diff --git a/lib/libc/include/generic-netbsd/fcntl.h b/lib/libc/include/generic-netbsd/fcntl.h
index af43c74a3daca814d873e6bda87f497dc6f0de4b..311effadd406e25dae75c281ff217008e87ab001 100644
--- a/lib/libc/include/generic-netbsd/fcntl.h
+++ b/lib/libc/include/generic-netbsd/fcntl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: fcntl.h,v 1.57 2025/07/25 23:24:46 kre Exp $	*/
+/*	$NetBSD: fcntl.h,v 1.57.2.1 2026/06/16 09:06:50 martin Exp $	*/
 
 /*-
  * Copyright (c) 1983, 1990, 1993
@@ -121,6 +121,9 @@
 #if defined(_NETBSD_SOURCE)
 #define	O_NOSIGPIPE	0x01000000	/* don't deliver sigpipe */
 #define	O_REGULAR	0x02000000	/* fail if not a regular file */
+#endif
+#if (_POSIX_C_SOURCE - 0) >= 200809L || (_XOPEN_SOURCE - 0 >= 700) || \
+    defined(_NETBSD_SOURCE)
 #define	O_EXEC		0x04000000	/* open for executing only */
 #endif
 #if (_POSIX_C_SOURCE - 0) >= 202405L || (_XOPEN_SOURCE - 0 >= 800) || \
diff --git a/lib/libc/include/generic-netbsd/i386/mcontext.h b/lib/libc/include/generic-netbsd/i386/mcontext.h
index eca7a40be452d1894f78d3de2424c400ea2dbd6e..bf34279f20a8dfa0fb8aa61839b7de8b2b96f640 100644
--- a/lib/libc/include/generic-netbsd/i386/mcontext.h
+++ b/lib/libc/include/generic-netbsd/i386/mcontext.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: mcontext.h,v 1.19 2024/11/30 01:04:10 christos Exp $	*/
+/*	$NetBSD: mcontext.h,v 1.19.2.1 2026/07/19 15:57:27 martin Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -40,6 +40,7 @@
 #define	_UC_CLRSTACK	_UC_MD_BIT17
 #define	_UC_VM		_UC_MD_BIT18
 #define	_UC_TLSBASE	_UC_MD_BIT19
+#define	_UC_XSAVE	_UC_MD_BIT20
 
 /*
  * Layout of mcontext_t according to the System V Application Binary Interface,
@@ -85,6 +86,27 @@ typedef struct {
 			char	__fp_xmm[512];
 		} __fp_xmm_state;	/* x87 and xmm regs in fxsave format */
 		int	__fp_fpregs[128];
+		struct {
+			/*
+			 * `The XSAVE feature set does not use bytes
+			 *  511:416; bytes 463:416 are reserved.'
+			 *
+			 * We take a part out of this to form a pointer
+			 * to an external XSAVE area.  This way, we can
+			 * replicate the FXSAVE parts for the benefit
+			 * of userland programs that aren't aware of
+			 * the XSAVE pointer, have used the extended
+			 * CPU registers (ymmN/zmmN/&c.), and want to
+			 * examine the x87/SSE register state in a
+			 * signal handler.  The kernel does not use
+			 * this part.
+			 */
+			char		__fxsave[416];
+			char		__rsvd[48];
+			__greg_t	__xsaveptr;
+			__greg_t	__xsavelen;
+			char		__pad[40];
+		} __xsave;
 	} __fp_reg_set;
 	int 	__fp_pad[33];			/* Historic padding */
 } __fpregset_t;
diff --git a/lib/libc/include/generic-netbsd/i386/wchar_limits.h b/lib/libc/include/generic-netbsd/i386/wchar_limits.h
index e3bf3b7090c9ee41148b6edc36944d5dad30fe8e..76ee442d874d23f7e4570df9abf167a81d39b79b 100644
--- a/lib/libc/include/generic-netbsd/i386/wchar_limits.h
+++ b/lib/libc/include/generic-netbsd/i386/wchar_limits.h
@@ -44,4 +44,4 @@
 #define	WINT_MIN	(-0x7fffffff-1)			/* wint_t	  */
 #define	WINT_MAX	0x7fffffff			/* wint_t	  */
 
-#endif /* !_I386_WCHAR_LIMITS_H_ */
+#endif /* !_I386_WCHAR_LIMITS_H_ */
\ No newline at end of file
diff --git a/lib/libc/include/generic-netbsd/machine/pte.h b/lib/libc/include/generic-netbsd/machine/pte.h
index 760dc280552255428ff7144e68346bb813c363cd..f19d4ffe10144f61bc3ef3a8fd35d06a81de4c78 100644
--- a/lib/libc/include/generic-netbsd/machine/pte.h
+++ b/lib/libc/include/generic-netbsd/machine/pte.h
@@ -1,4 +1,4 @@
-/* $NetBSD: pte.h,v 1.14.2.2 2025/10/26 12:28:36 martin Exp $ */
+/* $NetBSD: pte.h,v 1.14.2.3 2026/06/03 18:17:02 martin Exp $ */
 
 /*
  * Copyright (c) 2014, 2019, 2021 The NetBSD Foundation, Inc.
@@ -139,6 +139,12 @@ pte_modified_p(pt_entry_t pte)
 	return (pte & PTE_D) != 0;
 }
 
+static inline bool
+pte_referenced_p(pt_entry_t pte)
+{
+	return (pte & PTE_A) != 0;
+}
+
 static inline bool
 pte_cached_p(pt_entry_t pte)
 {
@@ -177,9 +183,15 @@ pte_nv_entry(bool kernel_p)
 }
 
 static inline pt_entry_t
-pte_prot_nowrite(pt_entry_t pte)
+pte_clear_modify(pt_entry_t pte)
 {
-	return pte & ~PTE_W;
+	return pte & ~PTE_D;
+}
+
+static inline pt_entry_t
+pte_clear_reference(pt_entry_t pte)
+{
+	return pte & ~PTE_A;
 }
 
 static inline pt_entry_t
@@ -237,28 +249,29 @@ pte_make_enter(paddr_t pa, struct vm_page_md *mdpg, vm_prot_t prot,
 	pte |= pte_prot_bits(mdpg, prot, kernel_p);
 	pte |= pte_enter_flags_to_pbmt(flags);
 
+	/*
+	 * pmap_enter should have checked flags and updated
+	 * VM_PAGEMD_{REFERENCED,MODIFIED}_P, so there is no
+	 * need here.
+	 */
+	KASSERT(((flags & VM_PROT_ALL) == 0) || VM_PAGEMD_REFERENCED_P(mdpg));
+	KASSERT(((flags & VM_PROT_WRITE) == 0) || VM_PAGEMD_MODIFIED_P(mdpg));
+
 	if (mdpg != NULL) {
-
-		if ((prot & VM_PROT_WRITE) != 0 &&
-		    ((flags & VM_PROT_WRITE) != 0 || VM_PAGEMD_MODIFIED_P(mdpg))) {
+		if ((prot & VM_PROT_WRITE) != 0 && VM_PAGEMD_MODIFIED_P(mdpg)) {
 			/*
-			* This is a writable mapping, and the page's mod state
-			* indicates it has already been modified.  No need for
-			* modified emulation.
-			*/
+			 * This is a writable mapping, and the page's mod state
+			 * indicates it has already been modified.  No need for
+			 * reference or modified emulation.
+			 */
 			pte |= PTE_A | PTE_D;
-		} else if ((flags & VM_PROT_ALL) || VM_PAGEMD_REFERENCED_P(mdpg)) {
+		} else if (VM_PAGEMD_REFERENCED_P(mdpg)) {
 			/*
-			* - The access type indicates that we don't need to do
-			*   referenced emulation.
-			* OR
-			* - The physical page has already been referenced so no need
-			*   to re-do referenced emulation here.
-			*/
+			 * The physical page has already been referenced so no need
+			 * to re-do referenced emulation here.
+			 */
 			pte |= PTE_A;
 		}
-	} else {
-		pte |= PTE_A | PTE_D;
 	}
 
 	return pte;
diff --git a/lib/libc/include/generic-netbsd/machine/vmparam.h b/lib/libc/include/generic-netbsd/machine/vmparam.h
index b483e18e8574ce42273a16ae6e90df2b10157c6c..ba9c754dce496cd5d52b0bda02691afeba05e979 100644
--- a/lib/libc/include/generic-netbsd/machine/vmparam.h
+++ b/lib/libc/include/generic-netbsd/machine/vmparam.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: vmparam.h,v 1.14 2023/05/07 12:41:48 skrll Exp $	*/
+/*	$NetBSD: vmparam.h,v 1.14.8.2 2026/06/03 18:17:02 martin Exp $	*/
 
 /*-
  * Copyright (c) 2014, 2020 The NetBSD Foundation, Inc.
@@ -50,6 +50,25 @@
 #define	PAGE_SIZE	(1 << PAGE_SHIFT)
 #define	PAGE_MASK	(PAGE_SIZE - 1)
 
+#ifdef _LP64
+/*
+ * Default pager_map of 16MB is awfully small.  There is plenty
+ * of VA so use it.
+ */
+#define	PAGER_MAP_DEFAULT_SIZE (512 * 1024 * 1024)
+
+/*
+ * Defaults for Unified Buffer Cache parameters.
+ */
+
+#ifndef UBC_WINSHIFT
+#define	UBC_WINSHIFT	16	/* 64kB */
+#endif
+#ifndef UBC_NWINS
+#define	UBC_NWINS	4096	/* 256MB */
+#endif
+#endif
+
 /*
  * USRSTACK is the top (end) of the user stack.
  *
@@ -125,12 +144,6 @@
 #define VM_MAX_KERNEL_ADDRESS	((vaddr_t)0xffffffd000000000)
 
 #else		/* Sv32 */
-/*
- * kernel virtual space layout:
- *   0x8000_0000  -   64GiB  KERNEL VM Space (inc. text/data/bss)
- *  (0x4000_0000      +1GiB) KERNEL VM start of KVA
- *  (0x0000_0000      64GiB) reserved
- */
 
 /*
  * kernel virtual space layout without direct map (common case)
@@ -154,13 +167,12 @@
  *
  */
 
-
-
 #define VM_MAXUSER_ADDRESS	((vaddr_t)-0x7fffffff-1)/* 0xffff_ffff_8000_0000 */
 #define VM_MIN_KERNEL_ADDRESS	((vaddr_t)-0x7fffffff-1)/* 0xffff_ffff_8000_0000 */
 #define VM_MAX_KERNEL_ADDRESS	((vaddr_t)-0x10000000)	/* 0xffff_ffff_f000_0000 */
 
 #endif
+
 #define VM_KERNEL_BASE		VM_MIN_KERNEL_ADDRESS
 #define VM_KERNEL_SIZE		0x2000000	/* 32 MiB (8 / 16 megapages) */
 #define VM_KERNEL_DTB_BASE	(VM_KERNEL_BASE + VM_KERNEL_SIZE)
diff --git a/lib/libc/include/generic-netbsd/mips/pte.h b/lib/libc/include/generic-netbsd/mips/pte.h
index 986baa4788a4a805c38fb9abf7a22b1be167ecd5..4b41ce44e84d89be8bbd496407183ae801fdbe8c 100644
--- a/lib/libc/include/generic-netbsd/mips/pte.h
+++ b/lib/libc/include/generic-netbsd/mips/pte.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: pte.h,v 1.27 2020/08/22 15:34:51 skrll Exp $	*/
+/*	$NetBSD: pte.h,v 1.27.28.1 2026/06/03 18:17:03 martin Exp $	*/
 
 /*-
  * Copyright (c) 1997 The NetBSD Foundation, Inc.
@@ -269,6 +269,12 @@ pte_modified_p(pt_entry_t pte)
 	return (pte & MIPS_MMU(PG_D)) != 0;
 }
 
+static inline bool
+pte_referenced_p(pt_entry_t pte)
+{
+	return false;
+}
+
 static inline bool
 pte_global_p(pt_entry_t pte)
 {
@@ -340,11 +346,17 @@ pte_prot_downgrade(pt_entry_t pte, vm_prot_t prot)
 }
 
 static inline pt_entry_t
-pte_prot_nowrite(pt_entry_t pte)
+pte_clear_modify(pt_entry_t pte)
 {
 	return pte & ~MIPS_MMU(PG_D);
 }
 
+static inline pt_entry_t
+pte_clear_reference(pt_entry_t pte)
+{
+	return pte;
+}
+
 static inline pt_entry_t
 pte_cached_change(pt_entry_t pte, bool cached)
 {
diff --git a/lib/libc/include/generic-netbsd/netinet/tcp_timer.h b/lib/libc/include/generic-netbsd/netinet/tcp_timer.h
index 0cef4010264fec7628c35943f450a5671cc554d3..b27152185d19fbc7ff1a3bcf9e299827b9e00871 100644
--- a/lib/libc/include/generic-netbsd/netinet/tcp_timer.h
+++ b/lib/libc/include/generic-netbsd/netinet/tcp_timer.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: tcp_timer.h,v 1.30 2019/08/06 15:48:18 riastradh Exp $	*/
+/*	$NetBSD: tcp_timer.h,v 1.30.34.1 2026/07/19 15:51:03 martin Exp $	*/
 
 /*-
  * Copyright (c) 2001, 2005 The NetBSD Foundation, Inc.
@@ -119,7 +119,7 @@
 #define	TCPTV_MSL	( 30*PR_SLOWHZ)		/* max seg lifetime (hah!) */
 #define	TCPTV_SRTTBASE	0			/* base roundtrip time;
 						   if 0, no idea yet */
-#define	TCPTV_SRTTDFLT	(  3*PR_SLOWHZ)		/* assumed RTT if no info */
+#define	TCPTV_SRTTDFLT	(  1*PR_SLOWHZ)		/* initial RTO; RFC 6298 (2.1) */
 
 #define	TCPTV_PERSMIN	(  5*PR_SLOWHZ)		/* retransmit persistance */
 #define	TCPTV_PERSMAX	( 60*PR_SLOWHZ)		/* maximum persist interval */
diff --git a/lib/libc/include/generic-netbsd/nfs/nfs.h b/lib/libc/include/generic-netbsd/nfs/nfs.h
index 8759c291d4faa0fd0e63eb9967fc8c2429ece6a9..cb66894f3100cb4d2f5c27e5182ffce64249e2fa 100644
--- a/lib/libc/include/generic-netbsd/nfs/nfs.h
+++ b/lib/libc/include/generic-netbsd/nfs/nfs.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: nfs.h,v 1.81 2024/12/07 02:05:55 riastradh Exp $	*/
+/*	$NetBSD: nfs.h,v 1.81.2.1 2026/06/27 09:46:05 martin Exp $	*/
 /*
  * Copyright (c) 1989, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
@@ -451,6 +451,8 @@ struct nfssvc_sock {
 	int		ns_sflags;		/* b: */
 	int		ns_cc;			/* b: */
 	int		ns_reclen;		/* b: */
+	int		ns_frag_count;		/* b: */
+	int		ns_streamlen;		/* b: */
 	int		ns_numuids;
 	u_int32_t	ns_sref;		/* g: */
 	SIMPLEQ_HEAD(, nfsrv_descript) ns_sendq; /* s: send reply list */
diff --git a/lib/libc/include/generic-netbsd/nfs/nfsmount.h b/lib/libc/include/generic-netbsd/nfs/nfsmount.h
index 2a38bbd2cc5d098a77903043f413a503c9201453..8c418f4509b62647c63be23a70ec5e7272aeb684 100644
--- a/lib/libc/include/generic-netbsd/nfs/nfsmount.h
+++ b/lib/libc/include/generic-netbsd/nfs/nfsmount.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: nfsmount.h,v 1.54 2024/12/07 02:05:55 riastradh Exp $	*/
+/*	$NetBSD: nfsmount.h,v 1.54.2.1 2026/06/03 18:46:36 martin Exp $	*/
 
 /*
  * Copyright (c) 1989, 1993
@@ -92,13 +92,15 @@ struct nfs_args {
 #define	NFSMNT_READDIRSIZE	0x00020000  /* Set readdir size */
 #define NFSMNT_XLATECOOKIE	0x00040000  /* 32<->64 dir cookie xlation */
 #define	NFSMNT_NOAC		0x00080000  /* Turn off attribute cache */
+#define	NFSMNT_NOWCCMSG		0x00100000  /* Turn off attribute wcc messages */
 
 #define NFSMNT_BITS	"\177\20" \
     "b\00soft\0b\01wsize\0b\02rsize\0b\03timeo\0" \
     "b\04retrans\0b\05maxgrps\0b\06intr\0b\07noconn\0" \
     "b\10nqnfs\0b\11nfsv3\0b\12kerb\0b\13dumbtimr\0" \
     "b\14leaseterm\0b\15readahead\0b\16deadthresh\0b\17resvport\0" \
-    "b\20rdirplus\0b\21readdirsize\0b\22xlatecookie\0b\23noac\0"
+    "b\20rdirplus\0b\21readdirsize\0b\22xlatecookie\0b\23noac\0" \
+    "b\24nowccmsg\0"
 
 /*
  * NFS internal flags (nm_iflag) */
diff --git a/lib/libc/include/generic-netbsd/pthread.h b/lib/libc/include/generic-netbsd/pthread.h
index b530af73b802a2ce1cab22be7c9e422d90d08a0d..0d201332f4cb7fb92b1d13f4af7ccb37728ae4ca 100644
--- a/lib/libc/include/generic-netbsd/pthread.h
+++ b/lib/libc/include/generic-netbsd/pthread.h
@@ -461,4 +461,4 @@ __END_DECLS
 
 #endif /* __LIBPTHREAD_SOURCE__ */
 
-#endif /* _LIB_PTHREAD_H */
+#endif /* _LIB_PTHREAD_H */
\ No newline at end of file
diff --git a/lib/libc/include/generic-netbsd/riscv/pte.h b/lib/libc/include/generic-netbsd/riscv/pte.h
index 760dc280552255428ff7144e68346bb813c363cd..f19d4ffe10144f61bc3ef3a8fd35d06a81de4c78 100644
--- a/lib/libc/include/generic-netbsd/riscv/pte.h
+++ b/lib/libc/include/generic-netbsd/riscv/pte.h
@@ -1,4 +1,4 @@
-/* $NetBSD: pte.h,v 1.14.2.2 2025/10/26 12:28:36 martin Exp $ */
+/* $NetBSD: pte.h,v 1.14.2.3 2026/06/03 18:17:02 martin Exp $ */
 
 /*
  * Copyright (c) 2014, 2019, 2021 The NetBSD Foundation, Inc.
@@ -139,6 +139,12 @@ pte_modified_p(pt_entry_t pte)
 	return (pte & PTE_D) != 0;
 }
 
+static inline bool
+pte_referenced_p(pt_entry_t pte)
+{
+	return (pte & PTE_A) != 0;
+}
+
 static inline bool
 pte_cached_p(pt_entry_t pte)
 {
@@ -177,9 +183,15 @@ pte_nv_entry(bool kernel_p)
 }
 
 static inline pt_entry_t
-pte_prot_nowrite(pt_entry_t pte)
+pte_clear_modify(pt_entry_t pte)
 {
-	return pte & ~PTE_W;
+	return pte & ~PTE_D;
+}
+
+static inline pt_entry_t
+pte_clear_reference(pt_entry_t pte)
+{
+	return pte & ~PTE_A;
 }
 
 static inline pt_entry_t
@@ -237,28 +249,29 @@ pte_make_enter(paddr_t pa, struct vm_page_md *mdpg, vm_prot_t prot,
 	pte |= pte_prot_bits(mdpg, prot, kernel_p);
 	pte |= pte_enter_flags_to_pbmt(flags);
 
+	/*
+	 * pmap_enter should have checked flags and updated
+	 * VM_PAGEMD_{REFERENCED,MODIFIED}_P, so there is no
+	 * need here.
+	 */
+	KASSERT(((flags & VM_PROT_ALL) == 0) || VM_PAGEMD_REFERENCED_P(mdpg));
+	KASSERT(((flags & VM_PROT_WRITE) == 0) || VM_PAGEMD_MODIFIED_P(mdpg));
+
 	if (mdpg != NULL) {
-
-		if ((prot & VM_PROT_WRITE) != 0 &&
-		    ((flags & VM_PROT_WRITE) != 0 || VM_PAGEMD_MODIFIED_P(mdpg))) {
+		if ((prot & VM_PROT_WRITE) != 0 && VM_PAGEMD_MODIFIED_P(mdpg)) {
 			/*
-			* This is a writable mapping, and the page's mod state
-			* indicates it has already been modified.  No need for
-			* modified emulation.
-			*/
+			 * This is a writable mapping, and the page's mod state
+			 * indicates it has already been modified.  No need for
+			 * reference or modified emulation.
+			 */
 			pte |= PTE_A | PTE_D;
-		} else if ((flags & VM_PROT_ALL) || VM_PAGEMD_REFERENCED_P(mdpg)) {
+		} else if (VM_PAGEMD_REFERENCED_P(mdpg)) {
 			/*
-			* - The access type indicates that we don't need to do
-			*   referenced emulation.
-			* OR
-			* - The physical page has already been referenced so no need
-			*   to re-do referenced emulation here.
-			*/
+			 * The physical page has already been referenced so no need
+			 * to re-do referenced emulation here.
+			 */
 			pte |= PTE_A;
 		}
-	} else {
-		pte |= PTE_A | PTE_D;
 	}
 
 	return pte;
diff --git a/lib/libc/include/generic-netbsd/riscv/vmparam.h b/lib/libc/include/generic-netbsd/riscv/vmparam.h
index b483e18e8574ce42273a16ae6e90df2b10157c6c..ba9c754dce496cd5d52b0bda02691afeba05e979 100644
--- a/lib/libc/include/generic-netbsd/riscv/vmparam.h
+++ b/lib/libc/include/generic-netbsd/riscv/vmparam.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: vmparam.h,v 1.14 2023/05/07 12:41:48 skrll Exp $	*/
+/*	$NetBSD: vmparam.h,v 1.14.8.2 2026/06/03 18:17:02 martin Exp $	*/
 
 /*-
  * Copyright (c) 2014, 2020 The NetBSD Foundation, Inc.
@@ -50,6 +50,25 @@
 #define	PAGE_SIZE	(1 << PAGE_SHIFT)
 #define	PAGE_MASK	(PAGE_SIZE - 1)
 
+#ifdef _LP64
+/*
+ * Default pager_map of 16MB is awfully small.  There is plenty
+ * of VA so use it.
+ */
+#define	PAGER_MAP_DEFAULT_SIZE (512 * 1024 * 1024)
+
+/*
+ * Defaults for Unified Buffer Cache parameters.
+ */
+
+#ifndef UBC_WINSHIFT
+#define	UBC_WINSHIFT	16	/* 64kB */
+#endif
+#ifndef UBC_NWINS
+#define	UBC_NWINS	4096	/* 256MB */
+#endif
+#endif
+
 /*
  * USRSTACK is the top (end) of the user stack.
  *
@@ -125,12 +144,6 @@
 #define VM_MAX_KERNEL_ADDRESS	((vaddr_t)0xffffffd000000000)
 
 #else		/* Sv32 */
-/*
- * kernel virtual space layout:
- *   0x8000_0000  -   64GiB  KERNEL VM Space (inc. text/data/bss)
- *  (0x4000_0000      +1GiB) KERNEL VM start of KVA
- *  (0x0000_0000      64GiB) reserved
- */
 
 /*
  * kernel virtual space layout without direct map (common case)
@@ -154,13 +167,12 @@
  *
  */
 
-
-
 #define VM_MAXUSER_ADDRESS	((vaddr_t)-0x7fffffff-1)/* 0xffff_ffff_8000_0000 */
 #define VM_MIN_KERNEL_ADDRESS	((vaddr_t)-0x7fffffff-1)/* 0xffff_ffff_8000_0000 */
 #define VM_MAX_KERNEL_ADDRESS	((vaddr_t)-0x10000000)	/* 0xffff_ffff_f000_0000 */
 
 #endif
+
 #define VM_KERNEL_BASE		VM_MIN_KERNEL_ADDRESS
 #define VM_KERNEL_SIZE		0x2000000	/* 32 MiB (8 / 16 megapages) */
 #define VM_KERNEL_DTB_BASE	(VM_KERNEL_BASE + VM_KERNEL_SIZE)
diff --git a/lib/libc/include/generic-netbsd/sys/fcntl.h b/lib/libc/include/generic-netbsd/sys/fcntl.h
index af43c74a3daca814d873e6bda87f497dc6f0de4b..311effadd406e25dae75c281ff217008e87ab001 100644
--- a/lib/libc/include/generic-netbsd/sys/fcntl.h
+++ b/lib/libc/include/generic-netbsd/sys/fcntl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: fcntl.h,v 1.57 2025/07/25 23:24:46 kre Exp $	*/
+/*	$NetBSD: fcntl.h,v 1.57.2.1 2026/06/16 09:06:50 martin Exp $	*/
 
 /*-
  * Copyright (c) 1983, 1990, 1993
@@ -121,6 +121,9 @@
 #if defined(_NETBSD_SOURCE)
 #define	O_NOSIGPIPE	0x01000000	/* don't deliver sigpipe */
 #define	O_REGULAR	0x02000000	/* fail if not a regular file */
+#endif
+#if (_POSIX_C_SOURCE - 0) >= 200809L || (_XOPEN_SOURCE - 0 >= 700) || \
+    defined(_NETBSD_SOURCE)
 #define	O_EXEC		0x04000000	/* open for executing only */
 #endif
 #if (_POSIX_C_SOURCE - 0) >= 202405L || (_XOPEN_SOURCE - 0 >= 800) || \
diff --git a/lib/libc/include/generic-netbsd/sys/lua.h b/lib/libc/include/generic-netbsd/sys/lua.h
index 2657da9e21de60c9a06eb7fcc80afbe6441cc2d2..8c820f69cd81e6074d2b75cf825eb63b1ceca35c 100644
--- a/lib/libc/include/generic-netbsd/sys/lua.h
+++ b/lib/libc/include/generic-netbsd/sys/lua.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: lua.h,v 1.9 2023/07/11 14:57:21 martin Exp $ */
+/*	$NetBSD: lua.h,v 1.9.8.1 2026/06/29 19:52:23 martin Exp $ */
 
 /*
  * Copyright (c) 2014 by Lourival Vieira Neto <lneto@NetBSD.org>.
@@ -33,7 +33,9 @@
 #define _SYS_LUA_H_
 
 #include <sys/param.h>
+
 #include <sys/ioccom.h>
+#include <sys/stdbool.h>
 
 #include <lua.h>		/* for lua_State */
 
diff --git a/lib/libc/include/generic-netbsd/sys/param.h b/lib/libc/include/generic-netbsd/sys/param.h
index 2590fadb10c70c69eb8735d851e4111e9206e7e3..423ccfd7ce7797dfeebb3008147363821784d01b 100644
--- a/lib/libc/include/generic-netbsd/sys/param.h
+++ b/lib/libc/include/generic-netbsd/sys/param.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: param.h,v 1.738.2.5 2026/05/12 04:23:51 martin Exp $	*/
+/*	$NetBSD: param.h,v 1.738.2.9 2026/07/30 15:23:12 martin Exp $	*/
 
 /*-
  * Copyright (c) 1982, 1986, 1989, 1993
@@ -566,4 +566,4 @@ extern size_t coherency_unit;
 #endif
 #endif /* !__ASSEMBLER__ */
 
-#endif /* !_SYS_PARAM_H_ */
+#endif /* !_SYS_PARAM_H_ */
\ No newline at end of file
diff --git a/lib/libc/include/generic-netbsd/x86/cpu_extended_state.h b/lib/libc/include/generic-netbsd/x86/cpu_extended_state.h
index ccad28305b4e3e4f49b5940ee1b98361e10887e8..d45664ead197649dcde26de0dbef00d29ffc8a55 100644
--- a/lib/libc/include/generic-netbsd/x86/cpu_extended_state.h
+++ b/lib/libc/include/generic-netbsd/x86/cpu_extended_state.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: cpu_extended_state.h,v 1.19 2025/04/24 01:50:39 riastradh Exp $	*/
+/*	$NetBSD: cpu_extended_state.h,v 1.19.2.1 2026/07/19 15:57:27 martin Exp $	*/
 
 #ifndef _X86_CPU_EXTENDED_STATE_H_
 #define _X86_CPU_EXTENDED_STATE_H_
@@ -142,6 +142,8 @@ struct xsave_header {
 };
 __CTASSERT(sizeof(struct xsave_header) == 512 + 64);
 
+#define	XSAVE_ALIGN	64
+
 /*
  * The ymm save area actually follows the xsave_header.
  */
diff --git a/lib/libc/include/generic-netbsd/x86/fpu.h b/lib/libc/include/generic-netbsd/x86/fpu.h
index 311cd9655549bab305e2c74063d7649da9649a93..e1280905a59724cfc05cb74005d9f3cb7d6a25d8 100644
--- a/lib/libc/include/generic-netbsd/x86/fpu.h
+++ b/lib/libc/include/generic-netbsd/x86/fpu.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: fpu.h,v 1.23 2020/10/24 07:14:29 mgorny Exp $	*/
+/*	$NetBSD: fpu.h,v 1.23.28.1 2026/07/19 15:57:27 martin Exp $	*/
 
 #ifndef	_X86_FPU_H_
 #define	_X86_FPU_H_
@@ -46,6 +46,12 @@ int process_read_xstate(struct lwp *, struct xstate *);
 int process_verify_xstate(const struct xstate *);
 int process_write_xstate(struct lwp *, const struct xstate *);
 
+bool process_xsave_needed_p(struct lwp *);
+void process_read_xsave(struct lwp *, const struct xsave_header **, size_t *);
+int process_verify_xsavelen(struct lwp *, size_t);
+int process_verify_xsave(struct lwp *, const struct xsave_header *, size_t);
+void process_write_xsave(struct lwp *, const struct xsave_header *, size_t);
+
 #endif
 
 #endif /* _X86_FPU_H_ */
\ No newline at end of file
diff --git a/lib/libc/include/generic-netbsd/x86/specialreg.h b/lib/libc/include/generic-netbsd/x86/specialreg.h
index 5158f8c4fab86eabf620d0c69394165e4d9d1707..36635ca349a1a9d3459471f003074119c1a94c0c 100644
--- a/lib/libc/include/generic-netbsd/x86/specialreg.h
+++ b/lib/libc/include/generic-netbsd/x86/specialreg.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: specialreg.h,v 1.219 2025/04/28 13:01:27 riastradh Exp $	*/
+/*	$NetBSD: specialreg.h,v 1.219.2.1 2026/07/19 15:57:27 martin Exp $	*/
 
 /*
  * Copyright (c) 2014-2020 The NetBSD Foundation, Inc.
@@ -183,16 +183,82 @@
 	"\0"
 
 /*
- * Known FPU bits, only these get enabled. The save area is sized for all the
- * fields below.
+ * XCR0_FPU: Known FPU bits, only these get enabled.  The save area is
+ * sized for all the fields below.
+ *
+ * Any bits added to this will expand the extended CPU state that we
+ * may have to save and restore with XSAVE for userland processes,
+ * either in the kernel when preempting threads, or on the user's stack
+ * when delivering a signal.
+ *
+ * The kernel can dyanmically allocate larger sizes (on amd64, anyway,
+ * though not currently on i386 or Xen PV).  But if the XSAVE area is
+ * expanded so much that it and mcontext_t exceed MINSIGSTKSZ
+ * (currently 8192), a userland ABI change and compatibility layer is
+ * required to accommodate that, because existing programs may use
+ * sigaltstack(2) with stacks sized for the old MINSIGSTKSZ.
+ *
+ * The current stack requirement is 3160 bytes of space plus up to
+ * 63+15+8=86 bytes of padding for alignment (could be reduced by
+ * around 512 bytes by having mcontext_t overlap with the XSAVE area a
+ * little in machdep.c cpu_getmcontext_xsave, but we don't do that
+ * right now):
+ *
+ * - mcontext_t (728 bytes: general registers and 512-byte FXSAVE area)
+ * - XSAVE header (576 bytes: 512 bytes of FXSAVE, 64 bytes of metadata)
+ * - AVX state: ymm0..ymm15 high 128-bit halves (256 bytes)
+ * - AVX-512 state:
+ *   . k0..k7 opmask registers (64 bytes)
+ *   . zmm0..zmm15 high 256-bit halves (512 bytes)
+ *   . zmm16..zmm31 registers (1024 bytes)
+ *
+ * Likely future extensions that would expand the state beyond
+ * MINSIGSTKSZ:
+ *
+ * - AMX (Advanced Matrix Extensions) and ACE (AI Compute Extensions)
+ *   state:
+ *   . [AMX/ACE] TILECFG (64 bytes)
+ *   . [AMX/ACE] TILEDATA (8192 bytes)
+ *   . [ACE] SCALEDATA (128 bytes)
+ *
+ * As a precaution against ABI breakage, x86/identcpu.c will panic at
+ * boot if the XSAVE state size enabled in XCR0 exceeds MINSIGSTKSZ.
+ *
+ * References:
+ *
+ * - Intel 64 and IA-32 Architectures Software Developer's Manual,
+ *   Volume 1: Basic Architecture, Intel, Order Number: 253665-092US,
+ *   June 2026, Sec. 13.1 `XSAVE-Supported Features and State-Component
+ *   Bitmaps', pp. 13-1 -- 13-2.
+ *   https://web.archive.org/web/20260709150417/https://cdrdv2-public.intel.com/922477/253665-092-sdm-vol-1.pdf
+ *
+ * - AI Compute Extensions (ACE) Specification, x86 Ecosystem Advisory
+ *   Group, Version 1.15, 2026-05-15, Sec 15.4.1 `XSAVE State
+ *   Components', p. 86.
+ *   https://web.archive.org/web/20260619062626/https://x86ecosystem.org/wp-content/uploads/2026/06/ACE_v1_Specification_public_1_15.pdf
  */
 #if defined __i386__ || defined XENPV /* XXX XENPV PR kern/59371 */
 #define XCR0_FPU	(XCR0_X87 | XCR0_SSE | XCR0_YMM_Hi128 | \
 			 XCR0_Opmask | XCR0_ZMM_Hi256 | XCR0_Hi16_ZMM)
 #else
 #define XCR0_FPU	(XCR0_X87 | XCR0_SSE | XCR0_YMM_Hi128 | \
-			 XCR0_Opmask | XCR0_ZMM_Hi256 | XCR0_Hi16_ZMM | \
-			 XCR0_TILECFG | XCR0_TILEDATA)
+			 XCR0_Opmask | XCR0_ZMM_Hi256 | XCR0_Hi16_ZMM)
+#endif
+
+/*
+ * Maximum size of XSAVE state that we can handle without ABI changes
+ * to userland.  Must match usage in cpu_getmcontext.  Extra 8 is neeed
+ * on amd64 to have space for return address in 16-byte-aligned stack
+ * frame.
+ */
+#ifdef __x86_64__
+#define	XSAVE_MAX_BYTES							      \
+	(MINSIGSTKSZ - (8 + STACK_ALIGNBYTES +				      \
+	    sizeof(struct sigframe_siginfo) + (XSAVE_ALIGN - 1)))
+#else
+#define	XSAVE_MAX_BYTES							      \
+	(MINSIGSTKSZ - (STACK_ALIGNBYTES +				      \
+	    sizeof(struct sigframe_siginfo) + (XSAVE_ALIGN - 1)))
 #endif
 
 /*
diff --git a/lib/libc/include/powerpc-netbsd-eabi/powerpc/oea/pmap.h b/lib/libc/include/powerpc-netbsd-eabi/powerpc/oea/pmap.h
index 8510dfa5f6337ddab007b85ea157e17a4aa396c6..b0584b636d5db885176da01d834d116b31dc8574 100644
--- a/lib/libc/include/powerpc-netbsd-eabi/powerpc/oea/pmap.h
+++ b/lib/libc/include/powerpc-netbsd-eabi/powerpc/oea/pmap.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: pmap.h,v 1.39 2023/12/15 09:42:33 rin Exp $	*/
+/*	$NetBSD: pmap.h,v 1.39.4.1 2026/07/03 17:51:59 martin Exp $	*/
 
 /*-
  * Copyright (C) 1995, 1996 Wolfgang Solfrank.
@@ -122,11 +122,13 @@ __BEGIN_DECLS
 #include <sys/systm.h>
 
 /*
- * For OEA and OEA64_BRIDGE, we guarantee that pa below USER_ADDR
- * (== 3GB < VM_MIN_KERNEL_ADDRESS) is direct-mapped.
+ * Physical memory below PMAP_DIRECT_MAPPED_LEN is direct-mapped 
+ * (pa == va). Direct region covers the segments below BOTH 
+ * the user copyin window (USER_SR) and the kernel HTAB window
+ * (KERNEL_SR), so it can never overlap.
  */
 #if defined(PPC_OEA) || defined(PPC_OEA64_BRIDGE)
-#define	PMAP_DIRECT_MAPPED_SR	(USER_SR - 1)
+#define	PMAP_DIRECT_MAPPED_SR	(MIN(USER_SR, KERNEL_SR) - 1)
 #define	PMAP_DIRECT_MAPPED_LEN \
     ((vaddr_t)SEGMENT_LENGTH * (PMAP_DIRECT_MAPPED_SR + 1))
 #endif
diff --git a/lib/libc/include/x86-netbsd-none/machine/mcontext.h b/lib/libc/include/x86-netbsd-none/machine/mcontext.h
index eca7a40be452d1894f78d3de2424c400ea2dbd6e..bf34279f20a8dfa0fb8aa61839b7de8b2b96f640 100644
--- a/lib/libc/include/x86-netbsd-none/machine/mcontext.h
+++ b/lib/libc/include/x86-netbsd-none/machine/mcontext.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: mcontext.h,v 1.19 2024/11/30 01:04:10 christos Exp $	*/
+/*	$NetBSD: mcontext.h,v 1.19.2.1 2026/07/19 15:57:27 martin Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -40,6 +40,7 @@
 #define	_UC_CLRSTACK	_UC_MD_BIT17
 #define	_UC_VM		_UC_MD_BIT18
 #define	_UC_TLSBASE	_UC_MD_BIT19
+#define	_UC_XSAVE	_UC_MD_BIT20
 
 /*
  * Layout of mcontext_t according to the System V Application Binary Interface,
@@ -85,6 +86,27 @@ typedef struct {
 			char	__fp_xmm[512];
 		} __fp_xmm_state;	/* x87 and xmm regs in fxsave format */
 		int	__fp_fpregs[128];
+		struct {
+			/*
+			 * `The XSAVE feature set does not use bytes
+			 *  511:416; bytes 463:416 are reserved.'
+			 *
+			 * We take a part out of this to form a pointer
+			 * to an external XSAVE area.  This way, we can
+			 * replicate the FXSAVE parts for the benefit
+			 * of userland programs that aren't aware of
+			 * the XSAVE pointer, have used the extended
+			 * CPU registers (ymmN/zmmN/&c.), and want to
+			 * examine the x87/SSE register state in a
+			 * signal handler.  The kernel does not use
+			 * this part.
+			 */
+			char		__fxsave[416];
+			char		__rsvd[48];
+			__greg_t	__xsaveptr;
+			__greg_t	__xsavelen;
+			char		__pad[40];
+		} __xsave;
 	} __fp_reg_set;
 	int 	__fp_pad[33];			/* Historic padding */
 } __fpregset_t;
diff --git a/lib/libc/include/x86_64-netbsd-none/amd64/mcontext.h b/lib/libc/include/x86_64-netbsd-none/amd64/mcontext.h
index 9d70991fa91fe048ff0eba745c83912464a15682..911c0c7c0ce632d0643001b55fe627cc56908d38 100644
--- a/lib/libc/include/x86_64-netbsd-none/amd64/mcontext.h
+++ b/lib/libc/include/x86_64-netbsd-none/amd64/mcontext.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: mcontext.h,v 1.24 2024/11/30 01:04:06 christos Exp $	*/
+/*	$NetBSD: mcontext.h,v 1.24.2.1 2026/07/19 15:57:26 martin Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -56,7 +56,28 @@ typedef	__greg_t	__gregset_t[_NGREG];
  * which requires 16 byte alignment. However the mcontext version
  * is never directly accessed.
  */
-typedef char __fpregset_t[512] __aligned(8);
+typedef union {
+	char	__fxsave[512] __aligned(8);
+	struct {
+		/*
+		 * `The XSAVE feature set does not use bytes 511:416;
+		 *  bytes 463:416 are reserved.'
+		 *
+		 * We take a part out of this to form a pointer to an
+		 * external XSAVE area.  This way, we can replicate the
+		 * FXSAVE parts for the benefit of userland programs
+		 * that aren't aware of the XSAVE pointer, have used
+		 * the extended CPU registers (ymmN/zmmN/&c.), and want
+		 * to examine the x87/SSE register state in a signal
+		 * handler.  The kernel does not use this part.
+		 */
+		char		__fxsave[416];
+		char		__rsvd[48];
+		__greg_t	__xsaveptr;
+		__greg_t	__xsavelen;
+		char		__pad[32];
+	}	__xsave;
+} __fpregset_t;
 
 typedef struct {
 	__gregset_t	__gregs;
@@ -75,6 +96,7 @@ typedef struct {
 #define	_UC_MACHINE_SET_PC(uc, pc)	_UC_MACHINE_PC(uc) = (pc)
 
 #define	_UC_TLSBASE	_UC_MD_BIT19
+#define	_UC_XSAVE	_UC_MD_BIT20
 
 /*
  * mcontext extensions to handle signal delivery.
@@ -127,6 +149,13 @@ typedef struct {
 		struct {
 			char	__fp_xmm[512];
 		} __fp_xmm_state;
+		struct {
+			char		__fxsave[416];
+			char		__rsvd[48];
+			__greg32_t	__xsaveptr;
+			__greg32_t	__xsavelen;
+			char		__pad[40];
+		} __xsave;
 	} __fp_reg_set;
 	int	__fp_pad[33];			/* Historic padding */
 } __fpregset32_t;
diff --git a/lib/libc/include/x86_64-netbsd-none/machine/mcontext.h b/lib/libc/include/x86_64-netbsd-none/machine/mcontext.h
index 9d70991fa91fe048ff0eba745c83912464a15682..911c0c7c0ce632d0643001b55fe627cc56908d38 100644
--- a/lib/libc/include/x86_64-netbsd-none/machine/mcontext.h
+++ b/lib/libc/include/x86_64-netbsd-none/machine/mcontext.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: mcontext.h,v 1.24 2024/11/30 01:04:06 christos Exp $	*/
+/*	$NetBSD: mcontext.h,v 1.24.2.1 2026/07/19 15:57:26 martin Exp $	*/
 
 /*-
  * Copyright (c) 1999 The NetBSD Foundation, Inc.
@@ -56,7 +56,28 @@ typedef	__greg_t	__gregset_t[_NGREG];
  * which requires 16 byte alignment. However the mcontext version
  * is never directly accessed.
  */
-typedef char __fpregset_t[512] __aligned(8);
+typedef union {
+	char	__fxsave[512] __aligned(8);
+	struct {
+		/*
+		 * `The XSAVE feature set does not use bytes 511:416;
+		 *  bytes 463:416 are reserved.'
+		 *
+		 * We take a part out of this to form a pointer to an
+		 * external XSAVE area.  This way, we can replicate the
+		 * FXSAVE parts for the benefit of userland programs
+		 * that aren't aware of the XSAVE pointer, have used
+		 * the extended CPU registers (ymmN/zmmN/&c.), and want
+		 * to examine the x87/SSE register state in a signal
+		 * handler.  The kernel does not use this part.
+		 */
+		char		__fxsave[416];
+		char		__rsvd[48];
+		__greg_t	__xsaveptr;
+		__greg_t	__xsavelen;
+		char		__pad[32];
+	}	__xsave;
+} __fpregset_t;
 
 typedef struct {
 	__gregset_t	__gregs;
@@ -75,6 +96,7 @@ typedef struct {
 #define	_UC_MACHINE_SET_PC(uc, pc)	_UC_MACHINE_PC(uc) = (pc)
 
 #define	_UC_TLSBASE	_UC_MD_BIT19
+#define	_UC_XSAVE	_UC_MD_BIT20
 
 /*
  * mcontext extensions to handle signal delivery.
@@ -127,6 +149,13 @@ typedef struct {
 		struct {
 			char	__fp_xmm[512];
 		} __fp_xmm_state;
+		struct {
+			char		__fxsave[416];
+			char		__rsvd[48];
+			__greg32_t	__xsaveptr;
+			__greg32_t	__xsavelen;
+			char		__pad[40];
+		} __xsave;
 	} __fp_reg_set;
 	int	__fp_pad[33];			/* Historic padding */
 } __fpregset32_t;