sotoinpcb(so)->inp_flags & INP_IPV6)
diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
index 6379e7947..1b784248f 100644
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip6.c,v 1.178 2023/12/15 00:24:56 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip6.c,v 1.179 2024/01/21 01:17:20 bluhm Exp $	*/
 /*	$KAME: raw_ip6.c,v 1.69 2001/03/04 15:55:44 itojun Exp $	*/
 
 /*
@@ -183,14 +183,14 @@ rip6_input(struct mbuf **mp, int *offp, int proto, int af)
 	rw_enter_write(&rawin6pcbtable.inpt_notify);
 	mtx_enter(&rawin6pcbtable.inpt_mtx);
 	TAILQ_FOREACH(inp, &rawin6pcbtable.inpt_queue, inp_queue) {
+		KASSERT(ISSET(inp->inp_flags, INP_IPV6));
+
 		if (inp->inp_socket->so_rcv.sb_state & SS_CANTRCVMORE)
 			continue;
 		if (rtable_l2(inp->inp_rtableid) !=
 		    rtable_l2(m->m_pkthdr.ph_rtableid))
 			continue;
 
-		if (!(inp->inp_flags & INP_IPV6))
-			continue;
 		if ((inp->inp_ipv6.ip6_nxt || proto == IPPROTO_ICMPV6) &&
 		    inp->inp_ipv6.ip6_nxt != proto)
 			continue;
diff --git a/sys/uvm/uvm_map.c b/sys/uvm/uvm_map.c
index 7accb1b1c..07d647e20 100644
--- a/sys/uvm/uvm_map.c
+++ b/sys/uvm/uvm_map.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uvm_map.c,v 1.323 2024/01/21 00:26:14 deraadt Exp $	*/
+/*	$OpenBSD: uvm_map.c,v 1.326 2024/01/21 17:21:55 deraadt Exp $	*/
 /*	$NetBSD: uvm_map.c,v 1.86 2000/11/27 08:40:03 chs Exp $	*/
 
 /*
@@ -3145,17 +3145,8 @@ uvm_map_protect(struct vm_map *map, vaddr_t start, vaddr_t end,
 			continue;
 
 		if (checkimmutable && (iter->etype & UVM_ET_IMMUTABLE)) {
-#ifdef SMALL_KERNEL
-			if (iter->protection == (PROT_READ | PROT_WRITE) &&
-			    new_prot == PROT_READ) {
-				/* Permit RW to R as a data-locking mechanism */
-				;
-			} else
-#endif
-			{
-				error = EPERM;
-				goto out;
-			}
+			error = EPERM;
+			goto out;
 		}
 		old_prot = iter->protection;
 		if (old_prot == PROT_NONE && new_prot != old_prot) {
@@ -4166,7 +4157,8 @@ int
 uvm_map_inherit(struct vm_map *map, vaddr_t start, vaddr_t end,
     vm_inherit_t new_inheritance)
 {
-	struct vm_map_entry *entry;
+	struct vm_map_entry *entry, *entry1;
+	int error = EPERM;
 
 	switch (new_inheritance) {
 	case MAP_INHERIT_NONE:
@@ -4193,14 +4185,27 @@ uvm_map_inherit(struct vm_map *map, vaddr_t start, vaddr_t end,
 	else
 		entry = RBT_NEXT(uvm_map_addr, entry);
 
+	/* First check for illegal operations */
+	entry1 = entry;
+	while (entry1 != NULL && entry1->start < end) {
+		if (entry1->etype & UVM_ET_IMMUTABLE)
+			goto out;
+		if (new_inheritance == MAP_INHERIT_ZERO &&
+		    (entry1->protection & PROT_WRITE) == 0)
+			goto out;
+		entry1 = RBT_NEXT(uvm_map_addr, entry1);
+	}
+
 	while (entry != NULL && entry->start < end) {
 		UVM_MAP_CLIP_END(map, entry, end);
 		entry->inheritance = new_inheritance;
 		entry = RBT_NEXT(uvm_map_addr, entry);
 	}
 
+	error = 0;
+out:
 	vm_map_unlock(map);
-	return (0);
+	return (error);
 }
 
 #ifdef PMAP_CHECK_COPYIN
@@ -4289,7 +4294,8 @@ uvm_map_syscall(struct vm_map *map, vaddr_t start, vaddr_t end)
 int
 uvm_map_immutable(struct vm_map *map, vaddr_t start, vaddr_t end, int imut)
 {
-	struct vm_map_entry *entry;
+	struct vm_map_entry *entry, *entry1;
+	int error = EPERM;
 
 	if (start > end)
 		return EINVAL;
@@ -4306,6 +4312,14 @@ uvm_map_immutable(struct vm_map *map, vaddr_t start, vaddr_t end, int imut)
 	else
 		entry = RBT_NEXT(uvm_map_addr, entry);
 
+	/* First check for illegal operations */
+	entry1 = entry;
+	while (entry1 != NULL && entry1->start < end) {
+		if (entry1->inheritance == MAP_INHERIT_ZERO)
+			goto out;
+		entry1 = RBT_NEXT(uvm_map_addr, entry1);
+	}
+	
 	while (entry != NULL && entry->start < end) {
 		UVM_MAP_CLIP_END(map, entry, end);
 		if (imut)
@@ -4316,6 +4330,8 @@ uvm_map_immutable(struct vm_map *map, vaddr_t start, vaddr_t end, int imut)
 	}
 
 	map->wserial++;
+	error = 0;
+out:
 	vm_map_unlock(map);
 	return (0);
 }
@@ -4553,9 +4569,13 @@ uvm_map_clean(struct vm_map *map, vaddr_t start, vaddr_t end, int flags)
 	vm_map_lock(map);
 	first = uvm_map_entrybyaddr(&map->addr, start);
 
-	/* Make a first pass to check for holes. */
+	/* Make a first pass to check for various conditions. */
 	for (entry = first; entry != NULL && entry->start < end;
 	    entry = RBT_NEXT(uvm_map_addr, entry)) {
+		if (entry->etype & UVM_ET_IMMUTABLE) {
+			vm_map_unlock(map);
+			return EPERM;
+		}
 		if (UVM_ET_ISSUBMAP(entry)) {
 			vm_map_unlock(map);
 			return EINVAL;