Pull up following revision(s) (requested by snj in ticket #1140): netbsd-7-0
authormartin <martin@NetBSD.org>
Sun, 13 Mar 2016 08:00:24 +0000
branchnetbsd-7-0
changeset 275887 e6987d6aadcd
parent 275886 ccc30c62aba0
child 275888 73b4536839c7
Pull up following revision(s) (requested by snj in ticket #1140): distrib/sets/lists/base/ad.aarch64: patch distrib/sets/lists/base/ad.arm: patch distrib/sets/lists/base/ad.mips: patch distrib/sets/lists/base/ad.powerpc: patch distrib/sets/lists/base/md.amd64: patch distrib/sets/lists/base/md.sparc64: patch distrib/sets/lists/base/shl.mi: patch distrib/sets/lists/debug/ad.aarch64: patch distrib/sets/lists/debug/ad.arm: patch distrib/sets/lists/debug/ad.mips: patch distrib/sets/lists/debug/ad.powerpc: patch distrib/sets/lists/debug/md.amd64: patch distrib/sets/lists/debug/md.sparc64: patch distrib/sets/lists/debug/shl.mi: patch doc/3RDPARTY: patch external/bsd/bind/bind2netbsd: up to 1.3 external/bsd/bind/dist/CHANGES: up to 1.20 external/bsd/bind/dist/COPYRIGHT: up to 1.1.1.10 external/bsd/bind/dist/README: up to 1.8 external/bsd/bind/dist/bin/check/check-tool.c: up to 1.8 external/bsd/bind/dist/bin/check/named-checkconf.c: up to 1.12 external/bsd/bind/dist/bin/check/named-checkzone.c: up to 1.8 external/bsd/bind/dist/bin/confgen/keygen.c: up to 1.7 external/bsd/bind/dist/bin/confgen/util.c: up to 1.5 external/bsd/bind/dist/bin/dig/dig.1: up to 1.11 external/bsd/bind/dist/bin/dig/dig.c: up to 1.11 external/bsd/bind/dist/bin/dig/dig.docbook: up to 1.1.1.12 external/bsd/bind/dist/bin/dig/dig.html: up to 1.1.1.12 external/bsd/bind/dist/bin/dig/dighost.c: up to 1.17 external/bsd/bind/dist/bin/dig/include/dig/dig.h: up to 1.12 external/bsd/bind/dist/bin/dig/nslookup.c: up to 1.12 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8: up to 1.8 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c: up to 1.12 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.docbook: up to 1.1.1.9 external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.html: up to 1.1.1.10 external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c: up to 1.17 external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c: up to 1.9 external/bsd/bind/dist/bin/dnssec/dnssec-settime.c: up to 1.13 external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c: up to 1.16 external/bsd/bind/dist/bin/named/bind9.xsl: up to 1.1.1.8 external/bsd/bind/dist/bin/named/bind9.xsl.h: up to 1.9 external/bsd/bind/dist/bin/named/client.c: up to 1.15 external/bsd/bind/dist/bin/named/config.c: up to 1.12 external/bsd/bind/dist/bin/named/control.c: up to 1.10 external/bsd/bind/dist/bin/named/controlconf.c: up to 1.11 external/bsd/bind/dist/bin/named/include/named/lwdclient.h: up to 1.5 external/bsd/bind/dist/bin/named/include/named/main.h: up to 1.6 external/bsd/bind/dist/bin/named/include/named/server.h: up to 1.10 external/bsd/bind/dist/bin/named/interfacemgr.c: up to 1.11 external/bsd/bind/dist/bin/named/logconf.c: up to 1.8 external/bsd/bind/dist/bin/named/lwdclient.c: up to 1.5 external/bsd/bind/dist/bin/named/lwresd.c: up to 1.7 external/bsd/bind/dist/bin/named/main.c: up to 1.19 external/bsd/bind/dist/bin/named/named.8: up to 1.8 external/bsd/bind/dist/bin/named/named.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/named/named.html: up to 1.1.1.9 external/bsd/bind/dist/bin/named/query.c: up to 1.21 external/bsd/bind/dist/bin/named/server.c: up to 1.20 external/bsd/bind/dist/bin/named/statschannel.c: up to 1.11 external/bsd/bind/dist/bin/named/update.c: up to 1.12 external/bsd/bind/dist/bin/named/win32/named.dsp.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/named.mak.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/named.vcxproj.in: up to 1.1.1.3 external/bsd/bind/dist/bin/named/win32/ntservice.c: up to 1.7 external/bsd/bind/dist/bin/named/win32/os.c: up to 1.9 external/bsd/bind/dist/bin/named/xfrout.c: up to 1.10 external/bsd/bind/dist/bin/nsupdate/nsupdate.1: up to 1.7 external/bsd/bind/dist/bin/nsupdate/nsupdate.c: up to 1.14 external/bsd/bind/dist/bin/nsupdate/nsupdate.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/nsupdate/nsupdate.html: up to 1.1.1.10 external/bsd/bind/dist/bin/pkcs11/Makefile.in: up to 1.1.1.7 external/bsd/bind/dist/bin/pkcs11/openssl-0.9.8zc-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-0.9.8ze-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0o-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0q-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1j-patch delete external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1l-patch: up to 1.1.1.1 external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-list.c: up to 1.8 external/bsd/bind/dist/bin/pkcs11/pkcs11-tokens.c: up to 1.1.1.5 external/bsd/bind/dist/bin/python/dnssec-coverage.py.in: up to 1.1.1.6 external/bsd/bind/dist/bin/rndc/rndc.8: up to 1.8 external/bsd/bind/dist/bin/rndc/rndc.c: up to 1.14 external/bsd/bind/dist/bin/rndc/rndc.docbook: up to 1.1.1.8 external/bsd/bind/dist/bin/rndc/rndc.html: up to 1.1.1.9 external/bsd/bind/dist/bin/rndc/util.c: up to 1.5 external/bsd/bind/dist/bin/tests/Makefile.in: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/adb_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/backtrace_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/byaddr_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/byname_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/cfg_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/compress_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/db/t_db.c: up to 1.8 external/bsd/bind/dist/bin/tests/db_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/dst/dst_test.c: up to 1.8 external/bsd/bind/dist/bin/tests/entropy2_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/entropy_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/fromhex.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/fsaccess_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/gxba_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/gxbn_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/hash_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/inter_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/keyboard_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lex_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lfsr_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/log_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lwres_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/lwresconf_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/makejournal.c: up to 1.4 external/bsd/bind/dist/bin/tests/master_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/name_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/names/t_names.c: up to 1.10 external/bsd/bind/dist/bin/tests/net/driver.c: up to 1.7 external/bsd/bind/dist/bin/tests/net/netaddr_multicast.c: up to 1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/find.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/genrsa.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/login.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/random.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/session.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sha1.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sign.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/verify.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/pkcs11-hmacmd5.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/pkcs11/pkcs11-md5sum.c: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/printmsg.c: delete external/bsd/bind/dist/bin/tests/printmsg.h: delete external/bsd/bind/dist/bin/tests/ratelimiter_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/rbt/t_rbt.c: up to 1.8 external/bsd/bind/dist/bin/tests/rbt_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/rdata_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/serial_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/sig0_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/sock_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/sym_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/README: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/addzone/tests.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/builtin/Makefile.in: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/builtin/gethostname.c: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/builtin/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/checkconf/good-class.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/tests.sh: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-caa-rr.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-dns-sd-reverse.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-nsap-empty.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-nsap-odd-nibble.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-unspec.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-dns-sd-reverse.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-gc-msdcs.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-nsap.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/cleanall.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/conf.sh.in: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/ditch.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dlzexternal/driver.c: up to 1.4 external/bsd/bind/dist/bin/tests/system/dnssec/clean.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds-auto.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds-update.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds.secure.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/named.conf: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/dnssec/ns2/sign.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/dnssec/prereq.sh: up to 1.1.1.9 external/bsd/bind/dist/bin/tests/system/dnssec/tests.sh: up to 1.1.1.16 external/bsd/bind/dist/bin/tests/system/ednscompliance/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/ns1/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/ns1/root.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/ednscompliance/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ans4/ans.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/fetchlimit.c: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns1/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns1/root.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns2/example.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns2/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named.args: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named1.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named2.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named3.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/root.hint: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/setup.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/fetchlimit/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/filter-aaaa/tests.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/inline/clean.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/inline/ns3/named.conf: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/lwresd/lwtest.c: up to 1.8 external/bsd/bind/dist/bin/tests/system/masterfile/clean.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/masterfile/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/masterfile/zone/inheritownerafterinclude.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/masterfile/zone/inheritownerafterinclude.good: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/masterfile/zone/nameservers.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/nsupdate/prereq.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/nsupdate/tests.sh: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/reclimit/ans2/ans.pl: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/reclimit/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/reclimit/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/resolver/ns4/named.conf: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/resolver/ns6/named.conf: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/resolver/tests.sh: up to 1.1.1.13 external/bsd/bind/dist/bin/tests/system/rndc/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/named.conf: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/test1.example.net.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/test2.example.net.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard1: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard2a: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard2b: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard3: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rpzrecurse/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/rrsetorder/ns4/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/rrsetorder/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/rsabigexponent/Makefile.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/rsabigexponent/bigkey.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/sit/tests.sh: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/start.pl: up to 1.1.1.13 external/bsd/bind/dist/bin/tests/system/staticstub/clean.sh: up to 1.1.1.5 external/bsd/bind/dist/bin/tests/system/staticstub/ns2/named.conf.in: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/named.conf.in: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/sign.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/staticstub/ns3/undelegated.db.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/staticstub/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/statistics/Makefile.in: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statistics/clean.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/ns1/named.conf: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/ns1/zone.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statistics/tests.sh: up to 1.1.1.2 external/bsd/bind/dist/bin/tests/system/statistics/xmlstats.c: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/clean.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/fetch.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/ns2/example.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/ns2/named.conf: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/server-json.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/server-xml.pl: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/statschannel/tests.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/stress/prereq.sh: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/stress/tests.sh: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/tkey/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/bin/tests/system/tkey/keycreate.c: up to 1.8 external/bsd/bind/dist/bin/tests/system/tkey/keydelete.c: up to 1.7 external/bsd/bind/dist/bin/tests/system/views/ns2/1.10.in-addr.arpa.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/views/ns2/named2.conf: up to 1.1.1.6 external/bsd/bind/dist/bin/tests/system/xfer/tests.sh: up to 1.1.1.10 external/bsd/bind/dist/bin/tests/system/zonechecks/bigserial.db: up to 1.1.1.1 external/bsd/bind/dist/bin/tests/system/zonechecks/ns1/named.conf: up to 1.1.1.3 external/bsd/bind/dist/bin/tests/system/zonechecks/setup.sh: up to 1.1.1.4 external/bsd/bind/dist/bin/tests/system/zonechecks/tests.sh: up to 1.1.1.7 external/bsd/bind/dist/bin/tests/task_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/tasks/t_tasks.c: up to 1.8 external/bsd/bind/dist/bin/tests/timer_test.c: up to 1.9 external/bsd/bind/dist/bin/tests/wire_test.c: up to 1.7 external/bsd/bind/dist/bin/tests/zone_test.c: up to 1.9 external/bsd/bind/dist/bin/tools/arpaname.c: up to 1.5 external/bsd/bind/dist/bin/tools/isc-hmac-fixup.c: up to 1.8 external/bsd/bind/dist/bin/tools/named-journalprint.c: up to 1.7 external/bsd/bind/dist/bin/tools/named-rrchecker.c: up to 1.1.1.4 external/bsd/bind/dist/bin/win32/BINDInstall/BINDInstallDlg.cpp: up to 1.1.1.10 external/bsd/bind/dist/bin/win32/BINDInstall/VersionInfo.cpp: up to 1.1.1.2 external/bsd/bind/dist/config.h.in: up to 1.12 external/bsd/bind/dist/config.h.win32: up to 1.1.1.12 external/bsd/bind/dist/configure: up to 1.5 external/bsd/bind/dist/configure.in: up to 1.8 external/bsd/bind/dist/contrib/README: up to 1.1.1.3 external/bsd/bind/dist/contrib/scripts/dnssec-keyset.sh: up to 1.1.1.1 external/bsd/bind/dist/doc/arm/Bv9ARM-book.xml: up to 1.1.1.19 external/bsd/bind/dist/doc/arm/Bv9ARM.ch01.html: up to 1.1.1.18 external/bsd/bind/dist/doc/arm/Bv9ARM.ch02.html: up to 1.1.1.15 external/bsd/bind/dist/doc/arm/Bv9ARM.ch03.html: up to 1.1.1.20 external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch05.html: up to 1.1.1.21 external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.ch10.html: up to 1.1.1.17 external/bsd/bind/dist/doc/arm/Bv9ARM.ch11.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.ch12.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.ch13.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/Bv9ARM.html: up to 1.8 external/bsd/bind/dist/doc/arm/Bv9ARM.pdf: up to 1.14 external/bsd/bind/dist/doc/arm/Makefile.in: up to 1.1.1.8 external/bsd/bind/dist/doc/arm/html-fixup.pl: up to 1.1.1.1 external/bsd/bind/dist/doc/arm/latex-fixup.pl: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/man.arpaname.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.ddns-confgen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.delv.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dig.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-settime.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.dnssec-verify.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.genrandom.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.host.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-checkconf.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-checkzone.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-journalprint.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named-rrchecker.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.named.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.nsec3hash.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.nsupdate.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc-confgen.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc.conf.html: up to 1.8 external/bsd/bind/dist/doc/arm/man.rndc.html: up to 1.8 external/bsd/bind/dist/doc/arm/notes.html: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/notes.pdf: up to 1.1.1.6 external/bsd/bind/dist/doc/arm/notes.xml: up to 1.1.1.6 external/bsd/bind/dist/doc/misc/rfc-compliance: up to 1.1.1.4 external/bsd/bind/dist/isc-config.sh.in: up to 1.1.1.6 external/bsd/bind/dist/lib/bind9/api: up to 1.1.1.17 external/bsd/bind/dist/lib/bind9/check.c: up to 1.13 external/bsd/bind/dist/lib/dns/adb.c: up to 1.12 external/bsd/bind/dist/lib/dns/api: up to 1.8 external/bsd/bind/dist/lib/dns/cache.c: up to 1.9 external/bsd/bind/dist/lib/dns/callbacks.c: up to 1.6 external/bsd/bind/dist/lib/dns/client.c: up to 1.11 external/bsd/bind/dist/lib/dns/diff.c: up to 1.10 external/bsd/bind/dist/lib/dns/dispatch.c: up to 1.11 external/bsd/bind/dist/lib/dns/dlz.c: up to 1.8 external/bsd/bind/dist/lib/dns/dnssec.c: up to 1.12 external/bsd/bind/dist/lib/dns/dst_api.c: up to 1.12 external/bsd/bind/dist/lib/dns/dst_openssl.h: up to 1.8 external/bsd/bind/dist/lib/dns/dst_parse.c: up to 1.9 external/bsd/bind/dist/lib/dns/geoip.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/gssapi_link.c: up to 1.9 external/bsd/bind/dist/lib/dns/gssapictx.c: up to 1.9 external/bsd/bind/dist/lib/dns/hmac_link.c: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/adb.h: up to 1.7 external/bsd/bind/dist/lib/dns/include/dns/log.h: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/message.h: up to 1.9 external/bsd/bind/dist/lib/dns/include/dns/name.h: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/resolver.h: up to 1.10 external/bsd/bind/dist/lib/dns/include/dns/result.h: up to 1.7 external/bsd/bind/dist/lib/dns/include/dns/rrl.h: up to 1.4 external/bsd/bind/dist/lib/dns/include/dns/stats.h: up to 1.8 external/bsd/bind/dist/lib/dns/include/dns/types.h: up to 1.8 external/bsd/bind/dist/lib/dns/include/dns/update.h: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/include/dns/zone.h: up to 1.17 external/bsd/bind/dist/lib/dns/include/dst/dst.h: up to 1.11 external/bsd/bind/dist/lib/dns/journal.c: up to 1.10 external/bsd/bind/dist/lib/dns/keytable.c: up to 1.11 external/bsd/bind/dist/lib/dns/log.c: up to 1.9 external/bsd/bind/dist/lib/dns/master.c: up to 1.15 external/bsd/bind/dist/lib/dns/message.c: up to 1.18 external/bsd/bind/dist/lib/dns/name.c: up to 1.12 external/bsd/bind/dist/lib/dns/ncache.c: up to 1.11 external/bsd/bind/dist/lib/dns/nsec.c: up to 1.10 external/bsd/bind/dist/lib/dns/nsec3.c: up to 1.12 external/bsd/bind/dist/lib/dns/openssl_link.c: up to 1.12 external/bsd/bind/dist/lib/dns/openssldh_link.c: up to 1.10 external/bsd/bind/dist/lib/dns/openssldsa_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/opensslecdsa_link.c: up to 1.10 external/bsd/bind/dist/lib/dns/opensslgost_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/opensslrsa_link.c: up to 1.11 external/bsd/bind/dist/lib/dns/order.c: up to 1.5 external/bsd/bind/dist/lib/dns/pkcs11dh_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11dsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11ecdsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11gost_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/pkcs11rsa_link.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/private.c: up to 1.8 external/bsd/bind/dist/lib/dns/rbt.c: up to 1.11 external/bsd/bind/dist/lib/dns/rbtdb.c: up to 1.21 external/bsd/bind/dist/lib/dns/rcode.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata.c: up to 1.13 external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/ch_3/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/afsdb_18.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/caa_257.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/rdata/generic/cdnskey_60.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/cds_59.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/cname_5.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/dname_39.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/eui48_108.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/eui64_109.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/gpos_27.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/hinfo_13.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/hip_55.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/isdn_20.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/l32_105.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/l64_106.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/loc_29.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/lp_107.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/rdata/generic/mb_7.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/md_3.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mf_4.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mg_8.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/minfo_14.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mr_9.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/mx_15.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/naptr_35.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/rdata/generic/nid_104.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/ns_2.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/nsec3param_51.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nsec_47.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/null_10.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/nxt_30.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/openpgpkey_61.c: up to 1.1.1.3 external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c: up to 1.9 external/bsd/bind/dist/lib/dns/rdata/generic/proforma.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/ptr_12.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/rp_17.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/rt_21.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/spf_99.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/generic/tlsa_52.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/rdata/generic/txt_16.c: up to 1.8 external/bsd/bind/dist/lib/dns/rdata/generic/unspec_103.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/generic/uri_256.c: up to 1.1.1.6 external/bsd/bind/dist/lib/dns/rdata/generic/x25_19.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/hs_4/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/a6_38.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/a_1.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/aaaa_28.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/apl_42.c: up to 1.7 external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/kx_36.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/nsap-ptr_23.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/nsap_22.c: up to 1.6 external/bsd/bind/dist/lib/dns/rdata/in_1/px_26.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/srv_33.c: up to 1.5 external/bsd/bind/dist/lib/dns/rdata/in_1/wks_11.c: up to 1.7 external/bsd/bind/dist/lib/dns/request.c: up to 1.10 external/bsd/bind/dist/lib/dns/resolver.c: up to 1.25 external/bsd/bind/dist/lib/dns/result.c: up to 1.7 external/bsd/bind/dist/lib/dns/rootns.c: up to 1.10 external/bsd/bind/dist/lib/dns/rpz.c: up to 1.10 external/bsd/bind/dist/lib/dns/rrl.c: up to 1.5 external/bsd/bind/dist/lib/dns/sdb.c: up to 1.10 external/bsd/bind/dist/lib/dns/sdlz.c: up to 1.10 external/bsd/bind/dist/lib/dns/spnego.c: up to 1.9 external/bsd/bind/dist/lib/dns/tcpmsg.c: up to 1.5 external/bsd/bind/dist/lib/dns/tests/geoip_test.c: up to 1.4 external/bsd/bind/dist/lib/dns/tests/gost_test.c: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/tests/master_test.c: up to 1.7 external/bsd/bind/dist/lib/dns/tests/rbt_serialize_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/tests/rbt_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/dns/tests/rdatasetstats_test.c: up to 1.1.1.4 external/bsd/bind/dist/lib/dns/tkey.c: up to 1.10 external/bsd/bind/dist/lib/dns/tsig.c: up to 1.9 external/bsd/bind/dist/lib/dns/update.c: up to 1.5 external/bsd/bind/dist/lib/dns/view.c: up to 1.11 external/bsd/bind/dist/lib/dns/win32/libdns.def.in: up to 1.1.1.7 external/bsd/bind/dist/lib/dns/xfrin.c: up to 1.12 external/bsd/bind/dist/lib/dns/zone.c: up to 1.15 external/bsd/bind/dist/lib/irs/api: up to 1.1.1.9 external/bsd/bind/dist/lib/irs/getaddrinfo.c: up to 1.8 external/bsd/bind/dist/lib/isc/api: up to 1.1.1.19 external/bsd/bind/dist/lib/isc/app_api.c: up to 1.8 external/bsd/bind/dist/lib/isc/assertions.c: up to 1.7 external/bsd/bind/dist/lib/isc/backtrace.c: up to 1.8 external/bsd/bind/dist/lib/isc/commandline.c: up to 1.6 external/bsd/bind/dist/lib/isc/entropy.c: up to 1.6 external/bsd/bind/dist/lib/isc/error.c: up to 1.5 external/bsd/bind/dist/lib/isc/heap.c: up to 1.8 external/bsd/bind/dist/lib/isc/hmacmd5.c: up to 1.9 external/bsd/bind/dist/lib/isc/hmacsha.c: up to 1.10 external/bsd/bind/dist/lib/isc/httpd.c: up to 1.9 external/bsd/bind/dist/lib/isc/include/isc/app.h: up to 1.9 external/bsd/bind/dist/lib/isc/include/isc/json.h: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/include/isc/mem.h: up to 1.14 external/bsd/bind/dist/lib/isc/include/isc/platform.h.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isc/include/isc/print.h: up to 1.6 external/bsd/bind/dist/lib/isc/include/isc/safe.h: up to 1.4 external/bsd/bind/dist/lib/isc/include/isc/util.h: up to 1.11 external/bsd/bind/dist/lib/isc/lex.c: up to 1.7 external/bsd/bind/dist/lib/isc/lib.c: up to 1.8 external/bsd/bind/dist/lib/isc/mem.c: up to 1.13 external/bsd/bind/dist/lib/isc/netaddr.c: up to 1.7 external/bsd/bind/dist/lib/isc/nothreads/include/isc/mutex.h: up to 1.5 external/bsd/bind/dist/lib/isc/pk11.c: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/pool.c: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/print.c: up to 1.6 external/bsd/bind/dist/lib/isc/pthreads/mutex.c: up to 1.7 external/bsd/bind/dist/lib/isc/regex.c: up to 1.4 external/bsd/bind/dist/lib/isc/rwlock.c: up to 1.9 external/bsd/bind/dist/lib/isc/safe.c: up to 1.4 external/bsd/bind/dist/lib/isc/socket_api.c: up to 1.11 external/bsd/bind/dist/lib/isc/stats.c: up to 1.6 external/bsd/bind/dist/lib/isc/task.c: up to 1.12 external/bsd/bind/dist/lib/isc/tests/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isc/tests/hash_test.c: up to 1.1.1.8 external/bsd/bind/dist/lib/isc/tests/mem_test.c: up to 1.1.1.2 external/bsd/bind/dist/lib/isc/tests/print_test.c: up to 1.1.1.5 external/bsd/bind/dist/lib/isc/tests/regex_test.c: up to 1.1.1.4 external/bsd/bind/dist/lib/isc/tests/safe_test.c: up to 1.4 external/bsd/bind/dist/lib/isc/tests/socket_test.c: up to 1.1.1.7 external/bsd/bind/dist/lib/isc/timer.c: up to 1.11 external/bsd/bind/dist/lib/isc/unix/app.c: up to 1.14 external/bsd/bind/dist/lib/isc/unix/file.c: up to 1.10 external/bsd/bind/dist/lib/isc/unix/ifiter_ioctl.c: up to 1.6 external/bsd/bind/dist/lib/isc/unix/ifiter_sysctl.c: up to 1.6 external/bsd/bind/dist/lib/isc/unix/include/isc/offset.h: up to 1.5 external/bsd/bind/dist/lib/isc/unix/net.c: up to 1.9 external/bsd/bind/dist/lib/isc/unix/socket.c: up to 1.18 external/bsd/bind/dist/lib/isc/win32/interfaceiter.c: up to 1.7 external/bsd/bind/dist/lib/isc/win32/libisc.def.exclude: up to 1.1.1.1 external/bsd/bind/dist/lib/isc/win32/libisc.def.in: up to 1.1.1.7 external/bsd/bind/dist/lib/isc/win32/libisc.vcxproj.in: up to 1.1.1.6 external/bsd/bind/dist/lib/isc/win32/net.c: up to 1.9 external/bsd/bind/dist/lib/isc/win32/win32os.c: up to 1.7 external/bsd/bind/dist/lib/isccc/Makefile.in: up to 1.1.1.10 external/bsd/bind/dist/lib/isccc/alist.c: up to 1.5 external/bsd/bind/dist/lib/isccc/api: up to 1.1.1.11 external/bsd/bind/dist/lib/isccc/cc.c: up to 1.10 external/bsd/bind/dist/lib/isccc/sexpr.c: up to 1.6 external/bsd/bind/dist/lib/isccfg/api: up to 1.1.1.17 external/bsd/bind/dist/lib/isccfg/include/isccfg/cfg.h: up to 1.7 external/bsd/bind/dist/lib/isccfg/include/isccfg/grammar.h: up to 1.6 external/bsd/bind/dist/lib/isccfg/namedconf.c: up to 1.12 external/bsd/bind/dist/lib/isccfg/parser.c: up to 1.10 external/bsd/bind/dist/lib/isccfg/win32/libisccfg.def: up to 1.1.1.8 external/bsd/bind/dist/lib/lwres/api: up to 1.1.1.14 external/bsd/bind/dist/lib/lwres/herror.c: up to 1.7 external/bsd/bind/dist/lib/lwres/print.c: up to 1.7 external/bsd/bind/dist/lib/lwres/win32/socket.c: up to 1.5 external/bsd/bind/dist/lib/samples/nsprobe.c: up to 1.1.1.6 external/bsd/bind/dist/lib/samples/resolve.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-async.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-gai.c: up to 1.1.1.5 external/bsd/bind/dist/lib/samples/sample-request.c: up to 1.1.1.6 external/bsd/bind/dist/lib/samples/sample-update.c: up to 1.1.1.6 external/bsd/bind/dist/srcid: up to 1.14 external/bsd/bind/dist/version: up to 1.18 external/bsd/bind/dist/win32utils/Configure: up to 1.1.1.5 external/bsd/bind/dist/win32utils/index.html: up to 1.1.1.7 external/bsd/bind/dist/win32utils/legacy/BuildSetup.bat.in: up to 1.1.1.5 external/bsd/bind/include/config.h: up to 1.18 external/bsd/bind/include/dns/enumclass.h: up to 1.8 external/bsd/bind/include/dns/enumtype.h: up to 1.11 external/bsd/bind/include/dns/rdatastruct.h: up to 1.11 external/bsd/bind/include/isc/platform.h: up to 1.21 external/bsd/bind/include/lwres/platform.h: up to 1.7 external/bsd/bind/lib/libbind9/shlib_version: up to 1.16 external/bsd/bind/lib/libdns/shlib_version: up to 1.18 external/bsd/bind/lib/libirs/shlib_version: up to 1.5 external/bsd/bind/lib/libisc/shlib_version: up to 1.18 external/bsd/bind/lib/libisccc/shlib_version: up to 1.16 external/bsd/bind/lib/libisccfg/shlib_version: up to 1.16 external/bsd/bind/lib/liblwres/shlib_version: up to 1.16 Update BIND to 9.10.3-P4.
distrib/sets/lists/base/ad.aarch64
distrib/sets/lists/base/ad.arm
distrib/sets/lists/base/ad.mips
distrib/sets/lists/base/ad.powerpc
distrib/sets/lists/base/md.amd64
distrib/sets/lists/base/md.sparc64
distrib/sets/lists/base/shl.mi
distrib/sets/lists/debug/ad.aarch64
distrib/sets/lists/debug/ad.arm
distrib/sets/lists/debug/ad.mips
distrib/sets/lists/debug/ad.powerpc
distrib/sets/lists/debug/md.amd64
distrib/sets/lists/debug/md.sparc64
distrib/sets/lists/debug/shl.mi
doc/3RDPARTY
external/bsd/bind/bind2netbsd
external/bsd/bind/dist/CHANGES
external/bsd/bind/dist/COPYRIGHT
external/bsd/bind/dist/README
external/bsd/bind/dist/bin/check/check-tool.c
external/bsd/bind/dist/bin/check/named-checkconf.c
external/bsd/bind/dist/bin/check/named-checkzone.c
external/bsd/bind/dist/bin/confgen/keygen.c
external/bsd/bind/dist/bin/confgen/util.c
external/bsd/bind/dist/bin/dig/dig.1
external/bsd/bind/dist/bin/dig/dig.c
external/bsd/bind/dist/bin/dig/dig.docbook
external/bsd/bind/dist/bin/dig/dig.html
external/bsd/bind/dist/bin/dig/dighost.c
external/bsd/bind/dist/bin/dig/include/dig/dig.h
external/bsd/bind/dist/bin/dig/nslookup.c
external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8
external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c
external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.docbook
external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.html
external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c
external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c
external/bsd/bind/dist/bin/dnssec/dnssec-settime.c
external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c
external/bsd/bind/dist/bin/named/bind9.xsl
external/bsd/bind/dist/bin/named/bind9.xsl.h
external/bsd/bind/dist/bin/named/client.c
external/bsd/bind/dist/bin/named/config.c
external/bsd/bind/dist/bin/named/control.c
external/bsd/bind/dist/bin/named/controlconf.c
external/bsd/bind/dist/bin/named/include/named/lwdclient.h
external/bsd/bind/dist/bin/named/include/named/main.h
external/bsd/bind/dist/bin/named/include/named/server.h
external/bsd/bind/dist/bin/named/interfacemgr.c
external/bsd/bind/dist/bin/named/logconf.c
external/bsd/bind/dist/bin/named/lwdclient.c
external/bsd/bind/dist/bin/named/lwresd.c
external/bsd/bind/dist/bin/named/main.c
external/bsd/bind/dist/bin/named/named.8
external/bsd/bind/dist/bin/named/named.docbook
external/bsd/bind/dist/bin/named/named.html
external/bsd/bind/dist/bin/named/query.c
external/bsd/bind/dist/bin/named/server.c
external/bsd/bind/dist/bin/named/statschannel.c
external/bsd/bind/dist/bin/named/update.c
external/bsd/bind/dist/bin/named/win32/named.dsp.in
external/bsd/bind/dist/bin/named/win32/named.mak.in
external/bsd/bind/dist/bin/named/win32/named.vcxproj.in
external/bsd/bind/dist/bin/named/win32/ntservice.c
external/bsd/bind/dist/bin/named/win32/os.c
external/bsd/bind/dist/bin/named/xfrout.c
external/bsd/bind/dist/bin/nsupdate/nsupdate.1
external/bsd/bind/dist/bin/nsupdate/nsupdate.c
external/bsd/bind/dist/bin/nsupdate/nsupdate.docbook
external/bsd/bind/dist/bin/nsupdate/nsupdate.html
external/bsd/bind/dist/bin/pkcs11/Makefile.in
external/bsd/bind/dist/bin/pkcs11/openssl-0.9.8zc-patch
external/bsd/bind/dist/bin/pkcs11/openssl-0.9.8ze-patch
external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0o-patch
external/bsd/bind/dist/bin/pkcs11/openssl-1.0.0q-patch
external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1j-patch
external/bsd/bind/dist/bin/pkcs11/openssl-1.0.1l-patch
external/bsd/bind/dist/bin/pkcs11/pkcs11-destroy.c
external/bsd/bind/dist/bin/pkcs11/pkcs11-keygen.c
external/bsd/bind/dist/bin/pkcs11/pkcs11-list.c
external/bsd/bind/dist/bin/pkcs11/pkcs11-tokens.c
external/bsd/bind/dist/bin/python/dnssec-coverage.py.in
external/bsd/bind/dist/bin/rndc/rndc.8
external/bsd/bind/dist/bin/rndc/rndc.c
external/bsd/bind/dist/bin/rndc/rndc.docbook
external/bsd/bind/dist/bin/rndc/rndc.html
external/bsd/bind/dist/bin/rndc/util.c
external/bsd/bind/dist/bin/tests/Makefile.in
external/bsd/bind/dist/bin/tests/adb_test.c
external/bsd/bind/dist/bin/tests/backtrace_test.c
external/bsd/bind/dist/bin/tests/byaddr_test.c
external/bsd/bind/dist/bin/tests/byname_test.c
external/bsd/bind/dist/bin/tests/cfg_test.c
external/bsd/bind/dist/bin/tests/compress_test.c
external/bsd/bind/dist/bin/tests/db/t_db.c
external/bsd/bind/dist/bin/tests/db_test.c
external/bsd/bind/dist/bin/tests/dst/dst_test.c
external/bsd/bind/dist/bin/tests/entropy2_test.c
external/bsd/bind/dist/bin/tests/entropy_test.c
external/bsd/bind/dist/bin/tests/fromhex.pl
external/bsd/bind/dist/bin/tests/fsaccess_test.c
external/bsd/bind/dist/bin/tests/gxba_test.c
external/bsd/bind/dist/bin/tests/gxbn_test.c
external/bsd/bind/dist/bin/tests/hash_test.c
external/bsd/bind/dist/bin/tests/inter_test.c
external/bsd/bind/dist/bin/tests/keyboard_test.c
external/bsd/bind/dist/bin/tests/lex_test.c
external/bsd/bind/dist/bin/tests/lfsr_test.c
external/bsd/bind/dist/bin/tests/log_test.c
external/bsd/bind/dist/bin/tests/lwres_test.c
external/bsd/bind/dist/bin/tests/lwresconf_test.c
external/bsd/bind/dist/bin/tests/makejournal.c
external/bsd/bind/dist/bin/tests/master_test.c
external/bsd/bind/dist/bin/tests/name_test.c
external/bsd/bind/dist/bin/tests/names/t_names.c
external/bsd/bind/dist/bin/tests/net/driver.c
external/bsd/bind/dist/bin/tests/net/netaddr_multicast.c
external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/find.c
external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/genrsa.c
external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/login.c
external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/random.c
external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/session.c
external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sha1.c
external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/sign.c
external/bsd/bind/dist/bin/tests/pkcs11/benchmarks/verify.c
external/bsd/bind/dist/bin/tests/pkcs11/pkcs11-hmacmd5.c
external/bsd/bind/dist/bin/tests/pkcs11/pkcs11-md5sum.c
external/bsd/bind/dist/bin/tests/printmsg.c
external/bsd/bind/dist/bin/tests/printmsg.h
external/bsd/bind/dist/bin/tests/ratelimiter_test.c
external/bsd/bind/dist/bin/tests/rbt/t_rbt.c
external/bsd/bind/dist/bin/tests/rbt_test.c
external/bsd/bind/dist/bin/tests/rdata_test.c
external/bsd/bind/dist/bin/tests/serial_test.c
external/bsd/bind/dist/bin/tests/sig0_test.c
external/bsd/bind/dist/bin/tests/sock_test.c
external/bsd/bind/dist/bin/tests/sym_test.c
external/bsd/bind/dist/bin/tests/system/Makefile.in
external/bsd/bind/dist/bin/tests/system/README
external/bsd/bind/dist/bin/tests/system/addzone/tests.sh
external/bsd/bind/dist/bin/tests/system/builtin/Makefile.in
external/bsd/bind/dist/bin/tests/system/builtin/gethostname.c
external/bsd/bind/dist/bin/tests/system/builtin/tests.sh
external/bsd/bind/dist/bin/tests/system/checkconf/good-class.conf
external/bsd/bind/dist/bin/tests/system/checkzone/tests.sh
external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-caa-rr.db
external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-dns-sd-reverse.db
external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-nsap-empty.db
external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-nsap-odd-nibble.db
external/bsd/bind/dist/bin/tests/system/checkzone/zones/bad-unspec.db
external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-dns-sd-reverse.db
external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-gc-msdcs.db
external/bsd/bind/dist/bin/tests/system/checkzone/zones/good-nsap.db
external/bsd/bind/dist/bin/tests/system/cleanall.sh
external/bsd/bind/dist/bin/tests/system/conf.sh.in
external/bsd/bind/dist/bin/tests/system/ditch.pl
external/bsd/bind/dist/bin/tests/system/dlzexternal/driver.c
external/bsd/bind/dist/bin/tests/system/dnssec/clean.sh
external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey-auto.secure.db.in
external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey-update.secure.db.in
external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cdnskey.secure.db.in
external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds-auto.secure.db.in
external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds-update.secure.db.in
external/bsd/bind/dist/bin/tests/system/dnssec/ns2/cds.secure.db.in
external/bsd/bind/dist/bin/tests/system/dnssec/ns2/named.conf
external/bsd/bind/dist/bin/tests/system/dnssec/ns2/sign.sh
external/bsd/bind/dist/bin/tests/system/dnssec/prereq.sh
external/bsd/bind/dist/bin/tests/system/dnssec/tests.sh
external/bsd/bind/dist/bin/tests/system/ednscompliance/clean.sh
external/bsd/bind/dist/bin/tests/system/ednscompliance/ns1/named.conf
external/bsd/bind/dist/bin/tests/system/ednscompliance/ns1/root.db
external/bsd/bind/dist/bin/tests/system/ednscompliance/tests.sh
external/bsd/bind/dist/bin/tests/system/fetchlimit/Makefile.in
external/bsd/bind/dist/bin/tests/system/fetchlimit/ans4/ans.pl
external/bsd/bind/dist/bin/tests/system/fetchlimit/clean.sh
external/bsd/bind/dist/bin/tests/system/fetchlimit/fetchlimit.c
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns1/named.conf
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns1/root.db
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns2/example.db
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns2/named.conf
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named.args
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named1.conf
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named2.conf
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/named3.conf
external/bsd/bind/dist/bin/tests/system/fetchlimit/ns3/root.hint
external/bsd/bind/dist/bin/tests/system/fetchlimit/prereq.sh
external/bsd/bind/dist/bin/tests/system/fetchlimit/setup.sh
external/bsd/bind/dist/bin/tests/system/fetchlimit/tests.sh
external/bsd/bind/dist/bin/tests/system/filter-aaaa/tests.sh
external/bsd/bind/dist/bin/tests/system/inline/clean.sh
external/bsd/bind/dist/bin/tests/system/inline/ns3/named.conf
external/bsd/bind/dist/bin/tests/system/lwresd/lwtest.c
external/bsd/bind/dist/bin/tests/system/masterfile/clean.sh
external/bsd/bind/dist/bin/tests/system/masterfile/tests.sh
external/bsd/bind/dist/bin/tests/system/masterfile/zone/inheritownerafterinclude.db
external/bsd/bind/dist/bin/tests/system/masterfile/zone/inheritownerafterinclude.good
external/bsd/bind/dist/bin/tests/system/masterfile/zone/nameservers.db
external/bsd/bind/dist/bin/tests/system/nsupdate/prereq.sh
external/bsd/bind/dist/bin/tests/system/nsupdate/tests.sh
external/bsd/bind/dist/bin/tests/system/reclimit/ans2/ans.pl
external/bsd/bind/dist/bin/tests/system/reclimit/prereq.sh
external/bsd/bind/dist/bin/tests/system/reclimit/tests.sh
external/bsd/bind/dist/bin/tests/system/resolver/ns4/named.conf
external/bsd/bind/dist/bin/tests/system/resolver/ns6/named.conf
external/bsd/bind/dist/bin/tests/system/resolver/tests.sh
external/bsd/bind/dist/bin/tests/system/rndc/tests.sh
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/named.conf
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/test1.example.net.db
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns1/test2.example.net.db
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard1
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard2a
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard2b
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/db.wildcard3
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf
external/bsd/bind/dist/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf
external/bsd/bind/dist/bin/tests/system/rpzrecurse/tests.sh
external/bsd/bind/dist/bin/tests/system/rrsetorder/ns4/named.conf
external/bsd/bind/dist/bin/tests/system/rrsetorder/tests.sh
external/bsd/bind/dist/bin/tests/system/rsabigexponent/Makefile.in
external/bsd/bind/dist/bin/tests/system/rsabigexponent/bigkey.c
external/bsd/bind/dist/bin/tests/system/sit/tests.sh
external/bsd/bind/dist/bin/tests/system/start.pl
external/bsd/bind/dist/bin/tests/system/staticstub/clean.sh
external/bsd/bind/dist/bin/tests/system/staticstub/ns2/named.conf.in
external/bsd/bind/dist/bin/tests/system/staticstub/ns3/named.conf.in
external/bsd/bind/dist/bin/tests/system/staticstub/ns3/sign.sh
external/bsd/bind/dist/bin/tests/system/staticstub/ns3/undelegated.db.in
external/bsd/bind/dist/bin/tests/system/staticstub/tests.sh
external/bsd/bind/dist/bin/tests/system/statistics/Makefile.in
external/bsd/bind/dist/bin/tests/system/statistics/clean.sh
external/bsd/bind/dist/bin/tests/system/statistics/ns1/named.conf
external/bsd/bind/dist/bin/tests/system/statistics/ns1/zone.db
external/bsd/bind/dist/bin/tests/system/statistics/tests.sh
external/bsd/bind/dist/bin/tests/system/statistics/xmlstats.c
external/bsd/bind/dist/bin/tests/system/statschannel/clean.sh
external/bsd/bind/dist/bin/tests/system/statschannel/fetch.pl
external/bsd/bind/dist/bin/tests/system/statschannel/ns2/example.db
external/bsd/bind/dist/bin/tests/system/statschannel/ns2/named.conf
external/bsd/bind/dist/bin/tests/system/statschannel/prereq.sh
external/bsd/bind/dist/bin/tests/system/statschannel/server-json.pl
external/bsd/bind/dist/bin/tests/system/statschannel/server-xml.pl
external/bsd/bind/dist/bin/tests/system/statschannel/tests.sh
external/bsd/bind/dist/bin/tests/system/stress/prereq.sh
external/bsd/bind/dist/bin/tests/system/stress/tests.sh
external/bsd/bind/dist/bin/tests/system/tkey/Makefile.in
external/bsd/bind/dist/bin/tests/system/tkey/keycreate.c
external/bsd/bind/dist/bin/tests/system/tkey/keydelete.c
external/bsd/bind/dist/bin/tests/system/views/ns2/1.10.in-addr.arpa.db
external/bsd/bind/dist/bin/tests/system/views/ns2/named2.conf
external/bsd/bind/dist/bin/tests/system/xfer/tests.sh
external/bsd/bind/dist/bin/tests/system/zonechecks/bigserial.db
external/bsd/bind/dist/bin/tests/system/zonechecks/ns1/named.conf
external/bsd/bind/dist/bin/tests/system/zonechecks/setup.sh
external/bsd/bind/dist/bin/tests/system/zonechecks/tests.sh
external/bsd/bind/dist/bin/tests/task_test.c
external/bsd/bind/dist/bin/tests/tasks/t_tasks.c
external/bsd/bind/dist/bin/tests/timer_test.c
external/bsd/bind/dist/bin/tests/wire_test.c
external/bsd/bind/dist/bin/tests/zone_test.c
external/bsd/bind/dist/bin/tools/arpaname.c
external/bsd/bind/dist/bin/tools/isc-hmac-fixup.c
external/bsd/bind/dist/bin/tools/named-journalprint.c
external/bsd/bind/dist/bin/tools/named-rrchecker.c
external/bsd/bind/dist/bin/win32/BINDInstall/BINDInstallDlg.cpp
external/bsd/bind/dist/bin/win32/BINDInstall/VersionInfo.cpp
external/bsd/bind/dist/config.h.in
external/bsd/bind/dist/config.h.win32
external/bsd/bind/dist/configure
external/bsd/bind/dist/configure.in
external/bsd/bind/dist/contrib/README
external/bsd/bind/dist/contrib/scripts/dnssec-keyset.sh
external/bsd/bind/dist/doc/arm/Bv9ARM-book.xml
external/bsd/bind/dist/doc/arm/Bv9ARM.ch01.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch02.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch03.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch04.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch05.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch06.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch07.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch08.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch09.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch10.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch11.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch12.html
external/bsd/bind/dist/doc/arm/Bv9ARM.ch13.html
external/bsd/bind/dist/doc/arm/Bv9ARM.html
external/bsd/bind/dist/doc/arm/Bv9ARM.pdf
external/bsd/bind/dist/doc/arm/Makefile.in
external/bsd/bind/dist/doc/arm/html-fixup.pl
external/bsd/bind/dist/doc/arm/latex-fixup.pl
external/bsd/bind/dist/doc/arm/man.arpaname.html
external/bsd/bind/dist/doc/arm/man.ddns-confgen.html
external/bsd/bind/dist/doc/arm/man.delv.html
external/bsd/bind/dist/doc/arm/man.dig.html
external/bsd/bind/dist/doc/arm/man.dnssec-checkds.html
external/bsd/bind/dist/doc/arm/man.dnssec-coverage.html
external/bsd/bind/dist/doc/arm/man.dnssec-dsfromkey.html
external/bsd/bind/dist/doc/arm/man.dnssec-importkey.html
external/bsd/bind/dist/doc/arm/man.dnssec-keyfromlabel.html
external/bsd/bind/dist/doc/arm/man.dnssec-keygen.html
external/bsd/bind/dist/doc/arm/man.dnssec-revoke.html
external/bsd/bind/dist/doc/arm/man.dnssec-settime.html
external/bsd/bind/dist/doc/arm/man.dnssec-signzone.html
external/bsd/bind/dist/doc/arm/man.dnssec-verify.html
external/bsd/bind/dist/doc/arm/man.genrandom.html
external/bsd/bind/dist/doc/arm/man.host.html
external/bsd/bind/dist/doc/arm/man.isc-hmac-fixup.html
external/bsd/bind/dist/doc/arm/man.named-checkconf.html
external/bsd/bind/dist/doc/arm/man.named-checkzone.html
external/bsd/bind/dist/doc/arm/man.named-journalprint.html
external/bsd/bind/dist/doc/arm/man.named-rrchecker.html
external/bsd/bind/dist/doc/arm/man.named.html
external/bsd/bind/dist/doc/arm/man.nsec3hash.html
external/bsd/bind/dist/doc/arm/man.nsupdate.html
external/bsd/bind/dist/doc/arm/man.rndc-confgen.html
external/bsd/bind/dist/doc/arm/man.rndc.conf.html
external/bsd/bind/dist/doc/arm/man.rndc.html
external/bsd/bind/dist/doc/arm/notes.html
external/bsd/bind/dist/doc/arm/notes.pdf
external/bsd/bind/dist/doc/arm/notes.xml
external/bsd/bind/dist/doc/misc/rfc-compliance
external/bsd/bind/dist/isc-config.sh.in
external/bsd/bind/dist/lib/bind9/api
external/bsd/bind/dist/lib/bind9/check.c
external/bsd/bind/dist/lib/dns/adb.c
external/bsd/bind/dist/lib/dns/api
external/bsd/bind/dist/lib/dns/cache.c
external/bsd/bind/dist/lib/dns/callbacks.c
external/bsd/bind/dist/lib/dns/client.c
external/bsd/bind/dist/lib/dns/diff.c
external/bsd/bind/dist/lib/dns/dispatch.c
external/bsd/bind/dist/lib/dns/dlz.c
external/bsd/bind/dist/lib/dns/dnssec.c
external/bsd/bind/dist/lib/dns/dst_api.c
external/bsd/bind/dist/lib/dns/dst_openssl.h
external/bsd/bind/dist/lib/dns/dst_parse.c
external/bsd/bind/dist/lib/dns/geoip.c
external/bsd/bind/dist/lib/dns/gssapi_link.c
external/bsd/bind/dist/lib/dns/gssapictx.c
external/bsd/bind/dist/lib/dns/hmac_link.c
external/bsd/bind/dist/lib/dns/include/dns/adb.h
external/bsd/bind/dist/lib/dns/include/dns/log.h
external/bsd/bind/dist/lib/dns/include/dns/message.h
external/bsd/bind/dist/lib/dns/include/dns/name.h
external/bsd/bind/dist/lib/dns/include/dns/resolver.h
external/bsd/bind/dist/lib/dns/include/dns/result.h
external/bsd/bind/dist/lib/dns/include/dns/rrl.h
external/bsd/bind/dist/lib/dns/include/dns/stats.h
external/bsd/bind/dist/lib/dns/include/dns/types.h
external/bsd/bind/dist/lib/dns/include/dns/update.h
external/bsd/bind/dist/lib/dns/include/dns/zone.h
external/bsd/bind/dist/lib/dns/include/dst/dst.h
external/bsd/bind/dist/lib/dns/journal.c
external/bsd/bind/dist/lib/dns/keytable.c
external/bsd/bind/dist/lib/dns/log.c
external/bsd/bind/dist/lib/dns/master.c
external/bsd/bind/dist/lib/dns/message.c
external/bsd/bind/dist/lib/dns/name.c
external/bsd/bind/dist/lib/dns/ncache.c
external/bsd/bind/dist/lib/dns/nsec.c
external/bsd/bind/dist/lib/dns/nsec3.c
external/bsd/bind/dist/lib/dns/openssl_link.c
external/bsd/bind/dist/lib/dns/openssldh_link.c
external/bsd/bind/dist/lib/dns/openssldsa_link.c
external/bsd/bind/dist/lib/dns/opensslecdsa_link.c
external/bsd/bind/dist/lib/dns/opensslgost_link.c
external/bsd/bind/dist/lib/dns/opensslrsa_link.c
external/bsd/bind/dist/lib/dns/order.c
external/bsd/bind/dist/lib/dns/pkcs11dh_link.c
external/bsd/bind/dist/lib/dns/pkcs11dsa_link.c
external/bsd/bind/dist/lib/dns/pkcs11ecdsa_link.c
external/bsd/bind/dist/lib/dns/pkcs11gost_link.c
external/bsd/bind/dist/lib/dns/pkcs11rsa_link.c
external/bsd/bind/dist/lib/dns/private.c
external/bsd/bind/dist/lib/dns/rbt.c
external/bsd/bind/dist/lib/dns/rbtdb.c
external/bsd/bind/dist/lib/dns/rcode.c
external/bsd/bind/dist/lib/dns/rdata.c
external/bsd/bind/dist/lib/dns/rdata/any_255/tsig_250.c
external/bsd/bind/dist/lib/dns/rdata/ch_3/a_1.c
external/bsd/bind/dist/lib/dns/rdata/generic/afsdb_18.c
external/bsd/bind/dist/lib/dns/rdata/generic/caa_257.c
external/bsd/bind/dist/lib/dns/rdata/generic/cdnskey_60.c
external/bsd/bind/dist/lib/dns/rdata/generic/cds_59.c
external/bsd/bind/dist/lib/dns/rdata/generic/cert_37.c
external/bsd/bind/dist/lib/dns/rdata/generic/cname_5.c
external/bsd/bind/dist/lib/dns/rdata/generic/dlv_32769.c
external/bsd/bind/dist/lib/dns/rdata/generic/dname_39.c
external/bsd/bind/dist/lib/dns/rdata/generic/dnskey_48.c
external/bsd/bind/dist/lib/dns/rdata/generic/ds_43.c
external/bsd/bind/dist/lib/dns/rdata/generic/eui48_108.c
external/bsd/bind/dist/lib/dns/rdata/generic/eui64_109.c
external/bsd/bind/dist/lib/dns/rdata/generic/gpos_27.c
external/bsd/bind/dist/lib/dns/rdata/generic/hinfo_13.c
external/bsd/bind/dist/lib/dns/rdata/generic/hip_55.c
external/bsd/bind/dist/lib/dns/rdata/generic/ipseckey_45.c
external/bsd/bind/dist/lib/dns/rdata/generic/isdn_20.c
external/bsd/bind/dist/lib/dns/rdata/generic/key_25.c
external/bsd/bind/dist/lib/dns/rdata/generic/keydata_65533.c
external/bsd/bind/dist/lib/dns/rdata/generic/l32_105.c
external/bsd/bind/dist/lib/dns/rdata/generic/l64_106.c
external/bsd/bind/dist/lib/dns/rdata/generic/loc_29.c
external/bsd/bind/dist/lib/dns/rdata/generic/lp_107.c
external/bsd/bind/dist/lib/dns/rdata/generic/mb_7.c
external/bsd/bind/dist/lib/dns/rdata/generic/md_3.c
external/bsd/bind/dist/lib/dns/rdata/generic/mf_4.c
external/bsd/bind/dist/lib/dns/rdata/generic/mg_8.c
external/bsd/bind/dist/lib/dns/rdata/generic/minfo_14.c
external/bsd/bind/dist/lib/dns/rdata/generic/mr_9.c
external/bsd/bind/dist/lib/dns/rdata/generic/mx_15.c
external/bsd/bind/dist/lib/dns/rdata/generic/naptr_35.c
external/bsd/bind/dist/lib/dns/rdata/generic/nid_104.c
external/bsd/bind/dist/lib/dns/rdata/generic/ns_2.c
external/bsd/bind/dist/lib/dns/rdata/generic/nsec3_50.c
external/bsd/bind/dist/lib/dns/rdata/generic/nsec3param_51.c
external/bsd/bind/dist/lib/dns/rdata/generic/nsec_47.c
external/bsd/bind/dist/lib/dns/rdata/generic/null_10.c
external/bsd/bind/dist/lib/dns/rdata/generic/nxt_30.c
external/bsd/bind/dist/lib/dns/rdata/generic/openpgpkey_61.c
external/bsd/bind/dist/lib/dns/rdata/generic/opt_41.c
external/bsd/bind/dist/lib/dns/rdata/generic/proforma.c
external/bsd/bind/dist/lib/dns/rdata/generic/ptr_12.c
external/bsd/bind/dist/lib/dns/rdata/generic/rp_17.c
external/bsd/bind/dist/lib/dns/rdata/generic/rrsig_46.c
external/bsd/bind/dist/lib/dns/rdata/generic/rt_21.c
external/bsd/bind/dist/lib/dns/rdata/generic/sig_24.c
external/bsd/bind/dist/lib/dns/rdata/generic/soa_6.c
external/bsd/bind/dist/lib/dns/rdata/generic/spf_99.c
external/bsd/bind/dist/lib/dns/rdata/generic/sshfp_44.c
external/bsd/bind/dist/lib/dns/rdata/generic/tkey_249.c
external/bsd/bind/dist/lib/dns/rdata/generic/tlsa_52.c
external/bsd/bind/dist/lib/dns/rdata/generic/txt_16.c
external/bsd/bind/dist/lib/dns/rdata/generic/unspec_103.c
external/bsd/bind/dist/lib/dns/rdata/generic/uri_256.c
external/bsd/bind/dist/lib/dns/rdata/generic/x25_19.c
external/bsd/bind/dist/lib/dns/rdata/hs_4/a_1.c
external/bsd/bind/dist/lib/dns/rdata/in_1/a6_38.c
external/bsd/bind/dist/lib/dns/rdata/in_1/a_1.c
external/bsd/bind/dist/lib/dns/rdata/in_1/aaaa_28.c
external/bsd/bind/dist/lib/dns/rdata/in_1/apl_42.c
external/bsd/bind/dist/lib/dns/rdata/in_1/dhcid_49.c
external/bsd/bind/dist/lib/dns/rdata/in_1/kx_36.c
external/bsd/bind/dist/lib/dns/rdata/in_1/nsap-ptr_23.c
external/bsd/bind/dist/lib/dns/rdata/in_1/nsap_22.c
external/bsd/bind/dist/lib/dns/rdata/in_1/px_26.c
external/bsd/bind/dist/lib/dns/rdata/in_1/srv_33.c
external/bsd/bind/dist/lib/dns/rdata/in_1/wks_11.c
external/bsd/bind/dist/lib/dns/request.c
external/bsd/bind/dist/lib/dns/resolver.c
external/bsd/bind/dist/lib/dns/result.c
external/bsd/bind/dist/lib/dns/rootns.c
external/bsd/bind/dist/lib/dns/rpz.c
external/bsd/bind/dist/lib/dns/rrl.c
external/bsd/bind/dist/lib/dns/sdb.c
external/bsd/bind/dist/lib/dns/sdlz.c
external/bsd/bind/dist/lib/dns/spnego.c
external/bsd/bind/dist/lib/dns/tcpmsg.c
external/bsd/bind/dist/lib/dns/tests/geoip_test.c
external/bsd/bind/dist/lib/dns/tests/gost_test.c
external/bsd/bind/dist/lib/dns/tests/master_test.c
external/bsd/bind/dist/lib/dns/tests/rbt_serialize_test.c
external/bsd/bind/dist/lib/dns/tests/rbt_test.c
external/bsd/bind/dist/lib/dns/tests/rdatasetstats_test.c
external/bsd/bind/dist/lib/dns/tkey.c
external/bsd/bind/dist/lib/dns/tsig.c
external/bsd/bind/dist/lib/dns/update.c
external/bsd/bind/dist/lib/dns/view.c
external/bsd/bind/dist/lib/dns/win32/libdns.def.in
external/bsd/bind/dist/lib/dns/xfrin.c
external/bsd/bind/dist/lib/dns/zone.c
external/bsd/bind/dist/lib/irs/api
external/bsd/bind/dist/lib/irs/getaddrinfo.c
external/bsd/bind/dist/lib/isc/api
external/bsd/bind/dist/lib/isc/app_api.c
external/bsd/bind/dist/lib/isc/assertions.c
external/bsd/bind/dist/lib/isc/backtrace.c
external/bsd/bind/dist/lib/isc/commandline.c
external/bsd/bind/dist/lib/isc/entropy.c
external/bsd/bind/dist/lib/isc/error.c
external/bsd/bind/dist/lib/isc/heap.c
external/bsd/bind/dist/lib/isc/hmacmd5.c
external/bsd/bind/dist/lib/isc/hmacsha.c
external/bsd/bind/dist/lib/isc/httpd.c
external/bsd/bind/dist/lib/isc/include/isc/app.h
external/bsd/bind/dist/lib/isc/include/isc/json.h
external/bsd/bind/dist/lib/isc/include/isc/mem.h
external/bsd/bind/dist/lib/isc/include/isc/platform.h.in
external/bsd/bind/dist/lib/isc/include/isc/print.h
external/bsd/bind/dist/lib/isc/include/isc/safe.h
external/bsd/bind/dist/lib/isc/include/isc/util.h
external/bsd/bind/dist/lib/isc/lex.c
external/bsd/bind/dist/lib/isc/lib.c
external/bsd/bind/dist/lib/isc/mem.c
external/bsd/bind/dist/lib/isc/netaddr.c
external/bsd/bind/dist/lib/isc/nothreads/include/isc/mutex.h
external/bsd/bind/dist/lib/isc/pk11.c
external/bsd/bind/dist/lib/isc/pool.c
external/bsd/bind/dist/lib/isc/print.c
external/bsd/bind/dist/lib/isc/pthreads/mutex.c
external/bsd/bind/dist/lib/isc/regex.c
external/bsd/bind/dist/lib/isc/rwlock.c
external/bsd/bind/dist/lib/isc/safe.c
external/bsd/bind/dist/lib/isc/socket_api.c
external/bsd/bind/dist/lib/isc/stats.c
external/bsd/bind/dist/lib/isc/task.c
external/bsd/bind/dist/lib/isc/tests/Makefile.in
external/bsd/bind/dist/lib/isc/tests/hash_test.c
external/bsd/bind/dist/lib/isc/tests/mem_test.c
external/bsd/bind/dist/lib/isc/tests/print_test.c
external/bsd/bind/dist/lib/isc/tests/regex_test.c
external/bsd/bind/dist/lib/isc/tests/safe_test.c
external/bsd/bind/dist/lib/isc/tests/socket_test.c
external/bsd/bind/dist/lib/isc/timer.c
external/bsd/bind/dist/lib/isc/unix/app.c
external/bsd/bind/dist/lib/isc/unix/file.c
external/bsd/bind/dist/lib/isc/unix/ifiter_ioctl.c
external/bsd/bind/dist/lib/isc/unix/ifiter_sysctl.c
external/bsd/bind/dist/lib/isc/unix/include/isc/offset.h
external/bsd/bind/dist/lib/isc/unix/net.c
external/bsd/bind/dist/lib/isc/unix/socket.c
external/bsd/bind/dist/lib/isc/win32/interfaceiter.c
external/bsd/bind/dist/lib/isc/win32/libisc.def.exclude
external/bsd/bind/dist/lib/isc/win32/libisc.def.in
external/bsd/bind/dist/lib/isc/win32/libisc.vcxproj.in
external/bsd/bind/dist/lib/isc/win32/net.c
external/bsd/bind/dist/lib/isc/win32/win32os.c
external/bsd/bind/dist/lib/isccc/Makefile.in
external/bsd/bind/dist/lib/isccc/alist.c
external/bsd/bind/dist/lib/isccc/api
external/bsd/bind/dist/lib/isccc/cc.c
external/bsd/bind/dist/lib/isccc/sexpr.c
external/bsd/bind/dist/lib/isccfg/api
external/bsd/bind/dist/lib/isccfg/include/isccfg/cfg.h
external/bsd/bind/dist/lib/isccfg/include/isccfg/grammar.h
external/bsd/bind/dist/lib/isccfg/namedconf.c
external/bsd/bind/dist/lib/isccfg/parser.c
external/bsd/bind/dist/lib/isccfg/win32/libisccfg.def
external/bsd/bind/dist/lib/lwres/api
external/bsd/bind/dist/lib/lwres/herror.c
external/bsd/bind/dist/lib/lwres/print.c
external/bsd/bind/dist/lib/lwres/win32/socket.c
external/bsd/bind/dist/lib/samples/nsprobe.c
external/bsd/bind/dist/lib/samples/resolve.c
external/bsd/bind/dist/lib/samples/sample-async.c
external/bsd/bind/dist/lib/samples/sample-gai.c
external/bsd/bind/dist/lib/samples/sample-request.c
external/bsd/bind/dist/lib/samples/sample-update.c
external/bsd/bind/dist/srcid
external/bsd/bind/dist/version
external/bsd/bind/dist/win32utils/Configure
external/bsd/bind/dist/win32utils/index.html
external/bsd/bind/dist/win32utils/legacy/BuildSetup.bat.in
external/bsd/bind/include/config.h
external/bsd/bind/include/dns/enumclass.h
external/bsd/bind/include/dns/enumtype.h
external/bsd/bind/include/dns/rdatastruct.h
external/bsd/bind/include/isc/platform.h
external/bsd/bind/include/lwres/platform.h
external/bsd/bind/lib/libbind9/shlib_version
external/bsd/bind/lib/libdns/shlib_version
external/bsd/bind/lib/libirs/shlib_version
external/bsd/bind/lib/libisc/shlib_version
external/bsd/bind/lib/libisccc/shlib_version
external/bsd/bind/lib/libisccfg/shlib_version
external/bsd/bind/lib/liblwres/shlib_version
--- a/distrib/sets/lists/base/ad.aarch64	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/base/ad.aarch64	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: ad.aarch64,v 1.2.2.7.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: ad.aarch64,v 1.2.2.7.2.2 2016/03/13 08:00:40 martin Exp $
 ./lib/eabi					base-compat-shlib	compat
 ./lib/eabi/npf					base-npf-shlib		compat
 ./lib/eabi/npf/ext_log.so			base-npf-shlib		compat,pic
@@ -98,7 +98,7 @@
 ./usr/lib/eabi/libbfd.so.13			base-compat-shlib	compat,pic,binutils
 ./usr/lib/eabi/libbfd.so.13.0			base-compat-shlib	compat,pic,binutils
 ./usr/lib/eabi/libbind9.so.8			base-compat-shlib	compat,pic
-./usr/lib/eabi/libbind9.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/eabi/libbind9.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libblacklist.so.0			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libblacklist.so.0.0		base-compat-shlib	compat,pic
 ./usr/lib/eabi/libbluetooth.so.4			base-compat-shlib	compat,pic
@@ -128,7 +128,7 @@
 ./usr/lib/eabi/libdm.so.0				base-compat-shlib	compat,pic
 ./usr/lib/eabi/libdm.so.0.0			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libdns.so.8			base-compat-shlib	compat,pic
-./usr/lib/eabi/libdns.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/eabi/libdns.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libdns_sd.so.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/eabi/libdns_sd.so.0.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/eabi/libdwarf.so.1			base-compat-shlib	compat,pic
@@ -174,13 +174,13 @@
 ./usr/lib/eabi/libipsec.so.3			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libipsec.so.3.0			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libirs.so.8			base-compat-shlib	compat,pic
-./usr/lib/eabi/libirs.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/eabi/libirs.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libisc.so.8			base-compat-shlib	compat,pic
-./usr/lib/eabi/libisc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/eabi/libisc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libisccc.so.8			base-compat-shlib	compat,pic
-./usr/lib/eabi/libisccc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/eabi/libisccc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libisccfg.so.8			base-compat-shlib	compat,pic
-./usr/lib/eabi/libisccfg.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/eabi/libisccfg.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/eabi/libiscsi.so.2			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/eabi/libiscsi.so.2.0			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/eabi/libisns.so.0			base-compat-shlib	compat,pic
@@ -208,7 +208,7 @@
 ./usr/lib/eabi/liblutok.so.2			base-compat-shlib	compat,pic,kyua
 ./usr/lib/eabi/liblutok.so.2.0			base-compat-shlib	compat,pic,kyua
 ./usr/lib/eabi/liblwres.so.8			base-compat-shlib	compat,pic
-./usr/lib/eabi/liblwres.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/eabi/liblwres.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/eabi/liblzf.so.1			base-compat-shlib	compat,pic
 ./usr/lib/eabi/liblzf.so.1.0			base-compat-shlib	compat,pic
 ./usr/lib/eabi/liblzma.so.1			base-compat-shlib	compat,pic
@@ -414,7 +414,7 @@
 #./usr/lib/eabihf/libbfd.so.13			base-compat-shlib	compat,pic,binutils
 #./usr/lib/eabihf/libbfd.so.13.0			base-compat-shlib	compat,pic,binutils
 #./usr/lib/eabihf/libbind9.so.8			base-compat-shlib	compat,pic
-#./usr/lib/eabihf/libbind9.so.8.2			base-compat-shlib	compat,pic
+#./usr/lib/eabihf/libbind9.so.8.4			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libbluetooth.so.4			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libbluetooth.so.4.2		base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libbsdmalloc.so.0			base-compat-shlib	compat,pic
@@ -442,7 +442,7 @@
 #./usr/lib/eabihf/libdm.so.0				base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libdm.so.0.0			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libdns.so.8			base-compat-shlib	compat,pic
-#./usr/lib/eabihf/libdns.so.8.2			base-compat-shlib	compat,pic
+#./usr/lib/eabihf/libdns.so.8.4			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libdns_sd.so.0			base-compat-shlib	compat,pic,mdns
 #./usr/lib/eabihf/libdns_sd.so.0.0			base-compat-shlib	compat,pic,mdns
 #./usr/lib/eabihf/libdwarf.so.1			base-compat-shlib	compat,pic
@@ -488,13 +488,13 @@
 #./usr/lib/eabihf/libipsec.so.3			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libipsec.so.3.0			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libirs.so.8			base-compat-shlib	compat,pic
-#./usr/lib/eabihf/libirs.so.8.2			base-compat-shlib	compat,pic
+#./usr/lib/eabihf/libirs.so.8.4			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libisc.so.8			base-compat-shlib	compat,pic
-#./usr/lib/eabihf/libisc.so.8.2			base-compat-shlib	compat,pic
+#./usr/lib/eabihf/libisc.so.8.4			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libisccc.so.8			base-compat-shlib	compat,pic
-#./usr/lib/eabihf/libisccc.so.8.2			base-compat-shlib	compat,pic
+#./usr/lib/eabihf/libisccc.so.8.4			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libisccfg.so.8			base-compat-shlib	compat,pic
-#./usr/lib/eabihf/libisccfg.so.8.2			base-compat-shlib	compat,pic
+#./usr/lib/eabihf/libisccfg.so.8.4			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/libiscsi.so.2			base-compat-shlib	compat,pic,iscsi
 #./usr/lib/eabihf/libiscsi.so.2.0			base-compat-shlib	compat,pic,iscsi
 #./usr/lib/eabihf/libisns.so.0			base-compat-shlib	compat,pic
@@ -522,7 +522,7 @@
 #./usr/lib/eabihf/liblutok.so.2			base-compat-shlib	compat,pic,kyua
 #./usr/lib/eabihf/liblutok.so.2.0			base-compat-shlib	compat,pic,kyua
 #./usr/lib/eabihf/liblwres.so.8			base-compat-shlib	compat,pic
-#./usr/lib/eabihf/liblwres.so.8.2			base-compat-shlib	compat,pic
+#./usr/lib/eabihf/liblwres.so.8.4			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/liblzf.so.1			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/liblzf.so.1.0			base-compat-shlib	compat,pic
 #./usr/lib/eabihf/liblzma.so.1			base-compat-shlib	compat,pic
@@ -728,7 +728,7 @@
 ./usr/lib/oabi/libbfd.so.13			base-compat-shlib	compat,pic,binutils
 ./usr/lib/oabi/libbfd.so.13.0			base-compat-shlib	compat,pic,binutils
 ./usr/lib/oabi/libbind9.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libbind9.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libbind9.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libblacklist.so.0		base-compat-shlib	compat,pic
 ./usr/lib/oabi/libblacklist.so.0.0		base-compat-shlib	compat,pic
 ./usr/lib/oabi/libbluetooth.so.4		base-compat-shlib	compat,pic
@@ -756,7 +756,7 @@
 ./usr/lib/oabi/libdm.so.0			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libdm.so.0.0			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libdns.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libdns.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libdns.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libdns_sd.so.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/oabi/libdns_sd.so.0.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/oabi/libdwarf.so.1			base-compat-shlib	compat,pic
@@ -802,13 +802,13 @@
 ./usr/lib/oabi/libipsec.so.3			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libipsec.so.3.0			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libirs.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libirs.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libirs.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libisc.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libisc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libisc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libisccc.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libisccc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libisccc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libisccfg.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libisccfg.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libisccfg.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libiscsi.so.2			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/oabi/libiscsi.so.2.0			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/oabi/libisns.so.0			base-compat-shlib	compat,pic
@@ -836,7 +836,7 @@
 ./usr/lib/oabi/liblutok.so.1			base-compat-shlib	compat,pic,kyua
 ./usr/lib/oabi/liblutok.so.1.0			base-compat-shlib	compat,pic,kyua
 ./usr/lib/oabi/liblwres.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/liblwres.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/liblwres.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/liblzf.so.1			base-compat-shlib	compat,pic
 ./usr/lib/oabi/liblzf.so.1.0			base-compat-shlib	compat,pic
 ./usr/lib/oabi/liblzma.so.1			base-compat-shlib	compat,pic
--- a/distrib/sets/lists/base/ad.arm	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/base/ad.arm	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: ad.arm,v 1.54.2.10.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: ad.arm,v 1.54.2.10.2.2 2016/03/13 08:00:40 martin Exp $
 ./lib/oabi					base-compat-shlib	compat
 ./lib/oabi/npf					base-npf-shlib		compat
 ./lib/oabi/npf/ext_log.so			base-npf-shlib		compat,pic
@@ -88,7 +88,7 @@
 ./usr/lib/oabi/libbfd.so.13			base-compat-shlib	compat,pic,binutils
 ./usr/lib/oabi/libbfd.so.13.0			base-compat-shlib	compat,pic,binutils
 ./usr/lib/oabi/libbind9.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libbind9.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libbind9.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libblacklist.so.0		base-compat-shlib	compat,pic
 ./usr/lib/oabi/libblacklist.so.0.0		base-compat-shlib	compat,pic
 ./usr/lib/oabi/libbluetooth.so.4		base-compat-shlib	compat,pic
@@ -124,7 +124,7 @@
 ./usr/lib/oabi/libdm.so.0			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libdm.so.0.0			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libdns.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libdns.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libdns.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libdns_sd.so.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/oabi/libdns_sd.so.0.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/oabi/libdwarf.so.1			base-compat-shlib	compat,pic
@@ -172,13 +172,13 @@
 ./usr/lib/oabi/libipsec.so.3			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libipsec.so.3.0			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libirs.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libirs.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libirs.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libisc.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libisc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libisc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libisccc.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libisccc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libisccc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libisccfg.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/libisccfg.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/libisccfg.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/libiscsi.so.2			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/oabi/libiscsi.so.2.0			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/oabi/libisns.so.0			base-compat-shlib	compat,pic
@@ -208,7 +208,7 @@
 ./usr/lib/oabi/liblutok.so.2			base-compat-shlib	compat,pic,kyua
 ./usr/lib/oabi/liblutok.so.2.0			base-compat-shlib	compat,pic,kyua
 ./usr/lib/oabi/liblwres.so.8			base-compat-shlib	compat,pic
-./usr/lib/oabi/liblwres.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/oabi/liblwres.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/oabi/liblzf.so.1			base-compat-shlib	compat,pic
 ./usr/lib/oabi/liblzf.so.1.0			base-compat-shlib	compat,pic
 ./usr/lib/oabi/liblzma.so.1			base-compat-shlib	compat,pic
--- a/distrib/sets/lists/base/ad.mips	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/base/ad.mips	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: ad.mips,v 1.48.2.10.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: ad.mips,v 1.48.2.10.2.2 2016/03/13 08:00:40 martin Exp $
 ./lib/64					base-compat-shlib	compat,arch64
 ./lib/64/npf					base-npf-shlib		compat,arch64
 ./lib/64/npf/ext_log.so				base-npf-shlib		compat,pic,arch64
@@ -86,7 +86,7 @@
 ./usr/lib/64/libbfd.so.13			base-compat-shlib	compat,pic,binutils,arch64
 ./usr/lib/64/libbfd.so.13.0			base-compat-shlib	compat,pic,binutils,arch64
 ./usr/lib/64/libbind9.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/64/libbind9.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/64/libbind9.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libblacklist.so.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libblacklist.so.0.0		base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libbluetooth.so.4			base-compat-shlib	compat,pic,arch64
@@ -120,7 +120,7 @@
 ./usr/lib/64/libdm.so.0				base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libdm.so.0.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libdns.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/64/libdns.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/64/libdns.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libdns_sd.so.0			base-compat-shlib	compat,pic,mdns,arch64
 ./usr/lib/64/libdns_sd.so.0.0			base-compat-shlib	compat,pic,mdns,arch64
 ./usr/lib/64/libdwarf.so.1			base-compat-shlib	compat,pic,arch64
@@ -168,13 +168,13 @@
 ./usr/lib/64/libipsec.so.3			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libipsec.so.3.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libirs.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/64/libirs.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/64/libirs.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libisc.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/64/libisc.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/64/libisc.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libisccc.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/64/libisccc.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/64/libisccc.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libisccfg.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/64/libisccfg.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/64/libisccfg.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/libiscsi.so.2			base-compat-shlib	compat,pic,iscsi,arch64
 ./usr/lib/64/libiscsi.so.2.0			base-compat-shlib	compat,pic,iscsi,arch64
 ./usr/lib/64/libisns.so.0			base-compat-shlib	compat,pic,arch64
@@ -204,7 +204,7 @@
 ./usr/lib/64/liblutok.so.2			base-compat-shlib	compat,pic,kyua,arch64
 ./usr/lib/64/liblutok.so.2.0			base-compat-shlib	compat,pic,kyua,arch64
 ./usr/lib/64/liblwres.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/64/liblwres.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/64/liblwres.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/liblzf.so.1			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/liblzf.so.1.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/64/liblzma.so.1			base-compat-shlib	compat,pic,arch64
@@ -436,7 +436,7 @@
 ./usr/lib/o32/libbfd.so.13			base-compat-shlib	compat,pic,binutils,arch64
 ./usr/lib/o32/libbfd.so.13.0			base-compat-shlib	compat,pic,binutils,arch64
 ./usr/lib/o32/libbind9.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/o32/libbind9.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/o32/libbind9.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libblacklist.so.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libblacklist.so.0.0		base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libbluetooth.so.4			base-compat-shlib	compat,pic,arch64
@@ -464,7 +464,7 @@
 ./usr/lib/o32/libdm.so.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libdm.so.0.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libdns.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/o32/libdns.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/o32/libdns.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libdns_sd.so.0			base-compat-shlib	compat,pic,mdns,arch64
 ./usr/lib/o32/libdns_sd.so.0.0			base-compat-shlib	compat,pic,mdns,arch64
 ./usr/lib/o32/libdwarf.so.1			base-compat-shlib	compat,pic,arch64
@@ -512,13 +512,13 @@
 ./usr/lib/o32/libipsec.so.3			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libipsec.so.3.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libirs.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/o32/libirs.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/o32/libirs.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libisc.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/o32/libisc.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/o32/libisc.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libisccc.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/o32/libisccc.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/o32/libisccc.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libisccfg.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/o32/libisccfg.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/o32/libisccfg.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/libiscsi.so.2			base-compat-shlib	compat,pic,iscsi,arch64
 ./usr/lib/o32/libiscsi.so.2.0			base-compat-shlib	compat,pic,iscsi,arch64
 ./usr/lib/o32/libisns.so.0			base-compat-shlib	compat,pic,arch64
@@ -546,7 +546,7 @@
 ./usr/lib/o32/liblutok.so.1			base-compat-shlib	compat,pic,kyua,arch64
 ./usr/lib/o32/liblutok.so.1.0			base-compat-shlib	compat,pic,kyua,arch64
 ./usr/lib/o32/liblwres.so.8			base-compat-shlib	compat,pic,arch64
-./usr/lib/o32/liblwres.so.8.2			base-compat-shlib	compat,pic,arch64
+./usr/lib/o32/liblwres.so.8.4			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/liblzf.so.1			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/liblzf.so.1.0			base-compat-shlib	compat,pic,arch64
 ./usr/lib/o32/liblzma.so.1			base-compat-shlib	compat,pic,arch64
--- a/distrib/sets/lists/base/ad.powerpc	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/base/ad.powerpc	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: ad.powerpc,v 1.17.2.8.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: ad.powerpc,v 1.17.2.8.2.2 2016/03/13 08:00:40 martin Exp $
 ./lib/powerpc					base-npf-shlib		compat,arch64
 ./lib/powerpc/npf				base-npf-shlib		compat,arch64
 ./lib/powerpc/npf/ext_log.so			base-npf-shlib		compat,arch64,pic
@@ -75,7 +75,7 @@
 ./usr/lib/powerpc/libbfd.so.13			base-compat-shlib	compat,arch64,pic,binutils
 ./usr/lib/powerpc/libbfd.so.13.0		base-compat-shlib	compat,arch64,pic,binutils
 ./usr/lib/powerpc/libbind9.so.8			base-compat-shlib	compat,arch64,pic
-./usr/lib/powerpc/libbind9.so.8.2		base-compat-shlib	compat,arch64,pic
+./usr/lib/powerpc/libbind9.so.8.4		base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libblacklist.so.0		base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libblacklist.so.0.0		base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libbluetooth.so.4		base-compat-shlib	compat,arch64,pic
@@ -105,7 +105,7 @@
 ./usr/lib/powerpc/libdm.so.0			base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libdm.so.0.0			base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libdns.so.8			base-compat-shlib	compat,arch64,pic
-./usr/lib/powerpc/libdns.so.8.2			base-compat-shlib	compat,arch64,pic
+./usr/lib/powerpc/libdns.so.8.4			base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libdns_sd.so.0		base-compat-shlib	compat,arch64,pic,mdns
 ./usr/lib/powerpc/libdns_sd.so.0.0		base-compat-shlib	compat,arch64,pic,mdns
 ./usr/lib/powerpc/libdwarf.so.1			base-compat-shlib	compat,arch64,pic
@@ -151,13 +151,13 @@
 ./usr/lib/powerpc/libipsec.so.3			base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libipsec.so.3.0		base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libirs.so.8			base-compat-shlib	compat,arch64,pic
-./usr/lib/powerpc/libirs.so.8.2			base-compat-shlib	compat,arch64,pic
+./usr/lib/powerpc/libirs.so.8.4			base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libisc.so.8			base-compat-shlib	compat,arch64,pic
-./usr/lib/powerpc/libisc.so.8.2			base-compat-shlib	compat,arch64,pic
+./usr/lib/powerpc/libisc.so.8.4			base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libisccc.so.8			base-compat-shlib	compat,arch64,pic
-./usr/lib/powerpc/libisccc.so.8.2		base-compat-shlib	compat,arch64,pic
+./usr/lib/powerpc/libisccc.so.8.4		base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libisccfg.so.8		base-compat-shlib	compat,arch64,pic
-./usr/lib/powerpc/libisccfg.so.8.2		base-compat-shlib	compat,arch64,pic
+./usr/lib/powerpc/libisccfg.so.8.4		base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/libiscsi.so.2			base-compat-shlib	compat,arch64,pic,iscsi
 ./usr/lib/powerpc/libiscsi.so.2.0		base-compat-shlib	compat,arch64,pic,iscsi
 ./usr/lib/powerpc/libisns.so.0			base-compat-shlib	compat,arch64,pic
@@ -187,7 +187,7 @@
 ./usr/lib/powerpc/liblutok.so.2			base-compat-shlib	compat,arch64,pic,kyua
 ./usr/lib/powerpc/liblutok.so.2.0		base-compat-shlib	compat,arch64,pic,kyua
 ./usr/lib/powerpc/liblwres.so.8			base-compat-shlib	compat,arch64,pic
-./usr/lib/powerpc/liblwres.so.8.2		base-compat-shlib	compat,arch64,pic
+./usr/lib/powerpc/liblwres.so.8.4		base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/liblzf.so.1			base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/liblzf.so.1.0			base-compat-shlib	compat,arch64,pic
 ./usr/lib/powerpc/liblzma.so.1			base-compat-shlib	compat,arch64,pic
--- a/distrib/sets/lists/base/md.amd64	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/base/md.amd64	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: md.amd64,v 1.244.2.9.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: md.amd64,v 1.244.2.9.2.2 2016/03/13 08:00:40 martin Exp $
 ./dev/lms0					base-obsolete		obsolete
 ./dev/mms0					base-obsolete		obsolete
 ./lib/i386					base-compat-shlib		compat
@@ -78,7 +78,7 @@
 ./usr/lib/i386/libbfd.so.13			base-compat-shlib	compat,pic,binutils
 ./usr/lib/i386/libbfd.so.13.0			base-compat-shlib	compat,pic,binutils
 ./usr/lib/i386/libbind9.so.8			base-compat-shlib	compat,pic
-./usr/lib/i386/libbind9.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/i386/libbind9.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/i386/libblacklist.so.0		base-compat-shlib	compat,pic
 ./usr/lib/i386/libblacklist.so.0.0		base-compat-shlib	compat,pic
 ./usr/lib/i386/libbluetooth.so.4		base-compat-shlib	compat,pic
@@ -112,7 +112,7 @@
 ./usr/lib/i386/libdm.so.0			base-compat-shlib	compat,pic
 ./usr/lib/i386/libdm.so.0.0			base-compat-shlib	compat,pic
 ./usr/lib/i386/libdns.so.8			base-compat-shlib	compat,pic
-./usr/lib/i386/libdns.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/i386/libdns.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/i386/libdns_sd.so.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/i386/libdns_sd.so.0.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/i386/libdwarf.so.1			base-compat-shlib	compat,pic
@@ -163,13 +163,13 @@
 ./usr/lib/i386/libipsec.so.3			base-compat-shlib	compat,pic
 ./usr/lib/i386/libipsec.so.3.0			base-compat-shlib	compat,pic
 ./usr/lib/i386/libirs.so.8			base-compat-shlib	compat,pic
-./usr/lib/i386/libirs.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/i386/libirs.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/i386/libisc.so.8			base-compat-shlib	compat,pic
-./usr/lib/i386/libisc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/i386/libisc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/i386/libisccc.so.8			base-compat-shlib	compat,pic
-./usr/lib/i386/libisccc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/i386/libisccc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/i386/libisccfg.so.8			base-compat-shlib	compat,pic
-./usr/lib/i386/libisccfg.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/i386/libisccfg.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/i386/libiscsi.so.2			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/i386/libiscsi.so.2.0			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/i386/libisns.so.0			base-compat-shlib	compat,pic
@@ -201,7 +201,7 @@
 ./usr/lib/i386/liblutok.so.2			base-compat-shlib	compat,pic,kyua
 ./usr/lib/i386/liblutok.so.2.0			base-compat-shlib	compat,pic,kyua
 ./usr/lib/i386/liblwres.so.8			base-compat-shlib	compat,pic
-./usr/lib/i386/liblwres.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/i386/liblwres.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/i386/liblzf.so.1			base-compat-shlib	compat,pic
 ./usr/lib/i386/liblzf.so.1.0			base-compat-shlib	compat,pic
 ./usr/lib/i386/liblzma.so.1			base-compat-shlib	compat,pic
--- a/distrib/sets/lists/base/md.sparc64	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/base/md.sparc64	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: md.sparc64,v 1.232.2.9.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: md.sparc64,v 1.232.2.9.2.2 2016/03/13 08:00:40 martin Exp $
 ./lib/sparc					base-npf-shlib		compat
 ./lib/sparc/npf					base-npf-shlib		compat
 ./lib/sparc/npf/ext_log.so			base-npf-shlib		compat,pic
@@ -76,7 +76,7 @@
 ./usr/lib/sparc/libbfd.so.13			base-compat-shlib	compat,pic,binutils
 ./usr/lib/sparc/libbfd.so.13.0			base-compat-shlib	compat,pic,binutils
 ./usr/lib/sparc/libbind9.so.8			base-compat-shlib	compat,pic
-./usr/lib/sparc/libbind9.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/sparc/libbind9.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libblacklist.so.0		base-compat-shlib	compat,pic
 ./usr/lib/sparc/libblacklist.so.0.0		base-compat-shlib	compat,pic
 ./usr/lib/sparc/libbluetooth.so.4		base-compat-shlib	compat,pic
@@ -110,7 +110,7 @@
 ./usr/lib/sparc/libdm.so.0			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libdm.so.0.0			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libdns.so.8			base-compat-shlib	compat,pic
-./usr/lib/sparc/libdns.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/sparc/libdns.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libdns_sd.so.0			base-compat-shlib	compat,pic,mdns
 ./usr/lib/sparc/libdns_sd.so.0.0		base-compat-shlib	compat,pic,mdns
 ./usr/lib/sparc/libdwarf.so.1			base-compat-shlib	compat,pic
@@ -158,13 +158,13 @@
 ./usr/lib/sparc/libipsec.so.3			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libipsec.so.3.0			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libirs.so.8			base-compat-shlib	compat,pic
-./usr/lib/sparc/libirs.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/sparc/libirs.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libisc.so.8			base-compat-shlib	compat,pic
-./usr/lib/sparc/libisc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/sparc/libisc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libisccc.so.8			base-compat-shlib	compat,pic
-./usr/lib/sparc/libisccc.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/sparc/libisccc.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/sparc/libisccfg.so.8			base-compat-shlib	compat,pic
-./usr/lib/sparc/libisccfg.so.8.2		base-compat-shlib	compat,pic
+./usr/lib/sparc/libisccfg.so.8.4		base-compat-shlib	compat,pic
 ./usr/lib/sparc/libiscsi.so.2			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/sparc/libiscsi.so.2.0			base-compat-shlib	compat,pic,iscsi
 ./usr/lib/sparc/libisns.so.0			base-compat-shlib	compat,pic
@@ -196,7 +196,7 @@
 ./usr/lib/sparc/liblutok.so.2			base-compat-shlib	compat,pic,kyua
 ./usr/lib/sparc/liblutok.so.2.0			base-compat-shlib	compat,pic,kyua
 ./usr/lib/sparc/liblwres.so.8			base-compat-shlib	compat,pic
-./usr/lib/sparc/liblwres.so.8.2			base-compat-shlib	compat,pic
+./usr/lib/sparc/liblwres.so.8.4			base-compat-shlib	compat,pic
 ./usr/lib/sparc/liblzf.so.1			base-compat-shlib	compat,pic
 ./usr/lib/sparc/liblzf.so.1.0			base-compat-shlib	compat,pic
 ./usr/lib/sparc/liblzma.so.1			base-compat-shlib	compat,pic
--- a/distrib/sets/lists/base/shl.mi	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/base/shl.mi	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: shl.mi,v 1.712.2.9.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: shl.mi,v 1.712.2.9.2.2 2016/03/13 08:00:40 martin Exp $
 #
 # Note:	Don't delete entries from here - mark them as "obsolete" instead,
 #	unless otherwise stated below.
@@ -191,7 +191,7 @@
 ./usr/lib/libbfd.so.13.0			base-sys-shlib		binutils
 ./usr/lib/libbind9.so				base-bind-shlib
 ./usr/lib/libbind9.so.8				base-bind-shlib
-./usr/lib/libbind9.so.8.2			base-bind-shlib
+./usr/lib/libbind9.so.8.4			base-bind-shlib
 ./usr/lib/libblacklist.so			base-sys-shlib
 ./usr/lib/libblacklist.so.0			base-sys-shlib
 ./usr/lib/libblacklist.so.0.0			base-sys-shlib
@@ -245,7 +245,7 @@
 ./usr/lib/libdm.so.0.0				base-sys-shlib
 ./usr/lib/libdns.so				base-bind-shlib
 ./usr/lib/libdns.so.8				base-bind-shlib
-./usr/lib/libdns.so.8.2				base-bind-shlib
+./usr/lib/libdns.so.8.4				base-bind-shlib
 ./usr/lib/libdns_sd.so				base-mdns-shlib		mdns
 ./usr/lib/libdns_sd.so.0			base-mdns-shlib		mdns
 ./usr/lib/libdns_sd.so.0.0			base-mdns-shlib		mdns
@@ -320,16 +320,16 @@
 ./usr/lib/libipsec.so.3.0			base-net-shlib
 ./usr/lib/libirs.so				base-bind-shlib
 ./usr/lib/libirs.so.8				base-bind-shlib
-./usr/lib/libirs.so.8.2				base-bind-shlib
+./usr/lib/libirs.so.8.4				base-bind-shlib
 ./usr/lib/libisc.so				base-bind-shlib
 ./usr/lib/libisc.so.8				base-bind-shlib
-./usr/lib/libisc.so.8.2				base-bind-shlib
+./usr/lib/libisc.so.8.4				base-bind-shlib
 ./usr/lib/libisccc.so				base-bind-shlib
 ./usr/lib/libisccc.so.8				base-bind-shlib
-./usr/lib/libisccc.so.8.2			base-bind-shlib
+./usr/lib/libisccc.so.8.4			base-bind-shlib
 ./usr/lib/libisccfg.so				base-bind-shlib
 ./usr/lib/libisccfg.so.8			base-bind-shlib
-./usr/lib/libisccfg.so.8.2			base-bind-shlib
+./usr/lib/libisccfg.so.8.4			base-bind-shlib
 ./usr/lib/libiscsi.so				base-iscsi-shlib	iscsi
 ./usr/lib/libiscsi.so.2				base-iscsi-shlib	iscsi
 ./usr/lib/libiscsi.so.2.0			base-iscsi-shlib	iscsi
@@ -377,7 +377,7 @@
 ./usr/lib/liblutok.so.2.0			base-sys-shlib		kyua
 ./usr/lib/liblwres.so				base-bind-shlib
 ./usr/lib/liblwres.so.8				base-bind-shlib
-./usr/lib/liblwres.so.8.2			base-bind-shlib
+./usr/lib/liblwres.so.8.4			base-bind-shlib
 ./usr/lib/liblzf.so				base-sys-shlib
 ./usr/lib/liblzf.so.1				base-sys-shlib
 ./usr/lib/liblzf.so.1.0				base-sys-shlib
--- a/distrib/sets/lists/debug/ad.aarch64	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/debug/ad.aarch64	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: ad.aarch64,v 1.2.2.7.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: ad.aarch64,v 1.2.2.7.2.2 2016/03/13 08:00:40 martin Exp $
 -./usr/libdata/debug/usr/tests/lib/libc/gen/t_fpsetmask.debug
 -./usr/libdata/debug/usr/tests/lib/libc/gen/t_fpsetround.debug
 ./usr/lib/eabi/libcrypto_g.a			comp-c-debuglib		compat,crypto,debuglib
@@ -62,7 +62,7 @@
 ./usr/libdata/debug/usr/lib/eabi/libatf-c.so.0.0.debug		comp-compat-shlib	compat,pic,atf,debug
 ./usr/libdata/debug/usr/lib/eabi/libavl.so.0.0.debug		comp-zfs-debug	zfs,dynamicroot,debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libbfd.so.13.0.debug	comp-sys-debug	binutils,debug,compat
-./usr/libdata/debug/usr/lib/eabi/libbind9.so.8.2.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/eabi/libbind9.so.8.4.debug	comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libblacklist.so.0.0.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libbluetooth.so.4.2.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libbsdmalloc.so.0.0.debug	comp-sys-debug	debug,compat
@@ -78,7 +78,7 @@
 ./usr/libdata/debug/usr/lib/eabi/libdes.so.8.2.debug		comp-crypto-debug	crypto,debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libdevmapper.so.1.0.debug	comp-lvm-debug	lvm,debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libdm.so.0.0.debug 		comp-sys-debug	debug,compat
-./usr/libdata/debug/usr/lib/eabi/libdns.so.8.2.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/eabi/libdns.so.8.4.debug		comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libdns_sd.so.0.0.debug	comp-mdns-debug	mdns,debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libdtrace.so.2.0.debug	comp-sys-debug	dtrace,debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libdwarf.so.1.0.debug	comp-sys-debug	debug,compat
@@ -103,10 +103,10 @@
 ./usr/libdata/debug/usr/lib/eabi/libhx509.so.5.0.debug	comp-krb5-debug	kerberos,debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libintl.so.1.0.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libipsec.so.3.0.debug	comp-net-debug	debug,compat
-./usr/libdata/debug/usr/lib/eabi/libirs.so.8.2.debug		comp-bind-debug	debug,compat
-./usr/libdata/debug/usr/lib/eabi/libisc.so.8.2.debug		comp-bind-debug	debug,compat
-./usr/libdata/debug/usr/lib/eabi/libisccc.so.8.2.debug	comp-bind-debug	debug,compat
-./usr/libdata/debug/usr/lib/eabi/libisccfg.so.8.2.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/eabi/libirs.so.8.4.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/eabi/libisc.so.8.4.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/eabi/libisccc.so.8.4.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/eabi/libisccfg.so.8.4.debug	comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libiscsi.so.2.0.debug	comp-iscsi-debug	iscsi,debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libisns.so.0.0.debug	comp-isns-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libkadm5clnt.so.13.0.debug	comp-compat-shlib	compat,pic,kerberos,debug
@@ -120,7 +120,7 @@
 ./usr/libdata/debug/usr/lib/eabi/libldap_r.so.4.3.debug	comp-ldap-debug	ldap,debug,compat
 ./usr/libdata/debug/usr/lib/eabi/liblua.so.5.3.debug		comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/liblutok.so.2.0.debug		comp-kyua-debug	kyua,debug,compat
-./usr/libdata/debug/usr/lib/eabi/liblwres.so.8.2.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/eabi/liblwres.so.8.4.debug	comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/liblzf.so.1.0.debug		comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/liblzma.so.1.1.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/eabi/libm.so.0.11.debug		comp-sys-debug	debug,compat
@@ -230,7 +230,7 @@
 #./usr/libdata/debug/usr/lib/eabihf/libdes.so.8.2.debug		comp-crypto-debug	crypto,debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libdevmapper.so.1.0.debug	comp-lvm-debug	lvm,debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libdm.so.0.0.debug 		comp-sys-debug	debug,compat
-#./usr/libdata/debug/usr/lib/eabihf/libdns.so.8.2.debug		comp-bind-debug	debug,compat
+#./usr/libdata/debug/usr/lib/eabihf/libdns.so.8.4.debug		comp-bind-debug	debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libdns_sd.so.0.0.debug	comp-mdns-debug	mdns,debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libdtrace.so.2.0.debug	comp-sys-debug	dtrace,debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libdwarf.so.1.1.debug	comp-sys-debug	debug,compat
@@ -255,10 +255,10 @@
 #./usr/libdata/debug/usr/lib/eabihf/libhx509.so.5.0.debug	comp-krb5-debug	kerberos,debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libintl.so.1.0.debug	comp-sys-debug	debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libipsec.so.3.0.debug	comp-net-debug	debug,compat
-#./usr/libdata/debug/usr/lib/eabihf/libirs.so.8.2.debug		comp-bind-debug	debug,compat
-#./usr/libdata/debug/usr/lib/eabihf/libisc.so.8.2.debug		comp-bind-debug	debug,compat
-#./usr/libdata/debug/usr/lib/eabihf/libisccc.so.8.2.debug	comp-bind-debug	debug,compat
-#./usr/libdata/debug/usr/lib/eabihf/libisccfg.so.8.2.debug	comp-bind-debug	debug,compat
+#./usr/libdata/debug/usr/lib/eabihf/libirs.so.8.4.debug		comp-bind-debug	debug,compat
+#./usr/libdata/debug/usr/lib/eabihf/libisc.so.8.4.debug		comp-bind-debug	debug,compat
+#./usr/libdata/debug/usr/lib/eabihf/libisccc.so.8.4.debug	comp-bind-debug	debug,compat
+#./usr/libdata/debug/usr/lib/eabihf/libisccfg.so.8.4.debug	comp-bind-debug	debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libiscsi.so.2.0.debug	comp-iscsi-debug	iscsi,debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libisns.so.0.0.debug	comp-isns-debug	debug,compat
 #./usr/libdata/debug/usr/lib/eabihf/libkadm5clnt.so.13.0.debug	comp-compat-shlib	compat,pic,kerberos,debug
@@ -367,7 +367,7 @@
 ./usr/libdata/debug/usr/lib/oabi/libatf-c.so.0.0.debug		comp-compat-shlib	compat,pic,atf,debug
 ./usr/libdata/debug/usr/lib/oabi/libavl.so.0.0.debug		comp-zfs-debug	zfs,dynamicroot,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libbfd.so.13.0.debug		comp-sys-debug	binutils,debug,compat
-./usr/libdata/debug/usr/lib/oabi/libbind9.so.8.2.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libbind9.so.8.4.debug		comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libblacklist.so.0.0.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libbluetooth.so.4.2.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libbsdmalloc.so.0.0.debug	comp-sys-debug	debug,compat
@@ -383,7 +383,7 @@
 ./usr/libdata/debug/usr/lib/oabi/libdes.so.8.2.debug		comp-crypto-debug	crypto,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdevmapper.so.1.0.debug	comp-lvm-debug	lvm,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdm.so.0.0.debug 		comp-sys-debug	debug,compat
-./usr/libdata/debug/usr/lib/oabi/libdns.so.8.2.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libdns.so.8.4.debug		comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdns_sd.so.0.0.debug		comp-mdns-debug	mdns,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdtrace.so.2.0.debug		comp-sys-debug	dtrace,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdwarf.so.1.0.debug		comp-sys-debug	debug,compat
@@ -408,10 +408,10 @@
 ./usr/libdata/debug/usr/lib/oabi/libhx509.so.5.0.debug		comp-krb5-debug	kerberos,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libintl.so.1.0.debug		comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libipsec.so.3.0.debug		comp-net-debug	debug,compat
-./usr/libdata/debug/usr/lib/oabi/libirs.so.8.2.debug		comp-bind-debug	debug,compat
-./usr/libdata/debug/usr/lib/oabi/libisc.so.8.2.debug		comp-bind-debug	debug,compat
-./usr/libdata/debug/usr/lib/oabi/libisccc.so.8.2.debug		comp-bind-debug	debug,compat
-./usr/libdata/debug/usr/lib/oabi/libisccfg.so.8.2.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libirs.so.8.4.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libisc.so.8.4.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libisccc.so.8.4.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libisccfg.so.8.4.debug		comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libiscsi.so.2.0.debug		comp-iscsi-debug	iscsi,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libisns.so.0.0.debug		comp-isns-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libkadm5clnt.so.13.0.debug	comp-compat-shlib	compat,pic,kerberos,debug
@@ -425,7 +425,7 @@
 ./usr/libdata/debug/usr/lib/oabi/libldap_r.so.4.3.debug		comp-ldap-debug	ldap,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/liblua.so.5.3.debug		comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/liblutok.so.2.0.debug		comp-kyua-debug	kyua,debug,compat
-./usr/libdata/debug/usr/lib/oabi/liblwres.so.8.2.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/liblwres.so.8.4.debug		comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/liblzf.so.1.0.debug		comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/liblzma.so.1.1.debug		comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libm.so.0.11.debug		comp-sys-debug	debug,compat
--- a/distrib/sets/lists/debug/ad.arm	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/debug/ad.arm	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: ad.arm,v 1.42.2.9.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: ad.arm,v 1.42.2.9.2.2 2016/03/13 08:00:40 martin Exp $
 ./usr/lib/libarm_g.a				comp-c-debuglib		debuglib
 ./usr/lib/libc_vfp_g.a				comp-c-debuglib		debuglib,softfloat
 ./usr/lib/libpmc_g.a				comp-c-debuglib		debuglib
@@ -201,7 +201,7 @@
 ./usr/libdata/debug/usr/lib/oabi/libatf-c.so.0.0.debug		comp-compat-shlib	compat,pic,atf,debug
 ./usr/libdata/debug/usr/lib/oabi/libavl.so.0.0.debug		comp-zfs-debug	zfs,dynamicroot,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libbfd.so.13.0.debug	comp-sys-debug	binutils,debug,compat
-./usr/libdata/debug/usr/lib/oabi/libbind9.so.8.2.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libbind9.so.8.4.debug	comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libblacklist.so.0.0.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libbluetooth.so.4.2.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libbsdmalloc.so.0.0.debug	comp-sys-debug	debug,compat
@@ -219,7 +219,7 @@
 ./usr/libdata/debug/usr/lib/oabi/libdes.so.8.2.debug		comp-crypto-debug	crypto,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdevmapper.so.1.0.debug	comp-lvm-debug	lvm,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdm.so.0.0.debug 		comp-sys-debug	debug,compat
-./usr/libdata/debug/usr/lib/oabi/libdns.so.8.2.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libdns.so.8.4.debug		comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdns_sd.so.0.0.debug	comp-mdns-debug	mdns,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdtrace.so.2.0.debug	comp-sys-debug	dtrace,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libdwarf.so.1.0.debug	comp-sys-debug	debug,compat
@@ -248,13 +248,13 @@
 ./usr/libdata/debug/usr/lib/oabi/libhx509.so.5.0.debug	comp-krb5-debug	kerberos,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libintl.so.1.0.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libipsec.so.3.0.debug	comp-net-debug	debug,compat
-./usr/libdata/debug/usr/lib/oabi/libirs.so.8.2.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libirs.so.8.4.debug	comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libisc.so.6.0.debug		comp-bind-debug	debug,compat,obsolete
-./usr/libdata/debug/usr/lib/oabi/libisc.so.8.2.debug		comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libisc.so.8.4.debug		comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libisccc.so.6.0.debug	comp-bind-debug	debug,compat,obsolete
-./usr/libdata/debug/usr/lib/oabi/libisccc.so.8.2.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libisccc.so.8.4.debug	comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libisccfg.so.6.0.debug	comp-bind-debug	debug,compat,obsolete
-./usr/libdata/debug/usr/lib/oabi/libisccfg.so.8.2.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/libisccfg.so.8.4.debug	comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libiscsi.so.2.0.debug	comp-iscsi-debug	iscsi,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libisns.so.0.0.debug	comp-isns-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libkadm5clnt.so.12.0.debug	 comp-compat-shlib	 compat,pic,kerberos,debug,obsolete
@@ -274,7 +274,7 @@
 ./usr/libdata/debug/usr/lib/oabi/liblutok.so.1.0.debug		comp-obsolete	obsolete
 ./usr/libdata/debug/usr/lib/oabi/liblutok.so.2.0.debug		comp-kyua-debug	kyua,debug,compat
 ./usr/libdata/debug/usr/lib/oabi/liblwres.so.6.0.debug	comp-bind-debug	debug,compat,obsolete
-./usr/libdata/debug/usr/lib/oabi/liblwres.so.8.2.debug	comp-bind-debug	debug,compat
+./usr/libdata/debug/usr/lib/oabi/liblwres.so.8.4.debug	comp-bind-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/liblzf.so.1.0.debug		comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/liblzma.so.1.1.debug	comp-sys-debug	debug,compat
 ./usr/libdata/debug/usr/lib/oabi/libm.so.0.11.debug		comp-sys-debug	debug,compat
--- a/distrib/sets/lists/debug/ad.mips	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/debug/ad.mips	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: ad.mips,v 1.38.2.8.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: ad.mips,v 1.38.2.8.2.2 2016/03/13 08:00:40 martin Exp $
 ./usr/lib/64/libcrypto_g.a			comp-c-debuglib		compat,crypto,debuglib,arch64
 ./usr/lib/64/libcrypto_idea_g.a			comp-obsolete		obsolete
 ./usr/lib/64/libcrypto_mdc2_g.a			comp-obsolete		obsolete
@@ -68,7 +68,7 @@
 ./usr/libdata/debug/usr/lib/64/libatf-c.so.0.0.debug		comp-compat-shlib	compat,pic,atf,debug,arch64
 ./usr/libdata/debug/usr/lib/64/libavl.so.0.0.debug		comp-zfs-debug	zfs,dynamicroot,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libbfd.so.13.0.debug	comp-sys-debug	binutils,debug,compat,arch64
-./usr/libdata/debug/usr/lib/64/libbind9.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/64/libbind9.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libblacklist.so.0.0.debug	comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libbluetooth.so.4.2.debug	comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libbsdmalloc.so.0.0.debug	comp-sys-debug	debug,compat,arch64
@@ -84,7 +84,7 @@
 ./usr/libdata/debug/usr/lib/64/libdes.so.8.2.debug		comp-crypto-debug	crypto,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libdevmapper.so.1.0.debug	comp-lvm-debug	lvm,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libdm.so.0.0.debug 		comp-sys-debug	debug,compat,arch64
-./usr/libdata/debug/usr/lib/64/libdns.so.8.2.debug		comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/64/libdns.so.8.4.debug		comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libdns_sd.so.0.0.debug	comp-mdns-debug	mdns,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libdtrace.so.2.0.debug	comp-sys-debug	dtrace,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libdwarf.so.1.0.debug	comp-sys-debug	debug,compat,arch64
@@ -113,13 +113,13 @@
 ./usr/libdata/debug/usr/lib/64/libhx509.so.5.0.debug	comp-krb5-debug	kerberos,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libintl.so.1.0.debug	comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libipsec.so.3.0.debug	comp-net-debug	debug,compat,arch64
-./usr/libdata/debug/usr/lib/64/libirs.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/64/libirs.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libisc.so.6.0.debug		comp-bind-debug	debug,compat,arch64,obsolete
-./usr/libdata/debug/usr/lib/64/libisc.so.8.2.debug		comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/64/libisc.so.8.4.debug		comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libisccc.so.6.0.debug	comp-bind-debug	debug,compat,arch64,obsolete
-./usr/libdata/debug/usr/lib/64/libisccc.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/64/libisccc.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libisccfg.so.6.0.debug	comp-bind-debug	debug,compat,arch64,obsolete
-./usr/libdata/debug/usr/lib/64/libisccfg.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/64/libisccfg.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libiscsi.so.2.0.debug	comp-iscsi-debug	iscsi,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libisns.so.0.0.debug	comp-isns-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libkadm5clnt.so.12.0.debug	 comp-compat-shlib	 compat,pic,kerberos,debug,obsolete,arch64
@@ -139,7 +139,7 @@
 ./usr/libdata/debug/usr/lib/64/liblutok.so.1.0.debug		comp-obsolete	obsolete
 ./usr/libdata/debug/usr/lib/64/liblutok.so.2.0.debug		comp-kyua-debug	kyua,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/liblwres.so.6.0.debug	comp-bind-debug	debug,compat,arch64,obsolete
-./usr/libdata/debug/usr/lib/64/liblwres.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/64/liblwres.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/liblzf.so.1.0.debug		comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/liblzma.so.1.1.debug	comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/64/libm.so.0.11.debug		comp-sys-debug	debug,compat,arch64
@@ -247,7 +247,7 @@
 ./usr/libdata/debug/usr/lib/o32/libatf-c.so.0.0.debug		comp-compat-shlib	compat,pic,atf,debug,arch64
 ./usr/libdata/debug/usr/lib/o32/libavl.so.0.0.debug		comp-zfs-debug	zfs,dynamicroot,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libbfd.so.13.0.debug	comp-sys-debug	binutils,debug,compat,arch64
-./usr/libdata/debug/usr/lib/o32/libbind9.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/o32/libbind9.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libblacklist.so.0.0.debug	comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libbluetooth.so.4.2.debug	comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libbsdmalloc.so.0.0.debug	comp-sys-debug	debug,compat,arch64
@@ -263,7 +263,7 @@
 ./usr/libdata/debug/usr/lib/o32/libdes.so.8.2.debug		comp-crypto-debug	crypto,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libdevmapper.so.1.0.debug	comp-lvm-debug	lvm,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libdm.so.0.0.debug 		comp-sys-debug	debug,compat,arch64
-./usr/libdata/debug/usr/lib/o32/libdns.so.8.2.debug		comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/o32/libdns.so.8.4.debug		comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libdns_sd.so.0.0.debug	comp-mdns-debug	mdns,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libdtrace.so.2.0.debug	comp-sys-debug	dtrace,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libdwarf.so.1.0.debug	comp-sys-debug	debug,compat,arch64
@@ -292,13 +292,13 @@
 ./usr/libdata/debug/usr/lib/o32/libhx509.so.5.0.debug	comp-krb5-debug	kerberos,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libintl.so.1.0.debug	comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libipsec.so.3.0.debug	comp-net-debug	debug,compat,arch64
-./usr/libdata/debug/usr/lib/o32/libirs.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/o32/libirs.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libisc.so.6.0.debug		comp-bind-debug	debug,compat,arch64,obsolete
-./usr/libdata/debug/usr/lib/o32/libisc.so.8.2.debug		comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/o32/libisc.so.8.4.debug		comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libisccc.so.6.0.debug	comp-bind-debug	debug,compat,arch64,obsolete
-./usr/libdata/debug/usr/lib/o32/libisccc.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/o32/libisccc.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libisccfg.so.6.0.debug	comp-bind-debug	debug,compat,arch64,obsolete
-./usr/libdata/debug/usr/lib/o32/libisccfg.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/o32/libisccfg.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libiscsi.so.2.0.debug	comp-iscsi-debug	iscsi,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libisns.so.0.0.debug	comp-isns-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libkadm5clnt.so.12.0.debug	 comp-compat-shlib	 compat,pic,kerberos,debug,obsolete,arch64
@@ -318,7 +318,7 @@
 ./usr/libdata/debug/usr/lib/o32/liblutok.so.1.0.debug		comp-obsolete	obsolete
 ./usr/libdata/debug/usr/lib/o32/liblutok.so.2.0.debug		comp-kyua-debug	kyua,debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/liblwres.so.6.0.debug	comp-bind-debug	debug,compat,arch64,obsolete
-./usr/libdata/debug/usr/lib/o32/liblwres.so.8.2.debug	comp-bind-debug	debug,compat,arch64
+./usr/libdata/debug/usr/lib/o32/liblwres.so.8.4.debug	comp-bind-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/liblzf.so.1.0.debug		comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/liblzma.so.1.1.debug	comp-sys-debug	debug,compat,arch64
 ./usr/libdata/debug/usr/lib/o32/libm.so.0.11.debug		comp-sys-debug	debug,compat,arch64
--- a/distrib/sets/lists/debug/ad.powerpc	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/debug/ad.powerpc	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: ad.powerpc,v 1.18.2.8.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: ad.powerpc,v 1.18.2.8.2.2 2016/03/13 08:00:40 martin Exp $
 ./usr/lib/powerpc/libamu_g.a			comp-c-debuglib		compat,arch64,debuglib
 ./usr/lib/powerpc/libarchive_g.a		comp-c-debuglib		compat,arch64,debuglib
 ./usr/lib/powerpc/libasan_g.a			comp-c-debuglib		compat,arch64,debuglib,gcc=48
@@ -153,7 +153,7 @@
 ./usr/libdata/debug/usr/lib/powerpc/libatf-c++.so.1.0.debug		comp-compat-shlib	compat,arch64,debug,pic,atf,debug
 ./usr/libdata/debug/usr/lib/powerpc/libatf-c.so.0.0.debug			comp-compat-shlib	compat,arch64,debug,pic,atf
 ./usr/libdata/debug/usr/lib/powerpc/libbfd.so.13.0.debug			comp-compat-shlib	compat,arch64,debug,pic,binutils
-./usr/libdata/debug/usr/lib/powerpc/libbind9.so.8.2.debug			comp-compat-shlib	compat,arch64,debug,pic
+./usr/libdata/debug/usr/lib/powerpc/libbind9.so.8.4.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libblacklist.so.0.0.debug		comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libbluetooth.so.4.2.debug		comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libbsdmalloc.so.0.0.debug		comp-compat-shlib	compat,arch64,debug,pic
@@ -167,7 +167,7 @@
 ./usr/libdata/debug/usr/lib/powerpc/libdes.so.8.2.debug			comp-compat-shlib	compat,arch64,debug,pic,crypto
 ./usr/libdata/debug/usr/lib/powerpc/libdevmapper.so.1.0.debug			comp-compat-shlib	compat,arch64,debug,pic,lvm
 ./usr/libdata/debug/usr/lib/powerpc/libdm.so.0.0.debug			comp-compat-shlib	compat,arch64,debug,pic
-./usr/libdata/debug/usr/lib/powerpc/libdns.so.8.2.debug			comp-compat-shlib	compat,arch64,debug,pic
+./usr/libdata/debug/usr/lib/powerpc/libdns.so.8.4.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libdns_sd.so.0.0.debug		comp-compat-shlib	compat,arch64,debug,pic,mdns
 ./usr/libdata/debug/usr/lib/powerpc/libdwarf.so.1.0.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libedit.so.3.1.debug			comp-compat-shlib	compat,arch64,debug,pic
@@ -190,10 +190,10 @@
 ./usr/libdata/debug/usr/lib/powerpc/libhx509.so.5.0.debug			comp-compat-shlib	compat,arch64,debug,pic,kerberos
 ./usr/libdata/debug/usr/lib/powerpc/libintl.so.1.0.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libipsec.so.3.0.debug			comp-compat-shlib	compat,arch64,debug,pic
-./usr/libdata/debug/usr/lib/powerpc/libirs.so.8.2.debug		comp-compat-shlib	compat,arch64,debug,pic
-./usr/libdata/debug/usr/lib/powerpc/libisc.so.8.2.debug			comp-compat-shlib	compat,arch64,debug,pic
-./usr/libdata/debug/usr/lib/powerpc/libisccc.so.8.2.debug			comp-compat-shlib	compat,arch64,debug,pic
-./usr/libdata/debug/usr/lib/powerpc/libisccfg.so.8.2.debug		comp-compat-shlib	compat,arch64,debug,pic
+./usr/libdata/debug/usr/lib/powerpc/libirs.so.8.4.debug		comp-compat-shlib	compat,arch64,debug,pic
+./usr/libdata/debug/usr/lib/powerpc/libisc.so.8.4.debug			comp-compat-shlib	compat,arch64,debug,pic
+./usr/libdata/debug/usr/lib/powerpc/libisccc.so.8.4.debug			comp-compat-shlib	compat,arch64,debug,pic
+./usr/libdata/debug/usr/lib/powerpc/libisccfg.so.8.4.debug		comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libiscsi.so.2.0.debug			comp-compat-shlib	compat,arch64,debug,pic,iscsi
 ./usr/libdata/debug/usr/lib/powerpc/libisns.so.0.0.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libkadm5clnt.so.13.0.debug	 comp-compat-shlib	 compat,arch64,debug,pic,kerberos
@@ -207,7 +207,7 @@
 ./usr/libdata/debug/usr/lib/powerpc/libldap_r.so.4.3.debug		comp-compat-shlib	compat,arch64,debug,pic,ldap
 ./usr/libdata/debug/usr/lib/powerpc/liblua.so.5.3.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/liblutok.so.2.0.debug			comp-compat-shlib	compat,arch64,debug,pic,kyua
-./usr/libdata/debug/usr/lib/powerpc/liblwres.so.8.2.debug			comp-compat-shlib	compat,arch64,debug,pic
+./usr/libdata/debug/usr/lib/powerpc/liblwres.so.8.4.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/liblzf.so.1.0.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/liblzma.so.1.1.debug			comp-compat-shlib	compat,arch64,debug,pic
 ./usr/libdata/debug/usr/lib/powerpc/libm.so.0.11.debug			comp-compat-shlib	compat,arch64,debug,pic
--- a/distrib/sets/lists/debug/md.amd64	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/debug/md.amd64	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: md.amd64,v 1.63.2.8.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: md.amd64,v 1.63.2.8.2.2 2016/03/13 08:00:40 martin Exp $
 ./usr/lib/i386/i18n/libBIG5_g.a			comp-c-debuglib		compat,debuglib
 ./usr/lib/i386/i18n/libDECHanyu_g.a		comp-c-debuglib		compat,debuglib
 ./usr/lib/i386/i18n/libEUCTW_g.a		comp-c-debuglib		compat,debuglib
@@ -198,7 +198,7 @@
 ./usr/libdata/debug/usr/lib/i386/libatf-c++.so.1.0.debug	comp-compat-shlib	compat,pic,atf,debug
 ./usr/libdata/debug/usr/lib/i386/libatf-c.so.0.0.debug	comp-compat-shlib	compat,pic,atf,debug
 ./usr/libdata/debug/usr/lib/i386/libbfd.so.13.0.debug	comp-compat-shlib	compat,pic,binutils,debug
-./usr/libdata/debug/usr/lib/i386/libbind9.so.8.2.debug	comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/i386/libbind9.so.8.4.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libblacklist.so.0.0.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libbluetooth.so.4.2.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libbsdmalloc.so.0.0.debug	comp-compat-shlib	compat,pic,debug
@@ -214,7 +214,7 @@
 ./usr/libdata/debug/usr/lib/i386/libdes.so.8.2.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libdevmapper.so.1.0.debug	comp-compat-shlib	compat,pic,lvm,debug
 ./usr/libdata/debug/usr/lib/i386/libdm.so.0.0.debug	comp-compat-shlib	compat,pic,debug
-./usr/libdata/debug/usr/lib/i386/libdns.so.8.2.debug	comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/i386/libdns.so.8.4.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libdns_sd.so.0.0.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libdwarf.so.1.0.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libedit.so.3.1.debug	comp-compat-shlib	compat,pic,debug
@@ -242,13 +242,13 @@
 ./usr/libdata/debug/usr/lib/i386/libi386.so.1.0.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libintl.so.1.0.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libipsec.so.3.0.debug	comp-compat-shlib	compat,pic,debug
-./usr/libdata/debug/usr/lib/i386/libirs.so.8.2.debug	comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/i386/libirs.so.8.4.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libisc.so.6.0.debug	comp-compat-shlib	compat,pic,debug,obsolete
-./usr/libdata/debug/usr/lib/i386/libisc.so.8.2.debug	comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/i386/libisc.so.8.4.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libisccc.so.6.0.debug	comp-compat-shlib	compat,pic,debug,obsolete
-./usr/libdata/debug/usr/lib/i386/libisccc.so.8.2.debug	comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/i386/libisccc.so.8.4.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libisccfg.so.6.0.debug	comp-compat-shlib	compat,pic,debug,obsolete
-./usr/libdata/debug/usr/lib/i386/libisccfg.so.8.2.debug	comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/i386/libisccfg.so.8.4.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libiscsi.so.2.0.debug	comp-compat-shlib	compat,pic,debug,iscsi
 ./usr/libdata/debug/usr/lib/i386/libisns.so.0.0.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libkadm5clnt.so.12.0.debug	comp-compat-shlib	compat,pic,kerberos,debug,obsolete
@@ -268,7 +268,7 @@
 ./usr/libdata/debug/usr/lib/i386/liblutok.so.1.0.debug	comp-obsolete		obsolete
 ./usr/libdata/debug/usr/lib/i386/liblutok.so.2.0.debug	comp-compat-shlib	compat,pic,debug,kyua
 ./usr/libdata/debug/usr/lib/i386/liblwres.so.6.0.debug	comp-compat-shlib	compat,pic,debug,obsolete
-./usr/libdata/debug/usr/lib/i386/liblwres.so.8.2.debug	comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/i386/liblwres.so.8.4.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/liblzf.so.1.0.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/liblzma.so.1.1.debug	comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/i386/libm.so.0.11.debug	comp-compat-shlib	compat,pic,debug
--- a/distrib/sets/lists/debug/md.sparc64	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/debug/md.sparc64	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: md.sparc64,v 1.61.2.8.2.2 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: md.sparc64,v 1.61.2.8.2.3 2016/03/13 08:00:40 martin Exp $
 ./usr/lib/sparc/i18n/libBIG5_g.a		comp-obsolete		obsolete
 ./usr/lib/sparc/i18n/libDECHanyu_g.a		comp-obsolete		obsolete
 ./usr/lib/sparc/i18n/libEUCTW_g.a		comp-obsolete		obsolete
@@ -196,7 +196,7 @@
 ./usr/libdata/debug/usr/lib/sparc/libatf-c++.so.1.0.debug		comp-compat-shlib	compat,pic,atf,debug
 ./usr/libdata/debug/usr/lib/sparc/libatf-c.so.0.0.debug			comp-compat-shlib	compat,pic,atf,debug
 ./usr/libdata/debug/usr/lib/sparc/libbfd.so.13.0.debug			comp-compat-shlib	compat,pic,binutils,debug
-./usr/libdata/debug/usr/lib/sparc/libbind9.so.8.2.debug			comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/sparc/libbind9.so.8.4.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libblacklist.so.0.0.debug		comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libbluetooth.so.4.2.debug		comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libbsdmalloc.so.0.0.debug		comp-compat-shlib	compat,pic,debug
@@ -211,7 +211,7 @@
 ./usr/libdata/debug/usr/lib/sparc/libdes.so.8.2.debug			comp-compat-shlib	compat,pic,debug,crypto
 ./usr/libdata/debug/usr/lib/sparc/libdevmapper.so.1.0.debug			comp-compat-shlib	compat,pic,debug,lvm
 ./usr/libdata/debug/usr/lib/sparc/libdm.so.0.0.debug			comp-compat-shlib	compat,pic,debug
-./usr/libdata/debug/usr/lib/sparc/libdns.so.8.2.debug			comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/sparc/libdns.so.8.4.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libdns_sd.so.0.0.debug		comp-compat-shlib	compat,pic,debug,mdns
 ./usr/libdata/debug/usr/lib/sparc/libdwarf.so.1.0.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libedit.so.3.1.debug			comp-compat-shlib	compat,pic,debug
@@ -237,13 +237,13 @@
 ./usr/libdata/debug/usr/lib/sparc/libhx509.so.5.0.debug			comp-compat-shlib	compat,pic,debug,kerberos
 ./usr/libdata/debug/usr/lib/sparc/libintl.so.1.0.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libipsec.so.3.0.debug			comp-compat-shlib	compat,pic,debug
-./usr/libdata/debug/usr/lib/sparc/libirs.so.8.2.debug		comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/sparc/libirs.so.8.4.debug		comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libisc.so.6.0.debug			comp-compat-shlib	compat,pic,debug,obsolete
-./usr/libdata/debug/usr/lib/sparc/libisc.so.8.2.debug			comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/sparc/libisc.so.8.4.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libisccc.so.6.0.debug			comp-compat-shlib	compat,pic,debug,obsolete
-./usr/libdata/debug/usr/lib/sparc/libisccc.so.8.2.debug			comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/sparc/libisccc.so.8.4.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libisccfg.so.6.0.debug		comp-compat-shlib	compat,pic,debug,obsolete
-./usr/libdata/debug/usr/lib/sparc/libisccfg.so.8.2.debug		comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/sparc/libisccfg.so.8.4.debug		comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libiscsi.so.2.0.debug			comp-compat-shlib	compat,pic,debug,iscsi
 ./usr/libdata/debug/usr/lib/sparc/libisns.so.0.0.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libkadm5clnt.so.12.0.debug	 comp-compat-shlib	 compat,pic,kerberos,debug,obsolete
@@ -263,7 +263,7 @@
 ./usr/libdata/debug/usr/lib/sparc/liblutok.so.1.0.debug			comp-obsolete	obsolete
 ./usr/libdata/debug/usr/lib/sparc/liblutok.so.2.0.debug			comp-compat-shlib	compat,pic,debug,kyua
 ./usr/libdata/debug/usr/lib/sparc/liblwres.so.6.0.debug			comp-compat-shlib	compat,pic,debug,obsolete
-./usr/libdata/debug/usr/lib/sparc/liblwres.so.8.2.debug			comp-compat-shlib	compat,pic,debug
+./usr/libdata/debug/usr/lib/sparc/liblwres.so.8.4.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/liblzf.so.1.0.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/liblzma.so.1.1.debug			comp-compat-shlib	compat,pic,debug
 ./usr/libdata/debug/usr/lib/sparc/libm.so.0.11.debug			comp-compat-shlib	compat,pic,debug
--- a/distrib/sets/lists/debug/shl.mi	Fri Mar 11 12:27:04 2016 +0000
+++ b/distrib/sets/lists/debug/shl.mi	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-# $NetBSD: shl.mi,v 1.71.2.12.2.1 2016/03/08 13:48:44 martin Exp $
+# $NetBSD: shl.mi,v 1.71.2.12.2.2 2016/03/13 08:00:40 martin Exp $
 ./usr/libdata/debug/lib/libblacklist.so.0.0.debug	comp-sys-debug	debug
 ./usr/libdata/debug/lib/libc.so.12.193.1.debug		comp-sys-debug	debug
 ./usr/libdata/debug/lib/libcrypt.so.1.0.debug		comp-sys-debug	debug
@@ -58,7 +58,7 @@
 ./usr/libdata/debug/usr/lib/libatf-c.so.0.0.debug	comp-atf-debug	atf,debug
 ./usr/libdata/debug/usr/lib/libavl.so.0.0.debug		comp-zfs-debug	zfs,dynamicroot,debug
 ./usr/libdata/debug/usr/lib/libbfd.so.13.0.debug	comp-sys-debug	binutils,debug
-./usr/libdata/debug/usr/lib/libbind9.so.8.2.debug	comp-bind-debug	debug
+./usr/libdata/debug/usr/lib/libbind9.so.8.4.debug	comp-bind-debug	debug
 ./usr/libdata/debug/usr/lib/libblacklist.so.0.0.debug	comp-sys-debug	debug
 ./usr/libdata/debug/usr/lib/libbluetooth.so.4.2.debug	comp-sys-debug	debug
 ./usr/libdata/debug/usr/lib/libbsdmalloc.so.0.0.debug	comp-sys-debug	debug
@@ -76,7 +76,7 @@
 ./usr/libdata/debug/usr/lib/libdes.so.8.2.debug		comp-crypto-debug	crypto,debug
 ./usr/libdata/debug/usr/lib/libdevmapper.so.1.0.debug	comp-lvm-debug	lvm,debug
 ./usr/libdata/debug/usr/lib/libdm.so.0.0.debug 		comp-sys-debug	debug
-./usr/libdata/debug/usr/lib/libdns.so.8.2.debug 	comp-bind-debug debug
+./usr/libdata/debug/usr/lib/libdns.so.8.4.debug 	comp-bind-debug debug
 ./usr/libdata/debug/usr/lib/libdns_sd.so.0.0.debug	comp-mdns-debug	mdns,debug
 ./usr/libdata/debug/usr/lib/libdtrace.so.2.0.debug	comp-sys-debug	dtrace,debug
 ./usr/libdata/debug/usr/lib/libdwarf.so.1.0.debug	comp-sys-debug	debug
@@ -102,13 +102,13 @@
 ./usr/libdata/debug/usr/lib/libhx509.so.5.0.debug	comp-krb5-debug	kerberos,debug
 ./usr/libdata/debug/usr/lib/libintl.so.1.0.debug	comp-sys-debug	debug
 ./usr/libdata/debug/usr/lib/libipsec.so.3.0.debug	comp-net-debug	debug
-./usr/libdata/debug/usr/lib/libirs.so.8.2.debug		comp-bind-debug	debug
+./usr/libdata/debug/usr/lib/libirs.so.8.4.debug		comp-bind-debug	debug
 ./usr/libdata/debug/usr/lib/libisc.so.6.0.debug		comp-bind-debug	debug,obsolete
-./usr/libdata/debug/usr/lib/libisc.so.8.2.debug		comp-bind-debug	debug
+./usr/libdata/debug/usr/lib/libisc.so.8.4.debug		comp-bind-debug	debug
 ./usr/libdata/debug/usr/lib/libisccc.so.6.0.debug	comp-bind-debug	debug,obsolete
-./usr/libdata/debug/usr/lib/libisccc.so.8.2.debug	comp-bind-debug	debug
+./usr/libdata/debug/usr/lib/libisccc.so.8.4.debug	comp-bind-debug	debug
 ./usr/libdata/debug/usr/lib/libisccfg.so.6.0.debug	comp-bind-debug	debug,obsolete
-./usr/libdata/debug/usr/lib/libisccfg.so.8.2.debug	comp-bind-debug	debug
+./usr/libdata/debug/usr/lib/libisccfg.so.8.4.debug	comp-bind-debug	debug
 ./usr/libdata/debug/usr/lib/libiscsi.so.2.0.debug	comp-iscsi-debug	iscsi,debug
 ./usr/libdata/debug/usr/lib/libisns.so.0.0.debug	comp-isns-debug	debug
 ./usr/libdata/debug/usr/lib/libkadm5clnt.so.13.0.debug	comp-krb5-debug	kerberos,debug
@@ -124,7 +124,7 @@
 ./usr/libdata/debug/usr/lib/liblutok.so.1.0.debug	comp-obsolete	obsolete
 ./usr/libdata/debug/usr/lib/liblutok.so.2.0.debug	comp-kyua-debug	kyua,debug
 ./usr/libdata/debug/usr/lib/liblwres.so.6.0.debug	comp-bind-debug	debug,obsolete
-./usr/libdata/debug/usr/lib/liblwres.so.8.2.debug	comp-bind-debug	debug
+./usr/libdata/debug/usr/lib/liblwres.so.8.4.debug	comp-bind-debug	debug
 ./usr/libdata/debug/usr/lib/liblzf.so.1.0.debug		comp-sys-debug	debug
 ./usr/libdata/debug/usr/lib/liblzma.so.1.1.debug	comp-sys-debug	debug
 ./usr/libdata/debug/usr/lib/libm.so.0.11.debug		comp-sys-debug	debug
--- a/doc/3RDPARTY	Fri Mar 11 12:27:04 2016 +0000
+++ b/doc/3RDPARTY	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-#	$NetBSD: 3RDPARTY,v 1.1145.2.18.2.2 2016/03/08 21:41:06 snj Exp $
+#	$NetBSD: 3RDPARTY,v 1.1145.2.18.2.3 2016/03/13 08:00:24 martin Exp $
 #
 # This file contains a list of the software that has been integrated into
 # NetBSD where we are not the primary maintainer.
@@ -113,8 +113,8 @@
 bc includes dc, both of which are in the NetBSD tree.
 
 Package:	bind [named and utils]
-Version:	9.10.2-P4
-Current Vers:	9.10.2-P4
+Version:	9.10.3-P4
+Current Vers:	9.10.3-P4
 Maintainer:	Paul Vixie <vixie@vix.com>
 Archive Site:	ftp://ftp.isc.org/isc/bind9/
 Home Page:	http://www.isc.org/software/bind/
--- a/external/bsd/bind/bind2netbsd	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/bind2netbsd	Sun Mar 13 08:00:24 2016 +0000
@@ -1,6 +1,6 @@
 #! /bin/sh
 #
-#	$NetBSD: bind2netbsd,v 1.2 2014/03/06 02:12:56 christos Exp $
+#	$NetBSD: bind2netbsd,v 1.2.10.1 2016/03/13 08:00:24 martin Exp $
 #
 # Copyright (c) 2000 The NetBSD Foundation, Inc.
 # All rights reserved.
@@ -34,7 +34,7 @@
 #
 #	$ cd /some/where/temporary
 #	$ tar xpfz /new/bind/release/tar/file
-#	$ sh /usr/src/external/bsd/bind/dist/bind2netbsd bind-9.x.y `pwd`
+#	$ sh /usr/src/external/bsd/bind/bind2netbsd bind-9.x.y `pwd`
 #	$ cd src/external/bsd/bind/dist
 #	$ cvs -d cvs.netbsd.org:/cvsroot import -m "Import bind 9.x.y" src/external/bsd/bind/dist ISC bind-9-x-y
 #	$ cd ../../../../../bind-9.x.y
--- a/external/bsd/bind/dist/CHANGES	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/CHANGES	Sun Mar 13 08:00:24 2016 +0000
@@ -1,35 +1,250 @@
-	--- 9.10.2-P4 released ---
+
+	--- 9.10.3-P4 released ---
+
+4322.	[security]	Duplicate EDNS COOKIE options in a response could
+			trigger an assertion failure. (CVE-2016-2088)
+			[RT #41809]
+
+4319.	[security]	Fix resolver assertion failure due to improper
+			DNAME handling when parsing fetch reply messages.
+			(CVE-2016-1286) [RT #41753]
+
+4318.	[security]	Malformed control messages can trigger assertions
+			in named and rndc. (CVE-2016-1285) [RT #41666]
+
+	--- 9.10.3-P3 released ---
+
+4288.	[bug]		Fixed a regression in resolver.c:possibly_mark()
+			which caused known-bogus servers to be queried
+			anyway. [RT #41321]
+
+4286.	[security]	render_ecs errors were mishandled when printing out
+			a OPT record resulting in a assertion failure.
+			(CVE-2015-8705) [RT #41397]
+
+4285.	[security]	Specific APL data could trigger a INSIST.
+			(CVE-2015-8704) [RT #41396]
+
+	--- 9.10.3-P2 released ---
+
+4270.	[security]	Update allowed OpenSSL versions as named is
+			potentially vulnerable to CVE-2015-3193.
+
+4261.	[maint]		H.ROOT-SERVERS.NET is 198.97.190.53 and 2001:500:1::53.
+			[RT #40556]
+
+4260.	[security]	Insufficient testing when parsing a message allowed
+			records with an incorrect class to be be accepted,
+			triggering a REQUIRE failure when those records
+			were subsequently cached. (CVE-2015-8000) [RT #40987]
+
+4253.	[security]	Address fetch context reference count handling error
+			on socket error. (CVE-2015-8461) [RT#40945]
+
+	--- 9.10.3-P1 (withdrawn) ---
+
+	--- 9.10.3 released ---
+
+	--- 9.10.3rc1 released ---
+
+4193.	[bug]		Handle broken servers that return BADVERS incorrectly.
+			[RT #40427]
+
+4192.	[bug]		The default rrset-order of random was not always being
+			applied. [RT #40456]
+
+4191.	[protocol]	Accept DNS-SD non LDH PTR records in reverse zones
+			as per RFC 6763. [RT #37889]
+
+4190.	[protocol]	Accept Active Diretory gc._msdcs.<forest> name as
+			valid with check-names.  <forest> still needs to be
+			LDH. [RT #40399]
+
+4189.	[cleanup]	Don't exit on overly long tokens in named.conf.
+			[RT #40418]
+
+4188.	[bug]		Support HTTP/1.0 client properly on the statistics
+			channel. [RT #40261]
+
+4187.	[func]		When any RR type implementation doesn't
+			implement totext() for the RDATA's wire
+			representation and returns ISC_R_NOTIMPLEMENTED,
+			such RDATA is now printed in unknown
+			presentation format (RFC 3597). RR types affected
+			include LOC(29) and APL(42). [RT #40317].
+
+4186.	[bug]		Fixed an RPZ bug where a QNAME would be matched
+			against a policy RR with wildcard owner name
+			(trigger) where the QNAME was the wildcard owner
+			name's parent. For example, the bug caused a query
+			with QNAME "example.com" to match a policy RR with
+			"*.example.com" as trigger. [RT #40357]
+
+4185.	[bug]		Fixed an RPZ bug where a policy RR with wildcard
+			owner name (trigger) would prevent another policy RR
+			with its parent owner name from being
+			loaded. For example, the bug caused a policy RR
+			with trigger "example.com" to not have any
+			effect when a previous policy RR with trigger
+			"*.example.com" existed in that RPZ zone.
+			[RT #40357]
+
+4183.	[cleanup]	Use timing-safe memory comparisons in cryptographic
+			code. Also, the timing-safe comparison functions have
+			been renamed to avoid possible confusion with
+			memcmp(). Thanks to Loganaden Velvindron of
+			AFRINIC. [RT #40148]
+
+4182.	[cleanup]	Use mnemonics for RR class and type comparisons.
+			[RT #40297]
+
+4181.	[bug]		Queued notify messages could be dequeued from the
+			wrong rate limiter queue. [RT #40350]
+
+4179.	[bug]		Fix double frees in getaddrinfo() in libirs.
+			[RT #40209]
+
+4178.	[bug]		Fix assertion failure in parsing UNSPEC(103) RR from
+			text. [RT #40274]
+
+4177.	[bug]		Fix assertion failure in parsing NSAP records from
+			text. [RT #40285]
+
+4176.	[bug]		Address race issues with lwresd. [RT #40284]
+
+4175.	[bug]		TKEY with GSS-API keys needed bigger buffers.
+			[RT #40333]
+
+4174.	[bug]		"dnssec-coverage -r" didn't handle time unit
+			suffixes correctly. [RT #38444]
+
+4173.	[bug]		dig +sigchase was not properly matching the trusted
+			key. [RT #40188]
+
+4172.	[bug]		Named / named-checkconf didn't handle a view of CLASS0.
+			[RT #40265]
+
+4171.	[bug]		Fixed incorrect class checks in TSIG RR
+			implementation. [RT #40287]
 
 4170.	[security]	An incorrect boundary check in the OPENPGPKEY
 			rdatatype could trigger an assertion failure.
 			(CVE-2015-5986) [RT #40286]
 
+4169.	[test]		Added a 'wire_test -d' option to read input as
+			raw binary data, for use as a fuzzing harness.
+			[RT #40312]
+
 4168.	[security]	A buffer accounting error could trigger an
-			assertion failure when parsing certain malformed 
+			assertion failure when parsing certain malformed
 			DNSSEC keys. (CVE-2015-5722) [RT #40212]
 
-	--- 9.10.2-P3 released ---
+	--- 9.10.3b1 released ---
 
 4165.	[security]	A failure to reset a value to NULL in tkey.c could
 			result in an assertion failure. (CVE-2015-5477)
 			[RT #40046]
 
-	--- 9.10.2-P2 released ---
-
-4138.	[bug]		An uninitialized value in validator.c could result
+4164.	[bug]		Don't rename slave files and journals on out of memory.
+			[RT #40033]
+
+4163.	[bug]		Address compiler warnings. [RT #40024]
+
+4162.	[bug]		httpdmgr->flags was not being initialized. [RT #40017]
+
+4161.	[test]		Test for consistency between "rndc stats" and the
+			XML and JSON statistics channel contents. [RT #38700]
+
+4159.	[cleanup]	Alphabetize dig's help output. [RT #39966]
+
+4157.	[protocol]	Update experimental SIT code to use the EDNS COOKIE
+			option code point (10).  This is the minimal change
+			required to use the new code point. [RT #39928]
+
+4154.	[bug]		A OPT record should be included with the FORMERR
+			response when there is a malformed EDNS option.
+			[RT #39647]
+
+4153.	[bug]		Dig should zero non significant +subnet bits.  Check
+			that non significant ECS bits are zero on receipt.
+			[RT #39647]
+
+4151.	[bug]		'rndc flush' could cause a deadlock. [RT #39835]
+
+4150.	[bug]		win32: listen-on-v6 { any; }; was not working.  Apply
+			minimal fix.  [RT #39667]
+
+4149.	[bug]		Fixed a race condition in the getaddrinfo()
+			implementation in libirs, which caused the delv
+			utility to crash with an assertion failure when using
+			the '@server' syntax with a hostname argument.
+			[RT #39899]
+
+4148.	[bug]		Fix a bug when printing zone names with '/' character
+			in XML and JSON statistics output. [RT #39873]
+
+4147.	[bug]		Filter-aaaa / filter-aaaa-on-v4 / filter-aaaa-on-v6
+			was returning referrals rather than nodata responses
+			when the AAAA records were filtered.  [RT #39843]
+
+4146.	[bug]		Address reference leak that could prevent a clean
+			shutdown. [RT #37125]
+
+4145.	[bug]		Not all unassociated adb entries where being printed.
+			[RT #37125]
+
+4143.	[bug]		serial-query-rate was not effective for notify.
+			[RT #39858]
+
+4142.	[bug]		rndc addzone with view specified saved NZF config
+			that could not be read back by named. This has now
+			been fixed. [RT #39845]
+
+4141.	[bug]		A formatting bug caused rndc zonestatus to print
+			negative numbers for large serial values. This has
+			now been fixed. [RT #39854]
+
+4139.	[doc]		Fix rpz-client-ip documentation. [RT #39783]
+
+4138.	[security]	An uninitialized value in validator.c could result
 			in an assertion failure. (CVE-2015-4620) [RT #39795]
 
-	--- 9.10.2-P1 released ---
+4137.	[bug]		Make rndc reconfig report configuration errors the
+			same way rndc reload does. [RT #39635]
+
+4136.	[bug]		Stale statistics counters with the leading
+			'#' prefix (such as #NXDOMAIN) were not being
+			updated correctly. This	has been fixed. [RT #39141]
 
 4134.	[cleanup]	Include client-ip rules when logging the number
 			of RPZ rules of each type. [RT #39670]
 
+4133.	[port]		Update how various json libraries are handled.
+			[RT #39646]
+
+4132.	[cleanup]	dig: added +rd as a synonym for +recurse,
+			added +class as an unabbreviated alternative
+			to +cl. [RT #39686]
+
 4131.	[bug]		Addressed further problems with reloading RPZ
 			zones. [RT #39649]
 
+4130.	[bug]		The compatibility shim for *printf() misprinted some
+			large numbers. [RT #39586]
+
+4129.	[port]		Address API changes in OpenSSL 1.1.0. [RT #39532]
+
+4128.	[bug]		Address issues raised by Coverity 7.6. [RT #39537]
+
+4127.	[protocol]	CDS and CDNSKEY need to be signed by the key signing
+			key as per RFC 7344, Section 4.1. [RT #37215]
+
 4126.	[bug]		Addressed a regression introduced in change #4121.
 			[RT #39611]
 
+4123.	[port]		Added %z (size_t) format options to the portable
+			internal printf/sprintf implementation. [RT #39586]
+
 4122.	[bug]		The server could match a shorter prefix than what was
 			available in CLIENT-IP policy triggers, and so, an
 			unexpected action could be taken. This has been
@@ -50,12 +265,149 @@
 			pending for RPZ processing of an active query.
 			[RT #39415]
 
+4119.	[test]		Allow dig to set the message opcode. [RT #39550]
+
+4118.	[bug]		Teach isc-config.sh about irs. [RT #39213]
+
+4117.	[protocol]	Add EMPTY.AS112.ARPA as per RFC 7534.
+
 4116.	[bug]		Fix a bug in RPZ that could cause some policy
 			zones that did not specifically require
 			recursion to be treated as if they did;
 			consequently, setting qname-wait-recurse no; was
 			sometimes ineffective. [RT #39229]
 
+4113.	[test]		Check for Net::DNS is some system test
+			prerequisites. [RT #39369]
+
+4112.	[bug]		Named failed to load when "root-delegation-only"
+			was used without a list of domains to exclude.
+			[RT #39380]
+
+4111.	[doc]		Alphabetize rndc man page. [RT #39360]
+
+4110.	[bug]		Address memory leaks / null pointer dereferences
+			on out of memory. [RT #39310]
+
+4109.	[port]		linux: support reading the local port range from
+			net.ipv4.ip_local_port_range. [RT # 39379]
+
+4107.	[bug]		Address potential deadlock when updating zone content.
+			[RT #39269]
+
+4106.	[port]		Improve readline support. [RT #38938]
+
+4105.	[port]		Misc fixes for Microsoft Visual Studio
+			2015 CTP6 in 64 bit mode. [RT #39308]
+
+4104.	[bug]		Address uninitialized elements. [RT #39252]
+
+4102.	[bug]		Fix a use after free bug introduced in change
+			#4094.  [RT #39281]
+
+4101.	[bug]		dig: the +split and +rrcomments options didn't
+			work with +short. [RT #39291]
+
+4100.	[bug]		Inherited owernames on the line immediately following
+			a $INCLUDE were not working.  [RT #39268]
+
+4099.	[port]		clang: make unknown commandline options hard errors
+			when determining what options are supported.
+			[RT #39273]
+
+4098.	[bug]		Address use-after-free issue when using a
+			predecessor key with dnssec-settime. [RT #39272]
+
+4097.	[func]		Add additional logging about xfrin transfer status.
+			[RT #39170]
+
+4096.	[bug]		Fix a use after free of query->sendevent.
+			[RT #39132]
+
+4095.	[bug]		zone->options2 was not being properly initialized.
+			[RT #39228]
+
+4094.	[bug]		A race during shutdown or reconfiguration could
+			cause an assertion in mem.c. [RT #38979]
+
+4093.	[func]		Dig now learns the SIT value from truncated
+			responses when it retries over TCP. [RT #39047]
+
+4092.	[bug]		'in-view' didn't work for zones beneath a empty zone.
+			[RT #39173]
+
+4091.	[cleanup]	Some cleanups in isc mem code. [RT #38896]
+
+4090.	[bug]		Fix a crash while parsing malformed CAA RRs in
+			presentation format, i.e., from text such as
+			from master files. Thanks to John Van de
+			Meulebrouck Brendgard for discovering and
+			reporting this problem. [RT #39003]
+
+4089.	[bug]		Send notifies immediately for slave zones during
+			startup. [RT #38843]
+
+4088.	[port]		Fixed errors when building with libressl. [RT #38899]
+
+4087.	[bug]		Fix a crash due to use-after-free due to sequencing
+			of tasks actions. [RT #38495]
+
+4086.	[bug]		Fix out-of-srcdir build with native pkcs11. [RT #38831]
+
+4085.	[bug]		ISC_PLATFORM_HAVEXADDQ could be inconsistently set.
+			[RT #38828]
+
+4084.	[bug]		Fix a possible race in updating stats counters.
+			[RT #38826]
+
+4082.	[bug]		Incrementally sign large inline zone deltas.
+			[RT #37927]
+
+4081.	[cleanup]	Use dns_rdatalist_init consistently. [RT #38759]
+
+4078.	[bug]		Handle the case where CMSG_SPACE(sizeof(int)) !=
+			CMSG_SPACE(sizeof(char)). [RT #38621]
+
+4077.	[test]		Add static-stub regression test for DS NXDOMAIN
+			return making the static stub disappear. [RT #38564]
+
+4076.	[bug]		Named could crash on shutdown with outstanding
+			reload / reconfig events. [RT #38622]
+
+4074.	[cleanup]	Cleaned up more warnings from gcc -Wshadow. [RT #38708]
+
+4073.	[cleanup]	Add libjson-c version number reporting to
+			"named -V"; normalize version number formatting.
+			[RT #38056]
+
+4072.	[func]		Add a --enable-querytrace configure switch for
+			very verbose query trace logging. (This option
+			has a negative performance impact and should be
+			used only for debugging.) [RT #37520]
+
+4071.	[cleanup]	Initialize pthread mutex attrs just once, instead of
+			doing it per mutex creation. [RT #38547]
+
+4070.	[bug]		Fix a segfault in nslookup in a query such as
+			"nslookup isc.org AMS.SNS-PB.ISC.ORG -all".
+			[RT #38548]
+
+4069.	[doc]		Reorganize options in the nsupdate man page.
+			[RT #38515]
+
+4068.	[bug]		Omit unknown serial number from JSON zone statistics.
+			[RT #38604]
+
+4067.	[cleanup]	Reduce noise from RRL when query logging is
+			disabled. [RT #38648]
+
+4066.	[doc]		Reorganize options in the dig man page. [RT #38516]
+
+4064.	[contrib]	dnssec-keyset.sh: Generates a specified number
+			of DNSSEC keys with timing set to implement a
+			pre-publication key rollover strategy. Thanks
+			to Jeffry A. Spain. [RT #38459]
+
 4063.	[bug]		Asynchronous zone loads were not handled
 			correctly when the zone load was already in
 			progress; this could trigger a crash in zt.c.
@@ -66,6 +418,49 @@
 			during operation. If the read failed, named
 			could segfault. [RT #38559]
 
+3993.	[func]		Dig now supports EDNS negotiation by default.
+			(dig +[no]ednsnegotiation).
+
+			Note:  This is disabled by default in BIND 9.10
+			and enabled by default in BIND 9.11.  [RT #37604]
+
+3951.	[func]		Add the ability to set yet-to-be-defined EDNS flags
+			to dig (+ednsflags=#). [RT #37142]
+
+3938.	[func]		Added quotas to be used in recursive resolvers
+			that are under high query load for names in zones
+			whose authoritative servers are nonresponsive or
+			are experiencing a denial of service attack.
+
+			- "fetches-per-server" limits the number of
+			  simultaneous queries that can be sent to any
+			  single authoritative server.  The configured
+			  value is a starting point; it is automatically
+			  adjusted downward if the server is partially or
+			  completely non-responsive. The algorithm used to
+			  adjust the quota can be configured via the
+			  "fetch-quota-params" option.
+			- "fetches-per-zone" limits the number of
+			  simultaneous queries that can be sent for names
+			  within a single domain.  (Note: Unlike
+			  "fetches-per-server", this value is not
+			  self-tuning.)
+			- New stats counters have been added to count
+			  queries spilled due to these quotas.
+
+			These options are not available by default;
+			use "configure --enable-fetchlimit" (or
+			--enable-developer) to include them in the build.
+
+			See the ARM for details of these options. [RT #37125]
+
+3937.	[func]		Added some debug logging to better indicate the
+			conditions causing SERVFAILs when resolving.
+			[RT #35538]
+
+3812.	[func]		Dig now supports sending arbitary EDNS options from
+			the command line (+ednsopt=code[:value]). [RT #35584]
+
 	--- 9.10.2 released ---
 
 	--- 9.10.2rc2 released ---
@@ -73,7 +468,7 @@
 4061.	[bug]		Handle timeout in legacy system test. [RT #38573]
 
 4060.	[bug]		dns_rdata_freestruct could be called on a
-			uninitialised structure when handling a error.
+			uninitialized structure when handling a error.
 			[RT #38568]
 
 4059.	[bug]		Addressed valgrind warnings. [RT #38549]
--- a/external/bsd/bind/dist/COPYRIGHT	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/COPYRIGHT	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
 Copyright (C) 1996-2003  Internet Software Consortium.
 
 Permission to use, copy, modify, and/or distribute this software for any
--- a/external/bsd/bind/dist/README	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/README	Sun Mar 13 08:00:24 2016 +0000
@@ -51,28 +51,61 @@
 	For up-to-date release notes and errata, see
 	http://www.isc.org/software/bind9/releasenotes
 
-BIND 9.10.2-P4
+
+BIND 9.10.3-P4
+
+	BIND 9.10.3-P4 is a security release addressing the flaws
+	described in CVE-2016-1285, CVE-2016-1286 and CVE-2016-2088.
 
-	BIND 9.10.2-P4 is a security release addressing the flaws
-	described in CVE-2015-5722 and CVE-2015-5986.
+BIND 9.10.3-P3
+
+	BIND 9.10.3-P3 is a security release addressing the flaws
+	described in CVE-2015-8704 and CVE-2015-8705. It also fixes
+	a serious regression in authoritative server selection that
+	was introduced in BIND 9.10.3.
 
-BIND 9.10.2-P3
+BIND 9.10.3-P2
+
+	BIND 9.10.3-P2 is a security release addressing the flaws
+	described in CVE-2015-3193 (OpenSSL), CVE-2015-8000 and
+	CVE-2015-8461.
 
-	BIND 9.10.2-P3 is a security release addressing the flaw
-	described in CVE-2015-5477.
+BIND 9.10.3-P1
+
+	BIND 9.10.3-P1 was incomplete and was withdrawn prior to
+	publication.
+
+BIND 9.10.3
 
-BIND 9.10.2-P2
+	BIND 9.10.3 is a maintenance release and addresses bugs
+	found in BIND 9.10.2 and earlier, as well as the security
+	flaws described in CVE-2015-4620, CVE-2015-5477,
+	CVE-2015-5722, and CVE-2015-5986.
 
-	BIND 9.10.2-P2 is a security release addressing the flaw
-	described in CVE-2015-4620.
+	It also makes the following new features available:
+
+	- New "fetchlimit" quotas are now available for the use of
+	  recursive resolvers that are are under high query load for
+	  domains whose authoritative servers are nonresponsive or are
+	  experiencing a denial of service attack.
 
-BIND 9.10.2-P1
+	  + "fetches-per-server" limits the number of simultaneous queries
+	    that can be sent to any single authoritative server.  The
+	    configured value is a starting point; it is automatically
+	    adjusted downward if the server is partially or completely
+	    non-responsive. The algorithm used to adjust the quota can be
+	    configured via the "fetch-quota-params" option.
+	  + "fetches-per-zone" limits the number of simultaneous queries
+	    that can be sent for names within a single domain.  (Note:
+	    Unlike "fetches-per-server", this value is not self-tuning.)
+	  + New stats counters have been added to count
+	    queries spilled due to these quotas.
 
-        BIND 9.10.2-P1 is a patch release addressing several
-        bugs recently found in the response-policy zones (RPZ)
-        implementation in BIND 9.10.  These mostly affect servers
-        that have multiple frequently-updated response-policy
-        zones.
+	  NOTE: These features are NOT built in by default; use
+	  "configure --enable-fetchlimit" to enable them.
+
+	- Dig now supports sending of arbitary EDNS options by specifying
+	  them on the command line.
 
 BIND 9.10.2
 
--- a/external/bsd/bind/dist/bin/check/check-tool.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/check/check-tool.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: check-tool.c,v 1.6 2014/03/01 03:24:32 christos Exp $	*/
+/*	$NetBSD: check-tool.c,v 1.6.6.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -35,6 +35,7 @@
 #include <isc/mem.h>
 #include <isc/netdb.h>
 #include <isc/net.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
--- a/external/bsd/bind/dist/bin/check/named-checkconf.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/check/named-checkconf.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: named-checkconf.c,v 1.9.2.1 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: named-checkconf.c,v 1.9.2.1.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2007, 2009-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -33,6 +33,7 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>
--- a/external/bsd/bind/dist/bin/check/named-checkzone.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/check/named-checkzone.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: named-checkzone.c,v 1.6 2014/03/01 03:24:32 christos Exp $	*/
+/*	$NetBSD: named-checkzone.c,v 1.6.6.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -32,6 +32,7 @@
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/socket.h>
 #include <isc/string.h>
 #include <isc/task.h>
--- a/external/bsd/bind/dist/bin/confgen/keygen.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/confgen/keygen.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: keygen.c,v 1.5 2014/07/08 05:43:37 spz Exp $	*/
+/*	$NetBSD: keygen.c,v 1.5.4.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2009, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2012-2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -31,6 +31,7 @@
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/string.h>
 
--- a/external/bsd/bind/dist/bin/confgen/util.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/confgen/util.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: util.c,v 1.3 2012/06/05 00:38:51 christos Exp $	*/
+/*	$NetBSD: util.c,v 1.3.14.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -27,6 +27,7 @@
 #include <stdio.h>
 
 #include <isc/boolean.h>
+#include <isc/print.h>
 
 #include "util.h"
 
--- a/external/bsd/bind/dist/bin/dig/dig.1	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dig/dig.1	Sun Mar 13 08:00:24 2016 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dig.1,v 1.8.2.2 2015/07/17 04:31:20 snj Exp $
+.\"	$NetBSD: dig.1,v 1.8.2.2.2.1 2016/03/13 08:00:25 martin Exp $
 .\"
-.\" Copyright (C) 2004-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
 .\" Copyright (C) 2000-2003 Internet Software Consortium.
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
@@ -132,77 +132,97 @@
 .RE
 .SH "OPTIONS"
 .PP
-The
-\fB\-b\fR
-option sets the source IP address of the query to
-\fIaddress\fR. This must be a valid address on one of the host's network interfaces or "0.0.0.0" or "::". An optional port may be specified by appending "#<port>"
+\-4
+.RS 4
+Use IPv4 only.
+.RE
+.PP
+\-6
+.RS 4
+Use IPv6 only.
+.RE
 .PP
-The default query class (IN for internet) is overridden by the
-\fB\-c\fR
-option.
+\-b \fIaddress\fR\fI[#port]\fR
+.RS 4
+Set the source IP address of the query. The
+\fIaddress\fR
+must be a valid address on one of the host's network interfaces, or "0.0.0.0" or "::". An optional port may be specified by appending "#<port>"
+.RE
+.PP
+\-c \fIclass\fR
+.RS 4
+Set the query class. The default
 \fIclass\fR
-is any valid class, such as HS for Hesiod records or CH for Chaosnet records.
+is IN; other classes are HS for Hesiod records or CH for Chaosnet records.
+.RE
 .PP
-The
-\fB\-f\fR
-option makes
-\fBdig \fR
-operate in batch mode by reading a list of lookup requests to process from the file
-\fIfilename\fR. The file contains a number of queries, one per line. Each entry in the file should be organized in the same way they would be presented as queries to
+\-f \fIfile\fR
+.RS 4
+Batch mode:
+\fBdig\fR
+reads a list of lookup requests to process from the given
+\fIfile\fR. Each line in the file should be organized in the same way they would be presented as queries to
 \fBdig\fR
 using the command\-line interface.
+.RE
 .PP
-The
-\fB\-m\fR
-option enables memory usage debugging.
+\-i
+.RS 4
+Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT domain, which is no longer in use. Obsolete bit string label queries (RFC2874) are not attempted.
+.RE
 .PP
-If a non\-standard port number is to be queried, the
-\fB\-p\fR
-option is used.
-\fIport#\fR
-is the port number that
-\fBdig\fR
-will send its queries instead of the standard DNS port number 53. This option would be used to test a name server that has been configured to listen for queries on a non\-standard port number.
+\-k \fIkeyfile\fR
+.RS 4
+Sign queries using TSIG using a key read from the given file. Key files can be generated using
+\fBtsig\-keygen\fR(8). When using TSIG authentication with
+\fBdig\fR, the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by providing appropriate
+\fBkey\fR
+and
+\fBserver\fR
+statements in
+\fInamed.conf\fR.
+.RE
 .PP
-The
-\fB\-4\fR
-option forces
-\fBdig\fR
-to only use IPv4 query transport. The
-\fB\-6\fR
-option forces
-\fBdig\fR
-to only use IPv6 query transport.
+\-m
+.RS 4
+Enable memory usage debugging.
+.RE
+.PP
+\-p \fIport\fR
+.RS 4
+Send the query to a non\-standard port on the server, instead of the defaut port 53. This option would be used to test a name server that has been configured to listen for queries on a non\-standard port number.
+.RE
 .PP
-The
-\fB\-t\fR
-option sets the query type to
-\fItype\fR. It can be any valid query type which is supported in BIND 9. The default query type is "A", unless the
+\-q \fIname\fR
+.RS 4
+The domain name to query. This is useful to distinguish the
+\fIname\fR
+from other arguments.
+.RE
+.PP
+\-t \fItype\fR
+.RS 4
+The resource record type to query. It can be any valid query type which is supported in BIND 9. The default query type is "A", unless the
 \fB\-x\fR
-option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required,
+option is supplied to indicate a reverse lookup. A zone transfer can be requested by specifying a type of AXFR. When an incremental zone transfer (IXFR) is required, set the
 \fItype\fR
-is set to
+to
 ixfr=N. The incremental zone transfer will contain the changes made to the zone since the serial number in the zone's SOA record was
 \fIN\fR.
+.RE
 .PP
-The
-\fB\-q\fR
-option sets the query name to
-\fIname\fR. This is useful to distinguish the
-\fIname\fR
-from other arguments.
+\-v
+.RS 4
+Print the version number and exit.
+.RE
 .PP
-The
-\fB\-v\fR
-causes
-\fBdig\fR
-to print the version number and exit.
-.PP
-Reverse lookups \(em mapping addresses to names \(em are simplified by the
+\-x \fIaddr\fR
+.RS 4
+Simplified reverse lookups, for mapping addresses to names. The
+\fIaddr\fR
+is an IPv4 address in dotted\-decimal notation, or a colon\-delimited IPv6 address. When the
 \fB\-x\fR
-option.
-\fIaddr\fR
-is an IPv4 address in dotted\-decimal notation, or a colon\-delimited IPv6 address. When this option is used, there is no need to provide the
+is used, there is no need to provide the
 \fIname\fR,
 \fIclass\fR
 and
@@ -210,35 +230,41 @@
 arguments.
 \fBdig\fR
 automatically performs a lookup for a name like
-11.12.13.10.in\-addr.arpa
-and sets the query type and class to PTR and IN respectively. By default, IPv6 addresses are looked up using nibble format under the IP6.ARPA domain. To use the older RFC1886 method using the IP6.INT domain specify the
+94.2.0.192.in\-addr.arpa
+and sets the query type and class to PTR and IN respectively. IPv6 addresses are looked up using nibble format under the IP6.ARPA domain (but see also the
 \fB\-i\fR
-option. Bit string labels (RFC2874) are now experimental and are not attempted.
+option).
+.RE
 .PP
-To sign the DNS queries sent by
-\fBdig\fR
-and their responses using transaction signatures (TSIG), specify a TSIG key file using the
-\fB\-k\fR
-option. You can also specify the TSIG key itself on the command line using the
-\fB\-y\fR
-option;
+\-y \fI[hmac:]\fR\fIkeyname:secret\fR
+.RS 4
+Sign queries using TSIG with the given authentication key.
+\fIkeyname\fR
+is the name of the key, and
+\fIsecret\fR
+is the base64 encoded shared secret.
 \fIhmac\fR
-is the type of the TSIG, default HMAC\-MD5,
-\fIname\fR
-is the name of the TSIG key and
-\fIkey\fR
-is the actual key. The key is a base\-64 encoded string, typically generated by
-\fBdnssec\-keygen\fR(8). Caution should be taken when using the
+is the name of the key algorithm; valid choices are
+hmac\-md5,
+hmac\-sha1,
+hmac\-sha224,
+hmac\-sha256,
+hmac\-sha384, or
+hmac\-sha512. If
+\fIhmac\fR
+is not specified, the default is
+hmac\-md5.
+.sp
+NOTE: You should use the
+\fB\-k\fR
+option and avoid the
 \fB\-y\fR
-option on multi\-user systems as the key can be visible in the output from
+option, because with
+\fB\-y\fR
+the shared secret is supplied as a command line argument in clear text. This may be visible in the output from
 \fBps\fR(1)
-or in the shell's history file. When using TSIG authentication with
-\fBdig\fR, the name server that is queried needs to know the key and algorithm that is being used. In BIND, this is done by providing appropriate
-\fBkey\fR
-and
-\fBserver\fR
-statements in
-\fInamed.conf\fR.
+or in a history file maintained by the user's shell.
+.RE
 .SH "QUERY OPTIONS"
 .PP
 \fBdig\fR
@@ -247,7 +273,10 @@
 Each query option is identified by a keyword preceded by a plus sign (+). Some keywords set or reset an option. These may be preceded by the string
 no
 to negate the meaning of that keyword. Other keywords assign values to options like the timeout interval. They have the form
-\fB+keyword=value\fR. The query options are:
+\fB+keyword=value\fR. Keywords may be abbreviated, provided the abbreviation is unambiguous; for example,
++cd
+is equivalent to
++cdflag. The query options are:
 .PP
 \fB+[no]aaflag\fR
 .RS 4
@@ -302,7 +331,7 @@
 Set [do not set] the CD (checking disabled) bit in the query. This requests the server to not perform DNSSEC validation of responses.
 .RE
 .PP
-\fB+[no]cl\fR
+\fB+[no]class\fR
 .RS 4
 Display [do not display] the CLASS when printing the record.
 .RE
@@ -353,6 +382,27 @@
 clears the remembered EDNS version. EDNS is set to 0 by default.
 .RE
 .PP
+\fB+[no]ednsflags[=#]\fR
+.RS 4
+Set the must\-be\-zero EDNS flags bits (Z bits) to the specified value. Decimal, hex and octal encodings are accepted. Setting a named flag (e.g. DO) will silently be ignored. By default, no Z bits are set.
+.RE
+.PP
+\fB+[no]ednsnegotiation\fR
+.RS 4
+Enable / disable EDNS version negotiation. By default EDNS version negotiation is enabled.
+.RE
+.PP
+\fB+[no]ednsopt[=code[:value]]\fR
+.RS 4
+Specify EDNS option with code point
+\fBcode\fR
+and optionally payload of
+\fBvalue\fR
+as a hexadecimal string.
+\fB+noednsopt\fR
+clears the EDNS options to to be sent.
+.RE
+.PP
 \fB+[no]expire\fR
 .RS 4
 Send an EDNS Expire option.
@@ -423,6 +473,11 @@
 Print only one (starting) SOA record when performing an AXFR. The default is to print both the starting and ending SOA records.
 .RE
 .PP
+\fB+[no]opcode=value\fR
+.RS 4
+Set [restore] the DNS message opcode to the specified value. The default value is QUERY (0).
+.RE
+.PP
 \fB+[no]qr\fR
 .RS 4
 Print [do not print] the query as it is sent. By default, the query is not printed.
@@ -433,6 +488,12 @@
 Print [do not print] the question section of a query when an answer is returned. The default is to print the question section as a comment.
 .RE
 .PP
+\fB+[no]rdflag\fR
+.RS 4
+A synonym for
+\fI+[no]recurse\fR.
+.RE
+.PP
 \fB+[no]recurse\fR
 .RS 4
 Toggle the setting of the RD (recursion desired) bit in the query. This bit is set by default, which means
@@ -541,6 +602,8 @@
 \fBdig\fR
 makes iterative queries to resolve the name being looked up. It will follow referrals from the root servers, showing the answer from each server that was used to resolve the lookup.
 .sp
+If @server is also specified, it affects only the initial query for the root zone name servers.
+.sp
 \fB+dnssec\fR
 is also set when +trace is set to better emulate the default queries from a nameserver.
 .RE
@@ -643,7 +706,7 @@
 .PP
 There are probably too many query options.
 .SH "COPYRIGHT"
-Copyright \(co 2004\-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004\-2011, 2013\-2015 Internet Systems Consortium, Inc. ("ISC")
 .br
 Copyright \(co 2000\-2003 Internet Software Consortium.
 .br
--- a/external/bsd/bind/dist/bin/dig/dig.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dig/dig.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dig.c,v 1.9.2.1 2014/12/22 03:28:33 msaitoh Exp $	*/
+/*	$NetBSD: dig.c,v 1.9.2.1.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -31,8 +31,8 @@
 #include <isc/parseint.h>
 #include <isc/print.h>
 #include <isc/string.h>
+#include <isc/task.h>
 #include <isc/util.h>
-#include <isc/task.h>
 
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -118,21 +118,18 @@
 };
 
 /*% safe rcodetext[] */
-static char *
+static const char *
 rcode_totext(dns_rcode_t rcode)
 {
 	static char buf[sizeof("?65535")];
-	union {
-		const char *consttext;
-		char *deconsttext;
-	} totext;
 
 	if (rcode >= (sizeof(rcodetext)/sizeof(rcodetext[0]))) {
 		snprintf(buf, sizeof(buf), "?%u", rcode);
-		totext.deconsttext = buf;
-	} else
-		totext.consttext = rcodetext[rcode];
-	return totext.deconsttext;
+		return (buf);
+	} else if (rcode == dns_rcode_badcookie)
+		return ("BADCOOKIE");
+	else
+		return (rcodetext[rcode]);
 }
 
 /*% print usage */
@@ -171,79 +168,88 @@
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "                 (Use ixfr=version for type ixfr)\n"
 "        q-opt    is one of:\n"
-"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -4                  (use IPv4 query transport only)\n"
+"                 -6                  (use IPv6 query transport only)\n"
+"                 -b address[#port]   (bind to source address/port)\n"
+"                 -c class            (specify query class)\n"
+"                 -f filename         (batch mode)\n"
 "                 -i                  (use IP6.INT for IPv6 reverse lookups)\n"
-"                 -f filename         (batch mode)\n"
-"                 -b address[#port]   (bind to source address/port)\n"
+"                 -k keyfile          (specify tsig key file)\n"
+"                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
 "                 -t type             (specify query type)\n"
-"                 -c class            (specify query class)\n"
 "                 -u                  (display times in usec instead of msec)\n"
-"                 -k keyfile          (specify tsig key file)\n"
+"                 -x dot-notation     (shortcut for reverse lookups)\n"
 "                 -y [hmac:]name:key  (specify named base64 tsig key)\n"
-"                 -4                  (use IPv4 query transport only)\n"
-"                 -6                  (use IPv6 query transport only)\n"
-"                 -m                  (enable memory usage debugging)\n"
 "        d-opt    is of the form +keyword[=value], where keyword is:\n"
-"                 +[no]vc             (TCP mode)\n"
-"                 +[no]tcp            (TCP mode, alternate syntax)\n"
-"                 +time=###           (Set query timeout) [5]\n"
-"                 +tries=###          (Set number of UDP attempts) [3]\n"
-"                 +retry=###          (Set number of UDP retries) [2]\n"
-"                 +domain=###         (Set default domainname)\n"
+"                 +[no]aaonly         (Set AA flag in query (+[no]aaflag))\n"
+"                 +[no]additional     (Control display of additional section)\n"
+"                 +[no]adflag         (Set AD flag in query (default on))\n"
+"                 +[no]all            (Set or clear all display flags)\n"
+"                 +[no]answer         (Control display of answer section)\n"
+"                 +[no]authority      (Control display of authority section)\n"
+"                 +[no]besteffort     (Try to parse even illegal messages)\n"
 "                 +bufsize=###        (Set EDNS0 Max UDP packet size)\n"
-"                 +ndots=###          (Set NDOTS value)\n"
-"                 +subnet=addr        (Set edns-client-subnet option)\n"
-"                 +[no]edns[=###]     (Set EDNS version) [0]\n"
-"                 +[no]search         (Set whether to use searchlist)\n"
-"                 +[no]showsearch     (Search with intermediate results)\n"
-"                 +[no]defname        (Ditto)\n"
-"                 +[no]recurse        (Recursive mode)\n"
-"                 +[no]ignore         (Don't revert to TCP for TC responses.)"
-"\n"
-"                 +[no]fail           (Don't try next server on SERVFAIL)\n"
-"                 +[no]besteffort     (Try to parse even illegal messages)\n"
-"                 +[no]aaonly         (Set AA flag in query (+[no]aaflag))\n"
-"                 +[no]adflag         (Set AD flag in query)\n"
-"                 +[no]cdflag         (Set CD flag in query)\n"
+"                 +[no]cdflag         (Set checking disabled flag in query)\n"
 "                 +[no]cl             (Control display of class in records)\n"
 "                 +[no]cmd            (Control display of command line)\n"
 "                 +[no]comments       (Control display of comment lines)\n"
-"                 +[no]rrcomments     (Control display of per-record "
-				       "comments)\n"
 "                 +[no]crypto         (Control display of cryptographic "
 				       "fields in records)\n"
-"                 +[no]question       (Control display of question)\n"
-"                 +[no]answer         (Control display of answer)\n"
-"                 +[no]authority      (Control display of authority)\n"
-"                 +[no]additional     (Control display of additional)\n"
-"                 +[no]stats          (Control display of statistics)\n"
-"                 +[no]short          (Disable everything except short\n"
+"                 +[no]defname        (Use search list (+[no]search))\n"
+"                 +[no]dnssec         (Request DNSSEC records)\n"
+"                 +domain=###         (Set default domainname)\n"
+"                 +[no]edns[=###]     (Set EDNS version) [0]\n"
+"                 +ednsflags=###      (Set EDNS flag bits)\n"
+"                 +[no]ednsnegotiation (Set EDNS version negotiation)\n"
+"                 +ednsopt=###[:value] (Send specified EDNS option)\n"
+"                 +noednsopt          (Clear list of +ednsopt options)\n"
+"                 +[no]expire         (Request time to expire)\n"
+"                 +[no]fail           (Don't try next server on SERVFAIL)\n"
+"                 +[no]identify       (ID responders in short answers)\n"
+"                 +[no]ignore         (Don't revert to TCP for TC responses.)"
+"\n"
+"                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
+"                 +[no]multiline      (Print records in an expanded format)\n"
+"                 +ndots=###          (Set search NDOTS value)\n"
+"                 +[no]nsid           (Request Name Server ID)\n"
+"                 +[no]nssearch       (Search all authoritative nameservers)\n"
+"                 +[no]onesoa         (AXFR prints only one soa record)\n"
+"                 +[no]opcode=[###]   (Set the opcode of the request)\n"
+"                 +[no]qr             (Print question before sending)\n"
+"                 +[no]question       (Control display of question section)\n"
+"                 +[no]recurse        (Recursive mode)\n"
+"                 +retry=###          (Set number of UDP retries) [2]\n"
+"                 +[no]rrcomments     (Control display of per-record "
+				       "comments)\n"
+"                 +[no]search         (Set whether to use searchlist)\n"
+"                 +[no]short          (Display nothing except short\n"
 "                                      form of answer)\n"
-"                 +[no]ttlid          (Control display of ttls in records)\n"
-"                 +[no]all            (Set or clear all display flags)\n"
-"                 +[no]qr             (Print question before sending)\n"
-"                 +[no]nssearch       (Search all authoritative nameservers)\n"
-"                 +[no]identify       (ID responders in short answers)\n"
-"                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
-"                 +[no]dnssec         (Request DNSSEC records)\n"
-"                 +[no]expire         (Request time to expire)\n"
-"                 +[no]nsid           (Request Name Server ID)\n"
+"                 +[no]showsearch     (Search with intermediate results)\n"
+#ifdef DIG_SIGCHASE
+"                 +[no]sigchase       (Chase DNSSEC signatures)\n"
+#endif
 #ifdef ISC_PLATFORM_USESIT
 "                 +[no]sit            (Request a Source Identity Token)\n"
 #endif
+"                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
+"                 +[no]stats          (Control display of statistics)\n"
+"                 +subnet=addr        (Set edns-client-subnet option)\n"
+"                 +[no]tcp            (TCP mode (+[no]vc))\n"
+"                 +time=###           (Set query timeout) [5]\n"
 #ifdef DIG_SIGCHASE
-"                 +[no]sigchase       (Chase DNSSEC signatures)\n"
-"                 +trusted-key=####   (Trusted Key when chasing DNSSEC sigs)\n"
 #if DIG_SIGCHASE_TD
 "                 +[no]topdown        (Do DNSSEC validation top down mode)\n"
 #endif
 #endif
-"                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
-"                 +[no]multiline      (Print records in an expanded format)\n"
-"                 +[no]onesoa         (AXFR prints only one soa record)\n"
-"                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
+"                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
+"                 +tries=###          (Set number of UDP attempts) [3]\n"
+#ifdef DIG_SIGCHASE
+"                 +trusted-key=####   (Trusted Key when chasing DNSSEC sigs)\n"
+#endif
+"                 +[no]ttlid          (Control display of ttls in records)\n"
+"                 +[no]vc             (TCP mode (+[no]tcp))\n"
 "        global d-opts and servers (before host name) affect all queries.\n"
 "        local d-opts and servers (after host name) affect only that lookup.\n"
 "        -h                           (print help and exit)\n"
@@ -340,9 +346,12 @@
 		ADD_STRING(buf, " ");
 	}
 
+	if (rrcomments)
+		styleflags |= DNS_STYLEFLAG_RRCOMMENT;
 	if (nocrypto)
 		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
-	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, 60, " ", buf);
+	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0,
+				     splitwidth, " ", buf);
 	if (result == ISC_R_NOSPACE)
 		return (result);
 	check_result(result, "dns_rdata_totext");
@@ -752,7 +761,7 @@
 {
 	isc_result_t result;
 	char option_store[256];
-	char *cmd, *value, *ptr;
+	char *cmd, *value, *ptr, *code;
 	isc_uint32_t num;
 	isc_boolean_t state = ISC_TRUE;
 #if defined(DIG_SIGCHASE) || defined(ISC_PLATFORM_USESIT)
@@ -867,8 +876,9 @@
 				goto invalid_option;
 			}
 			break;
-		case 'l': /* cl */
-			FULLCHECK("cl");
+		case 'l': /* class */
+			/* keep +cl for backwards compatibility */
+			FULLCHECK2("cl", "class");
 			noclass = ISC_TF(!state);
 			break;
 		case 'm': /* cmd */
@@ -919,19 +929,77 @@
 	case 'e':
 		switch (cmd[1]) {
 		case 'd':
-			FULLCHECK("edns");
-			if (!state) {
-				lookup->edns = -1;
+			switch(cmd[2]) {
+			case 'n':
+				switch (cmd[3]) {
+				case 's':
+					switch (cmd[4]) {
+					case 0:
+						FULLCHECK("edns");
+						if (!state) {
+							lookup->edns = -1;
+							break;
+						}
+						if (value == NULL) {
+							lookup->edns = 0;
+							break;
+						}
+						result = parse_uint(&num,
+								    value,
+								    255,
+								    "edns");
+						if (result != ISC_R_SUCCESS)
+							fatal("Couldn't parse "
+							      "edns");
+						lookup->edns = num;
+						break;
+					case 'f':
+						FULLCHECK("ednsflags");
+						if (!state) {
+							lookup->ednsflags = 0;
+							break;
+						}
+						if (value == NULL) {
+							lookup->ednsflags = 0;
+							break;
+						}
+						result = parse_xint(&num,
+								    value,
+								    0xffff,
+								  "ednsflags");
+						if (result != ISC_R_SUCCESS)
+							fatal("Couldn't parse "
+							      "ednsflags");
+						lookup->ednsflags = num;
+						break;
+					case 'n':
+						FULLCHECK("ednsnegotiation");
+						lookup->ednsneg = state;
+						break;
+					case 'o':
+						FULLCHECK("ednsopt");
+						if (!state) {
+							lookup->ednsoptscnt = 0;
+							break;
+						}
+						if (value == NULL)
+							fatal("ednsopt no "
+							      "code point "
+							      "specified");
+						code = next_token(&value, ":");
+						save_opt(lookup, code, value);
+						break;
+					default:
+						goto invalid_option;
+					}
+					break;
+				default:
+					goto invalid_option;
+				}
 				break;
+			default:
+				goto invalid_option;
 			}
-			if (value == NULL) {
-				lookup->edns = 0;
-				break;
-			}
-			result = parse_uint(&num, value, 255, "edns");
-			if (result != ISC_R_SUCCESS)
-				fatal("Couldn't parse edns");
-			lookup->edns = num;
 			break;
 		case 'x':
 			FULLCHECK("expire");
@@ -1013,8 +1081,37 @@
 		}
 		break;
 	case 'o':
-		FULLCHECK("onesoa");
-		onesoa = state;
+		switch (cmd[1]) {
+		case 'n':
+			FULLCHECK("onesoa");
+			onesoa = state;
+			break;
+		case 'p':
+			FULLCHECK("opcode");
+			if (!state) {
+				lookup->opcode = 0;	/* default - query */
+				break;
+			}
+			if (value == NULL)
+				goto need_value;
+			for (num = 0;
+			     num < sizeof(opcodetext)/sizeof(opcodetext[0]);
+			     num++) {
+				if (strcasecmp(opcodetext[num], value) == 0)
+					break;
+			}
+			if (num < 16) {
+				lookup->opcode = (dns_opcode_t)num;
+				break;
+			}
+			result = parse_uint(&num, value, 15, "opcode");
+			if (result != ISC_R_SUCCESS)
+				fatal("Couldn't parse opcode");
+			lookup->opcode = (dns_opcode_t)num;
+			break;
+		default:
+			goto invalid_option;
+		}
 		break;
 	case 'q':
 		switch (cmd[1]) {
@@ -1034,6 +1131,10 @@
 		break;
 	case 'r':
 		switch (cmd[1]) {
+		case 'd': /* rdflag */
+			FULLCHECK("rdflag");
+			lookup->recurse = state;
+			break;
 		case 'e':
 			switch (cmd[2]) {
 			case 'c': /* recurse */
--- a/external/bsd/bind/dist/bin/dig/dig.docbook	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dig/dig.docbook	Sun Mar 13 08:00:24 2016 +0000
@@ -2,7 +2,7 @@
 	       "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
 	       [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2004-2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2011, 2013-2015  Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003  Internet Software Consortium.
  -
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -47,6 +47,7 @@
       <year>2011</year>
       <year>2013</year>
       <year>2014</year>
+      <year>2015</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
     <copyright>
@@ -216,127 +217,204 @@
   <refsect1>
     <title>OPTIONS</title>
 
-    <para>
-      The <option>-b</option> option sets the source IP address of the query
-      to <parameter>address</parameter>.  This must be a valid
-      address on
-      one of the host's network interfaces or "0.0.0.0" or "::".  An optional
-      port
-      may be specified by appending "#&lt;port&gt;"
-    </para>
+    <variablelist>
+      <varlistentry>
+        <term>-4</term>
+        <listitem>
+	  <para>
+	    Use IPv4 only.
+	  </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-6</term>
+        <listitem>
+	  <para>
+	    Use IPv6 only.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      The default query class (IN for internet) is overridden by the
-      <option>-c</option> option.  <parameter>class</parameter> is
-      any valid
-      class, such as HS for Hesiod records or CH for Chaosnet records.
-    </para>
+      <varlistentry>
+        <term>-b <replaceable class="parameter">address<optional>#port</optional></replaceable></term>
+        <listitem>
+	  <para>
+	    Set the source IP address of the query.
+	    The <parameter>address</parameter> must be a valid address on
+	    one of the host's network interfaces, or "0.0.0.0" or "::". An
+	    optional port may be specified by appending "#&lt;port&gt;"
+	  </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-c <replaceable class="parameter">class</replaceable></term>
+        <listitem>
+	  <para>
+	    Set the query class. The
+	    default <parameter>class</parameter> is IN; other classes
+	    are HS for Hesiod records or CH for Chaosnet records.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      The <option>-f</option> option makes <command>dig </command>
-      operate
-      in batch mode by reading a list of lookup requests to process from the
-      file <parameter>filename</parameter>.  The file contains a
-      number of
-      queries, one per line.  Each entry in the file should be organized in
-      the same way they would be presented as queries to
-      <command>dig</command> using the command-line interface.
-    </para>
+      <varlistentry>
+        <term>-f <replaceable class="parameter">file</replaceable></term>
+        <listitem>
+	  <para>
+	    Batch mode: <command>dig</command> reads a list of lookup
+	    requests to process from the
+	    given <parameter>file</parameter>. Each line in the file
+	    should be organized in the same way they would be
+	    presented as queries to
+	    <command>dig</command> using the command-line interface.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      The <option>-m</option> option enables memory usage debugging.
-      <!-- It enables ISC_MEM_DEBUGTRACE and ISC_MEM_DEBUGRECORD
-	   documented in include/isc/mem.h -->
-    </para>
+      <varlistentry>
+        <term>-i</term>
+        <listitem>
+	  <para>
+	    Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT
+	    domain, which is no longer in use. Obsolete bit string
+	    label queries (RFC2874) are not attempted.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      If a non-standard port number is to be queried, the
-      <option>-p</option> option is used.  <parameter>port#</parameter> is
-      the port number that <command>dig</command> will send its
-      queries
-      instead of the standard DNS port number 53.  This option would be used
-      to test a name server that has been configured to listen for queries
-      on a non-standard port number.
-    </para>
+      <varlistentry>
+        <term>-k <replaceable class="parameter">keyfile</replaceable></term>
+        <listitem>
+	  <para>
+	    Sign queries using TSIG using a key read from the given file.
+	    Key files can be generated using
+	    <citerefentry>
+	      <refentrytitle>tsig-keygen</refentrytitle><manvolnum>8</manvolnum>
+	    </citerefentry>.
+	    When using TSIG authentication with <command>dig</command>,
+	    the name server that is queried needs to know the key and
+	    algorithm that is being used. In BIND, this is done by
+	    providing appropriate <command>key</command>
+	    and <command>server</command> statements in
+	    <filename>named.conf</filename>.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      The <option>-4</option> option forces <command>dig</command>
-      to only
-      use IPv4 query transport.  The <option>-6</option> option forces
-      <command>dig</command> to only use IPv6 query transport.
-    </para>
+      <varlistentry>
+        <term>-m</term>
+        <listitem>
+	  <para>
+	    Enable memory usage debugging.
+	    <!-- It enables ISC_MEM_DEBUGTRACE and ISC_MEM_DEBUGRECORD
+		 documented in include/isc/mem.h -->
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      The <option>-t</option> option sets the query type to
-      <parameter>type</parameter>.  It can be any valid query type
-      which is
-      supported in BIND 9.  The default query type is "A", unless the
-      <option>-x</option> option is supplied to indicate a reverse lookup.
-      A zone transfer can be requested by specifying a type of AXFR.  When
-      an incremental zone transfer (IXFR) is required,
-      <parameter>type</parameter> is set to <literal>ixfr=N</literal>.
-      The incremental zone transfer will contain the changes made to the zone
-      since the serial number in the zone's SOA record was
-      <parameter>N</parameter>.
-    </para>
+      <varlistentry>
+        <term>-p <replaceable class="parameter">port</replaceable></term>
+        <listitem>
+	  <para>
+	    Send the query to a non-standard port on the server,
+	    instead of the defaut port 53. This option would be used
+	    to test a name server that has been configured to listen
+	    for queries on a non-standard port number.
+	  </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term>-q <replaceable class="parameter">name</replaceable></term>
+        <listitem>
+	  <para>
+	    The domain name to query. This is useful to distinguish
+	    the <parameter>name</parameter> from other arguments.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      The <option>-q</option> option sets the query name to 
-      <parameter>name</parameter>.  This is useful to distinguish the
-      <parameter>name</parameter> from other arguments.
-    </para>
+      <varlistentry>
+        <term>-t <replaceable class="parameter">type</replaceable></term>
+        <listitem>
+	  <para>
+	    The resource record type to query. It can be any valid query type
+	    which is
+	    supported in BIND 9.  The default query type is "A", unless the
+	    <option>-x</option> option is supplied to indicate a reverse lookup.
+	    A zone transfer can be requested by specifying a type of AXFR.  When
+	    an incremental zone transfer (IXFR) is required, set the
+	    <parameter>type</parameter> to <literal>ixfr=N</literal>.
+	    The incremental zone transfer will contain the changes
+	    made to the zone since the serial number in the zone's SOA
+	    record was
+	    <parameter>N</parameter>.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      The <option>-v</option> causes <command>dig</command> to
-      print the version number and exit.
-    </para>
+      <varlistentry>
+        <term>-v</term>
+        <listitem>
+	  <para>
+	    Print the version number and exit.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      Reverse lookups &mdash; mapping addresses to names &mdash; are simplified by the
-      <option>-x</option> option.  <parameter>addr</parameter> is
-      an IPv4
-      address in dotted-decimal notation, or a colon-delimited IPv6 address.
-      When this option is used, there is no need to provide the
-      <parameter>name</parameter>, <parameter>class</parameter> and
-      <parameter>type</parameter> arguments.  <command>dig</command>
-      automatically performs a lookup for a name like
-      <literal>11.12.13.10.in-addr.arpa</literal> and sets the
-      query type and
-      class to PTR and IN respectively.  By default, IPv6 addresses are
-      looked up using nibble format under the IP6.ARPA domain.
-      To use the older RFC1886 method using the IP6.INT domain
-      specify the <option>-i</option> option.  Bit string labels (RFC2874)
-      are now experimental and are not attempted.
-    </para>
+      <varlistentry>
+        <term>-x <replaceable class="parameter">addr</replaceable></term>
+        <listitem>
+	  <para>
+	    Simplified reverse lookups, for mapping addresses to
+	    names. The <parameter>addr</parameter> is an IPv4 address
+	    in dotted-decimal notation, or a colon-delimited IPv6
+	    address. When the <option>-x</option> is used, there is no
+	    need to provide
+	    the <parameter>name</parameter>, <parameter>class</parameter>
+	    and <parameter>type</parameter>
+	    arguments. <command>dig</command> automatically performs a
+	    lookup for a name like
+	    <literal>94.2.0.192.in-addr.arpa</literal> and sets the
+	    query type and class to PTR and IN respectively. IPv6
+	    addresses are looked up using nibble format under the
+	    IP6.ARPA domain (but see also the <option>-i</option>
+	    option).
+	  </para>
+        </listitem>
+      </varlistentry>
 
-    <para>
-      To sign the DNS queries sent by <command>dig</command> and
-      their
-      responses using transaction signatures (TSIG), specify a TSIG key file
-      using the <option>-k</option> option.  You can also specify the TSIG
-      key itself on the command line using the <option>-y</option> option;
-      <parameter>hmac</parameter> is the type of the TSIG, default HMAC-MD5,
-      <parameter>name</parameter> is the name of the TSIG key and
-      <parameter>key</parameter> is the actual key.  The key is a
-      base-64
-      encoded string, typically generated by
-      <citerefentry>
-	<refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>
-      </citerefentry>.
+      <varlistentry>
+        <term>-y <replaceable class="parameter"><optional>hmac:</optional>keyname:secret</replaceable></term>
+        <listitem>
+	  <para>
+	    Sign queries using TSIG with the given authentication key.
+	    <parameter>keyname</parameter> is the name of the key, and
+	    <parameter>secret</parameter> is the base64 encoded shared secret.
+	    <parameter>hmac</parameter> is the name of the key algorithm;
+	    valid choices are <literal>hmac-md5</literal>,
+	    <literal>hmac-sha1</literal>, <literal>hmac-sha224</literal>,
+	    <literal>hmac-sha256</literal>, <literal>hmac-sha384</literal>, or
+	    <literal>hmac-sha512</literal>.  If <parameter>hmac</parameter>
+	    is not specified, the default is <literal>hmac-md5</literal>.
+	  </para>
+	  <para>
+	    NOTE: You should use the <option>-k</option> option and
+	    avoid the <option>-y</option> option, because
+	    with <option>-y</option> the shared secret is supplied as
+	    a command line argument in clear text. This may be visible
+	    in the output from
+	    <citerefentry>
+              <refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum>
+	    </citerefentry>
+	    or in a history file maintained by the user's shell.
+	  </para>
+        </listitem>
+      </varlistentry>
 
-      Caution should be taken when using the <option>-y</option> option on
-      multi-user systems as the key can be visible in the output from
-      <citerefentry>
-	<refentrytitle>ps</refentrytitle><manvolnum>1</manvolnum>
-      </citerefentry>
-      or in the shell's history file.  When
-      using TSIG authentication with <command>dig</command>, the name
-      server that is queried needs to know the key and algorithm that is
-      being used.  In BIND, this is done by providing appropriate
-      <command>key</command> and <command>server</command> statements in
-      <filename>named.conf</filename>.
-    </para>
-
+    </variablelist>
   </refsect1>
 
   <refsect1>
@@ -358,6 +436,9 @@
       that keyword.  Other
       keywords assign values to options like the timeout interval.  They
       have the form <option>+keyword=value</option>.
+      Keywords may be abbreviated, provided the abbreviation is
+      unambiguous; for example, <literal>+cd</literal> is equivalent
+      to <literal>+cdflag</literal>.
       The query options are:
 
       <variablelist>
@@ -473,7 +554,7 @@
 	</varlistentry>
 
 	<varlistentry>
-	  <term><option>+[no]cl</option></term>
+	  <term><option>+[no]class</option></term>
 	  <listitem>
 	    <para>
 	      Display [do not display] the CLASS when printing the
@@ -569,6 +650,40 @@
 	</varlistentry>
 
 	<varlistentry>
+	  <term><option>+[no]ednsflags[=#]</option></term>
+	  <listitem>
+	    <para>
+	      Set the must-be-zero EDNS flags bits (Z bits) to the
+	      specified value. Decimal, hex and octal encodings are
+	      accepted. Setting a named flag (e.g. DO) will silently be
+	      ignored. By default, no Z bits are set.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
+	<varlistentry>
+	  <term><option>+[no]ednsnegotiation</option></term>
+	  <listitem>
+	    <para>
+	      Enable / disable EDNS version negotiation. By default
+	      EDNS version negotiation is enabled.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
+	<varlistentry>
+	  <term><option>+[no]ednsopt[=code[:value]]</option></term>
+	  <listitem>
+	    <para>
+	      Specify EDNS option with code point <option>code</option>
+	      and optionally payload of <option>value</option> as a
+	      hexadecimal string.  <option>+noednsopt</option>
+	      clears the EDNS options to to be sent.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
+	<varlistentry>
 	  <term><option>+[no]expire</option></term>
 	  <listitem>
 	    <para>
@@ -690,6 +805,16 @@
 	</varlistentry>
 
 	<varlistentry>
+	  <term><option>+[no]opcode=value</option></term>
+	  <listitem>
+	    <para>
+	      Set [restore] the DNS message opcode to the specified
+	      value.  The default value is QUERY (0).
+	    </para>
+	  </listitem>
+	</varlistentry>
+
+	<varlistentry>
 	  <term><option>+[no]qr</option></term>
 	  <listitem>
 	    <para>
@@ -711,6 +836,15 @@
 	</varlistentry>
 
 	<varlistentry>
+	  <term><option>+[no]rdflag</option></term>
+	  <listitem>
+	    <para>
+	      A synonym for <parameter>+[no]recurse</parameter>.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
+	<varlistentry>
 	  <term><option>+[no]recurse</option></term>
 	  <listitem>
 	    <para>
@@ -898,6 +1032,9 @@
 	      referrals from the root servers, showing the answer
 	      from each server that was used to resolve the lookup.
 	    </para> <para>
+	      If @server is also specified, it affects only the
+	      initial query for the root zone name servers.
+	    </para> <para>
 	      <command>+dnssec</command> is also set when +trace
 	      is set to better emulate the default queries from a
 	      nameserver.
--- a/external/bsd/bind/dist/bin/dig/dig.html	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dig/dig.html	Sun Mar 13 08:00:24 2016 +0000
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2004-2011, 2013, 2014 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2011, 2013-2015 Internet Systems Consortium, Inc. ("ISC")
  - Copyright (C) 2000-2003 Internet Software Consortium.
  - 
  - Permission to use, copy, modify, and/or distribute this software for any
@@ -34,7 +34,7 @@
 <div class="cmdsynopsis"><p><code class="command">dig</code>  [global-queryopt...] [query...]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543544"></a><h2>DESCRIPTION</h2>
+<a name="id2543547"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dig</strong></span>
       (domain information groper) is a flexible tool
       for interrogating DNS name servers.  It performs DNS lookups and
@@ -81,7 +81,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543623"></a><h2>SIMPLE USAGE</h2>
+<a name="id2543626"></a><h2>SIMPLE USAGE</h2>
 <p>
       A typical invocation of <span><strong class="command">dig</strong></span> looks like:
       </p>
@@ -134,115 +134,135 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543726"></a><h2>OPTIONS</h2>
-<p>
-      The <code class="option">-b</code> option sets the source IP address of the query
-      to <em class="parameter"><code>address</code></em>.  This must be a valid
-      address on
-      one of the host's network interfaces or "0.0.0.0" or "::".  An optional
-      port
-      may be specified by appending "#&lt;port&gt;"
-    </p>
-<p>
-      The default query class (IN for internet) is overridden by the
-      <code class="option">-c</code> option.  <em class="parameter"><code>class</code></em> is
-      any valid
-      class, such as HS for Hesiod records or CH for Chaosnet records.
-    </p>
-<p>
-      The <code class="option">-f</code> option makes <span><strong class="command">dig </strong></span>
-      operate
-      in batch mode by reading a list of lookup requests to process from the
-      file <em class="parameter"><code>filename</code></em>.  The file contains a
-      number of
-      queries, one per line.  Each entry in the file should be organized in
-      the same way they would be presented as queries to
-      <span><strong class="command">dig</strong></span> using the command-line interface.
-    </p>
-<p>
-      The <code class="option">-m</code> option enables memory usage debugging.
-      
-    </p>
-<p>
-      If a non-standard port number is to be queried, the
-      <code class="option">-p</code> option is used.  <em class="parameter"><code>port#</code></em> is
-      the port number that <span><strong class="command">dig</strong></span> will send its
-      queries
-      instead of the standard DNS port number 53.  This option would be used
-      to test a name server that has been configured to listen for queries
-      on a non-standard port number.
-    </p>
-<p>
-      The <code class="option">-4</code> option forces <span><strong class="command">dig</strong></span>
-      to only
-      use IPv4 query transport.  The <code class="option">-6</code> option forces
-      <span><strong class="command">dig</strong></span> to only use IPv6 query transport.
-    </p>
+<a name="id2543730"></a><h2>OPTIONS</h2>
+<div class="variablelist"><dl>
+<dt><span class="term">-4</span></dt>
+<dd><p>
+	    Use IPv4 only.
+	  </p></dd>
+<dt><span class="term">-6</span></dt>
+<dd><p>
+	    Use IPv6 only.
+	  </p></dd>
+<dt><span class="term">-b <em class="replaceable"><code>address[<span class="optional">#port</span>]</code></em></span></dt>
+<dd><p>
+	    Set the source IP address of the query.
+	    The <em class="parameter"><code>address</code></em> must be a valid address on
+	    one of the host's network interfaces, or "0.0.0.0" or "::". An
+	    optional port may be specified by appending "#&lt;port&gt;"
+	  </p></dd>
+<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
+<dd><p>
+	    Set the query class. The
+	    default <em class="parameter"><code>class</code></em> is IN; other classes
+	    are HS for Hesiod records or CH for Chaosnet records.
+	  </p></dd>
+<dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
+<dd><p>
+	    Batch mode: <span><strong class="command">dig</strong></span> reads a list of lookup
+	    requests to process from the
+	    given <em class="parameter"><code>file</code></em>. Each line in the file
+	    should be organized in the same way they would be
+	    presented as queries to
+	    <span><strong class="command">dig</strong></span> using the command-line interface.
+	  </p></dd>
+<dt><span class="term">-i</span></dt>
+<dd><p>
+	    Do reverse IPv6 lookups using the obsolete RFC1886 IP6.INT
+	    domain, which is no longer in use. Obsolete bit string
+	    label queries (RFC2874) are not attempted.
+	  </p></dd>
+<dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
+<dd><p>
+	    Sign queries using TSIG using a key read from the given file.
+	    Key files can be generated using
+	    <span class="citerefentry"><span class="refentrytitle">tsig-keygen</span>(8)</span>.
+	    When using TSIG authentication with <span><strong class="command">dig</strong></span>,
+	    the name server that is queried needs to know the key and
+	    algorithm that is being used. In BIND, this is done by
+	    providing appropriate <span><strong class="command">key</strong></span>
+	    and <span><strong class="command">server</strong></span> statements in
+	    <code class="filename">named.conf</code>.
+	  </p></dd>
+<dt><span class="term">-m</span></dt>
+<dd><p>
+	    Enable memory usage debugging.
+	    
+	  </p></dd>
+<dt><span class="term">-p <em class="replaceable"><code>port</code></em></span></dt>
+<dd><p>
+	    Send the query to a non-standard port on the server,
+	    instead of the defaut port 53. This option would be used
+	    to test a name server that has been configured to listen
+	    for queries on a non-standard port number.
+	  </p></dd>
+<dt><span class="term">-q <em class="replaceable"><code>name</code></em></span></dt>
+<dd><p>
+	    The domain name to query. This is useful to distinguish
+	    the <em class="parameter"><code>name</code></em> from other arguments.
+	  </p></dd>
+<dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
+<dd><p>
+	    The resource record type to query. It can be any valid query type
+	    which is
+	    supported in BIND 9.  The default query type is "A", unless the
+	    <code class="option">-x</code> option is supplied to indicate a reverse lookup.
+	    A zone transfer can be requested by specifying a type of AXFR.  When
+	    an incremental zone transfer (IXFR) is required, set the
+	    <em class="parameter"><code>type</code></em> to <code class="literal">ixfr=N</code>.
+	    The incremental zone transfer will contain the changes
+	    made to the zone since the serial number in the zone's SOA
+	    record was
+	    <em class="parameter"><code>N</code></em>.
+	  </p></dd>
+<dt><span class="term">-v</span></dt>
+<dd><p>
+	    Print the version number and exit.
+	  </p></dd>
+<dt><span class="term">-x <em class="replaceable"><code>addr</code></em></span></dt>
+<dd><p>
+	    Simplified reverse lookups, for mapping addresses to
+	    names. The <em class="parameter"><code>addr</code></em> is an IPv4 address
+	    in dotted-decimal notation, or a colon-delimited IPv6
+	    address. When the <code class="option">-x</code> is used, there is no
+	    need to provide
+	    the <em class="parameter"><code>name</code></em>, <em class="parameter"><code>class</code></em>
+	    and <em class="parameter"><code>type</code></em>
+	    arguments. <span><strong class="command">dig</strong></span> automatically performs a
+	    lookup for a name like
+	    <code class="literal">94.2.0.192.in-addr.arpa</code> and sets the
+	    query type and class to PTR and IN respectively. IPv6
+	    addresses are looked up using nibble format under the
+	    IP6.ARPA domain (but see also the <code class="option">-i</code>
+	    option).
+	  </p></dd>
+<dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
+<dd>
 <p>
-      The <code class="option">-t</code> option sets the query type to
-      <em class="parameter"><code>type</code></em>.  It can be any valid query type
-      which is
-      supported in BIND 9.  The default query type is "A", unless the
-      <code class="option">-x</code> option is supplied to indicate a reverse lookup.
-      A zone transfer can be requested by specifying a type of AXFR.  When
-      an incremental zone transfer (IXFR) is required,
-      <em class="parameter"><code>type</code></em> is set to <code class="literal">ixfr=N</code>.
-      The incremental zone transfer will contain the changes made to the zone
-      since the serial number in the zone's SOA record was
-      <em class="parameter"><code>N</code></em>.
-    </p>
-<p>
-      The <code class="option">-q</code> option sets the query name to 
-      <em class="parameter"><code>name</code></em>.  This is useful to distinguish the
-      <em class="parameter"><code>name</code></em> from other arguments.
-    </p>
-<p>
-      The <code class="option">-v</code> causes <span><strong class="command">dig</strong></span> to
-      print the version number and exit.
-    </p>
+	    Sign queries using TSIG with the given authentication key.
+	    <em class="parameter"><code>keyname</code></em> is the name of the key, and
+	    <em class="parameter"><code>secret</code></em> is the base64 encoded shared secret.
+	    <em class="parameter"><code>hmac</code></em> is the name of the key algorithm;
+	    valid choices are <code class="literal">hmac-md5</code>,
+	    <code class="literal">hmac-sha1</code>, <code class="literal">hmac-sha224</code>,
+	    <code class="literal">hmac-sha256</code>, <code class="literal">hmac-sha384</code>, or
+	    <code class="literal">hmac-sha512</code>.  If <em class="parameter"><code>hmac</code></em>
+	    is not specified, the default is <code class="literal">hmac-md5</code>.
+	  </p>
 <p>
-      Reverse lookups &#8212; mapping addresses to names &#8212; are simplified by the
-      <code class="option">-x</code> option.  <em class="parameter"><code>addr</code></em> is
-      an IPv4
-      address in dotted-decimal notation, or a colon-delimited IPv6 address.
-      When this option is used, there is no need to provide the
-      <em class="parameter"><code>name</code></em>, <em class="parameter"><code>class</code></em> and
-      <em class="parameter"><code>type</code></em> arguments.  <span><strong class="command">dig</strong></span>
-      automatically performs a lookup for a name like
-      <code class="literal">11.12.13.10.in-addr.arpa</code> and sets the
-      query type and
-      class to PTR and IN respectively.  By default, IPv6 addresses are
-      looked up using nibble format under the IP6.ARPA domain.
-      To use the older RFC1886 method using the IP6.INT domain
-      specify the <code class="option">-i</code> option.  Bit string labels (RFC2874)
-      are now experimental and are not attempted.
-    </p>
-<p>
-      To sign the DNS queries sent by <span><strong class="command">dig</strong></span> and
-      their
-      responses using transaction signatures (TSIG), specify a TSIG key file
-      using the <code class="option">-k</code> option.  You can also specify the TSIG
-      key itself on the command line using the <code class="option">-y</code> option;
-      <em class="parameter"><code>hmac</code></em> is the type of the TSIG, default HMAC-MD5,
-      <em class="parameter"><code>name</code></em> is the name of the TSIG key and
-      <em class="parameter"><code>key</code></em> is the actual key.  The key is a
-      base-64
-      encoded string, typically generated by
-      <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>.
-
-      Caution should be taken when using the <code class="option">-y</code> option on
-      multi-user systems as the key can be visible in the output from
-      <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
-      or in the shell's history file.  When
-      using TSIG authentication with <span><strong class="command">dig</strong></span>, the name
-      server that is queried needs to know the key and algorithm that is
-      being used.  In BIND, this is done by providing appropriate
-      <span><strong class="command">key</strong></span> and <span><strong class="command">server</strong></span> statements in
-      <code class="filename">named.conf</code>.
-    </p>
+	    NOTE: You should use the <code class="option">-k</code> option and
+	    avoid the <code class="option">-y</code> option, because
+	    with <code class="option">-y</code> the shared secret is supplied as
+	    a command line argument in clear text. This may be visible
+	    in the output from
+	    <span class="citerefentry"><span class="refentrytitle">ps</span>(1)</span>
+	    or in a history file maintained by the user's shell.
+	  </p>
+</dd>
+</dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2544018"></a><h2>QUERY OPTIONS</h2>
+<a name="id2544181"></a><h2>QUERY OPTIONS</h2>
 <p><span><strong class="command">dig</strong></span>
       provides a number of query options which affect
       the way in which lookups are made and the results displayed.  Some of
@@ -258,6 +278,9 @@
       that keyword.  Other
       keywords assign values to options like the timeout interval.  They
       have the form <code class="option">+keyword=value</code>.
+      Keywords may be abbreviated, provided the abbreviation is
+      unambiguous; for example, <code class="literal">+cd</code> is equivalent
+      to <code class="literal">+cdflag</code>.
       The query options are:
 
       </p>
@@ -322,7 +345,7 @@
 	      the query.  This requests the server to not perform
 	      DNSSEC validation of responses.
 	    </p></dd>
-<dt><span class="term"><code class="option">+[no]cl</code></span></dt>
+<dt><span class="term"><code class="option">+[no]class</code></span></dt>
 <dd><p>
 	      Display [do not display] the CLASS when printing the
 	      record.
@@ -378,6 +401,25 @@
 	       clears the remembered EDNS version.  EDNS is set to
 	       0 by default.
 	    </p></dd>
+<dt><span class="term"><code class="option">+[no]ednsflags[=#]</code></span></dt>
+<dd><p>
+	      Set the must-be-zero EDNS flags bits (Z bits) to the
+	      specified value. Decimal, hex and octal encodings are
+	      accepted. Setting a named flag (e.g. DO) will silently be
+	      ignored. By default, no Z bits are set.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]ednsnegotiation</code></span></dt>
+<dd><p>
+	      Enable / disable EDNS version negotiation. By default
+	      EDNS version negotiation is enabled.
+	    </p></dd>
+<dt><span class="term"><code class="option">+[no]ednsopt[=code[:value]]</code></span></dt>
+<dd><p>
+	      Specify EDNS option with code point <code class="option">code</code>
+	      and optionally payload of <code class="option">value</code> as a
+	      hexadecimal string.  <code class="option">+noednsopt</code>
+	      clears the EDNS options to to be sent.
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]expire</code></span></dt>
 <dd><p>
 	      Send an EDNS Expire option.
@@ -449,6 +491,11 @@
 	      an AXFR. The default is to print both the starting
 	      and ending SOA records.
 	    </p></dd>
+<dt><span class="term"><code class="option">+[no]opcode=value</code></span></dt>
+<dd><p>
+	      Set [restore] the DNS message opcode to the specified
+	      value.  The default value is QUERY (0).
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]qr</code></span></dt>
 <dd><p>
 	      Print [do not print] the query as it is sent.  By
@@ -460,6 +507,10 @@
 	      when an answer is returned.  The default is to print
 	      the question section as a comment.
 	    </p></dd>
+<dt><span class="term"><code class="option">+[no]rdflag</code></span></dt>
+<dd><p>
+	      A synonym for <em class="parameter"><code>+[no]recurse</code></em>.
+	    </p></dd>
 <dt><span class="term"><code class="option">+[no]recurse</code></span></dt>
 <dd><p>
 	      Toggle the setting of the RD (recursion desired) bit
@@ -580,6 +631,10 @@
 	      from each server that was used to resolve the lookup.
 	    </p>
 <p>
+	      If @server is also specified, it affects only the
+	      initial query for the root zone name servers.
+	    </p>
+<p>
 	      <span><strong class="command">+dnssec</strong></span> is also set when +trace
 	      is set to better emulate the default queries from a
 	      nameserver.
@@ -628,7 +683,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545243"></a><h2>MULTIPLE QUERIES</h2>
+<a name="id2542021"></a><h2>MULTIPLE QUERIES</h2>
 <p>
       The BIND 9 implementation of <span><strong class="command">dig </strong></span>
       supports
@@ -674,7 +729,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545305"></a><h2>IDN SUPPORT</h2>
+<a name="id2545769"></a><h2>IDN SUPPORT</h2>
 <p>
       If <span><strong class="command">dig</strong></span> has been built with IDN (internationalized
       domain name) support, it can accept and display non-ASCII domain names.
@@ -688,14 +743,14 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545328"></a><h2>FILES</h2>
+<a name="id2545792"></a><h2>FILES</h2>
 <p><code class="filename">/etc/resolv.conf</code>
     </p>
 <p><code class="filename">${HOME}/.digrc</code>
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545345"></a><h2>SEE ALSO</h2>
+<a name="id2545809"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">host</span>(1)</span>,
       <span class="citerefentry"><span class="refentrytitle">named</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
@@ -703,7 +758,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2545382"></a><h2>BUGS</h2>
+<a name="id2545846"></a><h2>BUGS</h2>
 <p>
       There are probably too many query options.
     </p>
--- a/external/bsd/bind/dist/bin/dig/dighost.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dig/dighost.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dighost.c,v 1.13.2.2 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: dighost.c,v 1.13.2.2.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -86,6 +86,7 @@
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/result.h>
+#include <isc/safe.h>
 #include <isc/serial.h>
 #include <isc/sockaddr.h>
 #include <isc/string.h>
@@ -152,6 +153,10 @@
 int tries = 3;
 int lookup_counter = 0;
 
+#ifdef ISC_PLATFORM_USESIT
+static char sitvalue[256];
+#endif
+
 #ifdef WITH_IDN
 static void		initialize_idn(void);
 static isc_result_t	output_filter(isc_buffer_t *buffer,
@@ -201,7 +206,7 @@
 
 #ifdef DIG_SIGCHASE
 
-isc_result_t	  get_trusted_key(isc_mem_t *mctx);
+isc_result_t	  get_trusted_key(void);
 dns_rdataset_t *  sigchase_scanname(dns_rdatatype_t type,
 				    dns_rdatatype_t covers,
 				    isc_boolean_t *lookedup,
@@ -219,32 +224,26 @@
 isc_result_t	  sigchase_verify_sig_key(dns_name_t *name,
 					  dns_rdataset_t *rdataset,
 					  dst_key_t* dnsseckey,
-					  dns_rdataset_t *sigrdataset,
-					  isc_mem_t *mctx);
+					  dns_rdataset_t *sigrdataset);
 isc_result_t	  sigchase_verify_sig(dns_name_t *name,
 				      dns_rdataset_t *rdataset,
 				      dns_rdataset_t *keyrdataset,
-				      dns_rdataset_t *sigrdataset,
-				      isc_mem_t *mctx);
+				      dns_rdataset_t *sigrdataset);
 isc_result_t	  sigchase_verify_ds(dns_name_t *name,
 				     dns_rdataset_t *keyrdataset,
-				     dns_rdataset_t *dsrdataset,
-				     isc_mem_t *mctx);
+				     dns_rdataset_t *dsrdataset);
 void		  sigchase(dns_message_t *msg);
 void		  print_rdata(dns_rdata_t *rdata, isc_mem_t *mctx);
-void		  print_rdataset(dns_name_t *name,
-				 dns_rdataset_t *rdataset, isc_mem_t *mctx);
-void		  dup_name(dns_name_t *source, dns_name_t* target,
-			   isc_mem_t *mctx);
-void		  free_name(dns_name_t *name, isc_mem_t *mctx);
+void		  print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset);
+void		  dup_name(dns_name_t *source, dns_name_t* target);
+void		  free_name(dns_name_t *name);
 void		  dump_database(void);
 void		  dump_database_section(dns_message_t *msg, int section);
 dns_rdataset_t *  search_type(dns_name_t *name, dns_rdatatype_t type,
 			      dns_rdatatype_t covers);
 isc_result_t	  contains_trusted_key(dns_name_t *name,
 				       dns_rdataset_t *rdataset,
-				       dns_rdataset_t *sigrdataset,
-				       isc_mem_t *mctx);
+				       dns_rdataset_t *sigrdataset);
 void		  print_type(dns_rdatatype_t type);
 isc_result_t	  prove_nx_domain(dns_message_t * msg,
 				  dns_name_t * name,
@@ -266,7 +265,7 @@
 			   dns_rdataset_t ** sigrdataset);
 static void	  nameFromString(const char *str, dns_name_t *p_ret);
 int		  inf_name(dns_name_t * name1, dns_name_t * name2);
-isc_result_t	  removetmpkey(isc_mem_t *mctx, const char *file);
+isc_result_t	  removetmpkey(const char *file);
 void		  clean_trustedkey(void);
 isc_result_t 	  insert_trustedkey(void *arg, dns_name_t *name,
 				    dns_rdataset_t *rdataset);
@@ -786,6 +785,8 @@
 	looknew->servfail_stops = ISC_TRUE;
 	looknew->besteffort = ISC_TRUE;
 	looknew->dnssec = ISC_FALSE;
+	looknew->ednsflags = 0;
+	looknew->opcode = dns_opcode_query;
 	looknew->expire = ISC_FALSE;
 	looknew->nsid = ISC_FALSE;
 #ifdef ISC_PLATFORM_USESIT
@@ -831,6 +832,9 @@
 #ifdef ISC_PLATFORM_USESIT
 	looknew->sitvalue = NULL;
 #endif
+	looknew->ednsopts = NULL;
+	looknew->ednsoptscnt = 0;
+	looknew->ednsneg = ISC_FALSE;
 	dns_fixedname_init(&looknew->fdomain);
 	ISC_LINK_INIT(looknew, link);
 	ISC_LIST_INIT(looknew->q);
@@ -877,12 +881,17 @@
 	looknew->servfail_stops = lookold->servfail_stops;
 	looknew->besteffort = lookold->besteffort;
 	looknew->dnssec = lookold->dnssec;
+	looknew->ednsflags = lookold->ednsflags;
+	looknew->opcode = lookold->opcode;
 	looknew->expire = lookold->expire;
 	looknew->nsid = lookold->nsid;
 #ifdef ISC_PLATFORM_USESIT
 	looknew->sit = lookold->sit;
 	looknew->sitvalue = lookold->sitvalue;
 #endif
+	looknew->ednsopts = lookold->ednsopts;
+	looknew->ednsoptscnt = lookold->ednsoptscnt;
+	looknew->ednsneg = lookold->ednsneg;
 #ifdef DIG_SIGCHASE
 	looknew->sigchase = lookold->sigchase;
 #if DIG_SIGCHASE_TD
@@ -918,6 +927,8 @@
 	if (lookold->ecs_addr != NULL) {
 		size_t len = sizeof(isc_sockaddr_t);
 		looknew->ecs_addr = isc_mem_allocate(mctx, len);
+		if (looknew->ecs_addr == NULL)
+			fatal("out of memory");
 		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
 	}
 
@@ -1010,11 +1021,11 @@
 	isc_buffer_free(&namebuf);
 }
 
-isc_result_t
-parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
-	   const char *desc) {
+static isc_result_t
+parse_uint_helper(isc_uint32_t *uip, const char *value, isc_uint32_t max,
+		  const char *desc, int base) {
 	isc_uint32_t n;
-	isc_result_t result = isc_parse_uint32(&n, value, 10);
+	isc_result_t result = isc_parse_uint32(&n, value, base);
 	if (result == ISC_R_SUCCESS && n > max)
 		result = ISC_R_RANGE;
 	if (result != ISC_R_SUCCESS) {
@@ -1026,6 +1037,18 @@
 	return (ISC_R_SUCCESS);
 }
 
+isc_result_t
+parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
+	   const char *desc) {
+	return (parse_uint_helper(uip, value, max, desc, 10));
+}
+
+isc_result_t
+parse_xint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
+	   const char *desc) {
+	return (parse_uint_helper(uip, value, max, desc, 0));
+}
+
 static isc_uint32_t
 parse_bits(char *arg, const char *desc, isc_uint32_t max) {
 	isc_result_t result;
@@ -1059,6 +1082,8 @@
 	}
 
 	sa = isc_mem_allocate(mctx, sizeof(*sa));
+	if (sa == NULL)
+		fatal("out of memory");
 	if (inet_pton(AF_INET6, value, &in6) == 1) {
 		isc_sockaddr_fromin6(sa, &in6, 0);
 		parsed = ISC_TRUE;
@@ -1486,6 +1511,45 @@
 	check_result(result, "isc_mutex_init");
 }
 
+#define EDNSOPTS 100U
+static dns_ednsopt_t ednsopts[EDNSOPTS];
+static unsigned char ednsoptscnt = 0;
+
+void
+save_opt(dig_lookup_t *lookup, char *code, char *value) {
+	isc_uint32_t num;
+	isc_buffer_t b;
+	isc_result_t result;
+
+	if (ednsoptscnt == EDNSOPTS)
+		fatal("too many ednsopts");
+
+	result = parse_uint(&num, code, 65535, "ednsopt");
+	if (result != ISC_R_SUCCESS)
+		fatal("bad edns code point: %s", code);
+
+	ednsopts[ednsoptscnt].code = num;
+	ednsopts[ednsoptscnt].length = 0;
+	ednsopts[ednsoptscnt].value = NULL;
+
+	if (value != NULL) {
+		char *buf;
+		buf = isc_mem_allocate(mctx, strlen(value)/2 + 1);
+		if (buf == NULL)
+			fatal("out of memory");
+		isc_buffer_init(&b, buf, strlen(value)/2 + 1);
+		result = isc_hex_decodestring(value, &b);
+		check_result(result, "isc_hex_decodestring");
+		ednsopts[ednsoptscnt].value = isc_buffer_base(&b);
+		ednsopts[ednsoptscnt].length = isc_buffer_usedlength(&b);
+	}
+
+	if (lookup->ednsoptscnt == 0)
+		lookup->ednsopts = &ednsopts[ednsoptscnt];
+	lookup->ednsoptscnt++;
+	ednsoptscnt++;
+}
+
 /*%
  * Add EDNS0 option record to a message.  Currently, the only supported
  * options are UDP buffer size, the DO bit, and EDNS options
@@ -1493,15 +1557,12 @@
  */
 static void
 add_opt(dns_message_t *msg, isc_uint16_t udpsize, isc_uint16_t edns,
-	isc_boolean_t dnssec, dns_ednsopt_t *opts, size_t count)
+	unsigned int flags, dns_ednsopt_t *opts, size_t count)
 {
 	dns_rdataset_t *rdataset = NULL;
 	isc_result_t result;
-	unsigned int flags = 0;
 
 	debug("add_opt()");
-	if (dnssec)
-		flags |= DNS_MESSAGEEXTFLAG_DO;
 	result = dns_message_buildopt(msg, &rdataset, edns, udpsize, flags,
 				      opts, count);
 	check_result(result, "dns_message_buildopt");
@@ -1695,7 +1756,7 @@
 #if DIG_SIGCHASE_TD
 		if (current_lookup->do_topdown &&
 		    !current_lookup->rdtype_sigchaseset) {
-			dst_key_t *trustedkey = NULL;
+			dst_key_t *dstkey = NULL;
 			isc_buffer_t *b = NULL;
 			isc_region_t r;
 			isc_result_t result;
@@ -1703,7 +1764,7 @@
 			dns_name_t *key_name;
 			int i;
 
-			result = get_trusted_key(mctx);
+			result = get_trusted_key();
 			if (result != ISC_R_SUCCESS) {
 				printf("\n;; No trusted key, "
 				       "+sigchase option is disabled\n");
@@ -1718,22 +1779,22 @@
 
 				if (dns_name_issubdomain(&query_name,
 							 key_name) == ISC_TRUE)
-					trustedkey = tk_list.key[i];
+					dstkey = tk_list.key[i];
 				/*
 				 * Verify temp is really the lowest
 				 * WARNING
 				 */
 			}
-			if (trustedkey == NULL) {
+			if (dstkey == NULL) {
 				printf("\n;; The queried zone: ");
 				dns_name_print(&query_name, stdout);
 				printf(" isn't a subdomain of any Trusted Keys"
 				       ": +sigchase option is disable\n");
 				current_lookup->sigchase = ISC_FALSE;
-				free_name(&query_name, mctx);
+				free_name(&query_name);
 				goto novalidation;
 			}
-			free_name(&query_name, mctx);
+			free_name(&query_name);
 
 			current_lookup->rdtype_sigchase
 				= current_lookup->rdtype;
@@ -1758,7 +1819,7 @@
 
 			result = isc_buffer_allocate(mctx, &b, BUFSIZE);
 			check_result(result, "isc_buffer_allocate");
-			result = dns_name_totext(dst_key_name(trustedkey),
+			result = dns_name_totext(dst_key_name(dstkey),
 						 ISC_FALSE, b);
 			check_result(result, "dns_name_totext");
 			isc_buffer_usedregion(b, &r);
@@ -2078,9 +2139,6 @@
 	dns_rdatalist_init(rdatalist);
 	rdatalist->type = dns_rdatatype_soa;
 	rdatalist->rdclass = lookup->rdclass;
-	rdatalist->covers = 0;
-	rdatalist->ttl = 0;
-	ISC_LIST_INIT(rdatalist->rdata);
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 
 	dns_rdatalist_tordataset(rdatalist, rdataset);
@@ -2307,7 +2365,7 @@
 
 	isc_random_get(&id);
 	lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
-	lookup->sendmsg->opcode = dns_opcode_query;
+	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
 	/*
 	 * If this is a trace request, completely disallow recursion, since
@@ -2391,7 +2449,8 @@
 	if (lookup->udpsize > 0 || lookup->dnssec ||
 	    lookup->edns > -1 || lookup->ecs_addr != NULL)
 	{
-		dns_ednsopt_t opts[DNS_EDNSOPTIONS];
+		dns_ednsopt_t opts[EDNSOPTS + DNS_EDNSOPTIONS];
+		unsigned int flags;
 		int i = 0;
 
 		if (lookup->udpsize == 0)
@@ -2412,13 +2471,19 @@
 			struct sockaddr *sa;
 			struct sockaddr_in *sin;
 			struct sockaddr_in6 *sin6;
+			const isc_uint8_t *addr;
 			size_t addrl;
+			isc_uint8_t mask;
 
 			sa = &lookup->ecs_addr->type.sa;
 			prefixlen = lookup->ecs_addr->length;
 
 			/* Round up prefix len to a multiple of 8 */
 			addrl = (prefixlen + 7) / 8;
+			if (prefixlen % 8 == 0)
+				mask = 0xff;
+			else
+				mask = 0xffU << (8 - (prefixlen % 8));
 
 			INSIST(i < DNS_EDNSOPTIONS);
 			opts[i].code = DNS_OPT_CLIENT_SUBNET;
@@ -2427,20 +2492,36 @@
 			isc_buffer_init(&b, ecsbuf, sizeof(ecsbuf));
 			if (sa->sa_family == AF_INET) {
 				sin = (struct sockaddr_in *) sa;
+				addr = (isc_uint8_t *) &sin->sin_addr;
+				/* family */
 				isc_buffer_putuint16(&b, 1);
+				/* source prefix-length */
 				isc_buffer_putuint8(&b, prefixlen);
+				/* scope prefix-length */
 				isc_buffer_putuint8(&b, 0);
-				isc_buffer_putmem(&b,
-					  (isc_uint8_t *) &sin->sin_addr,
-					  (unsigned int) addrl);
+				/* address */
+				if (addrl > 0) {
+					isc_buffer_putmem(&b, addr, addrl - 1);
+					isc_buffer_putuint8(&b,
+							    (addr[addrl - 1] &
+							     mask));
+				}
 			} else {
 				sin6 = (struct sockaddr_in6 *) sa;
+				addr = (isc_uint8_t *) &sin6->sin6_addr;
+				/* family */
 				isc_buffer_putuint16(&b, 2);
+				/* source prefix-length */
 				isc_buffer_putuint8(&b, prefixlen);
+				/* scope prefix-length */
 				isc_buffer_putuint8(&b, 0);
-				isc_buffer_putmem(&b,
-					  (isc_uint8_t *) &sin6->sin6_addr,
-					  (unsigned int) addrl);
+				/* address */
+				if (addrl > 0) {
+					isc_buffer_putmem(&b, addr, addrl - 1);
+					isc_buffer_putuint8(&b,
+							    (addr[addrl - 1] &
+							     mask));
+				}
 			}
 
 			opts[i].value = (isc_uint8_t *) ecsbuf;
@@ -2450,7 +2531,7 @@
 #ifdef ISC_PLATFORM_USESIT
 		if (lookup->sit) {
 			INSIST(i < DNS_EDNSOPTIONS);
-			opts[i].code = DNS_OPT_SIT;
+			opts[i].code = DNS_OPT_COOKIE;
 			if (lookup->sitvalue != NULL) {
 				isc_buffer_init(&b, sitbuf, sizeof(sitbuf));
 				result = isc_hex_decodestring(lookup->sitvalue,
@@ -2475,8 +2556,18 @@
 			i++;
 		}
 
+		if (lookup->ednsoptscnt != 0) {
+			memmove(&opts[i], lookup->ednsopts,
+				sizeof(dns_ednsopt_t) * lookup->ednsoptscnt);
+			i += lookup->ednsoptscnt;
+		}
+
+		flags = lookup->ednsflags;
+		flags &= ~DNS_MESSAGEEXTFLAG_DO;
+		if (lookup->dnssec)
+			flags |= DNS_MESSAGEEXTFLAG_DO;
 		add_opt(lookup->sendmsg, lookup->udpsize,
-			lookup->edns, lookup->dnssec, opts, i);
+			lookup->edns, flags, opts, i);
 	}
 
 	result = dns_message_rendersection(lookup->sendmsg,
@@ -3316,6 +3407,7 @@
 	isc_buffer_t hexbuf;
 	size_t len;
 	const unsigned char *sit;
+	isc_boolean_t copysit;
 	isc_result_t result;
 
 	if (l->sitvalue != NULL) {
@@ -3324,22 +3416,39 @@
 		check_result(result, "isc_hex_decodestring");
 		sit = isc_buffer_base(&hexbuf);
 		len = isc_buffer_usedlength(&hexbuf);
+		copysit = ISC_FALSE;
 	} else {
 		sit = cookie;
 		len = sizeof(cookie);
+		copysit = ISC_TRUE;
 	}
 
 	INSIST(msg->sitok == 0 && msg->sitbad == 0);
 	if (optlen >= len && optlen >= 8U) {
-		if (memcmp(isc_buffer_current(optbuf), sit, 8) == 0) {
+		if (isc_safe_memequal(isc_buffer_current(optbuf), sit, 8)) {
 			msg->sitok = 1;
 		} else {
 			printf(";; Warning: SIT client cookie mismatch\n");
 			msg->sitbad = 1;
+			copysit = ISC_FALSE;
 		}
 	} else {
 		printf(";; Warning: SIT bad token (too short)\n");
 		msg->sitbad = 1;
+		copysit = ISC_FALSE;
+	}
+	if (copysit) {
+		isc_region_t r;
+
+		r.base = isc_buffer_current(optbuf);
+		r.length = (unsigned int)optlen;
+		isc_buffer_init(&hexbuf, sitvalue, sizeof(sitvalue));
+		result = isc_hex_totext(&r, 2, "", &hexbuf);
+		check_result(result, "isc_hex_totext");
+		if (isc_buffer_availablelength(&hexbuf) > 0) {
+			isc_buffer_putuint8(&hexbuf, 0);
+			l->sitvalue = sitvalue;
+		}
 	}
 	isc_buffer_forward(optbuf, (unsigned int)optlen);
 }
@@ -3351,6 +3460,7 @@
 	isc_buffer_t optbuf;
 	isc_uint16_t optcode, optlen;
 	dns_rdataset_t *opt = msg->opt;
+	isc_boolean_t seen_cookie = ISC_FALSE;
 
 	result = dns_rdataset_first(opt);
 	if (result == ISC_R_SUCCESS) {
@@ -3362,8 +3472,16 @@
 			optcode = isc_buffer_getuint16(&optbuf);
 			optlen = isc_buffer_getuint16(&optbuf);
 			switch (optcode) {
-			case DNS_OPT_SIT:
+			case DNS_OPT_COOKIE:
+				/*
+				 * Only process the first cookie option.
+				 */
+				if (seen_cookie) {
+					isc_buffer_forward(&optbuf, optlen);
+					break;
+				}
 				process_sit(l, msg, &optbuf, optlen);
+				seen_cookie = ISC_TRUE;
 				break;
 			default:
 				isc_buffer_forward(&optbuf, optlen);
@@ -3374,6 +3492,10 @@
 }
 #endif
 
+static int
+ednsvers(dns_rdataset_t *opt) {
+	return ((opt->ttl >> 16) & 0xff);
+}
 
 /*%
  * Event handler for recv complete.  Perform whatever actions are necessary,
@@ -3403,6 +3525,7 @@
 	isc_region_t r;
 	isc_buffer_t *buf = NULL;
 #endif
+	int newedns;
 
 	UNUSED(task);
 	INSIST(!free_now);
@@ -3634,8 +3757,31 @@
 				goto udp_mismatch;
 		}
 	}
+	if (msg->rcode == dns_rcode_badvers && msg->opt != NULL &&
+	    (newedns = ednsvers(msg->opt)) < l->edns && l->ednsneg) {
+		/*
+		 * Add minimum EDNS version required checks here if needed.
+		 */
+		if (l->comments)
+			printf(";; BADVERS, retrying with EDNS version %u.\n",
+			       newedns);
+		l->edns = newedns;
+		n = requeue_lookup(l, ISC_TRUE);
+		n->origin = query->lookup->origin;
+		dns_message_destroy(&msg);
+		isc_event_free(&event);
+		clear_query(query);
+		cancel_lookup(l);
+		check_next_lookup(l);
+		UNLOCK_LOOKUP;
+		return;
+	}
 	if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0 &&
 	    !l->ignore && !l->tcp_mode) {
+#ifdef ISC_PLATFORM_USESIT
+		if (l->sitvalue == NULL && l->sit && msg->opt != NULL)
+			process_opt(l, msg);
+#endif
 		if (l->comments)
 			printf(";; Truncated, retrying in TCP mode.\n");
 		n = requeue_lookup(l, ISC_TRUE);
@@ -3924,10 +4070,14 @@
 get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	int count;
 	isc_result_t result;
-
-	isc_app_block();
+	isc_boolean_t is_running;
+
+	is_running = isc_app_isrunning();
+	if (is_running)
+		isc_app_block();
 	result = bind9_getaddresses(host, myport, sockaddr, 1, &count);
-	isc_app_unblock();
+	if (is_running)
+		isc_app_unblock();
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
@@ -4164,22 +4314,28 @@
 		isc_mem_free(mctx, ptr);
 	}
 	if (dns_name_dynamic(&chase_name))
-		free_name(&chase_name, mctx);
+		free_name(&chase_name);
 #if DIG_SIGCHASE_TD
 	if (dns_name_dynamic(&chase_current_name))
-		free_name(&chase_current_name, mctx);
+		free_name(&chase_current_name);
 	if (dns_name_dynamic(&chase_authority_name))
-		free_name(&chase_authority_name, mctx);
+		free_name(&chase_authority_name);
 #endif
 #if DIG_SIGCHASE_BU
 	if (dns_name_dynamic(&chase_signame))
-		free_name(&chase_signame, mctx);
+		free_name(&chase_signame);
 #endif
 
 #endif
 	debug("Removing log context");
 	isc_log_destroy(&lctx);
 
+	while (ednsoptscnt > 0U) {
+		ednsoptscnt--;
+		if (ednsopts[ednsoptscnt].value != NULL)
+			isc_mem_free(mctx, ednsopts[ednsoptscnt].value);
+	}
+
 	debug("Destroy memory");
 	if (memdebugging != 0)
 		isc_mem_stats(mctx, stderr);
@@ -4323,7 +4479,7 @@
 		     rdataset = ISC_LIST_NEXT(rdataset, link)) {
 			dns_name_print(msg_name, stdout);
 			printf("\n");
-			print_rdataset(msg_name, rdataset, mctx);
+			print_rdataset(msg_name, rdataset);
 			printf("end\n");
 		}
 		msg_name = NULL;
@@ -4503,7 +4659,7 @@
 insert_trustedkey(void *arg, dns_name_t *name, dns_rdataset_t *rdataset)
 {
 	isc_result_t result;
-	dst_key_t *key;
+	dst_key_t *dstkey;
 
 	UNUSED(arg);
 
@@ -4521,11 +4677,11 @@
 		isc_buffer_add(&b, rdata.length);
 		if (tk_list.nb_tk >= MAX_TRUSTED_KEY)
 			return (ISC_R_SUCCESS);
-		key = NULL;
-		result = dst_key_fromdns(name, rdata.rdclass, &b, mctx, &key);
+		dstkey = NULL;
+		result = dst_key_fromdns(name, rdata.rdclass, &b, mctx, &dstkey);
 		if (result != ISC_R_SUCCESS)
 			continue;
-		tk_list.key[tk_list.nb_tk++] = key;
+		tk_list.key[tk_list.nb_tk++] = dstkey;
 	}
 	return (ISC_R_SUCCESS);
 }
@@ -4550,7 +4706,7 @@
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
 
 isc_result_t
-removetmpkey(isc_mem_t *mctx, const char *file)
+removetmpkey(const char *file)
 {
 	char *tempnamekey = NULL;
 	int tempnamekeylen;
@@ -4574,8 +4730,7 @@
 }
 
 isc_result_t
-get_trusted_key(isc_mem_t *mctx)
-{
+get_trusted_key(void) {
 	isc_result_t result;
 	const char *filename = NULL;
 	dns_rdatacallbacks_t callbacks;
@@ -4626,7 +4781,7 @@
 	check_result(result, "nameFromString");
 
 	if (dns_name_dynamic(p_ret))
-		free_name(p_ret, mctx);
+		free_name(p_ret);
 
 	result = dns_name_dup(dns_fixedname_name(&fixedname), mctx, p_ret);
 	check_result(result, "nameFromString");
@@ -4675,7 +4830,6 @@
 #define __FOLLOW_GLUE__
 #ifdef __FOLLOW_GLUE__
 		isc_buffer_t *b = NULL;
-		isc_result_t result;
 		isc_region_t r;
 		dns_rdataset_t *rdataset = NULL;
 		isc_boolean_t true = ISC_TRUE;
@@ -4770,7 +4924,7 @@
 	printf(" for zone: %s", lookup->textname);
 	printf(" with nameservers:");
 	printf("\n");
-	print_rdataset(name, chase_nsrdataset, mctx);
+	print_rdataset(name, chase_nsrdataset);
 	return (ISC_R_SUCCESS);
 }
 
@@ -4853,14 +5007,14 @@
 	INSIST(chase_nsrdataset != NULL);
 	prepare_lookup(name);
 
-	dup_name(name, &chase_current_name, mctx);
+	dup_name(name, &chase_current_name);
 
 	return (ISC_R_SUCCESS);
 }
 #endif
 
 void
-print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset, isc_mem_t *mctx)
+print_rdataset(dns_name_t *name, dns_rdataset_t *rdataset)
 {
 	isc_buffer_t *b = NULL;
 	isc_result_t result;
@@ -4882,17 +5036,17 @@
 
 
 void
-dup_name(dns_name_t *source, dns_name_t *target, isc_mem_t *mctx) {
+dup_name(dns_name_t *source, dns_name_t *target) {
 	isc_result_t result;
 
 	if (dns_name_dynamic(target))
-		free_name(target, mctx);
+		free_name(target);
 	result = dns_name_dup(source, mctx, target);
 	check_result(result, "dns_name_dup");
 }
 
 void
-free_name(dns_name_t *name, isc_mem_t *mctx) {
+free_name(dns_name_t *name) {
 	dns_name_free(name, mctx);
 	dns_name_init(name, NULL);
 }
@@ -4909,8 +5063,7 @@
  */
 isc_result_t
 contains_trusted_key(dns_name_t *name, dns_rdataset_t *rdataset,
-		     dns_rdataset_t *sigrdataset,
-		     isc_mem_t *mctx)
+		     dns_rdataset_t *sigrdataset)
 {
 	dns_rdataset_t myrdataset;
 	dst_key_t *dnsseckey = NULL;
@@ -4946,8 +5099,7 @@
 				       dst_key_id(dnsseckey));
 				result = sigchase_verify_sig_key(name, rdataset,
 								 dnsseckey,
-								 sigrdataset,
-								 mctx);
+								 sigrdataset);
 				if (result == ISC_R_SUCCESS)
 					goto cleanup;
 			}
@@ -4955,19 +5107,20 @@
 		dst_key_free(&dnsseckey);
 	} while (dns_rdataset_next(&myrdataset) == ISC_R_SUCCESS);
 
+	result = ISC_R_NOTFOUND;
+
 cleanup:
 	if (dnsseckey != NULL)
 		dst_key_free(&dnsseckey);
 	dns_rdataset_disassociate(&myrdataset);
 
-	return (ISC_R_NOTFOUND);
+	return (result);
 }
 
 isc_result_t
 sigchase_verify_sig(dns_name_t *name, dns_rdataset_t *rdataset,
 		    dns_rdataset_t *keyrdataset,
-		    dns_rdataset_t *sigrdataset,
-		    isc_mem_t *mctx)
+		    dns_rdataset_t *sigrdataset)
 {
 	dns_rdataset_t mykeyrdataset;
 	dst_key_t *dnsseckey = NULL;
@@ -4990,7 +5143,7 @@
 		check_result(result, "dns_dnssec_keyfromrdata");
 
 		result = sigchase_verify_sig_key(name, rdataset, dnsseckey,
-						 sigrdataset, mctx);
+						 sigrdataset);
 		if (result == ISC_R_SUCCESS)
 			goto cleanup;
 		dst_key_free(&dnsseckey);
@@ -5008,8 +5161,7 @@
 
 isc_result_t
 sigchase_verify_sig_key(dns_name_t *name, dns_rdataset_t *rdataset,
-			dst_key_t *dnsseckey, dns_rdataset_t *sigrdataset,
-			isc_mem_t *mctx)
+			dst_key_t *dnsseckey, dns_rdataset_t *sigrdataset)
 {
 	dns_rdata_sig_t siginfo;
 	dns_rdataset_t myrdataset;
@@ -5068,7 +5220,7 @@
 
 isc_result_t
 sigchase_verify_ds(dns_name_t *name, dns_rdataset_t *keyrdataset,
-		   dns_rdataset_t *dsrdataset, isc_mem_t *mctx)
+		   dns_rdataset_t *dsrdataset)
 {
 	dns_rdata_ds_t dsinfo;
 	dns_rdataset_t mydsrdataset;
@@ -5135,8 +5287,7 @@
 					result = sigchase_verify_sig_key(name,
 							 keyrdataset,
 							 dnsseckey,
-							 chase_sigkeyrdataset,
-							 mctx);
+							 chase_sigkeyrdataset);
 					if (result ==  ISC_R_SUCCESS)
 						goto cleanup;
 				} else {
@@ -5242,7 +5393,7 @@
 							 dns_rdatatype_ns,
 							 dns_rdatatype_any,
 							 DNS_SECTION_AUTHORITY);
-			dup_name(name, &chase_authority_name, mctx);
+			dup_name(name, &chase_authority_name);
 			if (chase_nsrdataset != NULL) {
 				have_delegation_ns = ISC_TRUE;
 				printf("no response but there is a delegation"
@@ -5260,7 +5411,7 @@
 		} else {
 			printf(";; NO ANSWERS: %s\n",
 			       isc_result_totext(result));
-			free_name(&chase_name, mctx);
+			free_name(&chase_name);
 			clean_trustedkey();
 			return;
 		}
@@ -5292,7 +5443,7 @@
 		return;
 	INSIST(chase_keyrdataset != NULL);
 	printf("\n;; DNSKEYset:\n");
-	print_rdataset(&chase_current_name , chase_keyrdataset, mctx);
+	print_rdataset(&chase_current_name , chase_keyrdataset);
 
 
 	result = advanced_rrsearch(&chase_sigkeyrdataset,
@@ -5309,22 +5460,20 @@
 		return;
 	INSIST(chase_sigkeyrdataset != NULL);
 	printf("\n;; RRSIG of the DNSKEYset:\n");
-	print_rdataset(&chase_current_name , chase_sigkeyrdataset, mctx);
+	print_rdataset(&chase_current_name , chase_sigkeyrdataset);
 
 
 	if (!chase_dslookedup && !chase_nslookedup) {
 		if (!delegation_follow) {
 			result = contains_trusted_key(&chase_current_name,
 						      chase_keyrdataset,
-						      chase_sigkeyrdataset,
-						      mctx);
+						      chase_sigkeyrdataset);
 		} else {
 			INSIST(chase_dsrdataset != NULL);
 			INSIST(chase_sigdsrdataset != NULL);
 			result = sigchase_verify_ds(&chase_current_name,
 						    chase_keyrdataset,
-						    chase_dsrdataset,
-						    mctx);
+						    chase_dsrdataset);
 		}
 
 		if (result != ISC_R_SUCCESS) {
@@ -5383,8 +5532,8 @@
 			result = child_of_zone(&chase_name, &chase_current_name,
 					       &tmp_name);
 			if (dns_name_dynamic(&chase_authority_name))
-				free_name(&chase_authority_name, mctx);
-			dup_name(&tmp_name, &chase_authority_name, mctx);
+				free_name(&chase_authority_name);
+			dup_name(&tmp_name, &chase_authority_name);
 			printf(";; and we try to continue chain of trust"
 			       " validation of the zone: ");
 			dns_name_print(&chase_authority_name, stdout);
@@ -5429,7 +5578,7 @@
 			return;
 		INSIST(chase_dsrdataset != NULL);
 		printf("\n;; DSset:\n");
-		print_rdataset(&chase_authority_name , chase_dsrdataset, mctx);
+		print_rdataset(&chase_authority_name , chase_dsrdataset);
 
 		result = advanced_rrsearch(&chase_sigdsrdataset,
 					   &chase_authority_name,
@@ -5442,14 +5591,13 @@
 			goto cleanandgo;
 		}
 		printf("\n;; RRSIGset of DSset\n");
-		print_rdataset(&chase_authority_name,
-			       chase_sigdsrdataset, mctx);
+		print_rdataset(&chase_authority_name, chase_sigdsrdataset);
 		INSIST(chase_sigdsrdataset != NULL);
 
 		result = sigchase_verify_sig(&chase_authority_name,
 					     chase_dsrdataset,
 					     chase_keyrdataset,
-					     chase_sigdsrdataset, mctx);
+					     chase_sigdsrdataset);
 		if (result != ISC_R_SUCCESS) {
 			printf("\n;; Impossible to verify the DSset:"
 			       " FAILED\n\n");
@@ -5465,8 +5613,8 @@
 		have_delegation_ns = ISC_FALSE;
 		delegation_follow = ISC_TRUE;
 		error_message = NULL;
-		dup_name(&chase_authority_name, &chase_current_name, mctx);
-		free_name(&chase_authority_name, mctx);
+		dup_name(&chase_authority_name, &chase_current_name);
+		free_name(&chase_authority_name);
 		return;
 	}
 
@@ -5491,14 +5639,14 @@
 		}
 		ret = sigchase_verify_sig(&rdata_name, rdataset,
 					  chase_keyrdataset,
-					  sigrdataset, mctx);
+					  sigrdataset);
 		if (ret != ISC_R_SUCCESS) {
-			free_name(&rdata_name, mctx);
+			free_name(&rdata_name);
 			printf("\n;; Impossible to verify the NSEC RR to prove"
 			       " the non-existence : FAILED\n\n");
 			goto cleanandgo;
 		}
-		free_name(&rdata_name, mctx);
+		free_name(&rdata_name);
 		if (result != ISC_R_SUCCESS) {
 			printf("\n;; Impossible to verify the non-existence:"
 			       " FAILED\n\n");
@@ -5513,9 +5661,9 @@
  cleanandgo:
 	printf(";; cleanandgo \n");
 	if (dns_name_dynamic(&chase_current_name))
-		free_name(&chase_current_name, mctx);
+		free_name(&chase_current_name);
 	if (dns_name_dynamic(&chase_authority_name))
-		free_name(&chase_authority_name, mctx);
+		free_name(&chase_authority_name);
 	clean_trustedkey();
 	return;
 
@@ -5531,22 +5679,22 @@
 	}
 	result = sigchase_verify_sig(&chase_name, chase_rdataset,
 				     chase_keyrdataset,
-				     chase_sigrdataset, mctx);
+				     chase_sigrdataset);
 	if (result != ISC_R_SUCCESS) {
 		printf("\n;; Impossible to verify the RRset : FAILED\n\n");
 		/*
 		  printf("RRset:\n");
-		  print_rdataset(&chase_name , chase_rdataset, mctx);
+		  print_rdataset(&chase_name , chase_rdataset);
 		  printf("DNSKEYset:\n");
-		  print_rdataset(&chase_name , chase_keyrdataset, mctx);
+		  print_rdataset(&chase_name , chase_keyrdataset);
 		  printf("RRSIG of RRset:\n");
-		  print_rdataset(&chase_name , chase_sigrdataset, mctx);
+		  print_rdataset(&chase_name , chase_sigrdataset);
 		  printf("\n");
 		*/
 		goto cleanandgo;
 	} else {
 		printf("\n;; The Answer:\n");
-		print_rdataset(&chase_name , chase_rdataset, mctx);
+		print_rdataset(&chase_name , chase_rdataset);
 
 		printf("\n;; FINISH : we have validate the DNSSEC chain"
 		       " of trust: SUCCESS\n\n");
@@ -5587,9 +5735,9 @@
 			printf("\n;; No Answers: Validation FAILED\n\n");
 			return (ISC_R_NOTFOUND);
 		}
-		dup_name(name, &chase_name, mctx);
+		dup_name(name, &chase_name);
 		printf(";; RRset to chase:\n");
-		print_rdataset(&chase_name, chase_rdataset, mctx);
+		print_rdataset(&chase_name, chase_rdataset);
 	}
 	INSIST(chase_rdataset != NULL);
 
@@ -5603,14 +5751,14 @@
 			printf("\n;; RRSIG is missing for continue validation:"
 			       " FAILED\n\n");
 			if (dns_name_dynamic(&chase_name))
-				free_name(&chase_name, mctx);
+				free_name(&chase_name);
 			return (ISC_R_NOTFOUND);
 		}
 		if (result == ISC_R_NOTFOUND) {
 			return (ISC_R_NOTFOUND);
 		}
 		printf("\n;; RRSIG of the RRset to chase:\n");
-		print_rdataset(&chase_name, chase_sigrdataset, mctx);
+		print_rdataset(&chase_name, chase_sigrdataset);
 	}
 	INSIST(chase_sigrdataset != NULL);
 
@@ -5621,7 +5769,7 @@
 	dns_rdataset_current(chase_sigrdataset, &sigrdata);
 	result = dns_rdata_tostruct(&sigrdata, &siginfo, NULL);
 	check_result(result, "sigrdata tostruct siginfo");
-	dup_name(&siginfo.signer, &chase_signame, mctx);
+	dup_name(&siginfo.signer, &chase_signame);
 	dns_rdata_freestruct(&siginfo);
 	dns_rdata_reset(&sigrdata);
 
@@ -5635,17 +5783,17 @@
 		if (result == ISC_R_FAILURE) {
 			printf("\n;; DNSKEY is missing to continue validation:"
 			       " FAILED\n\n");
-			free_name(&chase_signame, mctx);
+			free_name(&chase_signame);
 			if (dns_name_dynamic(&chase_name))
-				free_name(&chase_name, mctx);
+				free_name(&chase_name);
 			return (ISC_R_NOTFOUND);
 		}
 		if (result == ISC_R_NOTFOUND) {
-			free_name(&chase_signame, mctx);
+			free_name(&chase_signame);
 			return (ISC_R_NOTFOUND);
 		}
 		printf("\n;; DNSKEYset that signs the RRset to chase:\n");
-		print_rdataset(&chase_signame, chase_keyrdataset, mctx);
+		print_rdataset(&chase_signame, chase_keyrdataset);
 	}
 	INSIST(chase_keyrdataset != NULL);
 
@@ -5658,18 +5806,18 @@
 		if (result == ISC_R_FAILURE) {
 			printf("\n;; RRSIG for DNSKEY is missing  to continue"
 			       " validation : FAILED\n\n");
-			free_name(&chase_signame, mctx);
+			free_name(&chase_signame);
 			if (dns_name_dynamic(&chase_name))
-				free_name(&chase_name, mctx);
+				free_name(&chase_name);
 			return (ISC_R_NOTFOUND);
 		}
 		if (result == ISC_R_NOTFOUND) {
-			free_name(&chase_signame, mctx);
+			free_name(&chase_signame);
 			return (ISC_R_NOTFOUND);
 		}
 		printf("\n;; RRSIG of the DNSKEYset that signs the "
 		       "RRset to chase:\n");
-		print_rdataset(&chase_signame, chase_sigkeyrdataset, mctx);
+		print_rdataset(&chase_signame, chase_sigkeyrdataset);
 	}
 	INSIST(chase_sigkeyrdataset != NULL);
 
@@ -5684,12 +5832,12 @@
 			printf("\n");
 		}
 		if (result == ISC_R_NOTFOUND) {
-			free_name(&chase_signame, mctx);
+			free_name(&chase_signame);
 			return (ISC_R_NOTFOUND);
 		}
 		if (chase_dsrdataset != NULL) {
 			printf("\n;; DSset of the DNSKEYset\n");
-			print_rdataset(&chase_signame, chase_dsrdataset, mctx);
+			print_rdataset(&chase_signame, chase_dsrdataset);
 		}
 	}
 
@@ -5712,8 +5860,7 @@
 			chase_dsrdataset = NULL;
 		} else {
 			printf("\n;; RRSIG of the DSset of the DNSKEYset\n");
-			print_rdataset(&chase_signame, chase_sigdsrdataset,
-				       mctx);
+			print_rdataset(&chase_signame, chase_sigdsrdataset);
 		}
 	}
 	return (1);
@@ -5728,7 +5875,7 @@
 	int ret;
 
 	if (tk_list.nb_tk == 0) {
-		result = get_trusted_key(mctx);
+		result = get_trusted_key();
 		if (result != ISC_R_SUCCESS) {
 			printf("No trusted keys present\n");
 			return;
@@ -5755,7 +5902,7 @@
 		result = prove_nx(msg, &query_name, current_lookup->rdclass,
 				  current_lookup->rdtype, &rdata_name,
 				  &rdataset, &sigrdataset);
-		free_name(&query_name, mctx);
+		free_name(&query_name);
 		if (rdataset == NULL || sigrdataset == NULL ||
 		    dns_name_countlabels(&rdata_name) == 0) {
 			printf("\n;; Impossible to verify the Non-existence,"
@@ -5774,8 +5921,8 @@
 		printf(";; An NSEC prove the non-existence of a answers,"
 		       " Now we want validate this NSEC\n");
 
-		dup_name(&rdata_name, &chase_name, mctx);
-		free_name(&rdata_name, mctx);
+		dup_name(&rdata_name, &chase_name);
+		free_name(&rdata_name);
 		chase_rdataset =  rdataset;
 		chase_sigrdataset = sigrdataset;
 		chase_keyrdataset = NULL;
@@ -5796,10 +5943,10 @@
 
 	result = sigchase_verify_sig(&chase_name, chase_rdataset,
 				     chase_keyrdataset,
-				     chase_sigrdataset, mctx);
+				     chase_sigrdataset);
 	if (result != ISC_R_SUCCESS) {
-		free_name(&chase_name, mctx);
-		free_name(&chase_signame, mctx);
+		free_name(&chase_name);
+		free_name(&chase_signame);
 		printf(";; No DNSKEY is valid to check the RRSIG"
 		       " of the RRset: FAILED\n");
 		clean_trustedkey();
@@ -5808,10 +5955,10 @@
 	printf(";; OK We found DNSKEY (or more) to validate the RRset\n");
 
 	result = contains_trusted_key(&chase_signame, chase_keyrdataset,
-				      chase_sigkeyrdataset, mctx);
+				      chase_sigkeyrdataset);
 	if (result ==  ISC_R_SUCCESS) {
-		free_name(&chase_name, mctx);
-		free_name(&chase_signame, mctx);
+		free_name(&chase_name);
+		free_name(&chase_signame);
 		printf("\n;; Ok this DNSKEY is a Trusted Key,"
 		       " DNSSEC validation is ok: SUCCESS\n\n");
 		clean_trustedkey();
@@ -5821,8 +5968,8 @@
 	printf(";; Now, we are going to validate this DNSKEY by the DS\n");
 
 	if (chase_dsrdataset == NULL) {
-		free_name(&chase_name, mctx);
-		free_name(&chase_signame, mctx);
+		free_name(&chase_name);
+		free_name(&chase_signame);
 		printf(";; the DNSKEY isn't trusted-key and there isn't"
 		       " DS to validate the DNSKEY: FAILED\n");
 		clean_trustedkey();
@@ -5830,10 +5977,10 @@
 	}
 
 	result =  sigchase_verify_ds(&chase_signame, chase_keyrdataset,
-				     chase_dsrdataset, mctx);
+				     chase_dsrdataset);
 	if (result !=  ISC_R_SUCCESS) {
-		free_name(&chase_signame, mctx);
-		free_name(&chase_name, mctx);
+		free_name(&chase_signame);
+		free_name(&chase_name);
 		printf(";; ERROR no DS validates a DNSKEY in the"
 		       " DNSKEY RRset: FAILED\n");
 		clean_trustedkey();
@@ -5844,8 +5991,8 @@
 		       " the RRset\n");
 	INSIST(chase_sigdsrdataset != NULL);
 
-	dup_name(&chase_signame, &chase_name, mctx);
-	free_name(&chase_signame, mctx);
+	dup_name(&chase_signame, &chase_name);
+	free_name(&chase_signame);
 	chase_rdataset = chase_dsrdataset;
 	chase_sigrdataset = chase_sigdsrdataset;
 	chase_keyrdataset = NULL;
@@ -5958,7 +6105,7 @@
 
 		printf("There is a NSEC for this zone in the"
 		       " AUTHORITY section:\n");
-		print_rdataset(nsecname, nsecset, mctx);
+		print_rdataset(nsecname, nsecset);
 
 		for (result = dns_rdataset_first(nsecset);
 		     result == ISC_R_SUCCESS;
@@ -5987,7 +6134,7 @@
 				dns_rdata_freestruct(&nsecstruct);
 				*rdataset = nsecset;
 				*sigrdataset = signsecset;
-				dup_name(nsecname, rdata_name, mctx);
+				dup_name(nsecname, rdata_name);
 
 				return (ISC_R_SUCCESS);
 			}
@@ -6040,7 +6187,7 @@
 		printf("There isn't RRSIG NSEC for the zone \n");
 		return (ISC_R_FAILURE);
 	}
-	dup_name(name, rdata_name, mctx);
+	dup_name(name, rdata_name);
 	*rdataset = nsecset;
 	*sigrdataset = signsecset;
 
--- a/external/bsd/bind/dist/bin/dig/include/dig/dig.h	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dig/include/dig/dig.h	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: dig.h,v 1.9.4.2 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: dig.h,v 1.9.4.2.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
  * Copyright (C) 2004-2009, 2011-2015  Internet Systems Consortium, Inc. ("ISC")
@@ -135,7 +135,8 @@
 #ifdef ISC_PLATFORM_USESIT
 		sit,
 #endif
-		nsid;   /*% Name Server ID (RFC 5001) */
+		nsid,   /*% Name Server ID (RFC 5001) */
+		ednsneg;
 #ifdef DIG_SIGCHASE
 isc_boolean_t	sigchase;
 #if DIG_SIGCHASE_TD
@@ -193,6 +194,10 @@
 #ifdef ISC_PLATFORM_USESIT
 	char *sitvalue;
 #endif
+	dns_ednsopt_t *ednsopts;
+	unsigned int ednsoptscnt;
+	unsigned int ednsflags;
+	dns_opcode_t opcode;
 };
 
 /*% The dig_query structure */
@@ -347,6 +352,10 @@
 	   const char *desc);
 
 isc_result_t
+parse_xint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
+	   const char *desc);
+
+isc_result_t
 parse_netprefix(isc_sockaddr_t **sap, const char *value);
 
 void
@@ -428,6 +437,8 @@
 chase_sig(dns_message_t *msg);
 #endif
 
+void save_opt(dig_lookup_t *lookup, char *code, char *value);
+
 ISC_LANG_ENDDECLS
 
 #endif
--- a/external/bsd/bind/dist/bin/dig/nslookup.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dig/nslookup.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: nslookup.c,v 1.9.2.1 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: nslookup.c,v 1.9.2.1.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
  * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
@@ -587,7 +587,7 @@
 
 static void
 setoption(char *opt) {
-	if (strncasecmp(opt, "all", 4) == 0) {
+	if (strncasecmp(opt, "all", 3) == 0) {
 		show_settings(ISC_TRUE, ISC_FALSE);
 	} else if (strncasecmp(opt, "class=", 6) == 0) {
 		if (testclass(&opt[6]))
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.8	Sun Mar 13 08:00:24 2016 +0000
@@ -1,6 +1,6 @@
-.\"	$NetBSD: dnssec-dsfromkey.8,v 1.6.2.1 2014/12/22 03:28:33 msaitoh Exp $
+.\"	$NetBSD: dnssec-dsfromkey.8,v 1.6.2.1.2.1 2016/03/13 08:00:25 martin Exp $
 .\"
-.\" Copyright (C) 2008-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" Permission to use, copy, modify, and/or distribute this software for any
 .\" purpose with or without fee is hereby granted, provided that the above
@@ -34,7 +34,7 @@
 dnssec\-dsfromkey \- DNSSEC DS RR generation tool
 .SH "SYNOPSIS"
 .HP 17
-\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
+\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
 .HP 17
 \fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname}
 .HP 17
@@ -62,6 +62,11 @@
 must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384). These values are case insensitive.
 .RE
 .PP
+\-C
+.RS 4
+Generate CDS records rather than DS records. This is mutually exclusive with generating lookaside records.
+.RE
+.PP
 \-T \fITTL\fR
 .RS 4
 Specifies the TTL of the DS records.
@@ -100,7 +105,7 @@
 .RS 4
 Generate a DLV set instead of a DS set. The specified
 \fBdomain\fR
-is appended to the name for each record in the set. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431.
+is appended to the name for each record in the set. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431. This is mutually exclusive with generating CDS records.
 .RE
 .PP
 \-s
@@ -167,5 +172,5 @@
 .PP
 Internet Systems Consortium
 .SH "COPYRIGHT"
-Copyright \(co 2008\-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008\-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
 .br
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: dnssec-dsfromkey.c,v 1.9.2.2 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: dnssec-dsfromkey.c,v 1.9.2.2.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
  * Copyright (C) 2008-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
@@ -244,7 +244,7 @@
 
 static void
 emit(unsigned int dtype, isc_boolean_t showall, char *lookaside,
-     dns_rdata_t *rdata)
+     isc_boolean_t cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
 	unsigned char buf[DNS_DS_BUFFERSIZE];
@@ -308,9 +308,12 @@
 	isc_buffer_usedregion(&classb, &r);
 	printf("%.*s", (int)r.length, r.base);
 
-	if (lookaside == NULL)
-		printf(" DS ");
-	else
+	if (lookaside == NULL) {
+		if (cds)
+			printf(" CDS ");
+		else
+			printf(" DS ");
+	} else
 		printf(" DLV ");
 
 	isc_buffer_usedregion(&textb, &r);
@@ -338,6 +341,7 @@
 			"(SHA-1, SHA-256, GOST or SHA-384)\n");
 	fprintf(stderr, "    -1: use SHA-1\n");
 	fprintf(stderr, "    -2: use SHA-256\n");
+	fprintf(stderr, "    -C: print CDS record\n");
 	fprintf(stderr, "    -l: add lookaside zone and print DLV records\n");
 	fprintf(stderr, "    -s: read keyset from keyset-<dnsname> file\n");
 	fprintf(stderr, "    -c class: rdata class for DS set (default: IN)\n");
@@ -358,6 +362,7 @@
 	char		*endp;
 	int		ch;
 	unsigned int	dtype = DNS_DSDIGEST_SHA1;
+	isc_boolean_t	cds = ISC_FALSE;
 	isc_boolean_t	both = ISC_TRUE;
 	isc_boolean_t	usekeyset = ISC_FALSE;
 	isc_boolean_t	showall = ISC_FALSE;
@@ -383,8 +388,8 @@
 
 	isc_commandline_errprint = ISC_FALSE;
 
-	while ((ch = isc_commandline_parse(argc, argv,
-					   "12Aa:c:d:Ff:K:l:sT:v:hV")) != -1) {
+#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:hV"
+	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
 			dtype = DNS_DSDIGEST_SHA1;
@@ -401,6 +406,12 @@
 			algname = isc_commandline_argument;
 			both = ISC_FALSE;
 			break;
+		case 'C':
+			if (lookaside != NULL)
+				fatal("lookaside and CDS are mutually"
+				      " exclusive");
+			cds = ISC_TRUE;
+			break;
 		case 'c':
 			classname = isc_commandline_argument;
 			break;
@@ -417,6 +428,9 @@
 			filename = isc_commandline_argument;
 			break;
 		case 'l':
+			if (cds)
+				fatal("lookaside and CDS are mutually"
+				      " exclusive");
 			lookaside = isc_commandline_argument;
 			if (strlen(lookaside) == 0U)
 				fatal("lookaside must be a non-empty string");
@@ -535,11 +549,11 @@
 
 			if (both) {
 				emit(DNS_DSDIGEST_SHA1, showall, lookaside,
-				     &rdata);
+				     cds, &rdata);
 				emit(DNS_DSDIGEST_SHA256, showall, lookaside,
-				     &rdata);
+				     cds, &rdata);
 			} else
-				emit(dtype, showall, lookaside, &rdata);
+				emit(dtype, showall, lookaside, cds, &rdata);
 		}
 	} else {
 		unsigned char key_buf[DST_KEY_MAXSIZE];
@@ -548,10 +562,12 @@
 			DST_KEY_MAXSIZE, &rdata);
 
 		if (both) {
-			emit(DNS_DSDIGEST_SHA1, showall, lookaside, &rdata);
-			emit(DNS_DSDIGEST_SHA256, showall, lookaside, &rdata);
+			emit(DNS_DSDIGEST_SHA1, showall, lookaside, cds,
+			     &rdata);
+			emit(DNS_DSDIGEST_SHA256, showall, lookaside, cds,
+			     &rdata);
 		} else
-			emit(dtype, showall, lookaside, &rdata);
+			emit(dtype, showall, lookaside, cds, &rdata);
 	}
 
 	if (dns_rdataset_isassociated(&rdataset))
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.docbook	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.docbook	Sun Mar 13 08:00:24 2016 +0000
@@ -2,7 +2,7 @@
                "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd"
                [<!ENTITY mdash "&#8212;">]>
 <!--
- - Copyright (C) 2008-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  -
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -41,6 +41,7 @@
       <year>2011</year>
       <year>2012</year>
       <year>2014</year>
+      <year>2015</year>
       <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
     </copyright>
   </docinfo>
@@ -52,6 +53,7 @@
       <arg><option>-1</option></arg>
       <arg><option>-2</option></arg>
       <arg><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
+      <arg><option>-C</option></arg>
       <arg><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
       <arg><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
       <arg choice="req">keyfile</arg>
@@ -123,6 +125,16 @@
       </varlistentry>
 
       <varlistentry>
+        <term>-C</term>
+        <listitem>
+          <para>
+            Generate CDS records rather than DS records.  This is mutually
+	    exclusive with generating lookaside records.
+          </para>
+        </listitem>
+      </varlistentry>
+
+      <varlistentry>
         <term>-T <replaceable class="parameter">TTL</replaceable></term>
         <listitem>
           <para>
@@ -182,7 +194,8 @@
             <option>domain</option> is appended to the name for each
             record in the set.
             The DNSSEC Lookaside Validation (DLV) RR is described
-            in RFC 4431.
+            in RFC 4431.  This is mutually exclusive with generating
+	    CDS records.
           </para>
         </listitem>
       </varlistentry>
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.html	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-dsfromkey.html	Sun Mar 13 08:00:24 2016 +0000
@@ -1,5 +1,5 @@
 <!--
- - Copyright (C) 2008-2012, 2014 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014, 2015 Internet Systems Consortium, Inc. ("ISC")
  - 
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -28,19 +28,19 @@
 </div>
 <div class="refsynopsisdiv">
 <h2>Synopsis</h2>
-<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
+<div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-C</code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] {keyfile}</p></div>
 <div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  {-s} [<code class="option">-1</code>] [<code class="option">-2</code>] [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>] [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>] [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>] [<code class="option">-s</code>] [<code class="option">-c <em class="replaceable"><code>class</code></em></code>] [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>] [<code class="option">-f <em class="replaceable"><code>file</code></em></code>] [<code class="option">-A</code>] [<code class="option">-v <em class="replaceable"><code>level</code></em></code>] {dnsname}</p></div>
 <div class="cmdsynopsis"><p><code class="command">dnssec-dsfromkey</code>  [<code class="option">-h</code>] [<code class="option">-V</code>]</p></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543514"></a><h2>DESCRIPTION</h2>
+<a name="id2543522"></a><h2>DESCRIPTION</h2>
 <p><span><strong class="command">dnssec-dsfromkey</strong></span>
       outputs the Delegation Signer (DS) resource record (RR), as defined in
       RFC 3658 and RFC 4509, for the given key(s).
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543526"></a><h2>OPTIONS</h2>
+<a name="id2543533"></a><h2>OPTIONS</h2>
 <div class="variablelist"><dl>
 <dt><span class="term">-1</span></dt>
 <dd><p>
@@ -58,6 +58,11 @@
             SHA-256 (SHA256), GOST or SHA-384 (SHA384).
             These values are case insensitive.
           </p></dd>
+<dt><span class="term">-C</span></dt>
+<dd><p>
+            Generate CDS records rather than DS records.  This is mutually
+	    exclusive with generating lookaside records.
+          </p></dd>
 <dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
 <dd><p>
             Specifies the TTL of the DS records.
@@ -98,7 +103,8 @@
             <code class="option">domain</code> is appended to the name for each
             record in the set.
             The DNSSEC Lookaside Validation (DLV) RR is described
-            in RFC 4431.
+            in RFC 4431.  This is mutually exclusive with generating
+	    CDS records.
           </p></dd>
 <dt><span class="term">-s</span></dt>
 <dd><p>
@@ -125,7 +131,7 @@
 </dl></div>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543780"></a><h2>EXAMPLE</h2>
+<a name="id2543800"></a><h2>EXAMPLE</h2>
 <p>
       To build the SHA-256 DS RR from the
       <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
@@ -140,7 +146,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543810"></a><h2>FILES</h2>
+<a name="id2543830"></a><h2>FILES</h2>
 <p>
       The keyfile can be designed by the key identification
       <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
@@ -154,13 +160,13 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543845"></a><h2>CAVEAT</h2>
+<a name="id2543865"></a><h2>CAVEAT</h2>
 <p>
       A keyfile error can give a "file not found" even if the file exists.
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543854"></a><h2>SEE ALSO</h2>
+<a name="id2543875"></a><h2>SEE ALSO</h2>
 <p><span class="citerefentry"><span class="refentrytitle">dnssec-keygen</span>(8)</span>,
       <span class="citerefentry"><span class="refentrytitle">dnssec-signzone</span>(8)</span>,
       <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
@@ -170,7 +176,7 @@
     </p>
 </div>
 <div class="refsect1" lang="en">
-<a name="id2543894"></a><h2>AUTHOR</h2>
+<a name="id2543914"></a><h2>AUTHOR</h2>
 <p><span class="corpauthor">Internet Systems Consortium</span>
     </p>
 </div>
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-keygen.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: dnssec-keygen.c,v 1.14.2.2 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: dnssec-keygen.c,v 1.14.2.2.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
  * Portions Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
@@ -43,6 +43,7 @@
 #include <isc/commandline.h>
 #include <isc/entropy.h>
 #include <isc/mem.h>
+#include <isc/print.h>
 #include <isc/region.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -241,7 +242,7 @@
 	int		dbits = 0;
 	dns_ttl_t	ttl = 0;
 	isc_boolean_t	use_default = ISC_FALSE, use_nsec3 = ISC_FALSE;
-	isc_stdtime_t	publish = 0, activate = 0, revoke = 0;
+	isc_stdtime_t	publish = 0, activate = 0, revokekey = 0;
 	isc_stdtime_t	inactive = 0, delete = 0;
 	isc_stdtime_t	now;
 	int		prepub = -1;
@@ -429,7 +430,7 @@
 			if (setrev || unsetrev)
 				fatal("-R specified more than once");
 
-			revoke = strtotime(isc_commandline_argument,
+			revokekey = strtotime(isc_commandline_argument,
 					   now, now, &setrev);
 			unsetrev = !setrev;
 			break;
@@ -958,7 +959,7 @@
 						"was used. Revoking a ZSK is "
 						"legal, but undefined.\n",
 						program);
-				dst_key_settime(key, DST_TIME_REVOKE, revoke);
+				dst_key_settime(key, DST_TIME_REVOKE, revokekey);
 			}
 
 			if (setinact)
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-revoke.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: dnssec-revoke.c,v 1.7.2.1 2014/12/22 03:28:33 msaitoh Exp $	*/
+/*	$NetBSD: dnssec-revoke.c,v 1.7.2.1.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2009-2012, 2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2009-2012, 2014, 2015  Internet Systems Consortium, Inc. ("ISC")
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -98,7 +98,7 @@
 	isc_uint32_t flags;
 	isc_buffer_t buf;
 	isc_boolean_t force = ISC_FALSE;
-	isc_boolean_t remove = ISC_FALSE;
+	isc_boolean_t removefile = ISC_FALSE;
 	isc_boolean_t id = ISC_FALSE;
 
 	if (argc == 1)
@@ -135,7 +135,7 @@
 			}
 			break;
 		    case 'r':
-			remove = ISC_TRUE;
+			removefile = ISC_TRUE;
 			break;
 		    case 'R':
 			id = ISC_TRUE;
@@ -259,7 +259,7 @@
 		 * Remove old key file, if told to (and if
 		 * it isn't the same as the new file)
 		 */
-		if (remove && dst_key_alg(key) != DST_ALG_RSAMD5) {
+		if (removefile && dst_key_alg(key) != DST_ALG_RSAMD5) {
 			isc_buffer_init(&buf, oldname, sizeof(oldname));
 			dst_key_setflags(key, flags & ~DNS_KEYFLAG_REVOKE);
 			dst_key_buildfilename(key, DST_TYPE_PRIVATE, dir, &buf);
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-settime.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-settime.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: dnssec-settime.c,v 1.10.2.2 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: dnssec-settime.c,v 1.10.2.2.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
  * Copyright (C) 2009-2015  Internet Systems Consortium, Inc. ("ISC")
@@ -117,8 +117,8 @@
 	} else if (epoch) {
 		fprintf(stream, "%d\n", (int) when);
 	} else {
-		time_t time = when;
-		output = ctime(&time);
+		time_t timet = when;
+		output = ctime(&timet);
 		fprintf(stream, "%s", output);
 	}
 }
@@ -411,7 +411,6 @@
 					"inactive.\n", program);
 
 		changed = setpub = setact = ISC_TRUE;
-		dst_key_free(&prevkey);
 	} else {
 		if (prepub < 0)
 			prepub = 0;
@@ -602,6 +601,8 @@
 		printf("%s\n", newname);
 	}
 
+	if (prevkey != NULL)
+		dst_key_free(&prevkey);
 	dst_key_free(&key);
 	dst_lib_destroy();
 	isc_hash_destroy();
--- a/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/dnssec/dnssec-signzone.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: dnssec-signzone.c,v 1.13.2.2 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: dnssec-signzone.c,v 1.13.2.2.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
  * Portions Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
@@ -54,6 +54,7 @@
 #include <isc/random.h>
 #include <isc/rwlock.h>
 #include <isc/serial.h>
+#include <isc/safe.h>
 #include <isc/stdio.h>
 #include <isc/stdlib.h>
 #include <isc/string.h>
@@ -688,7 +689,9 @@
 			    (iszsk(key) && !keyset_kskonly))
 				signwithkey(name, set, key->key, ttl, add,
 					    "signing with dnskey");
-		} else if (iszsk(key)) {
+		} else if (set->type == dns_rdatatype_cds ||
+			   set->type == dns_rdatatype_cdnskey ||
+			   iszsk(key)) {
 			signwithkey(name, set, key->key, ttl, add,
 				    "signing with dnskey");
 		}
@@ -765,7 +768,7 @@
 
 static int
 hashlist_comp(const void *a, const void *b) {
-	return (memcmp(a, b, hash_length + 1));
+	return (isc_safe_memcompare(a, b, hash_length + 1));
 }
 
 static void
@@ -792,7 +795,7 @@
 		next += l->length;
 		if (next[l->length-1] != 0)
 			continue;
-		if (memcmp(current, next, l->length - 1) == 0)
+		if (isc_safe_memequal(current, next, l->length - 1))
 			return (ISC_TRUE);
 		current = next;
 	}
@@ -1324,7 +1327,7 @@
  * Delete any RRSIG records at a node.
  */
 static void
-cleannode(dns_db_t *db, dns_dbversion_t *version, dns_dbnode_t *node) {
+cleannode(dns_db_t *db, dns_dbversion_t *dbversion, dns_dbnode_t *node) {
 	dns_rdatasetiter_t *rdsiter = NULL;
 	dns_rdataset_t set;
 	isc_result_t result, dresult;
@@ -1333,7 +1336,7 @@
 		return;
 
 	dns_rdataset_init(&set);
-	result = dns_db_allrdatasets(db, node, version, 0, &rdsiter);
+	result = dns_db_allrdatasets(db, node, dbversion, 0, &rdsiter);
 	check_result(result, "dns_db_allrdatasets");
 	result = dns_rdatasetiter_first(rdsiter);
 	while (result == ISC_R_SUCCESS) {
@@ -1347,7 +1350,7 @@
 		dns_rdataset_disassociate(&set);
 		result = dns_rdatasetiter_next(rdsiter);
 		if (destroy) {
-			dresult = dns_db_deleterdataset(db, node, version,
+			dresult = dns_db_deleterdataset(db, node, dbversion,
 							dns_rdatatype_rrsig,
 							covers);
 			check_result(dresult, "dns_db_deleterdataset");
@@ -1864,11 +1867,9 @@
 				      dns_rdatatype_nsec3param,
 				      &nsec3param, &b);
 	check_result(result, "dns_rdata_fromstruct()");
+	dns_rdatalist_init(&rdatalist);
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.type = rdata.type;
-	rdatalist.covers = 0;
-	rdatalist.ttl = 0;
-	ISC_LIST_INIT(rdatalist.rdata);
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
 	result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	check_result(result, "dns_rdatalist_tordataset()");
@@ -1930,11 +1931,10 @@
 				      nexthash, ISC_SHA1_DIGESTLENGTH,
 				      nsec3buffer, &rdata);
 	check_result(result, "addnsec3: dns_nsec3_buildrdata()");
+	dns_rdatalist_init(&rdatalist);
 	rdatalist.rdclass = rdata.rdclass;
 	rdatalist.type = rdata.type;
-	rdatalist.covers = 0;
 	rdatalist.ttl = ttl;
-	ISC_LIST_INIT(rdatalist.rdata);
 	ISC_LIST_APPEND(rdatalist.rdata, &rdata, link);
 	result = dns_rdatalist_tordataset(&rdatalist, &rdataset);
 	check_result(result, "dns_rdatalist_tordataset()");
@@ -2023,14 +2023,13 @@
 		if (exists && nsec3.hash == hashalg &&
 		    nsec3.iterations == iterations &&
 		    nsec3.salt_length == salt_len &&
-		    !memcmp(nsec3.salt, salt, salt_len))
+		    isc_safe_memequal(nsec3.salt, salt, salt_len))
 			continue;
+		dns_rdatalist_init(&rdatalist);
 		rdatalist.rdclass = rdata.rdclass;
 		rdatalist.type = rdata.type;
-		rdatalist.covers = 0;
 		if (set_maxttl)
 			rdatalist.ttl = ISC_MIN(rdataset.ttl, maxttl);
-		ISC_LIST_INIT(rdatalist.rdata);
 		dns_rdata_init(&delrdata);
 		dns_rdata_clone(&rdata, &delrdata);
 		ISC_LIST_APPEND(rdatalist.rdata, &delrdata, link);
@@ -2712,7 +2711,7 @@
 
 	if (!update && set_salt) {
 		if (salt_length != orig_saltlen ||
-		    memcmp(saltbuf, orig_salt, salt_length) != 0)
+		    !isc_safe_memequal(saltbuf, orig_salt, salt_length))
 			fatal("An NSEC3 chain exists with a different salt. "
 			      "Use -u to update it.");
 	} else if (!set_salt) {
@@ -2780,7 +2779,7 @@
 	char *filename;
 	char namestr[DNS_NAME_FORMATSIZE];
 	dns_db_t *db = NULL;
-	dns_dbversion_t *version = NULL;
+	dns_dbversion_t *dbversion = NULL;
 	dns_diff_t diff;
 	dns_difftuple_t *tuple = NULL;
 	dns_fixedname_t fixed;
@@ -2903,19 +2902,19 @@
 			       gclass, 0, NULL, &db);
 	check_result(result, "dns_db_create");
 
-	result = dns_db_newversion(db, &version);
+	result = dns_db_newversion(db, &dbversion);
 	check_result(result, "dns_db_newversion");
 
-	result = dns_diff_apply(&diff, db, version);
+	result = dns_diff_apply(&diff, db, dbversion);
 	check_result(result, "dns_diff_apply");
 	dns_diff_clear(&diff);
 
-	result = dns_master_dump(mctx, db, version, style, filename);
+	result = dns_master_dump(mctx, db, dbversion, style, filename);
 	check_result(result, "dns_master_dump");
 
 	isc_mem_put(mctx, filename, filenamelen + 1);
 
-	dns_db_closeversion(db, &version, ISC_FALSE);
+	dns_db_closeversion(db, &dbversion, ISC_FALSE);
 	dns_db_detach(&db);
 }
 
@@ -3589,7 +3588,10 @@
 	 * of keys rather early.
 	 */
 	ISC_LIST_INIT(keylist);
-	isc_rwlock_init(&keylist_lock, 0, 0);
+	result = isc_rwlock_init(&keylist_lock, 0, 0);
+	if (result != ISC_R_SUCCESS)
+		fatal("could not initialize keylist_lock: %s",
+		      isc_result_totext(result));
 
 	/*
 	 * Fill keylist with:
--- a/external/bsd/bind/dist/bin/named/bind9.xsl	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/bind9.xsl	Sun Mar 13 08:00:24 2016 +0000
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
- - Copyright (C) 2006-2009, 2012-2014  Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2006-2009, 2012-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
  -
  - Permission to use, copy, modify, and/or distribute this software for any
  - purpose with or without fee is hereby granted, provided that the above
@@ -20,7 +20,7 @@
 <!-- %Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp % -->
 <xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://www.w3.org/1999/xhtml" version="1.0">
   <xsl:output method="html" indent="yes" version="4.0"/>
-  <xsl:template match="statistics[@version=&quot;3.5&quot;]">
+  <xsl:template match="statistics[@version=&quot;3.6&quot;]">
     <html>
       <head>
         <xsl:if test="system-property('xsl:vendor')!='Transformiix'">
--- a/external/bsd/bind/dist/bin/named/bind9.xsl.h	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/bind9.xsl.h	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: bind9.xsl.h,v 1.6 2014/07/08 05:43:37 spz Exp $	*/
+/*	$NetBSD: bind9.xsl.h,v 1.6.4.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
  * Generated by convertxsl.pl 1.14 2008/07/17 23:43:26 jinmei Exp  
@@ -7,7 +7,7 @@
 static char xslmsg[] =
 	"<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n"
 	"<!--\n"
-	" - Copyright (C) 2006-2009, 2012-2014 Internet Systems Consortium, Inc. (\"ISC\")\n"
+	" - Copyright (C) 2006-2009, 2012-2014, 2016 Internet Systems Consortium, Inc. (\"ISC\")\n"
 	" -\n"
 	" - Permission to use, copy, modify, and/or distribute this software for any\n"
 	" - purpose with or without fee is hereby granted, provided that the above\n"
@@ -27,7 +27,7 @@
 	"<!-- \045Id: bind9.xsl,v 1.21 2009/01/27 23:47:54 tbox Exp \045 -->\n"
 	"<xsl:stylesheet xmlns:xsl=\"http://www.w3.org/1999/XSL/Transform\" xmlns=\"http://www.w3.org/1999/xhtml\" version=\"1.0\">\n"
 	" <xsl:output method=\"html\" indent=\"yes\" version=\"4.0\"/>\n"
-	" <xsl:template match=\"statistics[@version=&quot;3.5&quot;]\">\n"
+	" <xsl:template match=\"statistics[@version=&quot;3.6&quot;]\">\n"
 	" <html>\n"
 	" <head>\n"
 	" <xsl:if test=\"system-property('xsl:vendor')!='Transformiix'\">\n"
--- a/external/bsd/bind/dist/bin/named/client.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/client.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: client.c,v 1.10.2.3 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: client.c,v 1.10.2.3.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2016  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -17,8 +17,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* Id: client.c,v 1.286 2012/01/31 23:47:30 tbox Exp  */
-
 #include <config.h>
 
 #include <isc/formatcheck.h>
@@ -28,6 +26,7 @@
 #include <isc/print.h>
 #include <isc/queue.h>
 #include <isc/random.h>
+#include <isc/safe.h>
 #include <isc/serial.h>
 #include <isc/stats.h>
 #include <isc/stdio.h>
@@ -125,7 +124,10 @@
  */
 #endif
 
-#define SIT_SIZE 24U /* 8 + 4 + 4 + 8 */
+#define COOKIE_SIZE 24U /* 8 + 4 + 4 + 8 */
+
+#define WANTNSID(x) (((x)->attributes & NS_CLIENTATTR_WANTNSID) != 0)
+#define WANTEXPIRE(x) (((x)->attributes & NS_CLIENTATTR_WANTEXPIRE) != 0)
 
 /*% nameserver client manager structure */
 struct ns_clientmgr {
@@ -346,12 +348,12 @@
 		 * We are trying to abort request processing.
 		 */
 		if (client->nsends > 0) {
-			isc_socket_t *socket;
+			isc_socket_t *sock;
 			if (TCP_CLIENT(client))
-				socket = client->tcpsocket;
+				sock = client->tcpsocket;
 			else
-				socket = client->udpsocket;
-			isc_socket_cancel(socket, client->task,
+				sock = client->udpsocket;
+			isc_socket_cancel(sock, client->task,
 					  ISC_SOCKCANCEL_SEND);
 		}
 
@@ -865,17 +867,17 @@
 	isc_result_t result;
 	isc_region_t r;
 	isc_sockaddr_t *address;
-	isc_socket_t *socket;
+	isc_socket_t *sock;
 	isc_netaddr_t netaddr;
 	int match;
 	unsigned int sockflags = ISC_SOCKFLAG_IMMEDIATE;
 	isc_dscp_t dispdscp = -1;
 
 	if (TCP_CLIENT(client)) {
-		socket = client->tcpsocket;
+		sock = client->tcpsocket;
 		address = NULL;
 	} else {
-		socket = client->udpsocket;
+		sock = client->udpsocket;
 		address = &client->peeraddr;
 
 		isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
@@ -913,7 +915,7 @@
 
 	CTRACE("sendto");
 
-	result = isc_socket_sendto2(socket, &r, client->task,
+	result = isc_socket_sendto2(sock, &r, client->task,
 				    address, pktinfo,
 				    client->sendevent, sockflags);
 	if (result == ISC_R_SUCCESS || result == ISC_R_INPROGRESS) {
@@ -1297,10 +1299,15 @@
 		isc_boolean_t wouldlog;
 		char log_buf[DNS_RRL_LOG_BUF_LEN];
 		dns_rrl_result_t rrl_result;
+		int loglevel;
 
 		INSIST(rcode != dns_rcode_noerror &&
 		       rcode != dns_rcode_nxdomain);
-		wouldlog = isc_log_wouldlog(ns_g_lctx, DNS_RRL_LOG_DROP);
+		if (ns_g_server->log_queries)
+			loglevel = DNS_RRL_LOG_DROP;
+		else
+			loglevel = ISC_LOG_DEBUG(1);
+		wouldlog = isc_log_wouldlog(ns_g_lctx, loglevel);
 		rrl_result = dns_rrl(client->view, &client->peeraddr,
 				     TCP_CLIENT(client),
 				     dns_rdataclass_in, dns_rdatatype_none,
@@ -1317,7 +1324,7 @@
 				ns_client_log(client,
 					      NS_LOGCATEGORY_QUERY_EERRORS,
 					      NS_LOGMODULE_CLIENT,
-					      DNS_RRL_LOG_DROP,
+					      loglevel,
 					      "%s", log_buf);
 			}
 			/*
@@ -1395,7 +1402,7 @@
 {
 	char nsid[BUFSIZ], *nsidp;
 #ifdef ISC_PLATFORM_USESIT
-	unsigned char sit[SIT_SIZE];
+	unsigned char sit[COOKIE_SIZE];
 #endif
 	isc_result_t result;
 	dns_view_t *view;
@@ -1420,7 +1427,7 @@
 	flags = client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE;
 
 	/* Set EDNS options if applicable */
-	if ((client->attributes & NS_CLIENTATTR_WANTNSID) != 0 &&
+	if (WANTNSID(client) &&
 	    (ns_g_server->server_id != NULL ||
 	     ns_g_server->server_usehostname)) {
 		if (ns_g_server->server_usehostname) {
@@ -1452,8 +1459,8 @@
 		compute_sit(client, now, nonce, &buf);
 
 		INSIST(count < DNS_EDNSOPTIONS);
-		ednsopts[count].code = DNS_OPT_SIT;
-		ednsopts[count].length = SIT_SIZE;
+		ednsopts[count].code = DNS_OPT_COOKIE;
+		ednsopts[count].length = COOKIE_SIZE;
 		ednsopts[count].value = sit;
 		count++;
 	}
@@ -1661,19 +1668,26 @@
 
 static void
 process_sit(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
-	unsigned char dbuf[SIT_SIZE];
+	unsigned char dbuf[COOKIE_SIZE];
 	unsigned char *old;
 	isc_stdtime_t now;
 	isc_uint32_t when;
 	isc_uint32_t nonce;
 	isc_buffer_t db;
 
+	/*
+	 * If we have already seen a ECS option skip this ECS option.
+	 */
+	if ((client->attributes & NS_CLIENTATTR_WANTSIT) != 0) {
+		isc_buffer_forward(buf, optlen);
+		return;
+	}
 	client->attributes |= NS_CLIENTATTR_WANTSIT;
 
 	isc_stats_increment(ns_g_server->nsstats,
 			    dns_nsstatscounter_sitopt);
 
-	if (optlen != SIT_SIZE) {
+	if (optlen != COOKIE_SIZE) {
 		/*
 		 * Not our token.
 		 */
@@ -1717,14 +1731,13 @@
 	isc_buffer_init(&db, dbuf, sizeof(dbuf));
 	compute_sit(client, when, nonce, &db);
 
-	if (memcmp(old, dbuf, SIT_SIZE) != 0) {
+	if (!isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
 		isc_stats_increment(ns_g_server->nsstats,
 				    dns_nsstatscounter_sitnomatch);
 		return;
 	}
 	isc_stats_increment(ns_g_server->nsstats,
 			    dns_nsstatscounter_sitmatch);
-
 	client->attributes |= NS_CLIENTATTR_HAVESIT;
 }
 #endif
@@ -1783,18 +1796,22 @@
 			optlen = isc_buffer_getuint16(&optbuf);
 			switch (optcode) {
 			case DNS_OPT_NSID:
-				isc_stats_increment(ns_g_server->nsstats,
+				if (!WANTNSID(client))
+					isc_stats_increment(
+						    ns_g_server->nsstats,
 						    dns_nsstatscounter_nsidopt);
 				client->attributes |= NS_CLIENTATTR_WANTNSID;
 				isc_buffer_forward(&optbuf, optlen);
 				break;
 #ifdef ISC_PLATFORM_USESIT
-			case DNS_OPT_SIT:
+			case DNS_OPT_COOKIE:
 				process_sit(client, &optbuf, optlen);
 				break;
 #endif
 			case DNS_OPT_EXPIRE:
-				isc_stats_increment(ns_g_server->nsstats,
+				if (!WANTEXPIRE(client))
+					isc_stats_increment(
+						  ns_g_server->nsstats,
 						  dns_nsstatscounter_expireopt);
 				client->attributes |= NS_CLIENTATTR_WANTEXPIRE;
 				isc_buffer_forward(&optbuf, optlen);
@@ -2013,6 +2030,14 @@
 		 * Parsing the request failed.  Send a response
 		 * (typically FORMERR or SERVFAIL).
 		 */
+		if (result == DNS_R_OPTERR)
+			(void)ns_client_addopt(client, client->message,
+					       &client->opt);
+
+		ns_client_log(client, NS_LOGCATEGORY_CLIENT,
+			      NS_LOGMODULE_CLIENT, ISC_LOG_WARNING,
+			      "message parsing failed: %s",
+			      isc_result_totext(result));
 		ns_client_error(client, result);
 		goto cleanup;
 	}
--- a/external/bsd/bind/dist/bin/named/config.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/config.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: config.c,v 1.9.4.2 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: config.c,v 1.9.4.2.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -168,7 +168,14 @@
 	dnssec-enable yes;\n\
 	dnssec-validation yes; \n\
 	dnssec-accept-expired no;\n\
-	clients-per-query 10;\n\
+"
+#ifdef ENABLE_FETCHLIMIT
+" 	fetches-per-server 0;\n\
+	fetches-per-zone 0;\n\
+	fetch-quota-params 100 0.1 0.3 0.7;\n\
+"
+#endif /* ENABLE_FETCHLIMIT */
+"	clients-per-query 10;\n\
 	max-clients-per-query 100;\n\
 	max-recursion-depth 7;\n\
 	max-recursion-queries 75;\n\
@@ -454,10 +461,6 @@
 	}
 
 	if (dscpsp != NULL) {
-		dscps = isc_mem_get(mctx, count * sizeof(isc_dscp_t));
-		if (dscps == NULL)
-			return (ISC_R_NOMEMORY);
-
 		dscpobj = cfg_tuple_get(list, "dscp");
 		if (dscpobj != NULL && cfg_obj_isuint32(dscpobj)) {
 			if (cfg_obj_asuint32(dscpobj) > 63) {
@@ -468,11 +471,18 @@
 			}
 			dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 		}
+
+		dscps = isc_mem_get(mctx, count * sizeof(isc_dscp_t));
+		if (dscps == NULL)
+			return (ISC_R_NOMEMORY);
 	}
 
 	addrs = isc_mem_get(mctx, count * sizeof(isc_sockaddr_t));
-	if (addrs == NULL)
+	if (addrs == NULL) {
+		if (dscps != NULL)
+			isc_mem_put(mctx, dscps, count * sizeof(isc_dscp_t));
 		return (ISC_R_NOMEMORY);
+	}
 
 	for (element = cfg_list_first(addrlist);
 	     element != NULL;
@@ -562,7 +572,7 @@
 	const cfg_obj_t *portobj;
 	const cfg_obj_t *dscpobj;
 	in_port_t port;
-	isc_dscp_t dscp;
+	isc_dscp_t dscp = -1;
 	dns_fixedname_t fname;
 	isc_sockaddr_t *addrs = NULL;
 	isc_dscp_t *dscps = NULL;
@@ -611,7 +621,8 @@
 			cfg_obj_log(dscpobj, ns_g_lctx, ISC_LOG_ERROR,
 				    "dscp value '%u' is out of range",
 				    cfg_obj_asuint32(dscpobj));
-			return (ISC_R_RANGE);
+			result = ISC_R_RANGE;
+			goto cleanup;
 		}
 		dscp = (isc_dscp_t)cfg_obj_asuint32(dscpobj);
 	}
--- a/external/bsd/bind/dist/bin/named/control.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/control.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: control.c,v 1.7.4.1 2014/12/22 03:28:33 msaitoh Exp $	*/
+/*	$NetBSD: control.c,v 1.7.4.1.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2007, 2009-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2009-2016  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -71,7 +71,7 @@
 #endif
 
 	data = isccc_alist_lookup(message, "_data");
-	if (data == NULL) {
+	if (!isccc_alist_alistp(data)) {
 		/*
 		 * No data section.
 		 */
@@ -103,7 +103,7 @@
 	if (command_compare(command, NS_COMMAND_RELOAD)) {
 		result = ns_server_reloadcommand(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_RECONFIG)) {
-		result = ns_server_reconfigcommand(ns_g_server, command);
+		result = ns_server_reconfigcommand(ns_g_server);
 	} else if (command_compare(command, NS_COMMAND_REFRESH)) {
 		result = ns_server_refreshcommand(ns_g_server, command, text);
 	} else if (command_compare(command, NS_COMMAND_RETRANSFER)) {
--- a/external/bsd/bind/dist/bin/named/controlconf.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/controlconf.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: controlconf.c,v 1.9 2014/07/08 05:43:37 spz Exp $	*/
+/*	$NetBSD: controlconf.c,v 1.9.4.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2008, 2011-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2008, 2011-2014, 2016  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2001-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -404,7 +404,7 @@
 	 * Limit exposure to replay attacks.
 	 */
 	_ctrl = isccc_alist_lookup(request, "_ctrl");
-	if (_ctrl == NULL) {
+	if (!isccc_alist_alistp(_ctrl)) {
 		log_invalid(&conn->ccmsg, ISC_R_FAILURE);
 		goto cleanup_request;
 	}
--- a/external/bsd/bind/dist/bin/named/include/named/lwdclient.h	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/include/named/lwdclient.h	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: lwdclient.h,v 1.3 2012/06/05 00:39:09 christos Exp $	*/
+/*	$NetBSD: lwdclient.h,v 1.3.14.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004, 2005, 2007, 2009  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -188,6 +188,7 @@
 	lwres_context_t	       *lwctx;		/*%< lightweight proto context */
 	isc_task_t	       *task;		/*%< owning task */
 	unsigned int		flags;
+	isc_mutex_t		lock;
 	ISC_LINK(ns_lwdclientmgr_t)	link;
 	ISC_LIST(ns_lwdclient_t)	idle;		/*%< idle client slots */
 	ISC_LIST(ns_lwdclient_t)	running;	/*%< running clients */
--- a/external/bsd/bind/dist/bin/named/include/named/main.h	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/include/named/main.h	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: main.h,v 1.4 2013/12/31 20:24:39 christos Exp $	*/
+/*	$NetBSD: main.h,v 1.4.6.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004, 2005, 2007, 2009, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2009, 2013, 2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2002  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -17,8 +17,6 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* Id: main.h,v 1.17 2009/09/29 23:48:03 tbox Exp  */
-
 #ifndef NAMED_MAIN_H
 #define NAMED_MAIN_H 1
 
@@ -28,6 +26,11 @@
 #define main(argc, argv) bindmain(argc, argv)
 #endif
 
+/*
+ * Commandline arguments for named; also referenced in win32/ntservice.c
+ */
+#define NS_MAIN_ARGS "46c:C:d:D:E:fFgi:lM:m:n:N:p:P:sS:t:T:U:u:vVx:"
+
 ISC_PLATFORM_NORETURN_PRE void
 ns_main_earlyfatal(const char *format, ...)
 ISC_FORMAT_PRINTF(1, 2) ISC_PLATFORM_NORETURN_POST;
--- a/external/bsd/bind/dist/bin/named/include/named/server.h	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/include/named/server.h	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: server.h,v 1.8.2.1 2014/12/22 03:28:34 msaitoh Exp $	*/
+/*	$NetBSD: server.h,v 1.8.2.1.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2014  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2003  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -53,6 +53,7 @@
 	isc_quota_t		xfroutquota;
 	isc_quota_t		tcpquota;
 	isc_quota_t		recursionquota;
+
 	dns_acl_t		*blackholeacl;
 	char *			statsfile;	/*%< Statistics file name */
 	char *			dumpfile;	/*%< Dump file name */
@@ -185,7 +186,6 @@
 	dns_nsstatscounter_expireopt = 44,
 	dns_nsstatscounter_otheropt = 45,
 
-#ifdef ISC_PLATFORM_USESIT
 	dns_nsstatscounter_sitopt = 46,
 	dns_nsstatscounter_sitbadsize = 47,
 	dns_nsstatscounter_sitbadtime = 48,
@@ -194,9 +194,6 @@
 	dns_nsstatscounter_sitnew = 51,
 
 	dns_nsstatscounter_max = 52
-#else
-	dns_nsstatscounter_max = 46
-#endif
 };
 
 void
@@ -242,7 +239,7 @@
  */
 
 isc_result_t
-ns_server_reconfigcommand(ns_server_t *server, char *args);
+ns_server_reconfigcommand(ns_server_t *server);
 /*%<
  * Act on a "reconfig" command from the command channel.
  */
--- a/external/bsd/bind/dist/bin/named/interfacemgr.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/interfacemgr.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,4 +1,4 @@
-/*	$NetBSD: interfacemgr.c,v 1.8.2.2 2015/07/17 04:31:20 snj Exp $	*/
+/*	$NetBSD: interfacemgr.c,v 1.8.2.2.2.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
  * Copyright (C) 2004-2009, 2011-2015  Internet Systems Consortium, Inc. ("ISC")
@@ -473,7 +473,7 @@
 	return (ISC_R_SUCCESS);
 
  addtodispatch_failure:
-	for (i = disp - 1; i <= 0; i--) {
+	for (i = disp - 1; i >= 0; i--) {
 		dns_dispatch_changeattributes(ifp->udpdispatch[i], 0,
 					      DNS_DISPATCHATTR_NOLISTEN);
 		dns_dispatch_detach(&(ifp->udpdispatch[i]));
--- a/external/bsd/bind/dist/bin/named/logconf.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/logconf.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: logconf.c,v 1.6 2013/12/31 20:24:39 christos Exp $	*/
+/*	$NetBSD: logconf.c,v 1.6.6.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004-2007, 2011, 2013  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004-2007, 2011, 2013, 2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 1999-2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -25,6 +25,7 @@
 
 #include <isc/file.h>
 #include <isc/offset.h>
+#include <isc/print.h>
 #include <isc/result.h>
 #include <isc/stdio.h>
 #include <isc/string.h>
--- a/external/bsd/bind/dist/bin/named/lwdclient.c	Fri Mar 11 12:27:04 2016 +0000
+++ b/external/bsd/bind/dist/bin/named/lwdclient.c	Sun Mar 13 08:00:24 2016 +0000
@@ -1,7 +1,7 @@
-/*	$NetBSD: lwdclient.c,v 1.3 2012/06/05 00:39:00 christos Exp $	*/
+/*	$NetBSD: lwdclient.c,v 1.3.14.1 2016/03/13 08:00:25 martin Exp $	*/
 
 /*
- * Copyright (C) 2004, 2005, 2007  Internet Systems Consortium, Inc. ("ISC")
+ * Copyright (C) 2004, 2005, 2007, 2015  Internet Systems Consortium, Inc. ("ISC")
  * Copyright (C) 2000, 2001  Internet Software Consortium.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
@@ -61,12 +61,16 @@
 	ns_lwdclientmgr_t *cm;
 	ns_lwdclient_t *client;
 	unsigned int i;
-	isc_result_t result = ISC_R_FAILURE;
+	isc_result_t result;
 
 	cm = isc_mem_get(lwresd->mctx, sizeof(ns_lwdclientmgr_t));
 	if (cm == NULL)
 		return (ISC_R_NOMEMORY);
 
+	result = isc_mutex_init(&cm->lock);
+	if (result != ISC_R_SUCCESS)
+		goto freecm;
+
 	cm->listener = NULL;
 	ns_lwreslistener_attach(listener, &cm->listener);
 	cm->mctx = lwresd->mctx;
@@ -80,10 +84,10 @@
 	ISC_LIST_INIT(cm->idle);
 	ISC_LIST_INIT(cm->running);
 
-	if (lwres_context_create(&cm->lwctx, cm->mctx,
-				 ns__lwresd_memalloc, ns__lwresd_memfree,
-				 LWRES_CONTEXT_SERVERMODE)
-	    != ISC_R_SUCCESS)
+	result = lwres_context_create(&cm->lwctx, cm->mctx,
+				      ns__lwresd_memalloc, ns__lwresd_memfree,
+				      LWRES_CONTEXT_SERVERMODE);
+	 if (result != ISC_R_SUCCESS)
 		goto errout;
 
 	for (i = 0; i < nclients; i++) {
@@ -98,8 +102,10 @@
 	/*
 	 * If we could create no clients, clean up and return.
 	 */
-	if (ISC_LIST_EMPTY(cm->idle))
+	if (ISC_LIST_EMPTY(cm->idle)) {
+		result = ISC_R_NOMEMORY;
 		goto errout;
+	}
 
 	result = isc_task_create(taskmgr, 0, &cm->task);
 	if (result != ISC_R_SUCCESS)
@@ -132,6 +138,9 @@
 	if (cm->lwctx != NULL)
 		lwres_context_destroy(&cm->lwctx);
 
+	DESTROYLOCK(&cm->lock);
+
+ freecm:
 	isc_mem_put(lwresd->mctx, cm, sizeof(*cm));
 	return (result);
 }
@@ -141,11 +150,14 @@
 	ns_lwdclient_t *client;
 	ns_lwreslistener_t *listener;
 
-	if (!SHUTTINGDOWN(cm))
+	LOCK(&cm->lock);
+	if (!SHUTTINGDOWN(cm)) {
+		UNLOCK(&cm->lock);
 		return;
+	}
 
 	/*
-	 * run through the idle list and free the clients there.  Idle
+	 * Run through the idle list and free the clients there.  Idle
 	 * clients do not have a recv running nor do they have any finds
 	 * or similar running.
 	 */
@@ -158,14 +170,20 @@
 		client = ISC_LIST_HEAD(cm->idle);
 	}
 
-	if (!ISC_LIST_EMPTY(cm->running))
+	if (!ISC_LIST_EMPTY(cm->running)) {
+		UNLOCK(&cm->lock);
 		return;
+	}
+
+	UNLOCK(&cm->lock);
 
 	lwres_context_destroy(&cm->lwctx);
 	cm->view = NULL;
 	isc_socket_detach(&cm->sock);
 	isc_task_detach(&cm->task);
 
+	DESTROYLOCK(&cm->lock);
+
 	listener = cm->listener;
 	ns_lwreslistener_unlinkcm(listener, cm);
 	ns_lwdclient_log(50, "destroying manager %p", cm);
@@ -227,8 +245,10 @@
 
 	NS_LWDCLIENT_SETRECVDONE(client);
 
+	LOCK(&cm->lock);
 	INSIST((cm->flags & NS_LWDCLIENTMGR_FLAGRECVPENDING) != 0);
 	cm->flags &= ~NS_LWDCLIENTMGR_FLAGRECVPENDING;
+	UNLOCK(&cm->lock);
 
 	ns_lwdclient_log(50,
 			 "event received: task %p, length %u, result %u (%s)",
@@ -276,40 +296,53 @@
 	ns_lwdclient_t *client;
 	isc_result_t result;
 	isc_region_t r;
+	isc_boolean_t destroy = ISC_FALSE;
 
+
+	LOCK(&cm->lock);
 	if (SHUTTINGDOWN(cm)) {
-		lwdclientmgr_destroy(cm);
-		return (ISC_R_SUCCESS);
+		destroy = ISC_TRUE;
+		result = ISC_R_SUCCESS;
+		goto unlock;
 	}
 
 	/*
 	 * If a recv is already running, don't bother.
 	 */
-	if ((cm->flags & NS_LWDCLIENTMGR_FLAGRECVPENDING) != 0)
-		return (ISC_R_SUCCESS);
+	if ((cm->flags & NS_LWDCLIENTMGR_FLAGRECVPENDING) != 0) {
+		result = ISC_R_SUCCESS;
+		goto unlock;
+	}
 
 	/*
 	 * If we have no idle slots, just return success.
 	 */
 	client = ISC_LIST_HEAD(cm->idle);
-	if (client == NULL)
-		return (ISC_R_SUCCESS);
+	if (client == NULL) {
+		result = ISC_R_SUCCESS;
+		goto unlock;
+	}
+
 	INSIST(NS_LWDCLIENT_ISIDLE(client));
 
 	/*
+	 * Set the flag to say there is a recv pending.  If isc_socket_recv
+	 * fails we will clear the flag otherwise it will be cleared by
+	 * ns_lwdclient_recv.
+	 */
+	cm->flags |= NS_LWDCLIENTMGR_FLAGRECVPENDING;
+
+	/*
 	 * Issue the recv.  If it fails, return that it did.
 	 */
 	r.base = client->buffer;
 	r.length = LWRES_RECVLENGTH;
 	result = isc_socket_recv(cm->sock, &r, 0, cm->task, ns_lwdclient_recv,
 				 client);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-
-	/*
-	 * Set the flag to say we've issued a recv() call.
-	 */
-	cm->flags |= NS_LWDCLIENTMGR_FLAGRECVPENDING;
+	if (result != ISC_R_SUCCESS) {
+		cm->flags &= ~NS_LWDCLIENTMGR_FLAGRECVPENDING;
+		goto unlock;
+	}
 
 	/*
 	 * Remove the client from the idle list, and put it on the running
@@ -319,7 +352,13 @@
 	ISC_LIST_UNLINK(cm->idle, client, link);
 	ISC_LIST_APPEND(cm->running, client, link);