From fe31ca472467eaa2c531d4f0d68c3c72df8b7296 Mon Sep 17 00:00:00 2001
From: purplerain <purplerain@secbsd.org>
Date: Tue, 9 Apr 2024 04:40:00 +0000
Subject: [PATCH] sync with OpenBSD -current

---
 etc/skel/dot.version                          |  2 +-
 lib/libcrypto/asn1/a_time_tm.c                | 40 ++++++---------
 lib/libcrypto/x509/x509_local.h               |  4 +-
 lib/libcrypto/x509/x509_purp.c                |  5 +-
 lib/libcrypto/x509/x509_verify.c              | 46 ++++-------------
 lib/libcrypto/x509/x509_vfy.c                 | 24 ++-------
 lib/libpcap/gencode.c                         | 24 ++++-----
 lib/libpcap/grammar.y                         |  4 +-
 lib/libpcap/optimize.c                        |  9 ++--
 lib/libpcap/scanner.l                         |  4 +-
 lib/libtls/tls.c                              |  4 +-
 regress/lib/libcrypto/asn1/asn1time.c         | 50 +++++++++++++++++--
 regress/lib/libcrypto/asn1/rfc5280time.c      |  9 +---
 sbin/iked/proc.c                              |  5 +-
 .../pci/drm/drm_panel_orientation_quirks.c    | 18 +++++++
 sys/dev/pci/drm/include/drm/i915_pciids.h     | 13 +++--
 sys/dev/pci/pcidevs                           |  8 ++-
 sys/dev/pci/pcidevs.h                         |  8 ++-
 sys/dev/pci/pcidevs_data.h                    | 26 +++++++++-
 usr.sbin/httpd/httpd.c                        |  4 +-
 usr.sbin/httpd/proc.c                         |  5 +-
 usr.sbin/rpki-client/aspa.c                   | 23 +++++----
 usr.sbin/rpki-client/extern.h                 |  6 ++-
 usr.sbin/rpki-client/main.c                   |  8 +--
 usr.sbin/rpki-client/output-bgpd.c            |  4 +-
 usr.sbin/rpki-client/output-json.c            |  4 +-
 usr.sbin/rpki-client/output-ometric.c         |  4 +-
 usr.sbin/rpki-client/repo.c                   |  5 +-
 usr.sbin/snmpd/proc.c                         |  5 +-
 usr.sbin/snmpd/snmpd.c                        |  4 +-
 usr.sbin/vmd/proc.c                           |  5 +-
 usr.sbin/vmd/vmd.c                            |  5 +-
 32 files changed, 215 insertions(+), 170 deletions(-)

diff --git a/etc/skel/dot.version b/etc/skel/dot.version
index 339830be8..3eabc2f60 100644
--- a/etc/skel/dot.version
+++ b/etc/skel/dot.version
@@ -1 +1 @@
-# SecBSD 1.5-efcc4eb: Thu Apr  4 00:00:00 UTC 2024 (Yatagarasu)
+# SecBSD 1.5-cc34b9f: Tue Apr  9 00:00:00 UTC 2024 (Yatagarasu)
diff --git a/lib/libcrypto/asn1/a_time_tm.c b/lib/libcrypto/asn1/a_time_tm.c
index 986c1e735..c8eabec08 100644
--- a/lib/libcrypto/asn1/a_time_tm.c
+++ b/lib/libcrypto/asn1/a_time_tm.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: a_time_tm.c,v 1.33 2024/03/02 09:10:42 tb Exp $ */
+/* $OpenBSD: a_time_tm.c,v 1.34 2024/04/08 19:57:40 beck Exp $ */
 /*
  * Copyright (c) 2015 Bob Beck <beck@openbsd.org>
  *
@@ -160,15 +160,7 @@ tm_to_utctime(struct tm *tm, ASN1_TIME *atime)
 ASN1_TIME *
 tm_to_rfc5280_time(struct tm *tm, ASN1_TIME *atime)
 {
-	int year;
-
-	year = tm->tm_year + 1900;
-	if (year < 1950 || year > 9999) {
-		ASN1error(ASN1_R_ILLEGAL_TIME_VALUE);
-		return (NULL);
-	}
-
-	if (year < 2050)
+	if (tm->tm_year >= 50 && tm->tm_year < 150)
 		return (tm_to_utctime(tm, atime));
 
 	return (tm_to_gentime(tm, atime));
@@ -352,25 +344,21 @@ ASN1_time_parse(const char *bytes, size_t len, struct tm *tm, int mode)
 static int
 ASN1_TIME_set_string_internal(ASN1_TIME *s, const char *str, int mode)
 {
+	struct tm tm;
 	int type;
-	char *tmp;
 
-	if ((type = ASN1_time_parse(str, strlen(str), NULL, mode)) == -1)
+	if ((type = ASN1_time_parse(str, strlen(str), &tm, mode)) == -1)
 		return (0);
-	if (mode != 0 && mode != type)
+	switch(mode) {
+	case V_ASN1_UTCTIME:
+		return (type == mode && tm_to_utctime(&tm, s) != NULL);
+	case V_ASN1_GENERALIZEDTIME:
+		return (type == mode && tm_to_gentime(&tm, s) != NULL);
+	case RFC5280:
+		return (tm_to_rfc5280_time(&tm, s) != NULL);
+	default:
 		return (0);
-
-	if (s == NULL)
-		return (1);
-
-	if ((tmp = strdup(str)) == NULL)
-		return (0);
-	free(s->data);
-	s->data = tmp;
-	s->length = strlen(tmp);
-	s->type = type;
-
-	return (1);
+	}
 }
 
 static ASN1_TIME *
@@ -448,7 +436,7 @@ LCRYPTO_ALIAS(ASN1_TIME_to_generalizedtime);
 int
 ASN1_TIME_set_string(ASN1_TIME *s, const char *str)
 {
-	return (ASN1_TIME_set_string_internal(s, str, 0));
+	return (ASN1_TIME_set_string_internal(s, str, RFC5280));
 }
 LCRYPTO_ALIAS(ASN1_TIME_set_string);
 
diff --git a/lib/libcrypto/x509/x509_local.h b/lib/libcrypto/x509/x509_local.h
index 73cc582d7..5b74b0d1b 100644
--- a/lib/libcrypto/x509/x509_local.h
+++ b/lib/libcrypto/x509/x509_local.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: x509_local.h,v 1.23 2024/03/26 05:39:47 tb Exp $ */
+/*	$OpenBSD: x509_local.h,v 1.24 2024/04/08 23:46:21 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2013.
  */
@@ -188,8 +188,6 @@ struct x509_st {
 	struct ASIdentifiers_st *rfc3779_asid;
 #endif
 	unsigned char hash[X509_CERT_HASH_LEN];
-	time_t not_before;
-	time_t not_after;
 	X509_CERT_AUX *aux;
 } /* X509 */;
 
diff --git a/lib/libcrypto/x509/x509_purp.c b/lib/libcrypto/x509/x509_purp.c
index 53f4f2f96..8f4e5934e 100644
--- a/lib/libcrypto/x509/x509_purp.c
+++ b/lib/libcrypto/x509/x509_purp.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_purp.c,v 1.39 2024/03/02 10:43:52 tb Exp $ */
+/* $OpenBSD: x509_purp.c,v 1.40 2024/04/08 23:46:21 beck Exp $ */
 /* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
  * project 2001.
  */
@@ -559,9 +559,6 @@ x509v3_cache_extensions_internal(X509 *x)
 	if (!x509_extension_oids_are_unique(x))
 		x->ex_flags |= EXFLAG_INVALID;
 
-	if (!x509_verify_cert_info_populate(x))
-		x->ex_flags |= EXFLAG_INVALID;
-
 	x->ex_flags |= EXFLAG_SET;
 }
 
diff --git a/lib/libcrypto/x509/x509_verify.c b/lib/libcrypto/x509/x509_verify.c
index 19bb925d9..c7b2219fa 100644
--- a/lib/libcrypto/x509/x509_verify.c
+++ b/lib/libcrypto/x509/x509_verify.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_verify.c,v 1.68 2024/02/01 23:16:38 beck Exp $ */
+/* $OpenBSD: x509_verify.c,v 1.69 2024/04/08 23:46:21 beck Exp $ */
 /*
  * Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
  *
@@ -52,6 +52,9 @@ x509_verify_asn1_time_to_time_t(const ASN1_TIME *atime, int notAfter,
 	struct tm tm = { 0 };
 	int type;
 
+	if (atime == NULL)
+		return 0;
+
 	type = ASN1_time_parse(atime->data, atime->length, &tm, atime->type);
 	if (type == -1)
 		return 0;
@@ -80,35 +83,6 @@ x509_verify_asn1_time_to_time_t(const ASN1_TIME *atime, int notAfter,
 	return asn1_time_tm_to_time_t(&tm, out);
 }
 
-/*
- * Cache certificate hash, and values parsed out of an X509.
- * called from cache_extensions()
- */
-int
-x509_verify_cert_info_populate(X509 *cert)
-{
-	const ASN1_TIME *notBefore, *notAfter;
-
-	/*
-	 * Parse and save the cert times, or remember that they
-	 * are unacceptable/unparsable.
-	 */
-
-	cert->not_before = cert->not_after = -1;
-
-	if ((notBefore = X509_get_notBefore(cert)) == NULL)
-		return 0;
-	if ((notAfter = X509_get_notAfter(cert)) == NULL)
-		return 0;
-
-	if (!x509_verify_asn1_time_to_time_t(notBefore, 0, &cert->not_before))
-		return 0;
-	if (!x509_verify_asn1_time_to_time_t(notAfter, 1, &cert->not_after))
-		return 0;
-
-	return 1;
-}
-
 struct x509_verify_chain *
 x509_verify_chain_new(void)
 {
@@ -840,26 +814,28 @@ x509_verify_set_check_time(struct x509_verify_ctx *ctx)
 static int
 x509_verify_cert_times(X509 *cert, time_t *cmp_time, int *error)
 {
-	time_t when;
+	time_t when, not_before, not_after;
 
 	if (cmp_time == NULL)
 		when = time(NULL);
 	else
 		when = *cmp_time;
 
-	if (cert->not_before == -1) {
+	if (!x509_verify_asn1_time_to_time_t(X509_get_notBefore(cert), 0,
+	    &not_before)) {
 		*error = X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD;
 		return 0;
 	}
-	if (when < cert->not_before) {
+	if (when < not_before) {
 		*error = X509_V_ERR_CERT_NOT_YET_VALID;
 		return 0;
 	}
-	if (cert->not_after == -1) {
+	if (!x509_verify_asn1_time_to_time_t(X509_get_notAfter(cert), 1,
+	    &not_after)) {
 		*error = X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD;
 		return 0;
 	}
-	if (when > cert->not_after) {
+	if (when > not_after) {
 		*error = X509_V_ERR_CERT_HAS_EXPIRED;
 		return 0;
 	}
diff --git a/lib/libcrypto/x509/x509_vfy.c b/lib/libcrypto/x509/x509_vfy.c
index 539965863..501f5e571 100644
--- a/lib/libcrypto/x509/x509_vfy.c
+++ b/lib/libcrypto/x509/x509_vfy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: x509_vfy.c,v 1.142 2024/03/02 10:40:05 tb Exp $ */
+/* $OpenBSD: x509_vfy.c,v 1.143 2024/04/08 23:46:21 beck Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1744,18 +1744,6 @@ verify_cb_cert(X509_STORE_CTX *ctx, X509 *x, int depth, int err)
 	return ctx->verify_cb(0, ctx);
 }
 
-
-/* Mimic OpenSSL '0 for failure' ick */
-static int
-time_t_bogocmp(time_t a, time_t b)
-{
-	if (a == -1 || b == -1)
-		return 0;
-	if (a <= b)
-		return -1;
-	return 1;
-}
-
 /*
  * Check certificate validity times.
  *
@@ -1777,10 +1765,7 @@ x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth)
 	else
 		ptime = time(NULL);
 
-	if (x->ex_flags & EXFLAG_SET)
-		i = time_t_bogocmp(x->not_before, ptime);
-	else
-		i = X509_cmp_time(X509_get_notBefore(x), &ptime);
+	i = X509_cmp_time(X509_get_notBefore(x), &ptime);
 
 	if (i >= 0 && depth < 0)
 		return 0;
@@ -1791,10 +1776,7 @@ x509_check_cert_time(X509_STORE_CTX *ctx, X509 *x, int depth)
 	    X509_V_ERR_CERT_NOT_YET_VALID))
 		return 0;
 
-	if (x->ex_flags & EXFLAG_SET)
-		i = time_t_bogocmp(x->not_after, ptime);
-	else
-		i = X509_cmp_time_internal(X509_get_notAfter(x), &ptime, 1);
+	i = X509_cmp_time_internal(X509_get_notAfter(x), &ptime, 1);
 
 	if (i <= 0 && depth < 0)
 		return 0;
diff --git a/lib/libpcap/gencode.c b/lib/libpcap/gencode.c
index abbf08cb2..70cb90f80 100644
--- a/lib/libpcap/gencode.c
+++ b/lib/libpcap/gencode.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: gencode.c,v 1.65 2024/04/05 18:01:56 deraadt Exp $	*/
+/*	$OpenBSD: gencode.c,v 1.66 2024/04/08 02:51:14 jsg Exp $	*/
 
 /*
  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 1998
@@ -262,7 +262,7 @@ gen_retblk(int v)
 }
 
 static __inline void
-syntax()
+syntax(void)
 {
 	bpf_error("syntax error in filter expression");
 }
@@ -795,13 +795,13 @@ gen_uncond(int rsense)
 }
 
 static __inline struct block *
-gen_true()
+gen_true(void)
 {
 	return gen_uncond(1);
 }
 
 static __inline struct block *
-gen_false()
+gen_false(void)
 {
 	return gen_uncond(0);
 }
@@ -971,7 +971,7 @@ gen_hostop(bpf_u_int32 addr, bpf_u_int32 mask, int dir, int proto,
 #ifdef INET6
 static struct block *
 gen_hostop6(struct in6_addr *addr, struct in6_addr *mask, int dir, int proto,
-	u_int src_off, u_int dst_off)
+    u_int src_off, u_int dst_off)
 {
 	struct block *b0, *b1;
 	u_int offset;
@@ -1345,11 +1345,7 @@ gen_host6(struct in6_addr *addr, struct in6_addr *mask, int proto, int dir)
 
 #ifndef INET6
 static struct block *
-gen_gateway(eaddr, alist, proto, dir)
-	const u_char *eaddr;
-	bpf_u_int32 **alist;
-	int proto;
-	int dir;
+gen_gateway(const u_char *eaddr, bpf_u_int32 **alist, int proto, int dir)
 {
 	struct block *b0, *b1, *tmp;
 
@@ -1523,7 +1519,7 @@ gen_proto_abbrev(int proto)
 }
 
 static struct block *
-gen_ipfrag()
+gen_ipfrag(void)
 {
 	struct slist *s, *tmp;
 	struct block *b;
@@ -2779,7 +2775,7 @@ gen_relation(int code, struct arth *a0, struct arth *a1, int reversed)
 }
 
 struct arth *
-gen_loadlen()
+gen_loadlen(void)
 {
 	int regno = alloc_reg();
 	struct arth *a = (struct arth *)newchunk(sizeof(*a));
@@ -2795,7 +2791,7 @@ gen_loadlen()
 }
 
 struct arth *
-gen_loadrnd()
+gen_loadrnd(void)
 {
 	int regno = alloc_reg();
 	struct arth *a = (struct arth *)newchunk(sizeof(*a));
@@ -2882,7 +2878,7 @@ static int curreg;
  * Return the next free register.
  */
 static int
-alloc_reg()
+alloc_reg(void)
 {
 	int n = BPF_MEMWORDS;
 
diff --git a/lib/libpcap/grammar.y b/lib/libpcap/grammar.y
index 0c7db1641..40d7207ce 100644
--- a/lib/libpcap/grammar.y
+++ b/lib/libpcap/grammar.y
@@ -1,5 +1,5 @@
 %{
-/*	$OpenBSD: grammar.y,v 1.23 2021/12/01 18:28:45 deraadt Exp $	*/
+/*	$OpenBSD: grammar.y,v 1.24 2024/04/08 02:51:14 jsg Exp $	*/
 
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996
@@ -68,7 +68,7 @@ yyerror(char *msg)
 int yyparse(void);
 
 int
-pcap_parse()
+pcap_parse(void)
 {
 	return (yyparse());
 }
diff --git a/lib/libpcap/optimize.c b/lib/libpcap/optimize.c
index 5c0bdcb47..48ae8cebe 100644
--- a/lib/libpcap/optimize.c
+++ b/lib/libpcap/optimize.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: optimize.c,v 1.22 2024/04/05 18:01:56 deraadt Exp $	*/
+/*	$OpenBSD: optimize.c,v 1.23 2024/04/08 02:51:14 jsg Exp $	*/
 
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1993, 1994, 1995, 1996
@@ -510,7 +510,7 @@ struct valnode *vnode_base;
 struct valnode *next_vnode;
 
 static void
-init_val()
+init_val(void)
 {
 	curval = 0;
 	next_vnode = vnode_base;
@@ -1664,7 +1664,7 @@ intern_blocks(struct block *root)
 }
 
 static void
-opt_cleanup()
+opt_cleanup(void)
 {
 	free((void *)vnode_base);
 	free((void *)vmap);
@@ -2062,8 +2062,7 @@ icode_to_fcode(struct block *root, int *lenp)
 
 #ifdef BDEBUG
 static void
-opt_dump(root)
-	struct block *root;
+opt_dump(struct block *root)
 {
 	struct bpf_program f;
 
diff --git a/lib/libpcap/scanner.l b/lib/libpcap/scanner.l
index ebf886aea..48108c897 100644
--- a/lib/libpcap/scanner.l
+++ b/lib/libpcap/scanner.l
@@ -1,5 +1,5 @@
 %{
-/*	$OpenBSD: scanner.l,v 1.29 2024/04/05 18:01:56 deraadt Exp $	*/
+/*	$OpenBSD: scanner.l,v 1.30 2024/04/08 02:51:14 jsg Exp $	*/
 
 /*
  * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
@@ -328,7 +328,7 @@ lex_init(const char *buf)
  * define a macro to map this identifier to pcap_wrap.
  */
 int
-yywrap()
+yywrap(void)
 {
 	return 1;
 }
diff --git a/lib/libtls/tls.c b/lib/libtls/tls.c
index c2f7f3722..41bb06d85 100644
--- a/lib/libtls/tls.c
+++ b/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.103 2024/03/27 07:35:30 joshua Exp $ */
+/* $OpenBSD: tls.c,v 1.104 2024/04/08 20:47:32 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -387,7 +387,7 @@ tls_keypair_to_pkey(struct tls *ctx, struct tls_keypair *keypair, EVP_PKEY **pke
 		    NULL)) ==  NULL) {
 			tls_set_errorx(ctx, TLS_ERROR_UNKNOWN,
 			    "failed to read private key");
-		       	goto err;
+			goto err;
 		}
 	}
 
diff --git a/regress/lib/libcrypto/asn1/asn1time.c b/regress/lib/libcrypto/asn1/asn1time.c
index 8208fcd1c..7cc6df8a1 100644
--- a/regress/lib/libcrypto/asn1/asn1time.c
+++ b/regress/lib/libcrypto/asn1/asn1time.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1time.c,v 1.25 2024/02/18 22:17:01 tb Exp $ */
+/* $OpenBSD: asn1time.c,v 1.26 2024/04/08 19:57:40 beck Exp $ */
 /*
  * Copyright (c) 2015 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2024 Google Inc.
@@ -420,6 +420,7 @@ static int
 asn1_time_test(int test_no, const struct asn1_time_test *att, int type)
 {
 	ASN1_TIME *t = NULL, *tx509 = NULL;
+	char *parsed_time = NULL;
 	int failure = 1;
 
 	if (ASN1_TIME_set_string(NULL, att->str) != 1) {
@@ -434,9 +435,27 @@ asn1_time_test(int test_no, const struct asn1_time_test *att, int type)
 	if ((tx509 = ASN1_TIME_new()) == NULL)
 		goto done;
 
-	if (ASN1_TIME_set_string(t, att->str) != 1) {
-		fprintf(stderr, "FAIL: test %d - failed to set string '%s'\n",
-		    test_no, att->str);
+	switch (strlen(att->str)) {
+	case 13:
+		t->type = V_ASN1_UTCTIME;
+		if (ASN1_UTCTIME_set_string(t, att->str) != 1) {
+			fprintf(stderr, "FAIL: test %d - failed to set utc "
+			    "string '%s'\n",
+			    test_no, att->str);
+			goto done;
+		}
+		break;
+	case 15:
+		t->type = V_ASN1_GENERALIZEDTIME;
+		if (ASN1_GENERALIZEDTIME_set_string(t, att->str) != 1) {
+			fprintf(stderr, "FAIL: test %d - failed to set gen "
+			    "string '%s'\n",
+			    test_no, att->str);
+			goto done;
+		}
+		break;
+	default:
+		fprintf(stderr, "FAIL: unknown type\n");
 		goto done;
 	}
 
@@ -446,13 +465,33 @@ asn1_time_test(int test_no, const struct asn1_time_test *att, int type)
 		goto done;
 	}
 
+	if ((parsed_time = strdup(t->data)) == NULL)
+		goto done;
+
 	if (ASN1_TIME_normalize(t) != 1) {
 		fprintf(stderr, "FAIL: test %d - failed to set normalize '%s'\n",
 		    test_no, att->str);
 		goto done;
 	}
 
-	if (ASN1_TIME_set_string_X509(tx509, t->data) != 1) {
+	if (ASN1_TIME_set_string_X509(tx509, parsed_time) != 1) {
+		fprintf(stderr, "FAIL: test %d - failed to set string X509 '%s'\n",
+		    test_no, t->data);
+		goto done;
+	}
+
+	if (t->type != tx509->type) {
+		fprintf(stderr, "FAIL: test %d - type %d, different from %d\n",
+		    test_no, t->type, tx509->type);
+		goto done;
+	}
+
+	if (ASN1_TIME_compare(t, tx509) != 0) {
+		fprintf(stderr, "FAIL: ASN1_TIME values differ!\n");
+		goto done;
+	}
+
+	if (ASN1_TIME_set_string(tx509, parsed_time) != 1) {
 		fprintf(stderr, "FAIL: test %d - failed to set string X509 '%s'\n",
 		    test_no, t->data);
 		goto done;
@@ -476,6 +515,7 @@ asn1_time_test(int test_no, const struct asn1_time_test *att, int type)
 
 	ASN1_TIME_free(t);
 	ASN1_TIME_free(tx509);
+	free(parsed_time);
 
 	return (failure);
 }
diff --git a/regress/lib/libcrypto/asn1/rfc5280time.c b/regress/lib/libcrypto/asn1/rfc5280time.c
index 7a44a30e8..c57cac146 100644
--- a/regress/lib/libcrypto/asn1/rfc5280time.c
+++ b/regress/lib/libcrypto/asn1/rfc5280time.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rfc5280time.c,v 1.7 2022/09/05 21:12:08 tb Exp $ */
+/* $OpenBSD: rfc5280time.c,v 1.8 2024/04/08 19:57:40 beck Exp $ */
 /*
  * Copyright (c) 2015 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2015 Bob Beck <beck@opebsd.org>
@@ -234,13 +234,6 @@ rfc5280_invtime_test(int test_no, struct rfc5280_time_test *att)
 			goto done;
 		}
 	}
-	if (ASN1_TIME_set_string(t, att->str) != 0) {
-		if (X509_cmp_time(t, &now) != 0) {
-			fprintf(stderr, "FAIL: test %d - successfully parsed as UTCTIME "
-			    "string '%s'\n", test_no, att->str);
-			goto done;
-		}
-	}
 
 	failure = 0;
 
diff --git a/sbin/iked/proc.c b/sbin/iked/proc.c
index 534427b2b..186799182 100644
--- a/sbin/iked/proc.c
+++ b/sbin/iked/proc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.c,v 1.42 2024/02/15 20:10:45 tobhe Exp $	*/
+/*	$OpenBSD: proc.c,v 1.43 2024/04/08 12:50:05 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010 - 2016 Reyk Floeter <reyk@openbsd.org>
@@ -231,9 +231,10 @@ proc_init(struct privsep *ps, struct privsep_proc *procs, unsigned int nproc,
 
 	if (proc_id == PROC_PARENT) {
 		privsep_process = PROC_PARENT;
+		proc_setup(ps, procs, nproc);
+
 		if (!debug && daemon(0, 0) == -1)
 			fatal("failed to daemonize");
-		proc_setup(ps, procs, nproc);
 
 		/*
 		 * Create the children sockets so we can use them
diff --git a/sys/dev/pci/drm/drm_panel_orientation_quirks.c b/sys/dev/pci/drm/drm_panel_orientation_quirks.c
index 434ee4b91..518f71232 100644
--- a/sys/dev/pci/drm/drm_panel_orientation_quirks.c
+++ b/sys/dev/pci/drm/drm_panel_orientation_quirks.c
@@ -117,6 +117,12 @@ static const struct drm_dmi_panel_orientation_data lcd1080x1920_leftside_up = {
 	.orientation = DRM_MODE_PANEL_ORIENTATION_LEFT_UP,
 };
 
+static const struct drm_dmi_panel_orientation_data lcd1080x1920_rightside_up = {
+	.width = 1080,
+	.height = 1920,
+	.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+};
+
 static const struct drm_dmi_panel_orientation_data lcd1200x1920_rightside_up = {
 	.width = 1200,
 	.height = 1920,
@@ -279,6 +285,12 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1618-03")
 		},
 		.driver_data = (void *)&lcd720x1280_rightside_up,
+	}, {	/* GPD Win Mini */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1617-01")
+		},
+		.driver_data = (void *)&lcd1080x1920_rightside_up,
 	}, {	/* I.T.Works TW891 */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "To be filled by O.E.M."),
@@ -342,6 +354,12 @@ static const struct dmi_system_id orientation_data[] = {
 		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Duet 3 10IGL5"),
 		},
 		.driver_data = (void *)&lcd1200x1920_rightside_up,
+	}, {	/* Lenovo Legion Go 8APU1 */
+		.matches = {
+		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+		  DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Legion Go 8APU1"),
+		},
+		.driver_data = (void *)&lcd1600x2560_leftside_up,
 	}, {	/* Lenovo Yoga Book X90F / X90L */
 		.matches = {
 		  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Intel Corporation"),
diff --git a/sys/dev/pci/drm/include/drm/i915_pciids.h b/sys/dev/pci/drm/include/drm/i915_pciids.h
index 9199e2e12..8539a1e2b 100644
--- a/sys/dev/pci/drm/include/drm/i915_pciids.h
+++ b/sys/dev/pci/drm/include/drm/i915_pciids.h
@@ -711,7 +711,9 @@
 	INTEL_VGA_DEVICE(0x5692, info), \
 	INTEL_VGA_DEVICE(0x56A0, info), \
 	INTEL_VGA_DEVICE(0x56A1, info), \
-	INTEL_VGA_DEVICE(0x56A2, info)
+	INTEL_VGA_DEVICE(0x56A2, info), \
+	INTEL_VGA_DEVICE(0x56BE, info), \
+	INTEL_VGA_DEVICE(0x56BF, info)
 
 #define INTEL_DG2_G11_IDS(info) \
 	INTEL_VGA_DEVICE(0x5693, info), \
@@ -720,7 +722,11 @@
 	INTEL_VGA_DEVICE(0x56A5, info), \
 	INTEL_VGA_DEVICE(0x56A6, info), \
 	INTEL_VGA_DEVICE(0x56B0, info), \
-	INTEL_VGA_DEVICE(0x56B1, info)
+	INTEL_VGA_DEVICE(0x56B1, info), \
+	INTEL_VGA_DEVICE(0x56BA, info), \
+	INTEL_VGA_DEVICE(0x56BB, info), \
+	INTEL_VGA_DEVICE(0x56BC, info), \
+	INTEL_VGA_DEVICE(0x56BD, info)
 
 #define INTEL_DG2_G12_IDS(info) \
 	INTEL_VGA_DEVICE(0x5696, info), \
@@ -736,7 +742,8 @@
 	INTEL_DG2_G12_IDS(info)
 
 #define INTEL_ATS_M150_IDS(info) \
-	INTEL_VGA_DEVICE(0x56C0, info)
+	INTEL_VGA_DEVICE(0x56C0, info), \
+	INTEL_VGA_DEVICE(0x56C2, info)
 
 #define INTEL_ATS_M75_IDS(info) \
 	INTEL_VGA_DEVICE(0x56C1, info)
diff --git a/sys/dev/pci/pcidevs b/sys/dev/pci/pcidevs
index e9bea417a..82bd816df 100644
--- a/sys/dev/pci/pcidevs
+++ b/sys/dev/pci/pcidevs
@@ -1,4 +1,4 @@
-$OpenBSD: pcidevs,v 1.2072 2024/04/07 00:58:57 jsg Exp $
+$OpenBSD: pcidevs,v 1.2073 2024/04/09 01:22:19 jsg Exp $
 /*	$NetBSD: pcidevs,v 1.30 1997/06/24 06:20:24 thorpej Exp $	*/
 
 /*
@@ -6055,6 +6055,12 @@ product INTEL DG2_G11_6		0x56b0	Arc Pro A30M
 product INTEL DG2_G11_7		0x56b1	Arc Pro A40/A50
 product INTEL DG2_G12_5		0x56b2	Arc Pro A60M
 product INTEL DG2_G12_6		0x56b3	Arc Pro A60
+product INTEL DG2_G11_8		0x56ba	Arc A380E
+product INTEL DG2_G11_9		0x56bb	Arc A310E
+product INTEL DG2_G11_10	0x56bc	Arc A370E
+product INTEL DG2_G11_11	0x56bd	Arc A350E
+product INTEL DG2_G10_7		0x56be	Arc A750E
+product INTEL DG2_G10_8		0x56bf	Arc A580E
 product INTEL ATS_M150		0x56c0	Flex 170
 product INTEL ATS_M75		0x56c1	Flex 140
 product INTEL I219_LM24		0x57a0	I219-LM
diff --git a/sys/dev/pci/pcidevs.h b/sys/dev/pci/pcidevs.h
index 3f514212d..3e118caf7 100644
--- a/sys/dev/pci/pcidevs.h
+++ b/sys/dev/pci/pcidevs.h
@@ -2,7 +2,7 @@
  * THIS FILE AUTOMATICALLY GENERATED.  DO NOT EDIT.
  *
  * generated from:
- *	OpenBSD: pcidevs,v 1.2072 2024/04/07 00:58:57 jsg Exp 
+ *	OpenBSD: pcidevs,v 1.2073 2024/04/09 01:22:19 jsg Exp 
  */
 /*	$NetBSD: pcidevs,v 1.30 1997/06/24 06:20:24 thorpej Exp $	*/
 
@@ -6060,6 +6060,12 @@
 #define	PCI_PRODUCT_INTEL_DG2_G11_7	0x56b1		/* Arc Pro A40/A50 */
 #define	PCI_PRODUCT_INTEL_DG2_G12_5	0x56b2		/* Arc Pro A60M */
 #define	PCI_PRODUCT_INTEL_DG2_G12_6	0x56b3		/* Arc Pro A60 */
+#define	PCI_PRODUCT_INTEL_DG2_G11_8	0x56ba		/* Arc A380E */
+#define	PCI_PRODUCT_INTEL_DG2_G11_9	0x56bb		/* Arc A310E */
+#define	PCI_PRODUCT_INTEL_DG2_G11_10	0x56bc		/* Arc A370E */
+#define	PCI_PRODUCT_INTEL_DG2_G11_11	0x56bd		/* Arc A350E */
+#define	PCI_PRODUCT_INTEL_DG2_G10_7	0x56be		/* Arc A750E */
+#define	PCI_PRODUCT_INTEL_DG2_G10_8	0x56bf		/* Arc A580E */
 #define	PCI_PRODUCT_INTEL_ATS_M150	0x56c0		/* Flex 170 */
 #define	PCI_PRODUCT_INTEL_ATS_M75	0x56c1		/* Flex 140 */
 #define	PCI_PRODUCT_INTEL_I219_LM24	0x57a0		/* I219-LM */
diff --git a/sys/dev/pci/pcidevs_data.h b/sys/dev/pci/pcidevs_data.h
index b6c4cec83..1d132d80b 100644
--- a/sys/dev/pci/pcidevs_data.h
+++ b/sys/dev/pci/pcidevs_data.h
@@ -2,7 +2,7 @@
  * THIS FILE AUTOMATICALLY GENERATED.  DO NOT EDIT.
  *
  * generated from:
- *	OpenBSD: pcidevs,v 1.2072 2024/04/07 00:58:57 jsg Exp 
+ *	OpenBSD: pcidevs,v 1.2073 2024/04/09 01:22:19 jsg Exp 
  */
 
 /*	$NetBSD: pcidevs,v 1.30 1997/06/24 06:20:24 thorpej Exp $	*/
@@ -21571,6 +21571,30 @@ static const struct pci_known_product pci_known_products[] = {
 	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_DG2_G12_6,
 	    "Arc Pro A60",
 	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_DG2_G11_8,
+	    "Arc A380E",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_DG2_G11_9,
+	    "Arc A310E",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_DG2_G11_10,
+	    "Arc A370E",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_DG2_G11_11,
+	    "Arc A350E",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_DG2_G10_7,
+	    "Arc A750E",
+	},
+	{
+	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_DG2_G10_8,
+	    "Arc A580E",
+	},
 	{
 	    PCI_VENDOR_INTEL, PCI_PRODUCT_INTEL_ATS_M150,
 	    "Flex 170",
diff --git a/usr.sbin/httpd/httpd.c b/usr.sbin/httpd/httpd.c
index af863cf27..686f41c88 100644
--- a/usr.sbin/httpd/httpd.c
+++ b/usr.sbin/httpd/httpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: httpd.c,v 1.73 2022/09/02 07:38:14 benno Exp $	*/
+/*	$OpenBSD: httpd.c,v 1.74 2024/04/08 12:45:18 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2014 Reyk Floeter <reyk@openbsd.org>
@@ -220,8 +220,6 @@ main(int argc, char *argv[])
 	proc_init(ps, procs, nitems(procs), debug, argc0, argv, proc_id);
 
 	log_procinit("parent");
-	if (!debug && daemon(1, 0) == -1)
-		err(1, "failed to daemonize");
 
 	if (ps->ps_noaction == 0)
 		log_info("startup");
diff --git a/usr.sbin/httpd/proc.c b/usr.sbin/httpd/proc.c
index e8b08dd23..58ea14cc0 100644
--- a/usr.sbin/httpd/proc.c
+++ b/usr.sbin/httpd/proc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.c,v 1.43 2024/01/17 08:22:40 claudio Exp $	*/
+/*	$OpenBSD: proc.c,v 1.44 2024/04/08 12:45:18 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010 - 2016 Reyk Floeter <reyk@openbsd.org>
@@ -205,6 +205,9 @@ proc_init(struct privsep *ps, struct privsep_proc *procs, unsigned int nproc,
 		privsep_process = PROC_PARENT;
 		proc_setup(ps, procs, nproc);
 
+		if (!debug && daemon(1, 0) == -1)
+			fatal("failed to daemonize");
+
 		/*
 		 * Create the children sockets so we can use them
 		 * to distribute the rest of the socketpair()s using
diff --git a/usr.sbin/rpki-client/aspa.c b/usr.sbin/rpki-client/aspa.c
index 6f4945aea..6e42be76d 100644
--- a/usr.sbin/rpki-client/aspa.c
+++ b/usr.sbin/rpki-client/aspa.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: aspa.c,v 1.29 2024/04/05 16:05:15 job Exp $ */
+/*	$OpenBSD: aspa.c,v 1.30 2024/04/08 14:02:13 tb Exp $ */
 /*
  * Copyright (c) 2022 Job Snijders <job@fastly.com>
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -339,7 +339,7 @@ aspa_insert_vaps(char *fn, struct vap_tree *tree, struct aspa *aspa,
 	v->expires = aspa->expires;
 
 	if ((found = RB_INSERT(vap_tree, tree, v)) != NULL) {
-		if (found->invalid) {
+		if (found->overflowed) {
 			free(v);
 			return;
 		}
@@ -357,14 +357,6 @@ aspa_insert_vaps(char *fn, struct vap_tree *tree, struct aspa *aspa,
 	} else
 		repo_stat_inc(rp, v->talid, RTYPE_ASPA, STYPE_UNIQUE);
 
-	if (v->providersz >= MAX_ASPA_PROVIDERS) {
-		v->invalid = 1;
-		repo_stat_inc(rp, v->talid, RTYPE_ASPA, STYPE_INVALID);
-		warnx("%s: too many providers for ASPA Customer ASID "
-		    "(more than %d)", fn, MAX_ASPA_PROVIDERS);
-		return;
-	}
-
 	repo_stat_inc(rp, aspa->talid, RTYPE_ASPA, STYPE_TOTAL);
 
 	v->providers = reallocarray(v->providers,
@@ -391,6 +383,17 @@ aspa_insert_vaps(char *fn, struct vap_tree *tree, struct aspa *aspa,
 		if (j < v->providersz)
 			j++;
 	}
+
+	if (v->providersz >= MAX_ASPA_PROVIDERS) {
+		v->overflowed = 1;
+		free(v->providers);
+		v->providers = NULL;
+		v->providersz = 0;
+		repo_stat_inc(rp, v->talid, RTYPE_ASPA, STYPE_OVERFLOW);
+		warnx("%s: too many providers for ASPA Customer ASID %u "
+		    "(more than %d)", fn, v->custasid, MAX_ASPA_PROVIDERS);
+		return;
+	}
 }
 
 static inline int
diff --git a/usr.sbin/rpki-client/extern.h b/usr.sbin/rpki-client/extern.h
index 5ddf65248..c0d747158 100644
--- a/usr.sbin/rpki-client/extern.h
+++ b/usr.sbin/rpki-client/extern.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: extern.h,v 1.214 2024/04/05 16:05:15 job Exp $ */
+/*	$OpenBSD: extern.h,v 1.215 2024/04/08 14:02:13 tb Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -403,7 +403,7 @@ struct vap {
 	time_t			 expires;
 	int			 talid;
 	unsigned int		 repoid;
-	int			 invalid;
+	int			 overflowed;
 };
 
 /*
@@ -573,6 +573,7 @@ enum stype {
 	STYPE_UNIQUE,
 	STYPE_DEC_UNIQUE,
 	STYPE_PROVIDERS,
+	STYPE_OVERFLOW,
 };
 
 struct repo;
@@ -601,6 +602,7 @@ struct repotalstats {
 	uint32_t	 vaps; /* total number of Validated ASPA Payloads */
 	uint32_t	 vaps_uniqs; /* total number of unique VAPs */
 	uint32_t	 vaps_pas; /* total number of providers */
+	uint32_t	 vaps_overflowed; /* VAPs with too many providers */
 	uint32_t	 vrps; /* total number of Validated ROA Payloads */
 	uint32_t	 vrps_uniqs; /* number of unique vrps */
 	uint32_t	 spls; /* signed prefix list */
diff --git a/usr.sbin/rpki-client/main.c b/usr.sbin/rpki-client/main.c
index e996179d2..3a124ef84 100644
--- a/usr.sbin/rpki-client/main.c
+++ b/usr.sbin/rpki-client/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.256 2024/04/05 16:05:15 job Exp $ */
+/*	$OpenBSD: main.c,v 1.257 2024/04/08 14:02:13 tb Exp $ */
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -773,6 +773,7 @@ sum_stats(const struct repo *rp, const struct repotalstats *in, void *arg)
 	out->vaps += in->vaps;
 	out->vaps_uniqs += in->vaps_uniqs;
 	out->vaps_pas += in->vaps_pas;
+	out->vaps_overflowed += in->vaps_overflowed;
 	out->spls += in->spls;
 	out->spls_fail += in->spls_fail;
 	out->spls_invalid += in->spls_invalid;
@@ -1502,8 +1503,9 @@ main(int argc, char *argv[])
 	    stats.repo_stats.extra_files, stats.repo_stats.del_extra_files);
 	printf("VRP Entries: %u (%u unique)\n", stats.repo_tal_stats.vrps,
 	    stats.repo_tal_stats.vrps_uniqs);
-	printf("VAP Entries: %u (%u unique)\n", stats.repo_tal_stats.vaps,
-	    stats.repo_tal_stats.vaps_uniqs);
+	printf("VAP Entries: %u (%u unique, %u overflowed)\n",
+	    stats.repo_tal_stats.vaps, stats.repo_tal_stats.vaps_uniqs,
+	    stats.repo_tal_stats.vaps_overflowed);
 	printf("VSP Entries: %u (%u unique)\n", stats.repo_tal_stats.vsps,
 	    stats.repo_tal_stats.vsps_uniqs);
 
diff --git a/usr.sbin/rpki-client/output-bgpd.c b/usr.sbin/rpki-client/output-bgpd.c
index 1ca6c9913..fc6af38a4 100644
--- a/usr.sbin/rpki-client/output-bgpd.c
+++ b/usr.sbin/rpki-client/output-bgpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: output-bgpd.c,v 1.30 2024/04/05 16:05:15 job Exp $ */
+/*	$OpenBSD: output-bgpd.c,v 1.31 2024/04/08 14:02:13 tb Exp $ */
 /*
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
  *
@@ -58,7 +58,7 @@ output_bgpd(FILE *out, struct vrp_tree *vrps, struct brk_tree *brks,
 	if (fprintf(out, "\naspa-set {\n") < 0)
 		return -1;
 	RB_FOREACH(vap, vap_tree, vaps) {
-		if (vap->invalid)
+		if (vap->overflowed)
 			continue;
 		if (fprintf(out, "\tcustomer-as %d expires %lld "
 		    "provider-as { ", vap->custasid,
diff --git a/usr.sbin/rpki-client/output-json.c b/usr.sbin/rpki-client/output-json.c
index 4c56d5476..afea19f3f 100644
--- a/usr.sbin/rpki-client/output-json.c
+++ b/usr.sbin/rpki-client/output-json.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: output-json.c,v 1.47 2024/04/05 16:05:15 job Exp $ */
+/*	$OpenBSD: output-json.c,v 1.48 2024/04/08 14:02:13 tb Exp $ */
 /*
  * Copyright (c) 2019 Claudio Jeker <claudio@openbsd.org>
  *
@@ -93,7 +93,7 @@ print_vap(struct vap *v)
 {
 	size_t i;
 
-	if (v->invalid)
+	if (v->overflowed)
 		return;
 
 	json_do_object("aspa", 1);
diff --git a/usr.sbin/rpki-client/output-ometric.c b/usr.sbin/rpki-client/output-ometric.c
index c6d9f5869..a2795f125 100644
--- a/usr.sbin/rpki-client/output-ometric.c
+++ b/usr.sbin/rpki-client/output-ometric.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: output-ometric.c,v 1.9 2024/02/26 15:40:33 job Exp $ */
+/*	$OpenBSD: output-ometric.c,v 1.10 2024/04/08 14:02:13 tb Exp $ */
 /*
  * Copyright (c) 2022 Claudio Jeker <claudio@openbsd.org>
  *
@@ -82,6 +82,8 @@ set_common_stats(const struct repotalstats *in, struct ometric *metric,
 	    OKV("type", "state"), OKV("vap", "unique"), ol);
 	ometric_set_int_with_labels(metric, in->vaps_pas,
 	    OKV("type", "state"), OKV("vap providers", "total"), ol);
+	ometric_set_int_with_labels(metric, in->vaps_overflowed,
+	    OKV("type", "state"), OKV("vap overflowed"), ol);
 
 	ometric_set_int_with_labels(metric, in->spls,
 	    OKV("type", "state"), OKV("spl", "valid"), ol);
diff --git a/usr.sbin/rpki-client/repo.c b/usr.sbin/rpki-client/repo.c
index 1b7fa5744..7290dcfe4 100644
--- a/usr.sbin/rpki-client/repo.c
+++ b/usr.sbin/rpki-client/repo.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: repo.c,v 1.55 2024/03/22 03:38:12 job Exp $ */
+/*	$OpenBSD: repo.c,v 1.56 2024/04/08 14:02:13 tb Exp $ */
 /*
  * Copyright (c) 2021 Claudio Jeker <claudio@openbsd.org>
  * Copyright (c) 2019 Kristaps Dzonsons <kristaps@bsd.lv>
@@ -1490,6 +1490,9 @@ repo_stat_inc(struct repo *rp, int talid, enum rtype type, enum stype subtype)
 		case STYPE_PROVIDERS:
 			rp->stats[talid].vaps_pas++;
 			break;
+		case STYPE_OVERFLOW:
+			rp->stats[talid].vaps_overflowed++;
+			break;
 		default:
 			break;
 		}
diff --git a/usr.sbin/snmpd/proc.c b/usr.sbin/snmpd/proc.c
index 941857b71..61355cdb5 100644
--- a/usr.sbin/snmpd/proc.c
+++ b/usr.sbin/snmpd/proc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.c,v 1.30 2024/01/16 13:33:12 claudio Exp $	*/
+/*	$OpenBSD: proc.c,v 1.31 2024/04/08 13:18:54 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010 - 2016 Reyk Floeter <reyk@openbsd.org>
@@ -205,6 +205,9 @@ proc_init(struct privsep *ps, struct privsep_proc *procs, unsigned int nproc,
 		privsep_process = PROC_PARENT;
 		proc_setup(ps, procs, nproc);
 
+		if (!debug && daemon(0, 0) == -1)
+			fatal("failed to daemonize");
+
 		/*
 		 * Create the children sockets so we can use them
 		 * to distribute the rest of the socketpair()s using
diff --git a/usr.sbin/snmpd/snmpd.c b/usr.sbin/snmpd/snmpd.c
index 8c2a87be7..5598ce58f 100644
--- a/usr.sbin/snmpd/snmpd.c
+++ b/usr.sbin/snmpd/snmpd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: snmpd.c,v 1.50 2023/12/22 13:04:30 martijn Exp $	*/
+/*	$OpenBSD: snmpd.c,v 1.51 2024/04/08 13:18:54 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2007, 2008, 2012 Reyk Floeter <reyk@openbsd.org>
@@ -222,8 +222,6 @@ main(int argc, char *argv[])
 	env->sc_engine_boots = 0;
 
 	proc_init(ps, procs, nitems(procs), debug, argc0, argv0, proc_id);
-	if (!debug && daemon(0, 0) == -1)
-		err(1, "failed to daemonize");
 
 	log_procinit("parent");
 	log_info("startup");
diff --git a/usr.sbin/vmd/proc.c b/usr.sbin/vmd/proc.c
index ac6455dd7..6b5050187 100644
--- a/usr.sbin/vmd/proc.c
+++ b/usr.sbin/vmd/proc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: proc.c,v 1.23 2024/02/20 21:40:37 dv Exp $	*/
+/*	$OpenBSD: proc.c,v 1.24 2024/04/08 12:48:26 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2010 - 2016 Reyk Floeter <reyk@openbsd.org>
@@ -205,6 +205,9 @@ proc_init(struct privsep *ps, struct privsep_proc *procs, unsigned int nproc,
 		privsep_process = PROC_PARENT;
 		proc_setup(ps, procs, nproc);
 
+		if (!debug && daemon(0, 0) == -1)
+			fatal("failed to daemonize");
+
 		/*
 		 * Create the children sockets so we can use them
 		 * to distribute the rest of the socketpair()s using
diff --git a/usr.sbin/vmd/vmd.c b/usr.sbin/vmd/vmd.c
index 887e1cc9b..665a6b431 100644
--- a/usr.sbin/vmd/vmd.c
+++ b/usr.sbin/vmd/vmd.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: vmd.c,v 1.155 2024/02/05 21:58:09 dv Exp $	*/
+/*	$OpenBSD: vmd.c,v 1.156 2024/04/08 12:48:26 tobhe Exp $	*/
 
 /*
  * Copyright (c) 2015 Reyk Floeter <reyk@openbsd.org>
@@ -947,9 +947,6 @@ main(int argc, char **argv)
 	proc_init(ps, procs, nitems(procs), env->vmd_debug, argc0, argv,
 	    proc_id);
 
-	if (!env->vmd_debug && daemon(0, 0) == -1)
-		fatal("can't daemonize");
-
 	if (ps->ps_noaction == 0)
 		log_info("startup");