Merge from head

10 files changed, 256 insertions, 324 deletions

diff --git a/usr.bin/netstat/inet.c b/usr.bin/netstat/inet.c
index a04cc9a..af235f1 100644
--- a/usr.bin/netstat/inet.c
+++ b/usr.bin/netstat/inet.c
@@ -603,13 +603,8 @@ tcp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			warn("sysctl: net.inet.tcp.stats");
 			return;
 		}
-	} else {
-		u_long tcpstat_p[sizeof(struct tcpstat)/sizeof(uint64_t)];
- 
-		kread(off, &tcpstat_p, sizeof(tcpstat_p));
-		kread_counters(tcpstat_p, (uint64_t *)&tcpstat,
-		    sizeof(struct tcpstat)/sizeof(uint64_t));
-	}
+	} else
+		kread_counters(off, &tcpstat, len);
 
 	printf ("%s:\n", name);
 
@@ -743,7 +738,7 @@ udp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 {
 	struct udpstat udpstat, zerostat;
 	size_t len = sizeof udpstat;
-	u_long delivered;
+	uint64_t delivered;
 
 #ifdef INET6
 	if (udp_done != 0)
@@ -761,23 +756,23 @@ udp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &udpstat, len);
+		kread_counters(off, &udpstat, len);
 
 	printf("%s:\n", name);
 #define	p(f, m) if (udpstat.f || sflag <= 1) \
-    printf(m, udpstat.f, plural(udpstat.f))
+    printf("\t%ju " m, (uintmax_t)udpstat.f, plural(udpstat.f))
 #define	p1a(f, m) if (udpstat.f || sflag <= 1) \
-    printf(m, udpstat.f)
-	p(udps_ipackets, "\t%lu datagram%s received\n");
-	p1a(udps_hdrops, "\t%lu with incomplete header\n");
-	p1a(udps_badlen, "\t%lu with bad data length field\n");
-	p1a(udps_badsum, "\t%lu with bad checksum\n");
-	p1a(udps_nosum, "\t%lu with no checksum\n");
-	p1a(udps_noport, "\t%lu dropped due to no socket\n");
+    printf("\t%ju " m, (uintmax_t)udpstat.f)
+	p(udps_ipackets, "datagram%s received\n");
+	p1a(udps_hdrops, "with incomplete header\n");
+	p1a(udps_badlen, "with bad data length field\n");
+	p1a(udps_badsum, "with bad checksum\n");
+	p1a(udps_nosum, "with no checksum\n");
+	p1a(udps_noport, "dropped due to no socket\n");
 	p(udps_noportbcast,
-	    "\t%lu broadcast/multicast datagram%s undelivered\n");
-	p1a(udps_fullsock, "\t%lu dropped due to full socket buffers\n");
-	p1a(udpps_pcbhashmiss, "\t%lu not for hashed pcb\n");
+	    "broadcast/multicast datagram%s undelivered\n");
+	p1a(udps_fullsock, "dropped due to full socket buffers\n");
+	p1a(udpps_pcbhashmiss, "not for hashed pcb\n");
 	delivered = udpstat.udps_ipackets -
 		    udpstat.udps_hdrops -
 		    udpstat.udps_badlen -
@@ -786,11 +781,11 @@ udp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 		    udpstat.udps_noportbcast -
 		    udpstat.udps_fullsock;
 	if (delivered || sflag <= 1)
-		printf("\t%lu delivered\n", delivered);
-	p(udps_opackets, "\t%lu datagram%s output\n");
+		printf("\t%ju delivered\n", (uint64_t)delivered);
+	p(udps_opackets, "datagram%s output\n");
 	/* the next statistic is cumulative in udps_noportbcast */
 	p(udps_filtermcast,
-	    "\t%lu time%s multicast source filter matched\n");
+	    "time%s multicast source filter matched\n");
 #undef p
 #undef p1a
 }
@@ -816,7 +811,7 @@ carp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 	} else {
 		if (off == 0)
 			return;
-		kread(off, &carpstat, len);
+		kread_counters(off, &carpstat, len);
 	}
 
 	printf("%s:\n", name);
@@ -863,13 +858,8 @@ ip_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			warn("sysctl: net.inet.ip.stats");
 			return;
 		}
-	} else {
-		u_long ipstat_p[sizeof(struct ipstat)/sizeof(uint64_t)];
-
-		kread(off, &ipstat_p, sizeof(ipstat_p));
-		kread_counters(ipstat_p, (uint64_t *)&ipstat,
-		    sizeof(struct ipstat)/sizeof(uint64_t));
-	}
+	} else
+		kread_counters(off, &ipstat, len);
 
 	printf("%s:\n", name);
 
@@ -933,23 +923,23 @@ arp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &arpstat, len);
+		kread_counters(off, &arpstat, len);
 
 	printf("%s:\n", name);
 
 #define	p(f, m) if (arpstat.f || sflag <= 1) \
-    printf(m, arpstat.f, plural(arpstat.f))
+    printf("\t%ju " m, (uintmax_t)arpstat.f, plural(arpstat.f))
 #define	p2(f, m) if (arpstat.f || sflag <= 1) \
-    printf(m, arpstat.f, pluralies(arpstat.f))
-
-	p(txrequests, "\t%lu ARP request%s sent\n");
-	p2(txreplies, "\t%lu ARP repl%s sent\n");
-	p(rxrequests, "\t%lu ARP request%s received\n");
-	p2(rxreplies, "\t%lu ARP repl%s received\n");
-	p(received, "\t%lu ARP packet%s received\n");
-	p(dropped, "\t%lu total packet%s dropped due to no ARP entry\n");
-	p(timeouts, "\t%lu ARP entry%s timed out\n");
-	p(dupips, "\t%lu Duplicate IP%s seen\n");
+    printf("\t%ju " m, (uintmax_t)arpstat.f, pluralies(arpstat.f))
+
+	p(txrequests, "ARP request%s sent\n");
+	p2(txreplies, "ARP repl%s sent\n");
+	p(rxrequests, "ARP request%s received\n");
+	p2(rxreplies, "ARP repl%s received\n");
+	p(received, "ARP packet%s received\n");
+	p(dropped, "total packet%s dropped due to no ARP entry\n");
+	p(timeouts, "ARP entry%s timed out\n");
+	p(dupips, "Duplicate IP%s seen\n");
 #undef p
 #undef p2
 }
@@ -1020,7 +1010,7 @@ icmp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &icmpstat, len);
+		kread_counters(off, &icmpstat, len);
 
 	printf("%s:\n", name);
 
@@ -1227,7 +1217,7 @@ pim_stats(u_long off __unused, const char *name, int af1 __unused,
 	} else {
 		if (off == 0)
 			return;
-		kread(off, &pimstat, len);
+		kread_counters(off, &pimstat, len);
 	}
 
 	printf("%s:\n", name);
diff --git a/usr.bin/netstat/inet6.c b/usr.bin/netstat/inet6.c
index 9f51d06..78383ac 100644
--- a/usr.bin/netstat/inet6.c
+++ b/usr.bin/netstat/inet6.c
@@ -376,7 +376,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &ip6stat, len);
+		kread_counters(off, &ip6stat, len);
 
 	printf("%s:\n", name);
 
@@ -408,7 +408,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 	p(ip6s_cantfrag, "\t%ju datagram%s that can't be fragmented\n");
 	p(ip6s_badscope, "\t%ju packet%s that violated scope rules\n");
 	p(ip6s_notmember, "\t%ju multicast packet%s which we don't join\n");
-	for (first = 1, i = 0; i < 256; i++)
+	for (first = 1, i = 0; i < IP6S_HDRCNT; i++)
 		if (ip6stat.ip6s_nxthist[i] != 0) {
 			if (first) {
 				printf("\tInput histogram:\n");
@@ -419,7 +419,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 		}
 	printf("\tMbuf statistics:\n");
 	printf("\t\t%ju one mbuf\n", (uintmax_t)ip6stat.ip6s_m1);
-	for (first = 1, i = 0; i < 32; i++) {
+	for (first = 1, i = 0; i < IP6S_M2MMAX; i++) {
 		char ifbuf[IFNAMSIZ];
 		if (ip6stat.ip6s_m2m[i] != 0) {
 			if (first) {
@@ -445,7 +445,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 #define	PRINT_SCOPESTAT(s,i) do {\
 		switch(i) { /* XXX hardcoding in each case */\
 		case 1:\
-			p(s, "\t\t%ju node-local%s\n");\
+			p(s, "\t\t%ju interface-local%s\n");\
 			break;\
 		case 2:\
 			p(s,"\t\t%ju link-local%s\n");\
@@ -464,7 +464,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 
 	p(ip6s_sources_none,
 	  "\t%ju failure%s of source address selection\n");
-	for (first = 1, i = 0; i < 16; i++) {
+	for (first = 1, i = 0; i < IP6S_SCOPECNT; i++) {
 		if (ip6stat.ip6s_sources_sameif[i]) {
 			if (first) {
 				printf("\tsource addresses on an outgoing I/F\n");
@@ -473,7 +473,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			PRINT_SCOPESTAT(ip6s_sources_sameif[i], i);
 		}
 	}
-	for (first = 1, i = 0; i < 16; i++) {
+	for (first = 1, i = 0; i < IP6S_SCOPECNT; i++) {
 		if (ip6stat.ip6s_sources_otherif[i]) {
 			if (first) {
 				printf("\tsource addresses on a non-outgoing I/F\n");
@@ -482,7 +482,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			PRINT_SCOPESTAT(ip6s_sources_otherif[i], i);
 		}
 	}
-	for (first = 1, i = 0; i < 16; i++) {
+	for (first = 1, i = 0; i < IP6S_SCOPECNT; i++) {
 		if (ip6stat.ip6s_sources_samescope[i]) {
 			if (first) {
 				printf("\tsource addresses of same scope\n");
@@ -491,7 +491,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			PRINT_SCOPESTAT(ip6s_sources_samescope[i], i);
 		}
 	}
-	for (first = 1, i = 0; i < 16; i++) {
+	for (first = 1, i = 0; i < IP6S_SCOPECNT; i++) {
 		if (ip6stat.ip6s_sources_otherscope[i]) {
 			if (first) {
 				printf("\tsource addresses of a different scope\n");
@@ -500,7 +500,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			PRINT_SCOPESTAT(ip6s_sources_otherscope[i], i);
 		}
 	}
-	for (first = 1, i = 0; i < 16; i++) {
+	for (first = 1, i = 0; i < IP6S_SCOPECNT; i++) {
 		if (ip6stat.ip6s_sources_deprecated[i]) {
 			if (first) {
 				printf("\tdeprecated source addresses\n");
@@ -511,7 +511,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 	}
 
 	printf("\tSource addresses selection rule applied:\n");
-	for (i = 0; i < 16; i++) {
+	for (i = 0; i < IP6S_RULESMAX; i++) {
 		if (ip6stat.ip6s_sources_rule[i])
 			printf("\t\t%ju %s\n",
 			       (uintmax_t)ip6stat.ip6s_sources_rule[i],
@@ -858,7 +858,7 @@ icmp6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &icmp6stat, len);
+		kread_counters(off, &icmp6stat, len);
 
 	printf("%s:\n", name);
 
@@ -1052,7 +1052,7 @@ rip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &rip6stat, len);
+		kread_counters(off, &rip6stat, len);
 
 	printf("%s:\n", name);
 
@@ -1120,12 +1120,17 @@ inet6print(struct in6_addr *in6, int port, const char *proto, int numeric)
 char *
 inet6name(struct in6_addr *in6p)
 {
-	char *cp;
+	struct sockaddr_in6 sin6;
+	char hbuf[NI_MAXHOST], *cp;
 	static char line[50];
-	struct hostent *hp;
 	static char domain[MAXHOSTNAMELEN];
 	static int first = 1;
+	int flags, error;
 
+	if (IN6_IS_ADDR_UNSPECIFIED(in6p)) {
+		strcpy(line, "*");
+		return (line);
+	}
 	if (first && !numeric_addr) {
 		first = 0;
 		if (gethostname(domain, MAXHOSTNAMELEN) == 0 &&
@@ -1134,24 +1139,26 @@ inet6name(struct in6_addr *in6p)
 		else
 			domain[0] = 0;
 	}
-	cp = 0;
-	if (!numeric_addr && !IN6_IS_ADDR_UNSPECIFIED(in6p)) {
-		hp = gethostbyaddr((char *)in6p, sizeof(*in6p), AF_INET6);
-		if (hp) {
-			if ((cp = strchr(hp->h_name, '.')) &&
-			    !strcmp(cp + 1, domain))
-				*cp = 0;
-			cp = hp->h_name;
-		}
-	}
-	if (IN6_IS_ADDR_UNSPECIFIED(in6p))
-		strcpy(line, "*");
-	else if (cp)
-		strcpy(line, cp);
-	else
+	memset(&sin6, 0, sizeof(sin6));
+	memcpy(&sin6.sin6_addr, in6p, sizeof(*in6p));
+	sin6.sin6_family = AF_INET6;
+	/* XXX: in6p.s6_addr[2] can contain scopeid. */ 
+	in6_fillscopeid(&sin6);
+	flags = (numeric_addr) ? NI_NUMERICHOST : 0;
+	error = getnameinfo((struct sockaddr *)&sin6, sizeof(sin6), hbuf,
+	    sizeof(hbuf), NULL, 0, flags);
+	if (error == 0) {
+		if ((flags & NI_NUMERICHOST) == 0 &&
+		    (cp = strchr(hbuf, '.')) &&
+		    !strcmp(cp + 1, domain))
+			*cp = 0;
+		strcpy(line, hbuf);
+	} else {
+		/* XXX: this should not happen. */
 		sprintf(line, "%s",
-			inet_ntop(AF_INET6, (void *)in6p, ntop_buf,
+			inet_ntop(AF_INET6, (void *)&sin6.sin6_addr, ntop_buf,
 				sizeof(ntop_buf)));
+	}
 	return (line);
 }
 #endif /*INET6*/
diff --git a/usr.bin/netstat/ipsec.c b/usr.bin/netstat/ipsec.c
index 7b16f57..b4014ad 100644
--- a/usr.bin/netstat/ipsec.c
+++ b/usr.bin/netstat/ipsec.c
@@ -166,84 +166,18 @@ static struct val2str ipsec_compnames[] = {
 	{ -1, NULL },
 };
 
-static void ipsec_hist(const u_quad_t *hist, size_t histmax,
-		       const struct val2str *name, const char *title);
 static void print_ipsecstats(const struct ipsecstat *ipsecstat);
 
-
-/*
- * Dump IPSEC statistics structure.
- */
-static void
-ipsec_hist(const u_quad_t *hist, size_t histmax, const struct val2str *name,
-	   const char *title)
-{
-	int first;
-	size_t proto;
-	const struct val2str *p;
-
-	first = 1;
-	for (proto = 0; proto < histmax; proto++) {
-		if (hist[proto] <= 0)
-			continue;
-		if (first) {
-			printf("\t%s histogram:\n", title);
-			first = 0;
-		}
-		for (p = name; p && p->str; p++) {
-			if (p->val == (int)proto)
-				break;
-		}
-		if (p && p->str) {
-			printf("\t\t%s: %ju\n", p->str, (uintmax_t)hist[proto]);
-		} else {
-			printf("\t\t#%ld: %ju\n", (long)proto,
-			    (uintmax_t)hist[proto]);
-		}
-	}
-}
-
 static void
 print_ipsecstats(const struct ipsecstat *ipsecstat)
 {
 #define	p(f, m) if (ipsecstat->f || sflag <= 1) \
     printf(m, (uintmax_t)ipsecstat->f, plural(ipsecstat->f))
-#define	pes(f, m) if (ipsecstat->f || sflag <= 1) \
-    printf(m, (uintmax_t)ipsecstat->f, plurales(ipsecstat->f))
-#define	hist(f, n, t) \
-    ipsec_hist((f), sizeof(f)/sizeof(f[0]), (n), (t));
-
-	p(in_success, "\t%ju inbound packet%s processed successfully\n");
-	p(in_polvio, "\t%ju inbound packet%s violated process security "
-	    "policy\n");
-	p(in_nosa, "\t%ju inbound packet%s with no SA available\n");
-	p(in_inval, "\t%ju invalid inbound packet%s\n");
-	p(in_nomem, "\t%ju inbound packet%s failed due to insufficient memory\n");
-	p(in_badspi, "\t%ju inbound packet%s failed getting SPI\n");
-	p(in_ahreplay, "\t%ju inbound packet%s failed on AH replay check\n");
-	p(in_espreplay, "\t%ju inbound packet%s failed on ESP replay check\n");
-	p(in_ahauthsucc, "\t%ju inbound packet%s considered authentic\n");
-	p(in_ahauthfail, "\t%ju inbound packet%s failed on authentication\n");
-	hist(ipsecstat->in_ahhist, ipsec_ahnames, "AH input");
-	hist(ipsecstat->in_esphist, ipsec_espnames, "ESP input");
-	hist(ipsecstat->in_comphist, ipsec_compnames, "IPComp input");
-
-	p(out_success, "\t%ju outbound packet%s processed successfully\n");
-	p(out_polvio, "\t%ju outbound packet%s violated process security "
-	    "policy\n");
-	p(out_nosa, "\t%ju outbound packet%s with no SA available\n");
-	p(out_inval, "\t%ju invalid outbound packet%s\n");
-	p(out_nomem, "\t%ju outbound packet%s failed due to insufficient memory\n");
-	p(out_noroute, "\t%ju outbound packet%s with no route\n");
-	hist(ipsecstat->out_ahhist, ipsec_ahnames, "AH output");
-	hist(ipsecstat->out_esphist, ipsec_espnames, "ESP output");
-	hist(ipsecstat->out_comphist, ipsec_compnames, "IPComp output");
-	p(spdcachelookup, "\t%ju SPD cache lookup%s\n");
-	pes(spdcachemiss, "\t%ju SPD cache miss%s\n");
-#undef pes
-#undef hist
 	p(ips_in_polvio, "\t%ju inbound packet%s violated process "
 		"security policy\n");
+	p(ips_in_nomem, "\t%ju inbound packet%s failed due to "
+		"insufficient memory\n");
+	p(ips_in_inval, "\t%ju invalid inbound packet%s\n");
 	p(ips_out_polvio, "\t%ju outbound packet%s violated process "
 		"security policy\n");
 	p(ips_out_nosa, "\t%ju outbound packet%s with no SA available\n");
@@ -268,13 +202,13 @@ ipsec_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ipsecstat, sizeof(ipsecstat));
+	kread_counters(off, (char *)&ipsecstat, sizeof(ipsecstat));
 
 	print_ipsecstats(&ipsecstat);
 }
 
 
-static void ipsec_hist_new(const u_int32_t *hist, size_t histmax,
+static void ipsec_hist_new(const uint64_t *hist, size_t histmax,
 			   const struct val2str *name, const char *title);
 static void print_ahstats(const struct ahstat *ahstat);
 static void print_espstats(const struct espstat *espstat);
@@ -284,7 +218,7 @@ static void print_ipcompstats(const struct ipcompstat *ipcompstat);
  * Dump IPSEC statistics structure.
  */
 static void
-ipsec_hist_new(const u_int32_t *hist, size_t histmax,
+ipsec_hist_new(const uint64_t *hist, size_t histmax,
 	       const struct val2str *name, const char *title)
 {
 	int first;
@@ -304,10 +238,11 @@ ipsec_hist_new(const u_int32_t *hist, size_t histmax,
 				break;
 		}
 		if (p && p->str) {
-			printf("\t\t%s: %u\n", p->str, hist[proto]);
+			printf("\t\t%s: %ju\n", p->str,
+			    (uintmax_t)hist[proto]);
 		} else {
-			printf("\t\t#%lu: %u\n", (unsigned long)proto,
-			       hist[proto]);
+			printf("\t\t#%lu: %ju\n", (unsigned long)proto,
+			    (uintmax_t)hist[proto]);
 		}
 	}
 }
@@ -315,36 +250,33 @@ ipsec_hist_new(const u_int32_t *hist, size_t histmax,
 static void
 print_ahstats(const struct ahstat *ahstat)
 {
-#define	p32(f, m) if (ahstat->f || sflag <= 1) \
-    printf("\t%u" m, (unsigned int)ahstat->f, plural(ahstat->f))
-#define	p64(f, m) if (ahstat->f || sflag <= 1) \
+#define	p(f, m) if (ahstat->f || sflag <= 1) \
     printf("\t%ju" m, (uintmax_t)ahstat->f, plural(ahstat->f))
 #define	hist(f, n, t) \
     ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t));
 
-	p32(ahs_hdrops, " packet%s shorter than header shows\n");
-	p32(ahs_nopf, " packet%s dropped; protocol family not supported\n");
-	p32(ahs_notdb, " packet%s dropped; no TDB\n");
-	p32(ahs_badkcr, " packet%s dropped; bad KCR\n");
-	p32(ahs_qfull, " packet%s dropped; queue full\n");
-	p32(ahs_noxform, " packet%s dropped; no transform\n");
-	p32(ahs_wrap, " replay counter wrap%s\n");
-	p32(ahs_badauth, " packet%s dropped; bad authentication detected\n");
-	p32(ahs_badauthl, " packet%s dropped; bad authentication length\n");
-	p32(ahs_replay, " possible replay packet%s detected\n");
-	p32(ahs_input, " packet%s in\n");
-	p32(ahs_output, " packet%s out\n");
-	p32(ahs_invalid, " packet%s dropped; invalid TDB\n");
-	p64(ahs_ibytes, " byte%s in\n");
-	p64(ahs_obytes, " byte%s out\n");
-	p32(ahs_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
-	p32(ahs_pdrops, " packet%s blocked due to policy\n");
-	p32(ahs_crypto, " crypto processing failure%s\n");
-	p32(ahs_tunnel, " tunnel sanity check failure%s\n");
+	p(ahs_hdrops, " packet%s shorter than header shows\n");
+	p(ahs_nopf, " packet%s dropped; protocol family not supported\n");
+	p(ahs_notdb, " packet%s dropped; no TDB\n");
+	p(ahs_badkcr, " packet%s dropped; bad KCR\n");
+	p(ahs_qfull, " packet%s dropped; queue full\n");
+	p(ahs_noxform, " packet%s dropped; no transform\n");
+	p(ahs_wrap, " replay counter wrap%s\n");
+	p(ahs_badauth, " packet%s dropped; bad authentication detected\n");
+	p(ahs_badauthl, " packet%s dropped; bad authentication length\n");
+	p(ahs_replay, " possible replay packet%s detected\n");
+	p(ahs_input, " packet%s in\n");
+	p(ahs_output, " packet%s out\n");
+	p(ahs_invalid, " packet%s dropped; invalid TDB\n");
+	p(ahs_ibytes, " byte%s in\n");
+	p(ahs_obytes, " byte%s out\n");
+	p(ahs_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
+	p(ahs_pdrops, " packet%s blocked due to policy\n");
+	p(ahs_crypto, " crypto processing failure%s\n");
+	p(ahs_tunnel, " tunnel sanity check failure%s\n");
 	hist(ahstat->ahs_hist, ipsec_ahnames, "AH output");
 
-#undef p32
-#undef p64
+#undef p
 #undef hist
 }
 
@@ -356,7 +288,7 @@ ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ahstat, sizeof(ahstat));
+	kread_counters(off, (char *)&ahstat, sizeof(ahstat));
 
 	print_ahstats(&ahstat);
 }
@@ -364,37 +296,34 @@ ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
 static void
 print_espstats(const struct espstat *espstat)
 {
-#define	p32(f, m) if (espstat->f || sflag <= 1) \
-    printf("\t%u" m, (unsigned int)espstat->f, plural(espstat->f))
-#define	p64(f, m) if (espstat->f || sflag <= 1) \
+#define	p(f, m) if (espstat->f || sflag <= 1) \
     printf("\t%ju" m, (uintmax_t)espstat->f, plural(espstat->f))
 #define	hist(f, n, t) \
     ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t));
 
-	p32(esps_hdrops, " packet%s shorter than header shows\n");
-	p32(esps_nopf, " packet%s dropped; protocol family not supported\n");
-	p32(esps_notdb, " packet%s dropped; no TDB\n");
-	p32(esps_badkcr, " packet%s dropped; bad KCR\n");
-	p32(esps_qfull, " packet%s dropped; queue full\n");
-	p32(esps_noxform, " packet%s dropped; no transform\n");
-	p32(esps_badilen, " packet%s dropped; bad ilen\n");
-	p32(esps_wrap, " replay counter wrap%s\n");
-	p32(esps_badenc, " packet%s dropped; bad encryption detected\n");
-	p32(esps_badauth, " packet%s dropped; bad authentication detected\n");
-	p32(esps_replay, " possible replay packet%s detected\n");
-	p32(esps_input, " packet%s in\n");
-	p32(esps_output, " packet%s out\n");
-	p32(esps_invalid, " packet%s dropped; invalid TDB\n");
-	p64(esps_ibytes, " byte%s in\n");
-	p64(esps_obytes, " byte%s out\n");
-	p32(esps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
-	p32(esps_pdrops, " packet%s blocked due to policy\n");
-	p32(esps_crypto, " crypto processing failure%s\n");
-	p32(esps_tunnel, " tunnel sanity check failure%s\n");
+	p(esps_hdrops, " packet%s shorter than header shows\n");
+	p(esps_nopf, " packet%s dropped; protocol family not supported\n");
+	p(esps_notdb, " packet%s dropped; no TDB\n");
+	p(esps_badkcr, " packet%s dropped; bad KCR\n");
+	p(esps_qfull, " packet%s dropped; queue full\n");
+	p(esps_noxform, " packet%s dropped; no transform\n");
+	p(esps_badilen, " packet%s dropped; bad ilen\n");
+	p(esps_wrap, " replay counter wrap%s\n");
+	p(esps_badenc, " packet%s dropped; bad encryption detected\n");
+	p(esps_badauth, " packet%s dropped; bad authentication detected\n");
+	p(esps_replay, " possible replay packet%s detected\n");
+	p(esps_input, " packet%s in\n");
+	p(esps_output, " packet%s out\n");
+	p(esps_invalid, " packet%s dropped; invalid TDB\n");
+	p(esps_ibytes, " byte%s in\n");
+	p(esps_obytes, " byte%s out\n");
+	p(esps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
+	p(esps_pdrops, " packet%s blocked due to policy\n");
+	p(esps_crypto, " crypto processing failure%s\n");
+	p(esps_tunnel, " tunnel sanity check failure%s\n");
 	hist(espstat->esps_hist, ipsec_espnames, "ESP output");
 
-#undef p32
-#undef p64
+#undef p
 #undef hist
 }
 
@@ -406,7 +335,7 @@ esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&espstat, sizeof(espstat));
+	kread_counters(off, (char *)&espstat, sizeof(espstat));
 
 	print_espstats(&espstat);
 }
@@ -414,42 +343,31 @@ esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
 static void
 print_ipcompstats(const struct ipcompstat *ipcompstat)
 {
-	uint32_t version;
-#define	p32(f, m) if (ipcompstat->f || sflag <= 1) \
-    printf("\t%u" m, (unsigned int)ipcompstat->f, plural(ipcompstat->f))
-#define	p64(f, m) if (ipcompstat->f || sflag <= 1) \
+#define	p(f, m) if (ipcompstat->f || sflag <= 1) \
     printf("\t%ju" m, (uintmax_t)ipcompstat->f, plural(ipcompstat->f))
 #define	hist(f, n, t) \
     ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t));
 
-#ifndef IPCOMPSTAT_VERSION
-	version = 0;
-#else
-	version = ipcompstat->version;
-#endif
-	p32(ipcomps_hdrops, " packet%s shorter than header shows\n");
-	p32(ipcomps_nopf, " packet%s dropped; protocol family not supported\n");
-	p32(ipcomps_notdb, " packet%s dropped; no TDB\n");
-	p32(ipcomps_badkcr, " packet%s dropped; bad KCR\n");
-	p32(ipcomps_qfull, " packet%s dropped; queue full\n");
-	p32(ipcomps_noxform, " packet%s dropped; no transform\n");
-	p32(ipcomps_wrap, " replay counter wrap%s\n");
-	p32(ipcomps_input, " packet%s in\n");
-	p32(ipcomps_output, " packet%s out\n");
-	p32(ipcomps_invalid, " packet%s dropped; invalid TDB\n");
-	p64(ipcomps_ibytes, " byte%s in\n");
-	p64(ipcomps_obytes, " byte%s out\n");
-	p32(ipcomps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
-	p32(ipcomps_pdrops, " packet%s blocked due to policy\n");
-	p32(ipcomps_crypto, " crypto processing failure%s\n");
+	p(ipcomps_hdrops, " packet%s shorter than header shows\n");
+	p(ipcomps_nopf, " packet%s dropped; protocol family not supported\n");
+	p(ipcomps_notdb, " packet%s dropped; no TDB\n");
+	p(ipcomps_badkcr, " packet%s dropped; bad KCR\n");
+	p(ipcomps_qfull, " packet%s dropped; queue full\n");
+	p(ipcomps_noxform, " packet%s dropped; no transform\n");
+	p(ipcomps_wrap, " replay counter wrap%s\n");
+	p(ipcomps_input, " packet%s in\n");
+	p(ipcomps_output, " packet%s out\n");
+	p(ipcomps_invalid, " packet%s dropped; invalid TDB\n");
+	p(ipcomps_ibytes, " byte%s in\n");
+	p(ipcomps_obytes, " byte%s out\n");
+	p(ipcomps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
+	p(ipcomps_pdrops, " packet%s blocked due to policy\n");
+	p(ipcomps_crypto, " crypto processing failure%s\n");
 	hist(ipcompstat->ipcomps_hist, ipsec_compnames, "COMP output");
-	if (version >= 1) {
-	p32(ipcomps_threshold, " packet%s sent uncompressed; size < compr. algo. threshold\n");
-	p32(ipcomps_uncompr, " packet%s sent uncompressed; compression was useless\n");
-	}
+	p(ipcomps_threshold, " packet%s sent uncompressed; size < compr. algo. threshold\n");
+	p(ipcomps_uncompr, " packet%s sent uncompressed; compression was useless\n");
 
-#undef p32
-#undef p64
+#undef p
 #undef hist
 }
 
@@ -462,7 +380,7 @@ ipcomp_stats(u_long off, const char *name, int family __unused,
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ipcompstat, sizeof(ipcompstat));
+	kread_counters(off, (char *)&ipcompstat, sizeof(ipcompstat));
 
 	print_ipcompstats(&ipcompstat);
 }
diff --git a/usr.bin/netstat/main.c b/usr.bin/netstat/main.c
index ce4ff95..4efa280 100644
--- a/usr.bin/netstat/main.c
+++ b/usr.bin/netstat/main.c
@@ -112,78 +112,58 @@ static struct nlist nl[] = {
 	{ .n_name = "_mif6table" },
 #define	N_PFKEYSTAT	20
 	{ .n_name = "_pfkeystat" },
-#define	N_MBSTAT	21
-	{ .n_name = "_mbstat" },
-#define	N_MBTYPES	22
-	{ .n_name = "_mbtypes" },
-#define	N_NMBCLUSTERS	23
-	{ .n_name = "_nmbclusters" },
-#define	N_NMBUFS	24
-	{ .n_name = "_nmbufs" },
-#define	N_MBHI		25
-	{ .n_name = "_mbuf_hiwm" },
-#define	N_CLHI		26
-	{ .n_name = "_clust_hiwm" },
-#define	N_NCPUS		27
-	{ .n_name = "_smp_cpus" },
-#define	N_PAGESZ	28
-	{ .n_name = "_pagesize" },
-#define	N_MBPSTAT	29
-	{ .n_name = "_mb_statpcpu" },
-#define	N_RTTRASH	30
+#define	N_RTTRASH	21
 	{ .n_name = "_rttrash" },
-#define	N_MBLO		31
-	{ .n_name = "_mbuf_lowm" },
-#define	N_CLLO		32
-	{ .n_name = "_clust_lowm" },
-#define	N_CARPSTAT	33
+#define	N_CARPSTAT	22
 	{ .n_name = "_carpstats" },
-#define	N_PFSYNCSTAT	34
+#define	N_PFSYNCSTAT	23
 	{ .n_name = "_pfsyncstats" },
-#define	N_AHSTAT	35
+#define	N_AHSTAT	24
 	{ .n_name = "_ahstat" },
-#define	N_ESPSTAT	36
+#define	N_ESPSTAT	25
 	{ .n_name = "_espstat" },
-#define	N_IPCOMPSTAT	37
+#define	N_IPCOMPSTAT	26
 	{ .n_name = "_ipcompstat" },
-#define	N_TCPSTAT	38
-	{ .n_name = "_tcpstatp" },
-#define	N_UDPSTAT	39
+#define	N_TCPSTAT	27
+	{ .n_name = "_tcpstat" },
+#define	N_UDPSTAT	28
 	{ .n_name = "_udpstat" },
-#define	N_IPSTAT	40
-	{ .n_name = "_ipstatp" },
-#define	N_ICMPSTAT	41
+#define	N_IPSTAT	29
+	{ .n_name = "_ipstat" },
+#define	N_ICMPSTAT	30
 	{ .n_name = "_icmpstat" },
-#define	N_IGMPSTAT	42
+#define	N_IGMPSTAT	31
 	{ .n_name = "_igmpstat" },
-#define	N_PIMSTAT	43
+#define	N_PIMSTAT	32
 	{ .n_name = "_pimstat" },
-#define	N_TCBINFO	44
+#define	N_TCBINFO	33
 	{ .n_name = "_tcbinfo" },
-#define	N_UDBINFO	45
+#define	N_UDBINFO	34
 	{ .n_name = "_udbinfo" },
-#define	N_DIVCBINFO	46
+#define	N_DIVCBINFO	35
 	{ .n_name = "_divcbinfo" },
-#define	N_RIPCBINFO	47
+#define	N_RIPCBINFO	36
 	{ .n_name = "_ripcbinfo" },
-#define	N_UNP_COUNT	48
+#define	N_UNP_COUNT	37
 	{ .n_name = "_unp_count" },
-#define	N_UNP_GENCNT	49
+#define	N_UNP_GENCNT	38
 	{ .n_name = "_unp_gencnt" },
-#define	N_UNP_DHEAD	50
+#define	N_UNP_DHEAD	39
 	{ .n_name = "_unp_dhead" },
-#define	N_UNP_SHEAD	51
+#define	N_UNP_SHEAD	40
 	{ .n_name = "_unp_shead" },
-#define	N_RIP6STAT	52
+#define	N_RIP6STAT	41
 	{ .n_name = "_rip6stat" },
-#define	N_SCTPSTAT	53
+#define	N_SCTPSTAT	42
 	{ .n_name = "_sctpstat" },
-#define	N_MFCTABLESIZE	54
+#define	N_MFCTABLESIZE	43
 	{ .n_name = "_mfctablesize" },
-#define N_ARPSTAT       55
+#define	N_ARPSTAT       44
 	{ .n_name = "_arpstat" },
-#define	N_UNP_SPHEAD	56
+#define	N_UNP_SPHEAD	45
 	{ .n_name = "unp_sphead" },
+#define	N_SFSTAT	46
+	{ .n_name = "_sfstat"},
 	{ .n_name = NULL },
 };
 
@@ -363,10 +343,12 @@ main(int argc, char *argv[])
 {
 	struct protox *tp = NULL;  /* for printing cblocks & stats */
 	int ch;
+	int fib = -1;
+	char *endptr;
 
 	af = AF_UNSPEC;
 
-	while ((ch = getopt(argc, argv, "AaBbdf:ghI:iLlM:mN:np:Qq:rSTsuWw:xz"))
+	while ((ch = getopt(argc, argv, "AaBbdF:f:ghI:iLlM:mN:np:Qq:rSTsuWw:xz"))
 	    != -1)
 		switch(ch) {
 		case 'A':
@@ -384,6 +366,12 @@ main(int argc, char *argv[])
 		case 'd':
 			dflag = 1;
 			break;
+		case 'F':
+			fib = strtol(optarg, &endptr, 0);
+			if (*endptr != '\0' ||
+			    (fib == 0 && (errno == EINVAL || errno == ERANGE)))
+				errx(1, "%s: invalid fib", optarg);
+			break;
 		case 'f':
 			if (strcmp(optarg, "ipx") == 0)
 				af = AF_IPX;
@@ -535,7 +523,7 @@ main(int argc, char *argv[])
 	if (mflag) {
 		if (!live) {
 			if (kread(0, NULL, 0) == 0)
-				mbpr(kvmd, nl[N_MBSTAT].n_value);
+				mbpr(kvmd, nl[N_SFSTAT].n_value);
 		} else
 			mbpr(NULL, 0);
 		exit(0);
@@ -571,7 +559,7 @@ main(int argc, char *argv[])
 		if (sflag)
 			rt_stats(nl[N_RTSTAT].n_value, nl[N_RTTRASH].n_value);
 		else
-			routepr(nl[N_RTREE].n_value);
+			routepr(nl[N_RTREE].n_value, fib);
 		exit(0);
 	}
 	if (gflag) {
@@ -753,15 +741,21 @@ kread(u_long addr, void *buf, size_t size)
  * Read an array of N counters in kernel memory into array of N uint64_t's.
  */
 int
-kread_counters(u_long *addr, uint64_t *rval, size_t count)
+kread_counters(u_long addr, void *buf, size_t size)
 {
+	uint64_t *c = buf;
 
 	if (kvmd_init() < 0)
 		return (-1);
 
-	for (u_int i = 0; i < count; i++, addr++, rval++)
-		*rval = kvm_counter_u64_fetch(kvmd, *addr);
+	if (kread(addr, buf, size) < 0)
+		return (-1);
 
+	while (size != 0) {
+		*c = kvm_counter_u64_fetch(kvmd, *c);
+		size -= sizeof(*c);
+		c++;
+	}
 	return (0);
 }
 
diff --git a/usr.bin/netstat/mbuf.c b/usr.bin/netstat/mbuf.c
index 401a03c..d32304d 100644
--- a/usr.bin/netstat/mbuf.c
+++ b/usr.bin/netstat/mbuf.c
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/mbuf.h>
 #include <sys/protosw.h>
+#include <sys/sf_buf.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sysctl.h>
@@ -81,7 +82,7 @@ mbpr(void *kvmd, u_long mbaddr)
 	uintmax_t jumbo16_failures, jumbo16_sleeps, jumbo16_size;
 	uintmax_t bytes_inuse, bytes_incache, bytes_total;
 	int nsfbufs, nsfbufspeak, nsfbufsused;
-	struct mbstat mbstat;
+	struct sfstat sfstat;
 	size_t mlen;
 	int error;
 
@@ -308,20 +309,21 @@ mbpr(void *kvmd, u_long mbaddr)
 		    &mlen, NULL, 0))
 			printf("%d/%d/%d sfbufs in use (current/peak/max)\n",
 			    nsfbufsused, nsfbufspeak, nsfbufs);
-		mlen = sizeof(mbstat);
-		if (sysctlbyname("kern.ipc.mbstat", &mbstat, &mlen, NULL, 0)) {
-			warn("kern.ipc.mbstat");
+		mlen = sizeof(sfstat);
+		if (sysctlbyname("kern.ipc.sfstat", &sfstat, &mlen, NULL, 0)) {
+			warn("kern.ipc.sfstat");
 			goto out;
 		}
 	} else {
-		if (kread(mbaddr, (char *)&mbstat, sizeof mbstat) != 0)
+		if (kread_counters(mbaddr, (char *)&sfstat, sizeof sfstat) != 0)
 			goto out;
 	}
-	printf("%lu requests for sfbufs denied\n", mbstat.sf_allocfail);
-	printf("%lu requests for sfbufs delayed\n", mbstat.sf_allocwait);
-	printf("%lu requests for I/O initiated by sendfile\n",
-	    mbstat.sf_iocnt);
-	printf("%lu calls to protocol drain routines\n", mbstat.m_drain);
+	printf("%ju requests for sfbufs denied\n",
+	    (uintmax_t)sfstat.sf_allocfail);
+	printf("%ju requests for sfbufs delayed\n",
+	    (uintmax_t)sfstat.sf_allocwait);
+	printf("%ju requests for I/O initiated by sendfile\n",
+	    (uintmax_t)sfstat.sf_iocnt);
 out:
 	memstat_mtl_free(mtlp);
 }
diff --git a/usr.bin/netstat/mroute.c b/usr.bin/netstat/mroute.c
index 4d55cb6..7cade4e 100644
--- a/usr.bin/netstat/mroute.c
+++ b/usr.bin/netstat/mroute.c
@@ -350,29 +350,29 @@ mrt_stats(u_long mstaddr)
 			return;
 		}
 	} else
-		kread(mstaddr, (char *)&mrtstat, sizeof(mrtstat));
+		kread_counters(mstaddr, &mrtstat, len);
 
 	printf("IPv4 multicast forwarding:\n");
 
 #define	p(f, m) if (mrtstat.f || sflag <= 1) \
-	printf(m, mrtstat.f, plural(mrtstat.f))
+	printf(m, (uintmax_t)mrtstat.f, plural(mrtstat.f))
 #define	p2(f, m) if (mrtstat.f || sflag <= 1) \
-	printf(m, mrtstat.f, plurales(mrtstat.f))
+	printf(m, (uintmax_t)mrtstat.f, plurales(mrtstat.f))
 
-	p(mrts_mfc_lookups, "\t%lu multicast forwarding cache lookup%s\n");
-	p2(mrts_mfc_misses, "\t%lu multicast forwarding cache miss%s\n");
-	p(mrts_upcalls, "\t%lu upcall%s to multicast routing daemon\n");
-	p(mrts_upq_ovflw, "\t%lu upcall queue overflow%s\n");
+	p(mrts_mfc_lookups, "\t%ju multicast forwarding cache lookup%s\n");
+	p2(mrts_mfc_misses, "\t%ju multicast forwarding cache miss%s\n");
+	p(mrts_upcalls, "\t%ju upcall%s to multicast routing daemon\n");
+	p(mrts_upq_ovflw, "\t%ju upcall queue overflow%s\n");
 	p(mrts_upq_sockfull,
-	    "\t%lu upcall%s dropped due to full socket buffer\n");
-	p(mrts_cache_cleanups, "\t%lu cache cleanup%s\n");
-	p(mrts_no_route, "\t%lu datagram%s with no route for origin\n");
-	p(mrts_bad_tunnel, "\t%lu datagram%s arrived with bad tunneling\n");
-	p(mrts_cant_tunnel, "\t%lu datagram%s could not be tunneled\n");
-	p(mrts_wrong_if, "\t%lu datagram%s arrived on wrong interface\n");
-	p(mrts_drop_sel, "\t%lu datagram%s selectively dropped\n");
-	p(mrts_q_overflow, "\t%lu datagram%s dropped due to queue overflow\n");
-	p(mrts_pkt2large, "\t%lu datagram%s dropped for being too large\n");
+	    "\t%ju upcall%s dropped due to full socket buffer\n");
+	p(mrts_cache_cleanups, "\t%ju cache cleanup%s\n");
+	p(mrts_no_route, "\t%ju datagram%s with no route for origin\n");
+	p(mrts_bad_tunnel, "\t%ju datagram%s arrived with bad tunneling\n");
+	p(mrts_cant_tunnel, "\t%ju datagram%s could not be tunneled\n");
+	p(mrts_wrong_if, "\t%ju datagram%s arrived on wrong interface\n");
+	p(mrts_drop_sel, "\t%ju datagram%s selectively dropped\n");
+	p(mrts_q_overflow, "\t%ju datagram%s dropped due to queue overflow\n");
+	p(mrts_pkt2large, "\t%ju datagram%s dropped for being too large\n");
 
 #undef	p2
 #undef	p
diff --git a/usr.bin/netstat/netstat.1 b/usr.bin/netstat/netstat.1
index c52340a..0a37994 100644
--- a/usr.bin/netstat/netstat.1
+++ b/usr.bin/netstat/netstat.1
@@ -28,7 +28,7 @@
 .\"	@(#)netstat.1	8.8 (Berkeley) 4/18/94
 .\" $FreeBSD$
 .\"
-.Dd March 10, 2013
+.Dd May 17, 2013
 .Dt NETSTAT 1
 .Os
 .Sh NAME
@@ -217,14 +217,29 @@ states.
 .Nm
 .Fl r
 .Op Fl AanW
+.Op Fl F Ar fibnum
 .Op Fl f Ar address_family
 .Op Fl M Ar core
 .Op Fl N Ar system
 .Ek
 .Xc
-Display the contents of all routing tables,
-or a routing table for a particular
-.Ar address_family .
+Display the contents of routing tables.
+When
+.Fl f
+is specified, a routing table for a particular
+.Ar address_family
+is displayed.
+When
+.Fl F
+is specified, a routing table with the number
+.Ar fibnum
+is displayed.
+If the specified
+.Ar fibnum
+is -1 or
+.Fl F
+is not specified,
+the default routing table is displayed.
 If
 .Fl A
 is also present,
diff --git a/usr.bin/netstat/netstat.h b/usr.bin/netstat/netstat.h
index 32bea79..02b8a17 100644
--- a/usr.bin/netstat/netstat.h
+++ b/usr.bin/netstat/netstat.h
@@ -60,7 +60,7 @@ extern int	af;	/* address family */
 extern int	live;	/* true if we are examining a live system */
 
 int	kread(u_long addr, void *buf, size_t size);
-int	kread_counters(u_long *addr, uint64_t *rval, size_t count);
+int	kread_counters(u_long addr, void *buf, size_t size);
 const char *plural(uintmax_t);
 const char *plurales(uintmax_t);
 const char *pluralies(uintmax_t);
@@ -135,7 +135,7 @@ char	*atalk_print(struct sockaddr *, int);
 char	*atalk_print2(struct sockaddr *, struct sockaddr *, int);
 char	*ipx_print(struct sockaddr *);
 char	*ns_print(struct sockaddr *);
-void	routepr(u_long);
+void	routepr(u_long, int);
 
 void	ipxprotopr(u_long, const char *, int, int);
 void	spx_stats(u_long, const char *, int, int);
diff --git a/usr.bin/netstat/pfkey.c b/usr.bin/netstat/pfkey.c
index 0d48e5d..da81485 100644
--- a/usr.bin/netstat/pfkey.c
+++ b/usr.bin/netstat/pfkey.c
@@ -119,7 +119,7 @@ pfkey_stats(u_long off, const char *name, int family __unused,
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&pfkeystat, sizeof(pfkeystat));
+	kread_counters(off, (char *)&pfkeystat, sizeof(pfkeystat));
 
 #define	p(f, m) if (pfkeystat.f || sflag <= 1) \
     printf(m, (uintmax_t)pfkeystat.f, plural(pfkeystat.f))
diff --git a/usr.bin/netstat/route.c b/usr.bin/netstat/route.c
index dd91330..1de12cc 100644
--- a/usr.bin/netstat/route.c
+++ b/usr.bin/netstat/route.c
@@ -143,17 +143,20 @@ static void domask(char *, in_addr_t, u_long);
  * Print routing tables.
  */
 void
-routepr(u_long rtree)
+routepr(u_long rtree, int fibnum)
 {
 	struct radix_node_head **rnhp, *rnh, head;
 	size_t intsize;
-	int fam, fibnum, numfibs;
+	int fam, numfibs;
 
 	intsize = sizeof(int);
-	if (sysctlbyname("net.my_fibnum", &fibnum, &intsize, NULL, 0) == -1)
+	if (fibnum == -1 &&
+	    sysctlbyname("net.my_fibnum", &fibnum, &intsize, NULL, 0) == -1)
 		fibnum = 0;
 	if (sysctlbyname("net.fibs", &numfibs, &intsize, NULL, 0) == -1)
 		numfibs = 1;
+	if (fibnum < 0 || fibnum > numfibs - 1)
+		errx(EX_USAGE, "%d: invalid fib", fibnum);
 	rt_tables = calloc(numfibs * (AF_MAX+1),
 	    sizeof(struct radix_node_head *));
 	if (rt_tables == NULL)
@@ -166,7 +169,10 @@ routepr(u_long rtree)
 	if (clock_gettime(CLOCK_UPTIME, &uptime) < 0)
 		err(EX_OSERR, "clock_gettime() failed");
 
-	printf("Routing tables\n");
+	printf("Routing tables");
+	if (fibnum)
+		printf(" (fib: %d)", fibnum);
+	printf("\n");
 
 	if (Aflag == 0 && NewTree)
 		ntreestuff();