18 files changed, 300 insertions, 442 deletions

diff --git a/usr.bin/dtc/fdt.cc b/usr.bin/dtc/fdt.cc
index b6e7d56..6f27c9c 100644
--- a/usr.bin/dtc/fdt.cc
+++ b/usr.bin/dtc/fdt.cc
@@ -30,6 +30,8 @@
  * $FreeBSD$
  */
 
+#define __STDC_LIMIT_MACROS 1
+
 #include "fdt.hh"
 
 #include <algorithm>
@@ -281,6 +283,12 @@ property::parse_cells(input_buffer &input)
 				valid = false;
 				return;
 			}
+			if ((val < 0) || (val > UINT32_MAX))
+			{
+				input.parse_error("Value out of range");
+				valid = false;
+				return;
+			}
 			push_big_endian(v.byte_data, (uint32_t)val);
 			input.next_token();
 		}
diff --git a/usr.bin/kdump/kdump.c b/usr.bin/kdump/kdump.c
index 77a0cae..0f1a26b 100644
--- a/usr.bin/kdump/kdump.c
+++ b/usr.bin/kdump/kdump.c
@@ -165,6 +165,31 @@ struct proc_info
 
 TAILQ_HEAD(trace_procs, proc_info) trace_procs;
 
+static void
+strerror_init(void)
+{
+
+	/*
+	 * Cache NLS data before entering capability mode.
+	 * XXXPJD: There should be strerror_init() and strsignal_init() in libc.
+	 */
+	(void)catopen("libc", NL_CAT_LOCALE);
+}
+
+static void
+localtime_init(void)
+{
+	time_t ltime;
+
+	/*
+	 * Allow localtime(3) to cache /etc/localtime content before entering
+	 * capability mode.
+	 * XXXPJD: There should be localtime_init() in libc.
+	 */
+	(void)time(&ltime);
+	(void)localtime(&ltime);
+}
+
 int
 main(int argc, char *argv[])
 {
@@ -236,11 +261,9 @@ main(int argc, char *argv[])
 	if (!freopen(tracefile, "r", stdin))
 		err(1, "%s", tracefile);
 
-	/*
-	 * Cache NLS data before entering capability mode.
-	 * XXXPJD: There should be strerror_init() and strsignal_init() in libc.
-	 */
-	(void)catopen("libc", NL_CAT_LOCALE);
+	strerror_init();
+	localtime_init();
+
 	if (resolv == 0) {
 		if (cap_enter() < 0 && errno != ENOSYS)
 			err(1, "unable to enter capability mode");
diff --git a/usr.bin/netstat/inet.c b/usr.bin/netstat/inet.c
index a04cc9a..af235f1 100644
--- a/usr.bin/netstat/inet.c
+++ b/usr.bin/netstat/inet.c
@@ -603,13 +603,8 @@ tcp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			warn("sysctl: net.inet.tcp.stats");
 			return;
 		}
-	} else {
-		u_long tcpstat_p[sizeof(struct tcpstat)/sizeof(uint64_t)];
- 
-		kread(off, &tcpstat_p, sizeof(tcpstat_p));
-		kread_counters(tcpstat_p, (uint64_t *)&tcpstat,
-		    sizeof(struct tcpstat)/sizeof(uint64_t));
-	}
+	} else
+		kread_counters(off, &tcpstat, len);
 
 	printf ("%s:\n", name);
 
@@ -743,7 +738,7 @@ udp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 {
 	struct udpstat udpstat, zerostat;
 	size_t len = sizeof udpstat;
-	u_long delivered;
+	uint64_t delivered;
 
 #ifdef INET6
 	if (udp_done != 0)
@@ -761,23 +756,23 @@ udp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &udpstat, len);
+		kread_counters(off, &udpstat, len);
 
 	printf("%s:\n", name);
 #define	p(f, m) if (udpstat.f || sflag <= 1) \
-    printf(m, udpstat.f, plural(udpstat.f))
+    printf("\t%ju " m, (uintmax_t)udpstat.f, plural(udpstat.f))
 #define	p1a(f, m) if (udpstat.f || sflag <= 1) \
-    printf(m, udpstat.f)
-	p(udps_ipackets, "\t%lu datagram%s received\n");
-	p1a(udps_hdrops, "\t%lu with incomplete header\n");
-	p1a(udps_badlen, "\t%lu with bad data length field\n");
-	p1a(udps_badsum, "\t%lu with bad checksum\n");
-	p1a(udps_nosum, "\t%lu with no checksum\n");
-	p1a(udps_noport, "\t%lu dropped due to no socket\n");
+    printf("\t%ju " m, (uintmax_t)udpstat.f)
+	p(udps_ipackets, "datagram%s received\n");
+	p1a(udps_hdrops, "with incomplete header\n");
+	p1a(udps_badlen, "with bad data length field\n");
+	p1a(udps_badsum, "with bad checksum\n");
+	p1a(udps_nosum, "with no checksum\n");
+	p1a(udps_noport, "dropped due to no socket\n");
 	p(udps_noportbcast,
-	    "\t%lu broadcast/multicast datagram%s undelivered\n");
-	p1a(udps_fullsock, "\t%lu dropped due to full socket buffers\n");
-	p1a(udpps_pcbhashmiss, "\t%lu not for hashed pcb\n");
+	    "broadcast/multicast datagram%s undelivered\n");
+	p1a(udps_fullsock, "dropped due to full socket buffers\n");
+	p1a(udpps_pcbhashmiss, "not for hashed pcb\n");
 	delivered = udpstat.udps_ipackets -
 		    udpstat.udps_hdrops -
 		    udpstat.udps_badlen -
@@ -786,11 +781,11 @@ udp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 		    udpstat.udps_noportbcast -
 		    udpstat.udps_fullsock;
 	if (delivered || sflag <= 1)
-		printf("\t%lu delivered\n", delivered);
-	p(udps_opackets, "\t%lu datagram%s output\n");
+		printf("\t%ju delivered\n", (uint64_t)delivered);
+	p(udps_opackets, "datagram%s output\n");
 	/* the next statistic is cumulative in udps_noportbcast */
 	p(udps_filtermcast,
-	    "\t%lu time%s multicast source filter matched\n");
+	    "time%s multicast source filter matched\n");
 #undef p
 #undef p1a
 }
@@ -816,7 +811,7 @@ carp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 	} else {
 		if (off == 0)
 			return;
-		kread(off, &carpstat, len);
+		kread_counters(off, &carpstat, len);
 	}
 
 	printf("%s:\n", name);
@@ -863,13 +858,8 @@ ip_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			warn("sysctl: net.inet.ip.stats");
 			return;
 		}
-	} else {
-		u_long ipstat_p[sizeof(struct ipstat)/sizeof(uint64_t)];
-
-		kread(off, &ipstat_p, sizeof(ipstat_p));
-		kread_counters(ipstat_p, (uint64_t *)&ipstat,
-		    sizeof(struct ipstat)/sizeof(uint64_t));
-	}
+	} else
+		kread_counters(off, &ipstat, len);
 
 	printf("%s:\n", name);
 
@@ -933,23 +923,23 @@ arp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &arpstat, len);
+		kread_counters(off, &arpstat, len);
 
 	printf("%s:\n", name);
 
 #define	p(f, m) if (arpstat.f || sflag <= 1) \
-    printf(m, arpstat.f, plural(arpstat.f))
+    printf("\t%ju " m, (uintmax_t)arpstat.f, plural(arpstat.f))
 #define	p2(f, m) if (arpstat.f || sflag <= 1) \
-    printf(m, arpstat.f, pluralies(arpstat.f))
-
-	p(txrequests, "\t%lu ARP request%s sent\n");
-	p2(txreplies, "\t%lu ARP repl%s sent\n");
-	p(rxrequests, "\t%lu ARP request%s received\n");
-	p2(rxreplies, "\t%lu ARP repl%s received\n");
-	p(received, "\t%lu ARP packet%s received\n");
-	p(dropped, "\t%lu total packet%s dropped due to no ARP entry\n");
-	p(timeouts, "\t%lu ARP entry%s timed out\n");
-	p(dupips, "\t%lu Duplicate IP%s seen\n");
+    printf("\t%ju " m, (uintmax_t)arpstat.f, pluralies(arpstat.f))
+
+	p(txrequests, "ARP request%s sent\n");
+	p2(txreplies, "ARP repl%s sent\n");
+	p(rxrequests, "ARP request%s received\n");
+	p2(rxreplies, "ARP repl%s received\n");
+	p(received, "ARP packet%s received\n");
+	p(dropped, "total packet%s dropped due to no ARP entry\n");
+	p(timeouts, "ARP entry%s timed out\n");
+	p(dupips, "Duplicate IP%s seen\n");
 #undef p
 #undef p2
 }
@@ -1020,7 +1010,7 @@ icmp_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &icmpstat, len);
+		kread_counters(off, &icmpstat, len);
 
 	printf("%s:\n", name);
 
@@ -1227,7 +1217,7 @@ pim_stats(u_long off __unused, const char *name, int af1 __unused,
 	} else {
 		if (off == 0)
 			return;
-		kread(off, &pimstat, len);
+		kread_counters(off, &pimstat, len);
 	}
 
 	printf("%s:\n", name);
diff --git a/usr.bin/netstat/inet6.c b/usr.bin/netstat/inet6.c
index 25ab5a7..a3bbc31 100644
--- a/usr.bin/netstat/inet6.c
+++ b/usr.bin/netstat/inet6.c
@@ -376,7 +376,7 @@ ip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &ip6stat, len);
+		kread_counters(off, &ip6stat, len);
 
 	printf("%s:\n", name);
 
@@ -858,7 +858,7 @@ icmp6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &icmp6stat, len);
+		kread_counters(off, &icmp6stat, len);
 
 	printf("%s:\n", name);
 
@@ -1052,7 +1052,7 @@ rip6_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 			return;
 		}
 	} else
-		kread(off, &rip6stat, len);
+		kread_counters(off, &rip6stat, len);
 
 	printf("%s:\n", name);
 
diff --git a/usr.bin/netstat/ipsec.c b/usr.bin/netstat/ipsec.c
index 7b16f57..2eb8ee0 100644
--- a/usr.bin/netstat/ipsec.c
+++ b/usr.bin/netstat/ipsec.c
@@ -268,13 +268,13 @@ ipsec_stats(u_long off, const char *name, int af1 __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ipsecstat, sizeof(ipsecstat));
+	kread_counters(off, (char *)&ipsecstat, sizeof(ipsecstat));
 
 	print_ipsecstats(&ipsecstat);
 }
 
 
-static void ipsec_hist_new(const u_int32_t *hist, size_t histmax,
+static void ipsec_hist_new(const uint64_t *hist, size_t histmax,
 			   const struct val2str *name, const char *title);
 static void print_ahstats(const struct ahstat *ahstat);
 static void print_espstats(const struct espstat *espstat);
@@ -284,7 +284,7 @@ static void print_ipcompstats(const struct ipcompstat *ipcompstat);
  * Dump IPSEC statistics structure.
  */
 static void
-ipsec_hist_new(const u_int32_t *hist, size_t histmax,
+ipsec_hist_new(const uint64_t *hist, size_t histmax,
 	       const struct val2str *name, const char *title)
 {
 	int first;
@@ -304,10 +304,11 @@ ipsec_hist_new(const u_int32_t *hist, size_t histmax,
 				break;
 		}
 		if (p && p->str) {
-			printf("\t\t%s: %u\n", p->str, hist[proto]);
+			printf("\t\t%s: %ju\n", p->str,
+			    (uintmax_t)hist[proto]);
 		} else {
-			printf("\t\t#%lu: %u\n", (unsigned long)proto,
-			       hist[proto]);
+			printf("\t\t#%lu: %ju\n", (unsigned long)proto,
+			    (uintmax_t)hist[proto]);
 		}
 	}
 }
@@ -315,36 +316,33 @@ ipsec_hist_new(const u_int32_t *hist, size_t histmax,
 static void
 print_ahstats(const struct ahstat *ahstat)
 {
-#define	p32(f, m) if (ahstat->f || sflag <= 1) \
-    printf("\t%u" m, (unsigned int)ahstat->f, plural(ahstat->f))
-#define	p64(f, m) if (ahstat->f || sflag <= 1) \
+#define	p(f, m) if (ahstat->f || sflag <= 1) \
     printf("\t%ju" m, (uintmax_t)ahstat->f, plural(ahstat->f))
 #define	hist(f, n, t) \
     ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t));
 
-	p32(ahs_hdrops, " packet%s shorter than header shows\n");
-	p32(ahs_nopf, " packet%s dropped; protocol family not supported\n");
-	p32(ahs_notdb, " packet%s dropped; no TDB\n");
-	p32(ahs_badkcr, " packet%s dropped; bad KCR\n");
-	p32(ahs_qfull, " packet%s dropped; queue full\n");
-	p32(ahs_noxform, " packet%s dropped; no transform\n");
-	p32(ahs_wrap, " replay counter wrap%s\n");
-	p32(ahs_badauth, " packet%s dropped; bad authentication detected\n");
-	p32(ahs_badauthl, " packet%s dropped; bad authentication length\n");
-	p32(ahs_replay, " possible replay packet%s detected\n");
-	p32(ahs_input, " packet%s in\n");
-	p32(ahs_output, " packet%s out\n");
-	p32(ahs_invalid, " packet%s dropped; invalid TDB\n");
-	p64(ahs_ibytes, " byte%s in\n");
-	p64(ahs_obytes, " byte%s out\n");
-	p32(ahs_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
-	p32(ahs_pdrops, " packet%s blocked due to policy\n");
-	p32(ahs_crypto, " crypto processing failure%s\n");
-	p32(ahs_tunnel, " tunnel sanity check failure%s\n");
+	p(ahs_hdrops, " packet%s shorter than header shows\n");
+	p(ahs_nopf, " packet%s dropped; protocol family not supported\n");
+	p(ahs_notdb, " packet%s dropped; no TDB\n");
+	p(ahs_badkcr, " packet%s dropped; bad KCR\n");
+	p(ahs_qfull, " packet%s dropped; queue full\n");
+	p(ahs_noxform, " packet%s dropped; no transform\n");
+	p(ahs_wrap, " replay counter wrap%s\n");
+	p(ahs_badauth, " packet%s dropped; bad authentication detected\n");
+	p(ahs_badauthl, " packet%s dropped; bad authentication length\n");
+	p(ahs_replay, " possible replay packet%s detected\n");
+	p(ahs_input, " packet%s in\n");
+	p(ahs_output, " packet%s out\n");
+	p(ahs_invalid, " packet%s dropped; invalid TDB\n");
+	p(ahs_ibytes, " byte%s in\n");
+	p(ahs_obytes, " byte%s out\n");
+	p(ahs_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
+	p(ahs_pdrops, " packet%s blocked due to policy\n");
+	p(ahs_crypto, " crypto processing failure%s\n");
+	p(ahs_tunnel, " tunnel sanity check failure%s\n");
 	hist(ahstat->ahs_hist, ipsec_ahnames, "AH output");
 
-#undef p32
-#undef p64
+#undef p
 #undef hist
 }
 
@@ -356,7 +354,7 @@ ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ahstat, sizeof(ahstat));
+	kread_counters(off, (char *)&ahstat, sizeof(ahstat));
 
 	print_ahstats(&ahstat);
 }
@@ -364,37 +362,34 @@ ah_stats(u_long off, const char *name, int family __unused, int proto __unused)
 static void
 print_espstats(const struct espstat *espstat)
 {
-#define	p32(f, m) if (espstat->f || sflag <= 1) \
-    printf("\t%u" m, (unsigned int)espstat->f, plural(espstat->f))
-#define	p64(f, m) if (espstat->f || sflag <= 1) \
+#define	p(f, m) if (espstat->f || sflag <= 1) \
     printf("\t%ju" m, (uintmax_t)espstat->f, plural(espstat->f))
 #define	hist(f, n, t) \
     ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t));
 
-	p32(esps_hdrops, " packet%s shorter than header shows\n");
-	p32(esps_nopf, " packet%s dropped; protocol family not supported\n");
-	p32(esps_notdb, " packet%s dropped; no TDB\n");
-	p32(esps_badkcr, " packet%s dropped; bad KCR\n");
-	p32(esps_qfull, " packet%s dropped; queue full\n");
-	p32(esps_noxform, " packet%s dropped; no transform\n");
-	p32(esps_badilen, " packet%s dropped; bad ilen\n");
-	p32(esps_wrap, " replay counter wrap%s\n");
-	p32(esps_badenc, " packet%s dropped; bad encryption detected\n");
-	p32(esps_badauth, " packet%s dropped; bad authentication detected\n");
-	p32(esps_replay, " possible replay packet%s detected\n");
-	p32(esps_input, " packet%s in\n");
-	p32(esps_output, " packet%s out\n");
-	p32(esps_invalid, " packet%s dropped; invalid TDB\n");
-	p64(esps_ibytes, " byte%s in\n");
-	p64(esps_obytes, " byte%s out\n");
-	p32(esps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
-	p32(esps_pdrops, " packet%s blocked due to policy\n");
-	p32(esps_crypto, " crypto processing failure%s\n");
-	p32(esps_tunnel, " tunnel sanity check failure%s\n");
+	p(esps_hdrops, " packet%s shorter than header shows\n");
+	p(esps_nopf, " packet%s dropped; protocol family not supported\n");
+	p(esps_notdb, " packet%s dropped; no TDB\n");
+	p(esps_badkcr, " packet%s dropped; bad KCR\n");
+	p(esps_qfull, " packet%s dropped; queue full\n");
+	p(esps_noxform, " packet%s dropped; no transform\n");
+	p(esps_badilen, " packet%s dropped; bad ilen\n");
+	p(esps_wrap, " replay counter wrap%s\n");
+	p(esps_badenc, " packet%s dropped; bad encryption detected\n");
+	p(esps_badauth, " packet%s dropped; bad authentication detected\n");
+	p(esps_replay, " possible replay packet%s detected\n");
+	p(esps_input, " packet%s in\n");
+	p(esps_output, " packet%s out\n");
+	p(esps_invalid, " packet%s dropped; invalid TDB\n");
+	p(esps_ibytes, " byte%s in\n");
+	p(esps_obytes, " byte%s out\n");
+	p(esps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
+	p(esps_pdrops, " packet%s blocked due to policy\n");
+	p(esps_crypto, " crypto processing failure%s\n");
+	p(esps_tunnel, " tunnel sanity check failure%s\n");
 	hist(espstat->esps_hist, ipsec_espnames, "ESP output");
 
-#undef p32
-#undef p64
+#undef p
 #undef hist
 }
 
@@ -406,7 +401,7 @@ esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&espstat, sizeof(espstat));
+	kread_counters(off, (char *)&espstat, sizeof(espstat));
 
 	print_espstats(&espstat);
 }
@@ -414,42 +409,31 @@ esp_stats(u_long off, const char *name, int family __unused, int proto __unused)
 static void
 print_ipcompstats(const struct ipcompstat *ipcompstat)
 {
-	uint32_t version;
-#define	p32(f, m) if (ipcompstat->f || sflag <= 1) \
-    printf("\t%u" m, (unsigned int)ipcompstat->f, plural(ipcompstat->f))
-#define	p64(f, m) if (ipcompstat->f || sflag <= 1) \
+#define	p(f, m) if (ipcompstat->f || sflag <= 1) \
     printf("\t%ju" m, (uintmax_t)ipcompstat->f, plural(ipcompstat->f))
 #define	hist(f, n, t) \
     ipsec_hist_new((f), sizeof(f)/sizeof(f[0]), (n), (t));
 
-#ifndef IPCOMPSTAT_VERSION
-	version = 0;
-#else
-	version = ipcompstat->version;
-#endif
-	p32(ipcomps_hdrops, " packet%s shorter than header shows\n");
-	p32(ipcomps_nopf, " packet%s dropped; protocol family not supported\n");
-	p32(ipcomps_notdb, " packet%s dropped; no TDB\n");
-	p32(ipcomps_badkcr, " packet%s dropped; bad KCR\n");
-	p32(ipcomps_qfull, " packet%s dropped; queue full\n");
-	p32(ipcomps_noxform, " packet%s dropped; no transform\n");
-	p32(ipcomps_wrap, " replay counter wrap%s\n");
-	p32(ipcomps_input, " packet%s in\n");
-	p32(ipcomps_output, " packet%s out\n");
-	p32(ipcomps_invalid, " packet%s dropped; invalid TDB\n");
-	p64(ipcomps_ibytes, " byte%s in\n");
-	p64(ipcomps_obytes, " byte%s out\n");
-	p32(ipcomps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
-	p32(ipcomps_pdrops, " packet%s blocked due to policy\n");
-	p32(ipcomps_crypto, " crypto processing failure%s\n");
+	p(ipcomps_hdrops, " packet%s shorter than header shows\n");
+	p(ipcomps_nopf, " packet%s dropped; protocol family not supported\n");
+	p(ipcomps_notdb, " packet%s dropped; no TDB\n");
+	p(ipcomps_badkcr, " packet%s dropped; bad KCR\n");
+	p(ipcomps_qfull, " packet%s dropped; queue full\n");
+	p(ipcomps_noxform, " packet%s dropped; no transform\n");
+	p(ipcomps_wrap, " replay counter wrap%s\n");
+	p(ipcomps_input, " packet%s in\n");
+	p(ipcomps_output, " packet%s out\n");
+	p(ipcomps_invalid, " packet%s dropped; invalid TDB\n");
+	p(ipcomps_ibytes, " byte%s in\n");
+	p(ipcomps_obytes, " byte%s out\n");
+	p(ipcomps_toobig, " packet%s dropped; larger than IP_MAXPACKET\n");
+	p(ipcomps_pdrops, " packet%s blocked due to policy\n");
+	p(ipcomps_crypto, " crypto processing failure%s\n");
 	hist(ipcompstat->ipcomps_hist, ipsec_compnames, "COMP output");
-	if (version >= 1) {
-	p32(ipcomps_threshold, " packet%s sent uncompressed; size < compr. algo. threshold\n");
-	p32(ipcomps_uncompr, " packet%s sent uncompressed; compression was useless\n");
-	}
+	p(ipcomps_threshold, " packet%s sent uncompressed; size < compr. algo. threshold\n");
+	p(ipcomps_uncompr, " packet%s sent uncompressed; compression was useless\n");
 
-#undef p32
-#undef p64
+#undef p
 #undef hist
 }
 
@@ -462,7 +446,7 @@ ipcomp_stats(u_long off, const char *name, int family __unused,
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&ipcompstat, sizeof(ipcompstat));
+	kread_counters(off, (char *)&ipcompstat, sizeof(ipcompstat));
 
 	print_ipcompstats(&ipcompstat);
 }
diff --git a/usr.bin/netstat/main.c b/usr.bin/netstat/main.c
index ce4ff95..4efa280 100644
--- a/usr.bin/netstat/main.c
+++ b/usr.bin/netstat/main.c
@@ -112,78 +112,58 @@ static struct nlist nl[] = {
 	{ .n_name = "_mif6table" },
 #define	N_PFKEYSTAT	20
 	{ .n_name = "_pfkeystat" },
-#define	N_MBSTAT	21
-	{ .n_name = "_mbstat" },
-#define	N_MBTYPES	22
-	{ .n_name = "_mbtypes" },
-#define	N_NMBCLUSTERS	23
-	{ .n_name = "_nmbclusters" },
-#define	N_NMBUFS	24
-	{ .n_name = "_nmbufs" },
-#define	N_MBHI		25
-	{ .n_name = "_mbuf_hiwm" },
-#define	N_CLHI		26
-	{ .n_name = "_clust_hiwm" },
-#define	N_NCPUS		27
-	{ .n_name = "_smp_cpus" },
-#define	N_PAGESZ	28
-	{ .n_name = "_pagesize" },
-#define	N_MBPSTAT	29
-	{ .n_name = "_mb_statpcpu" },
-#define	N_RTTRASH	30
+#define	N_RTTRASH	21
 	{ .n_name = "_rttrash" },
-#define	N_MBLO		31
-	{ .n_name = "_mbuf_lowm" },
-#define	N_CLLO		32
-	{ .n_name = "_clust_lowm" },
-#define	N_CARPSTAT	33
+#define	N_CARPSTAT	22
 	{ .n_name = "_carpstats" },
-#define	N_PFSYNCSTAT	34
+#define	N_PFSYNCSTAT	23
 	{ .n_name = "_pfsyncstats" },
-#define	N_AHSTAT	35
+#define	N_AHSTAT	24
 	{ .n_name = "_ahstat" },
-#define	N_ESPSTAT	36
+#define	N_ESPSTAT	25
 	{ .n_name = "_espstat" },
-#define	N_IPCOMPSTAT	37
+#define	N_IPCOMPSTAT	26
 	{ .n_name = "_ipcompstat" },
-#define	N_TCPSTAT	38
-	{ .n_name = "_tcpstatp" },
-#define	N_UDPSTAT	39
+#define	N_TCPSTAT	27
+	{ .n_name = "_tcpstat" },
+#define	N_UDPSTAT	28
 	{ .n_name = "_udpstat" },
-#define	N_IPSTAT	40
-	{ .n_name = "_ipstatp" },
-#define	N_ICMPSTAT	41
+#define	N_IPSTAT	29
+	{ .n_name = "_ipstat" },
+#define	N_ICMPSTAT	30
 	{ .n_name = "_icmpstat" },
-#define	N_IGMPSTAT	42
+#define	N_IGMPSTAT	31
 	{ .n_name = "_igmpstat" },
-#define	N_PIMSTAT	43
+#define	N_PIMSTAT	32
 	{ .n_name = "_pimstat" },
-#define	N_TCBINFO	44
+#define	N_TCBINFO	33
 	{ .n_name = "_tcbinfo" },
-#define	N_UDBINFO	45
+#define	N_UDBINFO	34
 	{ .n_name = "_udbinfo" },
-#define	N_DIVCBINFO	46
+#define	N_DIVCBINFO	35
 	{ .n_name = "_divcbinfo" },
-#define	N_RIPCBINFO	47
+#define	N_RIPCBINFO	36
 	{ .n_name = "_ripcbinfo" },
-#define	N_UNP_COUNT	48
+#define	N_UNP_COUNT	37
 	{ .n_name = "_unp_count" },
-#define	N_UNP_GENCNT	49
+#define	N_UNP_GENCNT	38
 	{ .n_name = "_unp_gencnt" },
-#define	N_UNP_DHEAD	50
+#define	N_UNP_DHEAD	39
 	{ .n_name = "_unp_dhead" },
-#define	N_UNP_SHEAD	51
+#define	N_UNP_SHEAD	40
 	{ .n_name = "_unp_shead" },
-#define	N_RIP6STAT	52
+#define	N_RIP6STAT	41
 	{ .n_name = "_rip6stat" },
-#define	N_SCTPSTAT	53
+#define	N_SCTPSTAT	42
 	{ .n_name = "_sctpstat" },
-#define	N_MFCTABLESIZE	54
+#define	N_MFCTABLESIZE	43
 	{ .n_name = "_mfctablesize" },
-#define N_ARPSTAT       55
+#define	N_ARPSTAT       44
 	{ .n_name = "_arpstat" },
-#define	N_UNP_SPHEAD	56
+#define	N_UNP_SPHEAD	45
 	{ .n_name = "unp_sphead" },
+#define	N_SFSTAT	46
+	{ .n_name = "_sfstat"},
 	{ .n_name = NULL },
 };
 
@@ -363,10 +343,12 @@ main(int argc, char *argv[])
 {
 	struct protox *tp = NULL;  /* for printing cblocks & stats */
 	int ch;
+	int fib = -1;
+	char *endptr;
 
 	af = AF_UNSPEC;
 
-	while ((ch = getopt(argc, argv, "AaBbdf:ghI:iLlM:mN:np:Qq:rSTsuWw:xz"))
+	while ((ch = getopt(argc, argv, "AaBbdF:f:ghI:iLlM:mN:np:Qq:rSTsuWw:xz"))
 	    != -1)
 		switch(ch) {
 		case 'A':
@@ -384,6 +366,12 @@ main(int argc, char *argv[])
 		case 'd':
 			dflag = 1;
 			break;
+		case 'F':
+			fib = strtol(optarg, &endptr, 0);
+			if (*endptr != '\0' ||
+			    (fib == 0 && (errno == EINVAL || errno == ERANGE)))
+				errx(1, "%s: invalid fib", optarg);
+			break;
 		case 'f':
 			if (strcmp(optarg, "ipx") == 0)
 				af = AF_IPX;
@@ -535,7 +523,7 @@ main(int argc, char *argv[])
 	if (mflag) {
 		if (!live) {
 			if (kread(0, NULL, 0) == 0)
-				mbpr(kvmd, nl[N_MBSTAT].n_value);
+				mbpr(kvmd, nl[N_SFSTAT].n_value);
 		} else
 			mbpr(NULL, 0);
 		exit(0);
@@ -571,7 +559,7 @@ main(int argc, char *argv[])
 		if (sflag)
 			rt_stats(nl[N_RTSTAT].n_value, nl[N_RTTRASH].n_value);
 		else
-			routepr(nl[N_RTREE].n_value);
+			routepr(nl[N_RTREE].n_value, fib);
 		exit(0);
 	}
 	if (gflag) {
@@ -753,15 +741,21 @@ kread(u_long addr, void *buf, size_t size)
  * Read an array of N counters in kernel memory into array of N uint64_t's.
  */
 int
-kread_counters(u_long *addr, uint64_t *rval, size_t count)
+kread_counters(u_long addr, void *buf, size_t size)
 {
+	uint64_t *c = buf;
 
 	if (kvmd_init() < 0)
 		return (-1);
 
-	for (u_int i = 0; i < count; i++, addr++, rval++)
-		*rval = kvm_counter_u64_fetch(kvmd, *addr);
+	if (kread(addr, buf, size) < 0)
+		return (-1);
 
+	while (size != 0) {
+		*c = kvm_counter_u64_fetch(kvmd, *c);
+		size -= sizeof(*c);
+		c++;
+	}
 	return (0);
 }
 
diff --git a/usr.bin/netstat/mbuf.c b/usr.bin/netstat/mbuf.c
index 401a03c..d32304d 100644
--- a/usr.bin/netstat/mbuf.c
+++ b/usr.bin/netstat/mbuf.c
@@ -45,6 +45,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/mbuf.h>
 #include <sys/protosw.h>
+#include <sys/sf_buf.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sysctl.h>
@@ -81,7 +82,7 @@ mbpr(void *kvmd, u_long mbaddr)
 	uintmax_t jumbo16_failures, jumbo16_sleeps, jumbo16_size;
 	uintmax_t bytes_inuse, bytes_incache, bytes_total;
 	int nsfbufs, nsfbufspeak, nsfbufsused;
-	struct mbstat mbstat;
+	struct sfstat sfstat;
 	size_t mlen;
 	int error;
 
@@ -308,20 +309,21 @@ mbpr(void *kvmd, u_long mbaddr)
 		    &mlen, NULL, 0))
 			printf("%d/%d/%d sfbufs in use (current/peak/max)\n",
 			    nsfbufsused, nsfbufspeak, nsfbufs);
-		mlen = sizeof(mbstat);
-		if (sysctlbyname("kern.ipc.mbstat", &mbstat, &mlen, NULL, 0)) {
-			warn("kern.ipc.mbstat");
+		mlen = sizeof(sfstat);
+		if (sysctlbyname("kern.ipc.sfstat", &sfstat, &mlen, NULL, 0)) {
+			warn("kern.ipc.sfstat");
 			goto out;
 		}
 	} else {
-		if (kread(mbaddr, (char *)&mbstat, sizeof mbstat) != 0)
+		if (kread_counters(mbaddr, (char *)&sfstat, sizeof sfstat) != 0)
 			goto out;
 	}
-	printf("%lu requests for sfbufs denied\n", mbstat.sf_allocfail);
-	printf("%lu requests for sfbufs delayed\n", mbstat.sf_allocwait);
-	printf("%lu requests for I/O initiated by sendfile\n",
-	    mbstat.sf_iocnt);
-	printf("%lu calls to protocol drain routines\n", mbstat.m_drain);
+	printf("%ju requests for sfbufs denied\n",
+	    (uintmax_t)sfstat.sf_allocfail);
+	printf("%ju requests for sfbufs delayed\n",
+	    (uintmax_t)sfstat.sf_allocwait);
+	printf("%ju requests for I/O initiated by sendfile\n",
+	    (uintmax_t)sfstat.sf_iocnt);
 out:
 	memstat_mtl_free(mtlp);
 }
diff --git a/usr.bin/netstat/mroute.c b/usr.bin/netstat/mroute.c
index 4d55cb6..7cade4e 100644
--- a/usr.bin/netstat/mroute.c
+++ b/usr.bin/netstat/mroute.c
@@ -350,29 +350,29 @@ mrt_stats(u_long mstaddr)
 			return;
 		}
 	} else
-		kread(mstaddr, (char *)&mrtstat, sizeof(mrtstat));
+		kread_counters(mstaddr, &mrtstat, len);
 
 	printf("IPv4 multicast forwarding:\n");
 
 #define	p(f, m) if (mrtstat.f || sflag <= 1) \
-	printf(m, mrtstat.f, plural(mrtstat.f))
+	printf(m, (uintmax_t)mrtstat.f, plural(mrtstat.f))
 #define	p2(f, m) if (mrtstat.f || sflag <= 1) \
-	printf(m, mrtstat.f, plurales(mrtstat.f))
+	printf(m, (uintmax_t)mrtstat.f, plurales(mrtstat.f))
 
-	p(mrts_mfc_lookups, "\t%lu multicast forwarding cache lookup%s\n");
-	p2(mrts_mfc_misses, "\t%lu multicast forwarding cache miss%s\n");
-	p(mrts_upcalls, "\t%lu upcall%s to multicast routing daemon\n");
-	p(mrts_upq_ovflw, "\t%lu upcall queue overflow%s\n");
+	p(mrts_mfc_lookups, "\t%ju multicast forwarding cache lookup%s\n");
+	p2(mrts_mfc_misses, "\t%ju multicast forwarding cache miss%s\n");
+	p(mrts_upcalls, "\t%ju upcall%s to multicast routing daemon\n");
+	p(mrts_upq_ovflw, "\t%ju upcall queue overflow%s\n");
 	p(mrts_upq_sockfull,
-	    "\t%lu upcall%s dropped due to full socket buffer\n");
-	p(mrts_cache_cleanups, "\t%lu cache cleanup%s\n");
-	p(mrts_no_route, "\t%lu datagram%s with no route for origin\n");
-	p(mrts_bad_tunnel, "\t%lu datagram%s arrived with bad tunneling\n");
-	p(mrts_cant_tunnel, "\t%lu datagram%s could not be tunneled\n");
-	p(mrts_wrong_if, "\t%lu datagram%s arrived on wrong interface\n");
-	p(mrts_drop_sel, "\t%lu datagram%s selectively dropped\n");
-	p(mrts_q_overflow, "\t%lu datagram%s dropped due to queue overflow\n");
-	p(mrts_pkt2large, "\t%lu datagram%s dropped for being too large\n");
+	    "\t%ju upcall%s dropped due to full socket buffer\n");
+	p(mrts_cache_cleanups, "\t%ju cache cleanup%s\n");
+	p(mrts_no_route, "\t%ju datagram%s with no route for origin\n");
+	p(mrts_bad_tunnel, "\t%ju datagram%s arrived with bad tunneling\n");
+	p(mrts_cant_tunnel, "\t%ju datagram%s could not be tunneled\n");
+	p(mrts_wrong_if, "\t%ju datagram%s arrived on wrong interface\n");
+	p(mrts_drop_sel, "\t%ju datagram%s selectively dropped\n");
+	p(mrts_q_overflow, "\t%ju datagram%s dropped due to queue overflow\n");
+	p(mrts_pkt2large, "\t%ju datagram%s dropped for being too large\n");
 
 #undef	p2
 #undef	p
diff --git a/usr.bin/netstat/netstat.1 b/usr.bin/netstat/netstat.1
index c52340a..0a37994 100644
--- a/usr.bin/netstat/netstat.1
+++ b/usr.bin/netstat/netstat.1
@@ -28,7 +28,7 @@
 .\"	@(#)netstat.1	8.8 (Berkeley) 4/18/94
 .\" $FreeBSD$
 .\"
-.Dd March 10, 2013
+.Dd May 17, 2013
 .Dt NETSTAT 1
 .Os
 .Sh NAME
@@ -217,14 +217,29 @@ states.
 .Nm
 .Fl r
 .Op Fl AanW
+.Op Fl F Ar fibnum
 .Op Fl f Ar address_family
 .Op Fl M Ar core
 .Op Fl N Ar system
 .Ek
 .Xc
-Display the contents of all routing tables,
-or a routing table for a particular
-.Ar address_family .
+Display the contents of routing tables.
+When
+.Fl f
+is specified, a routing table for a particular
+.Ar address_family
+is displayed.
+When
+.Fl F
+is specified, a routing table with the number
+.Ar fibnum
+is displayed.
+If the specified
+.Ar fibnum
+is -1 or
+.Fl F
+is not specified,
+the default routing table is displayed.
 If
 .Fl A
 is also present,
diff --git a/usr.bin/netstat/netstat.h b/usr.bin/netstat/netstat.h
index 32bea79..02b8a17 100644
--- a/usr.bin/netstat/netstat.h
+++ b/usr.bin/netstat/netstat.h
@@ -60,7 +60,7 @@ extern int	af;	/* address family */
 extern int	live;	/* true if we are examining a live system */
 
 int	kread(u_long addr, void *buf, size_t size);
-int	kread_counters(u_long *addr, uint64_t *rval, size_t count);
+int	kread_counters(u_long addr, void *buf, size_t size);
 const char *plural(uintmax_t);
 const char *plurales(uintmax_t);
 const char *pluralies(uintmax_t);
@@ -135,7 +135,7 @@ char	*atalk_print(struct sockaddr *, int);
 char	*atalk_print2(struct sockaddr *, struct sockaddr *, int);
 char	*ipx_print(struct sockaddr *);
 char	*ns_print(struct sockaddr *);
-void	routepr(u_long);
+void	routepr(u_long, int);
 
 void	ipxprotopr(u_long, const char *, int, int);
 void	spx_stats(u_long, const char *, int, int);
diff --git a/usr.bin/netstat/pfkey.c b/usr.bin/netstat/pfkey.c
index 0d48e5d..da81485 100644
--- a/usr.bin/netstat/pfkey.c
+++ b/usr.bin/netstat/pfkey.c
@@ -119,7 +119,7 @@ pfkey_stats(u_long off, const char *name, int family __unused,
 	if (off == 0)
 		return;
 	printf ("%s:\n", name);
-	kread(off, (char *)&pfkeystat, sizeof(pfkeystat));
+	kread_counters(off, (char *)&pfkeystat, sizeof(pfkeystat));
 
 #define	p(f, m) if (pfkeystat.f || sflag <= 1) \
     printf(m, (uintmax_t)pfkeystat.f, plural(pfkeystat.f))
diff --git a/usr.bin/netstat/route.c b/usr.bin/netstat/route.c
index dd91330..1de12cc 100644
--- a/usr.bin/netstat/route.c
+++ b/usr.bin/netstat/route.c
@@ -143,17 +143,20 @@ static void domask(char *, in_addr_t, u_long);
  * Print routing tables.
  */
 void
-routepr(u_long rtree)
+routepr(u_long rtree, int fibnum)
 {
 	struct radix_node_head **rnhp, *rnh, head;
 	size_t intsize;
-	int fam, fibnum, numfibs;
+	int fam, numfibs;
 
 	intsize = sizeof(int);
-	if (sysctlbyname("net.my_fibnum", &fibnum, &intsize, NULL, 0) == -1)
+	if (fibnum == -1 &&
+	    sysctlbyname("net.my_fibnum", &fibnum, &intsize, NULL, 0) == -1)
 		fibnum = 0;
 	if (sysctlbyname("net.fibs", &numfibs, &intsize, NULL, 0) == -1)
 		numfibs = 1;
+	if (fibnum < 0 || fibnum > numfibs - 1)
+		errx(EX_USAGE, "%d: invalid fib", fibnum);
 	rt_tables = calloc(numfibs * (AF_MAX+1),
 	    sizeof(struct radix_node_head *));
 	if (rt_tables == NULL)
@@ -166,7 +169,10 @@ routepr(u_long rtree)
 	if (clock_gettime(CLOCK_UPTIME, &uptime) < 0)
 		err(EX_OSERR, "clock_gettime() failed");
 
-	printf("Routing tables\n");
+	printf("Routing tables");
+	if (fibnum)
+		printf(" (fib: %d)", fibnum);
+	printf("\n");
 
 	if (Aflag == 0 && NewTree)
 		ntreestuff();
diff --git a/usr.bin/systat/Makefile b/usr.bin/systat/Makefile
index 6a7e53d..40d55cc 100644
--- a/usr.bin/systat/Makefile
+++ b/usr.bin/systat/Makefile
@@ -5,7 +5,7 @@
 
 PROG=	systat
 SRCS=	cmds.c cmdtab.c devs.c fetch.c iostat.c keyboard.c main.c \
-	mbufs.c netcmds.c netstat.c pigs.c swap.c icmp.c \
+	netcmds.c netstat.c pigs.c swap.c icmp.c \
 	mode.c ip.c tcp.c \
 	vmstat.c convtbl.c ifcmds.c ifstat.c
 
diff --git a/usr.bin/systat/cmdtab.c b/usr.bin/systat/cmdtab.c
index 9b648ff..c9c9e7d 100644
--- a/usr.bin/systat/cmdtab.c
+++ b/usr.bin/systat/cmdtab.c
@@ -46,9 +46,6 @@ struct	cmdtab cmdtab[] = {
 	{ "swap",	showswap,	fetchswap,	labelswap,
 	  initswap,	openswap,	closeswap,	0,
 	  0,		CF_LOADAV },
-	{ "mbufs",	showmbufs,	fetchmbufs,	labelmbufs,
-	  initmbufs,	openmbufs,	closembufs,	0,
-	  0,		CF_LOADAV },
 	{ "iostat",	showiostat,	fetchiostat,	labeliostat,
 	  initiostat,	openiostat,	closeiostat,	cmdiostat,
 	  0,		CF_LOADAV },
diff --git a/usr.bin/systat/extern.h b/usr.bin/systat/extern.h
index 393fa1c..17fffc1 100644
--- a/usr.bin/systat/extern.h
+++ b/usr.bin/systat/extern.h
@@ -76,7 +76,6 @@ void	 closeiostat(WINDOW *);
 void	 closeip(WINDOW *);
 void	 closeip6(WINDOW *);
 void	 closekre(WINDOW *);
-void	 closembufs(WINDOW *);
 void	 closenetstat(WINDOW *);
 void	 closepigs(WINDOW *);
 void	 closeswap(WINDOW *);
@@ -99,7 +98,6 @@ void	 fetchip(void);
 void	 fetchip6(void);
 void	 fetchiostat(void);
 void	 fetchkre(void);
-void	 fetchmbufs(void);
 void	 fetchnetstat(void);
 void	 fetchpigs(void);
 void	 fetchswap(void);
@@ -113,7 +111,6 @@ int	 initip(void);
 int	 initip6(void);
 int	 initiostat(void);
 int	 initkre(void);
-int	 initmbufs(void);
 int	 initnetstat(void);
 int	 initpigs(void);
 int	 initswap(void);
@@ -127,7 +124,6 @@ void	 labelip(void);
 void	 labelip6(void);
 void	 labeliostat(void);
 void	 labelkre(void);
-void	 labelmbufs(void);
 void	 labelnetstat(void);
 void	 labelpigs(void);
 void	 labels(void);
@@ -143,7 +139,6 @@ WINDOW	*openip(void);
 WINDOW	*openip6(void);
 WINDOW	*openiostat(void);
 WINDOW	*openkre(void);
-WINDOW	*openmbufs(void);
 WINDOW	*opennetstat(void);
 WINDOW	*openpigs(void);
 WINDOW	*openswap(void);
@@ -161,7 +156,6 @@ void	 showip(void);
 void	 showip6(void);
 void	 showiostat(void);
 void	 showkre(void);
-void	 showmbufs(void);
 void	 shownetstat(void);
 void	 showpigs(void);
 void	 showswap(void);
diff --git a/usr.bin/systat/mbufs.c b/usr.bin/systat/mbufs.c
deleted file mode 100644
index 3fdbcac..0000000
--- a/usr.bin/systat/mbufs.c
+++ /dev/null
@@ -1,193 +0,0 @@
-/*-
- * Copyright (c) 1980, 1992, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-
-__FBSDID("$FreeBSD$");
-
-#ifdef lint
-static const char sccsid[] = "@(#)mbufs.c	8.1 (Berkeley) 6/6/93";
-#endif
-
-#include <sys/param.h>
-#include <sys/types.h>
-#include <sys/mbuf.h>
-#include <sys/sysctl.h>
-
-#include <errno.h>
-#include <stdlib.h>
-#include <string.h>
-#include <paths.h>
-
-#include "systat.h"
-#include "extern.h"
-
-static struct mbstat *mbstat;
-static long *m_mbtypes;
-static short nmbtypes;
-
-static struct mtnames {
-	short mt_type;
-	const char *mt_name;
-} mtnames[] = {
-	{ MT_DATA, 	"data"},
-	{ MT_HEADER,	"headers"},
-	{ MT_SONAME,	"socknames"},
-	{ MT_CONTROL,	"control"},
-	{ MT_OOBDATA,	"oobdata"}
-};
-#define	NNAMES	(sizeof (mtnames) / sizeof (mtnames[0]))
-
-WINDOW *
-openmbufs(void)
-{
-	return (subwin(stdscr, LINES-3-1, 0, MAINWIN_ROW, 0));
-}
-
-void
-closembufs(WINDOW *w)
-{
-	if (w == NULL)
-		return;
-	wclear(w);
-	wrefresh(w);
-	delwin(w);
-}
-
-void
-labelmbufs(void)
-{
-	wmove(wnd, 0, 0); wclrtoeol(wnd);
-	mvwaddstr(wnd, 0, 10,
-	    "/0   /5   /10  /15  /20  /25  /30  /35  /40  /45  /50  /55  /60");
-}
-
-void
-showmbufs(void)
-{
-	int i, j, max, idx;
-	u_long totmbufs;
-	char buf[10];
-	const char *mtname;
-
-	totmbufs = mbstat->m_mbufs;
-
-	/*
-	 * Print totals for different mbuf types.
-	 */
-	for (j = 0; j < wnd->_maxy; j++) {
-		max = 0, idx = -1;
-		for (i = 0; i < wnd->_maxy; i++) {
-			if (i == MT_NOTMBUF)
-				continue;
-			if (i >= nmbtypes)
-				break;
-			if (m_mbtypes[i] > max) {
-				max = m_mbtypes[i];
-				idx = i;
-			}
-		}
-		if (max == 0)
-			break;
-
-		mtname = NULL;
-		for (i = 0; i < (int)NNAMES; i++)
-			if (mtnames[i].mt_type == idx)
-				mtname = mtnames[i].mt_name;
-		if (mtname == NULL)
-			mvwprintw(wnd, 1+j, 0, "%10d", idx);
-		else
-			mvwprintw(wnd, 1+j, 0, "%-10.10s", mtname);
-		wmove(wnd, 1 + j, 10);
-		if (max > 60) {
-			snprintf(buf, sizeof(buf), " %d", max);
-			max = 60;
-			while (max--)
-				waddch(wnd, 'X');
-			waddstr(wnd, buf);
-		} else
-			while (max--)
-				waddch(wnd, 'X');
-		wclrtoeol(wnd);
-		m_mbtypes[idx] = 0;
-	}
-
-	/*
-	 * Print total number of free mbufs.
-	 */
-	if (totmbufs > 0) {
-		mvwprintw(wnd, 1+j, 0, "%-10.10s", "Mbufs");
-		if (totmbufs > 60) {
-			snprintf(buf, sizeof(buf), " %lu", totmbufs);
-			totmbufs = 60;
-			while(totmbufs--)
-				waddch(wnd, 'X');
-			waddstr(wnd, buf);
-		} else {
-			while(totmbufs--)
-				waddch(wnd, 'X');
-		}
-		wclrtoeol(wnd);
-		j++;
-	}
-	wmove(wnd, 1+j, 0); wclrtobot(wnd);
-}
-
-int
-initmbufs(void)
-{
-	size_t len;
-
-	len = sizeof *mbstat;
-	if ((mbstat = malloc(len)) == NULL) {
-		error("malloc mbstat failed");
-		return 0;
-	}
-	if (sysctlbyname("kern.ipc.mbstat", mbstat, &len, NULL, 0) < 0) {
-		error("sysctl retrieving mbstat");
-		return 0;
-	}
-	nmbtypes = mbstat->m_numtypes;
-	if ((m_mbtypes = calloc(nmbtypes, sizeof(long *))) == NULL) {
-		error("calloc m_mbtypes failed");
-		return 0;
-	}
-
-	return 1;
-}
-
-void
-fetchmbufs(void)
-{
-	size_t len;
-
-	len = sizeof *mbstat;
-	if (sysctlbyname("kern.ipc.mbstat", mbstat, &len, NULL, 0) < 0)
-		printw("sysctl: mbstat: %s", strerror(errno));
-}
diff --git a/usr.bin/systat/systat.1 b/usr.bin/systat/systat.1
index 4916b9c..9c144e7 100644
--- a/usr.bin/systat/systat.1
+++ b/usr.bin/systat/systat.1
@@ -28,7 +28,7 @@
 .\"	@(#)systat.1	8.2 (Berkeley) 12/30/93
 .\" $FreeBSD$
 .\"
-.Dd February 20, 2013
+.Dd July 15, 2013
 .Dt SYSTAT 1
 .Os
 .Sh NAME
@@ -67,7 +67,6 @@ statistics (a la
 .Xr iostat 8 ) ,
 virtual memory statistics (a la
 .Xr vmstat 8 ) ,
-network ``mbuf'' utilization,
 .Tn TCP/IP
 statistics,
 and network connections (a la
@@ -94,7 +93,6 @@ to be one of:
 .Ic iostat ,
 .Ic ip ,
 .Ic ip6 ,
-.Ic mbufs ,
 .Ic netstat ,
 .Ic pigs ,
 .Ic swap ,
@@ -280,9 +278,6 @@ the graph shows the percentage of space in use on each partition.
 If there are more than one swap partition in use,
 a total line is also shown.
 Areas known to the kernel, but not in use are shown as not available.
-.It Ic mbufs
-Display, in the lower window, the number of mbufs allocated
-for particular uses, i.e., data, socket structures, etc.
 .It Ic vmstat
 Take over the entire display and show a (rather crowded) compendium
 of statistics related to virtual memory usage, process scheduling,
diff --git a/usr.bin/uniq/uniq.c b/usr.bin/uniq/uniq.c
index 1077307..d34b0c0 100644
--- a/usr.bin/uniq/uniq.c
+++ b/usr.bin/uniq/uniq.c
@@ -44,15 +44,20 @@ static const char rcsid[] =
   "$FreeBSD$";
 #endif /* not lint */
 
+#include <sys/capability.h>
+
 #include <ctype.h>
 #include <err.h>
+#include <errno.h>
 #include <limits.h>
 #include <locale.h>
+#include <nl_types.h>
 #include <stdint.h>
 #define _WITH_GETLINE
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <termios.h>
 #include <unistd.h>
 #include <wchar.h>
 #include <wctype.h>
@@ -68,6 +73,17 @@ static wchar_t	*skip(wchar_t *);
 static void	 obsolete(char *[]);
 static void	 usage(void);
 
+static void
+strerror_init(void)
+{
+
+	/*
+	 * Cache NLS data before entering capability mode.
+	 * XXXPJD: There should be strerror_init() and strsignal_init() in libc.
+	 */
+	(void)catopen("libc", NL_CAT_LOCALE);
+}
+
 int
 main (int argc, char *argv[])
 {
@@ -77,6 +93,7 @@ main (int argc, char *argv[])
 	size_t prevbuflen, thisbuflen, b1;
 	char *prevline, *thisline, *p;
 	const char *ifn;
+	cap_rights_t rights;
 
 	(void) setlocale(LC_ALL, "");
 
@@ -128,8 +145,34 @@ main (int argc, char *argv[])
 	ofp = stdout;
 	if (argc > 0 && strcmp(argv[0], "-") != 0)
 		ifp = file(ifn = argv[0], "r");
+	if (cap_rights_limit(fileno(ifp), CAP_FSTAT | CAP_READ) < 0 &&
+	    errno != ENOSYS) {
+		err(1, "unable to limit rights for %s", ifn);
+	}
+	rights = CAP_FSTAT | CAP_WRITE;
 	if (argc > 1)
 		ofp = file(argv[1], "w");
+	else
+		rights |= CAP_IOCTL;
+	if (cap_rights_limit(fileno(ofp), rights) < 0 && errno != ENOSYS) {
+		err(1, "unable to limit rights for %s",
+		    argc > 1 ? argv[1] : "stdout");
+	}
+	if ((rights & CAP_IOCTL) != 0) {
+		unsigned long cmd;
+
+		cmd = TIOCGETA; /* required by isatty(3) in printf(3) */
+
+		if (cap_ioctls_limit(fileno(ofp), &cmd, 1) < 0 &&
+		    errno != ENOSYS) {
+			err(1, "unable to limit ioctls for %s",
+			    argc > 1 ? argv[1] : "stdout");
+		}
+	}
+
+	strerror_init();
+	if (cap_enter() < 0 && errno != ENOSYS)
+		err(1, "unable to enter capability mode");
 
 	prevbuflen = thisbuflen = 0;
 	prevline = thisline = NULL;