[illumos-gate merge]

commit ae5c3fb759f05e5de586c82b204aabe1e336b578
    13589 ccid: implicit conversion from 'atr_protocol_t' 'uccid_prot_t'
commit 8ad466288742ffe497149f668ec1c028def2c686
    13585 stmf: array subscript is above array bounds
commit 718fc4ac1dfcd860e967fb444c831507f97cd300
    13512 ksh's >; is not reliable with `-c'
commit 3be0d903330def6576e70a1a8a028f5828c9ea45
    13174 mac_prop_info_set_default_fec should be added to mac_prop_info(9F)
commit 25a9a7aaf35c7e4a2b5a57d3875af906147710d5
    13572 SMB Query FileFsVolumeInformation should allow truncation
commit 4d00d81bf82141f996e032f9c53e0e996a5f7204
    13501 smbutil view crashes in ndr_clnt_get_frags()
commit 7713a0580ffd38602449546f743c4eaccdeff06d
    13582 wsdiff does not like non-proto directories
commit e39a7b5b5afda54edb90e52709591832137db39f
    12849 ixgbe can do unnecessary allocations during tx
commit 3a51e5c06fdc66b1c3883ded28372f6ae8e9cedb
    13573 stop working around broken _msg makefiles and fix them
commit cd93bdd351ff6db57bb306f3135a27aff71919d0
    13535 snoop: multiply-defined symbols
commit f6e9c6bd978eaf32de099c7f4a16eb9d2f1e5ab1
    13541 powertop: symbol 'g_turbo_supported' is multiply-defined
commit f641a59486e69100969f92a7ec309574f76b238d
    13426 xpv_psm: symbol 'acpi_isop' is multiply-defined

39 files changed, 815 insertions, 660 deletions

diff --git a/manifest b/manifest
index 38f6dea7e8..3390f0877f 100644
--- a/manifest
+++ b/manifest
@@ -20759,6 +20759,7 @@ f usr/share/man/man9f/mac_link_update.9f 0444 root bin
 f usr/share/man/man9f/mac_lso_get.9f 0444 root bin
 f usr/share/man/man9f/mac_maxsdu_update.9f 0444 root bin
 f usr/share/man/man9f/mac_prop_info.9f 0444 root bin
+s usr/share/man/man9f/mac_prop_info_set_default_fec.9f=mac_prop_info.9f
 s usr/share/man/man9f/mac_prop_info_set_default_link_flowctrl.9f=mac_prop_info.9f
 s usr/share/man/man9f/mac_prop_info_set_default_str.9f=mac_prop_info.9f
 s usr/share/man/man9f/mac_prop_info_set_default_uint32.9f=mac_prop_info.9f
diff --git a/usr/src/Makefile b/usr/src/Makefile
index 713f5a1424..01ea95b29f 100644
--- a/usr/src/Makefile
+++ b/usr/src/Makefile
@@ -74,16 +74,6 @@ CHKMFSTSUBDIRS=	cmd
 CHKMANSUBDIRS = man
 
 MSGSUBDIRS=	cmd ucbcmd lib data
-DOMAINS= \
-	SUNW_OST_ADMIN \
-	SUNW_OST_NETRPC \
-	SUNW_OST_OSCMD \
-	SUNW_OST_OSLIB \
-	SUNW_OST_UCBCMD \
-	SUNW_OST_ZONEINFO
-
-MSGDDIRS=       $(DOMAINS:%=$(MSGROOT)/%)
-MSGDIRS=        $(MSGROOT) $(MSGDDIRS) $(MSGROOT)/LC_TIME
 
 all :=			TARGET= all
 install :=		TARGET= install
@@ -126,7 +116,7 @@ install1: mapfiles closedbins sgs
 
 install2: install1 .WAIT $(SUBDIRS)
 
-_msg: _msgdirs rootdirs FRC
+_msg: rootdirs FRC
 	@for m in $(MSGSUBDIRS); do \
 		cd $$m; pwd; $(MAKE) _msg; cd ..; \
 	done
@@ -220,9 +210,7 @@ bldtools:
 rootdirs: $(ROOTDIRS)
 	$(INS) -d -m 775 $(ROOT)/var/mail/:saved
 
-_msgdirs:       $(MSGDIRS)
-
-$(ROOTDIRS) $(MSGDIRS):
+$(ROOTDIRS):
 	$(INS.dir)
 
 userheaders: FRC
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.h b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.h
index 81add827e6..ff9099bbf9 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.h
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop.h
@@ -101,7 +101,7 @@ extern void del_transient(int port);
  * argument is interpreted.
  */
 #define	XID_CACHE_SIZE 256
-struct cache_struct {
+extern struct cache_struct {
 	int xid_num;	/* RPC transaction id */
 	int xid_frame;	/* Packet number */
 	int xid_prog;	/* RPC program number */
@@ -111,6 +111,26 @@ struct cache_struct {
 	int xid_gss_service; /* none, integ, priv */
 } xid_cache[XID_CACHE_SIZE];
 
+extern char *tkp, *sav_tkp;
+extern char *token;
+extern enum tokentype {
+	EOL,
+	ALPHA,
+	NUMBER,
+	FIELD,
+	ADDR_IP,
+	ADDR_ETHER,
+	SPECIAL,
+	ADDR_IP6,
+	ADDR_AT
+} tokentype;
+extern uint_t tokenval;
+
+enum direction { ANY, TO, FROM };
+extern enum direction dir;
+
+extern int eaddr;	/* need ethernet addr */
+extern int opstack;	/* operand stack depth */
 
 /*
  * The following macros advance the pointer passed to them.  They
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_filter.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_filter.c
index 16ea65e305..2118fb4179 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_filter.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_filter.c
@@ -499,31 +499,34 @@ static int slp_index	= 0;
  * Returns the index of dport in the table if found, otherwise -1.
  */
 static int
-find_slp(uint_t dport) {
-    int i;
+find_slp(uint_t dport)
+{
+	int i;
 
-    if (!dport)
-	return (0);
+	if (!dport)
+		return (0);
 
-    for (i = slp_index; i >= 0; i--)
-	if (slp_table[i] == dport) {
-	    return (i);
-	}
-    for (i = SLP_CACHE_SIZE - 1; i > slp_index; i--)
-	if (slp_table[i] == dport) {
-	    return (i);
-	}
-    return (-1);
+	for (i = slp_index; i >= 0; i--)
+		if (slp_table[i] == dport) {
+			return (i);
+		}
+	for (i = SLP_CACHE_SIZE - 1; i > slp_index; i--)
+		if (slp_table[i] == dport) {
+			return (i);
+		}
+	return (-1);
 }
 
-static void stash_slp(uint_t sport) {
-    if (slp_table[slp_index - 1] == sport)
-	/* avoid redundancy due to multicast retransmissions */
-	return;
+static void
+stash_slp(uint_t sport)
+{
+	if (slp_table[slp_index - 1] == sport)
+		/* avoid redundancy due to multicast retransmissions */
+		return;
 
-    slp_table[slp_index++] = sport;
-    if (slp_index == SLP_CACHE_SIZE)
-	slp_index = 0;
+	slp_table[slp_index++] = sport;
+	if (slp_index == SLP_CACHE_SIZE)
+		slp_index = 0;
 }
 
 /*
@@ -1123,8 +1126,7 @@ resolve_chain(uint_t p)
 
 char *tkp, *sav_tkp;
 char *token;
-enum { EOL, ALPHA, NUMBER, FIELD, ADDR_IP, ADDR_ETHER, SPECIAL,
-	ADDR_IP6, ADDR_AT } tokentype;
+enum tokentype tokentype;
 uint_t tokenval;
 
 /*
@@ -1134,7 +1136,7 @@ uint_t tokenval;
  * ALPHA:	A name that begins with a letter and contains
  *		letters or digits, hyphens or underscores.
  * NUMBER:	A number.  The value can be represented as
- * 		a decimal value (1234) or an octal value
+ *		a decimal value (1234) or an octal value
  *		that begins with zero (066) or a hex value
  *		that begins with 0x or 0X (0xff).
  * FIELD:	A name followed by a left square bracket.
@@ -1460,7 +1462,6 @@ comparison(char *s)
 	return (n_checks > 0);
 }
 
-enum direction { ANY, TO, FROM };
 enum direction dir;
 
 /*
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_pf.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_pf.c
index 6eec24cd85..fc6ce7a5bb 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_pf.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_pf.c
@@ -74,10 +74,6 @@ extern struct Pf_ext_packetfilt pf;
 static ushort_t *pfp;
 jmp_buf env;
 
-int eaddr;	/* need ethernet addr */
-
-int opstack;	/* operand stack depth */
-
 #define	EQ(val)		(strcmp(token, val) == 0)
 #define	IPV4_ONLY	0
 #define	IPV6_ONLY	1
@@ -234,14 +230,6 @@ datalink_t	dl;
 
 static int inBrace = 0, inBraceOR = 0;
 static int foundOR = 0;
-char *tkp, *sav_tkp;
-char *token;
-enum { EOL, ALPHA, NUMBER, FIELD, ADDR_IP, ADDR_ETHER, SPECIAL,
-	ADDR_IP6 } tokentype;
-uint_t tokenval;
-
-enum direction { ANY, TO, FROM };
-enum direction dir;
 
 extern void next();
 
@@ -271,8 +259,7 @@ static void pf_matchfn(const char *name);
 static void *last_offset_operation = (void*)pf_clear_offset_register;
 
 static void
-pf_emit(x)
-	ushort_t x;
+pf_emit(ushort_t x)
 {
 	if (pfp > &pf.Pf_Filter[PF_MAXFILTERS - 1])
 		longjmp(env, 1);
@@ -280,9 +267,7 @@ pf_emit(x)
 }
 
 static void
-pf_codeprint(code, len)
-	ushort_t *code;
-	int len;
+pf_codeprint(ushort_t *code, int len)
 {
 	ushort_t *pc;
 	ushort_t *plast = code + len;
@@ -599,10 +584,7 @@ pf_compare_zoneid(int offset, uint32_t val)
  * Generate pf code to match an IPv4 or IPv6 address.
  */
 static void
-pf_ipaddr_match(which, hostname, inet_type)
-	enum direction which;
-	char *hostname;
-	int inet_type;
+pf_ipaddr_match(enum direction which, char *hostname, int inet_type)
 {
 	bool_t found_host;
 	uint_t *addr4ptr;
@@ -766,7 +748,7 @@ pf_ipaddr_match(which, hostname, inet_type)
 					first = B_FALSE;
 			}
 			addr6ptr = (struct in6_addr *)
-				hp->h_addr_list[++h_addr_index];
+			    hp->h_addr_list[++h_addr_index];
 		}
 		if (!first) {
 			pf_emit(ENF_AND);
@@ -781,7 +763,7 @@ pf_ipaddr_match(which, hostname, inet_type)
 					pf_matchfn("ip6");
 					if (dl.dl_type == DL_ETHER) {
 						pf_check_vlan_tag(
-							ENCAP_ETHERTYPE_OFF/2);
+						    ENCAP_ETHERTYPE_OFF / 2);
 					}
 					pass++;
 				}
@@ -803,7 +785,7 @@ pf_ipaddr_match(which, hostname, inet_type)
 					first = B_FALSE;
 			}
 			addr6ptr = (struct in6_addr *)
-				hp->h_addr_list[++h_addr_index];
+			    hp->h_addr_list[++h_addr_index];
 		}
 		if (!first) {
 			pf_emit(ENF_AND);
@@ -858,9 +840,7 @@ pf_compare_address(int offset, uint_t len, uchar_t *addr)
  * Compare ethernet addresses.
  */
 static void
-pf_etheraddr_match(which, hostname)
-	enum direction which;
-	char *hostname;
+pf_etheraddr_match(enum direction which, char *hostname)
 {
 	struct ether_addr e, *ep = NULL;
 
@@ -870,7 +850,7 @@ pf_etheraddr_match(which, hostname)
 		if (ether_hostton(hostname, &e))
 			if (!arp_for_ether(hostname, &e))
 				pr_err("cannot obtain ether addr for %s",
-					hostname);
+				    hostname);
 		ep = &e;
 	}
 
@@ -900,9 +880,7 @@ pf_etheraddr_match(which, hostname)
  * an IP address.
  */
 static void
-pf_netaddr_match(which, netname)
-	enum direction which;
-	char *netname;
+pf_netaddr_match(enum direction which, char *netname)
 {
 	uint_t addr;
 	uint_t mask = 0xff000000;
@@ -1530,9 +1508,7 @@ pf_expression()
  * filter.
  */
 int
-pf_compile(e, print)
-	char *e;
-	int print;
+pf_compile(char *e, int print)
 {
 	char *argstr;
 	char *sav_str, *ptr, *sav_ptr;
@@ -1616,8 +1592,7 @@ pf_compile(e, print)
 
 			/* CHECK IF NO OR AHEAD */
 			sav_ptr = (char *)((uintptr_t)sav_str +
-						(uintptr_t)sav_tkp -
-						(uintptr_t)argstr);
+			    (uintptr_t)sav_tkp - (uintptr_t)argstr);
 			ptr = sav_ptr;
 			while (*ptr != '\0') {
 				switch (*ptr) {
@@ -1630,7 +1605,7 @@ pf_compile(e, print)
 				case 'o':
 				case 'O':
 					if ((*(ptr + 1) == 'R' ||
-						*(ptr + 1) == 'r') && !inBr)
+					    *(ptr + 1) == 'r') && !inBr)
 						aheadOR = 1;
 					break;
 				case ',':
@@ -1646,7 +1621,7 @@ pf_compile(e, print)
 				pf.Pf_Priority = 5;
 				if (print) {
 					pf_codeprint(&pf.Pf_Filter[0],
-							pf.Pf_FilterLen);
+					    pf.Pf_FilterLen);
 				}
 				compile(sav_ptr, print);
 				return (2);
diff --git a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rpc.c b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rpc.c
index be39961676..63d964c24c 100644
--- a/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rpc.c
+++ b/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_rpc.c
@@ -61,6 +61,7 @@ static void rpc_detail_reply(int, int, struct cache_struct *, char *, int len);
 static void print_creds(int);
 static void print_verif(int);
 static void stash_xid(ulong_t, int, int, int, int);
+struct cache_struct xid_cache[XID_CACHE_SIZE];
 
 #define	LAST_FRAG ((ulong_t)1 << 31)
 
@@ -257,8 +258,7 @@ rpc_detail_call(int flags, int xid, int rpcvers, int prog, int vers, int proc,
 }
 
 char *
-nameof_flavor(flavor)
-	int flavor;
+nameof_flavor(int flavor)
 {
 	switch (flavor) {
 	case AUTH_NONE : return ("None");
@@ -545,15 +545,13 @@ struct rpcnames {
 };
 
 int
-compare(a, b)
-	register struct rpcnames *a, *b;
+compare(struct rpcnames *a, struct rpcnames *b)
 {
 	return (a->rp_prog - b->rp_prog);
 }
 
 char *
-nameof_prog(prog)
-	int prog;
+nameof_prog(int prog)
 {
 	struct rpcnames *r;
 	struct rpcnames *bsearch();
@@ -570,8 +568,7 @@ nameof_prog(prog)
 }
 
 char *
-nameof_astat(status)
-	int status;
+nameof_astat(int status)
 {
 	switch (status) {
 	case SUCCESS	  : return ("Success");
@@ -585,8 +582,7 @@ nameof_astat(status)
 }
 
 char *
-nameof_why(why)
-	int why;
+nameof_why(int why)
 {
 	switch (why) {
 	case AUTH_BADCRED:	return ("bogus credentials (seal broken)");
@@ -723,8 +719,7 @@ struct cache_struct *xcp	= &xid_cache[0];
 struct cache_struct *xcplast	= &xid_cache[XID_CACHE_SIZE - 1];
 
 struct cache_struct *
-find_xid(xid)
-	ulong_t xid;
+find_xid(ulong_t xid)
 {
 	struct cache_struct *x;
 
@@ -758,9 +753,7 @@ stash_xid(ulong_t xid, int frame, int prog, int vers, int proc)
 }
 
 void
-check_retransmit(line, xid)
-	char *line;
-	ulong_t xid;
+check_retransmit(char *line, ulong_t xid)
 {
 	struct cache_struct *x;
 	extern int pi_frame;
diff --git a/usr/src/cmd/make/lib/mksh/Makefile b/usr/src/cmd/make/lib/mksh/Makefile
index de2fc14199..257b3e8f18 100644
--- a/usr/src/cmd/make/lib/mksh/Makefile
+++ b/usr/src/cmd/make/lib/mksh/Makefile
@@ -26,7 +26,7 @@ include $(SRC)/lib/Makefile.lib
 include ../../Makefile.com
 
 POFILE = libmksh.po
-POFILES = $(OBJECTS:%.o=%.po)
+MSGFILES = $(OBJECTS:%.o=%.cc)
 
 LIBS = $(LIBRARY)
 SRCDIR = ../
@@ -42,11 +42,9 @@ all: $(LIBS)
 
 install: all
 
-$(POFILE): $(POFILES)
-	$(CAT) $(POFILES) > $@
+$(POFILE): pofile_MSGFILES
 
-_msg: $(MSGDOMAIN) $(POFILE)
-	$(RM) $(MSGDOMAIN)/$(POFILE)
-	$(CP) $(POFILE) $(MSGDOMAIN)
+_msg: $(MSGDOMAINPOFILE)
 
 include $(SRC)/lib/Makefile.targ
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/cmd/powertop/common/powertop.c b/usr/src/cmd/powertop/common/powertop.c
index 731ff2af59..9b4188e363 100644
--- a/usr/src/cmd/powertop/common/powertop.c
+++ b/usr/src/cmd/powertop/common/powertop.c
@@ -72,7 +72,6 @@ state_info_t		g_cstate_info[NSTATES];
 freq_state_info_t	g_pstate_info[NSTATES];
 cpu_power_info_t	*g_cpu_power_states;
 
-boolean_t		g_turbo_supported;
 boolean_t		g_sig_resize;
 
 uint_t			g_argc;
diff --git a/usr/src/cmd/powertop/common/turbo.c b/usr/src/cmd/powertop/common/turbo.c
index b2cafe7689..4909b70899 100644
--- a/usr/src/cmd/powertop/common/turbo.c
+++ b/usr/src/cmd/powertop/common/turbo.c
@@ -62,9 +62,9 @@ static turbo_info_t	*t_new = NULL;
 static int
 pt_turbo_init(void)
 {
-	kstat_ctl_t 		*kc;
-	kstat_t 		*ksp;
-	kstat_named_t 		*knp;
+	kstat_ctl_t		*kc;
+	kstat_t			*ksp;
+	kstat_named_t		*knp;
 
 	/*
 	 * check if the CPU turbo is supported
@@ -111,10 +111,10 @@ pt_turbo_init(void)
 static int
 pt_turbo_snapshot(turbo_info_t *turbo_snapshot)
 {
-	kstat_ctl_t 		*kc;
-	kstat_t 		*ksp;
-	kstat_named_t 		*knp;
-	int 			cpu;
+	kstat_ctl_t		*kc;
+	kstat_t			*ksp;
+	kstat_named_t		*knp;
+	int			cpu;
 	turbo_info_t		*turbo_info;
 
 	if ((kc = kstat_open()) == NULL)
diff --git a/usr/src/cmd/ptools/Makefile b/usr/src/cmd/ptools/Makefile
index aec951e44b..24c3bb90c5 100644
--- a/usr/src/cmd/ptools/Makefile
+++ b/usr/src/cmd/ptools/Makefile
@@ -96,10 +96,12 @@ $(LEGACY_SUBDIRS): FRC
 # Combine all messages files into a single file and copy it to
 # MSGDOMAIN directory
 #
-_msg: ${POFILES}
+_msg: $(MSGDOMAIN) $(POFILES)
 	$(RM) $(POFILE)
 	$(CAT) $(POFILES) > $(POFILE)
 	$(RM)  $(MSGDOMAIN)/$(POFILE)
 	$(CP) $(POFILE) $(MSGDOMAIN)
 
 FRC:
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/cmd/smbsrv/test-msgbuf/test_mbmarshal.c b/usr/src/cmd/smbsrv/test-msgbuf/test_mbmarshal.c
index 967915688e..06798f6ade 100644
--- a/usr/src/cmd/smbsrv/test-msgbuf/test_mbmarshal.c
+++ b/usr/src/cmd/smbsrv/test-msgbuf/test_mbmarshal.c
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -139,7 +139,7 @@ out:
 }
 
 static void
-mbm_put_atrunc()
+mbm_put_atrunc1()
 {
 	uint8_t wire[] = { 'o', 'n', 'e', 't', };
 	mbuf_chain_t *mbc;
@@ -150,23 +150,57 @@ mbm_put_atrunc()
 	/* Encode with wire length < strlen */
 	rc = smb_mbc_encodef(mbc, "4s", "onetwo");
 	if (rc != 0) {
-		printf("Fail: mbm_put_atrunc encode\n");
+		printf("Fail: mbm_put_atrunc1 encode\n");
 		goto out;
 	}
 	/* Trunc should put exactly 4 */
 	if (mbc->chain->m_len != 4) {
-		printf("Fail: mbm_put_atrunc len=%d\n",
+		printf("Fail: mbm_put_atrunc1 len=%d\n",
 		    mbc->chain->m_len);
 		return;
 	}
 
 	if (memcmp(mbc->chain->m_data, wire, 4)) {
-		printf("Fail: mbm_put_atrunc cmp:\n");
+		printf("Fail: mbm_put_atrunc1 cmp:\n");
 		hexdump((uchar_t *)mbc->chain->m_data, 4);
 		return;
 	}
 
-	printf("Pass: mbm_put_atrunc\n");
+	printf("Pass: mbm_put_atrunc1\n");
+
+out:
+	smb_mbc_free(mbc);
+}
+
+static void
+mbm_put_atrunc2()
+{
+	uint8_t wire[] = { 'o', 'n', 'e', 't', 0 };
+	mbuf_chain_t *mbc;
+	int rc;
+
+	mbc = smb_mbc_alloc(4);
+
+	/* Encode with wire length < strlen */
+	rc = smb_mbc_encodef(mbc, "s", "onetwo");
+	if (rc != 1) {
+		printf("Fail: mbm_put_atrunc2 encode rc=%d\n", rc);
+		goto out;
+	}
+	/* Trunc should put exactly 4 */
+	if (mbc->chain->m_len != 4) {
+		printf("Fail: mbm_put_atrunc2 len=%d\n",
+		    mbc->chain->m_len);
+		return;
+	}
+
+	if (memcmp(mbc->chain->m_data, wire, 5)) {
+		printf("Fail: mbm_put_atrunc2 cmp:\n");
+		hexdump((uchar_t *)mbc->chain->m_data, 4);
+		return;
+	}
+
+	printf("Pass: mbm_put_atrunc2\n");
 
 out:
 	smb_mbc_free(mbc);
@@ -338,7 +372,7 @@ out:
 }
 
 static void
-mbm_put_utrunc()
+mbm_put_utrunc1()
 {
 	uint16_t wire[] = { 'o', 'n', 'e', 't' };
 	mbuf_chain_t *mbc;
@@ -349,23 +383,57 @@ mbm_put_utrunc()
 	/* Encode with wire length < strlen */
 	rc = smb_mbc_encodef(mbc, "8U", "onetwo");
 	if (rc != 0) {
-		printf("Fail: mbm_put_utrunc encode\n");
+		printf("Fail: mbm_put_utrunc1 encode\n");
 		goto out;
 	}
 	/* Trunc should put exactly 8 */
 	if (mbc->chain->m_len != 8) {
-		printf("Fail: mbm_put_utrunc len=%d\n",
+		printf("Fail: mbm_put_utrunc1 len=%d\n",
 		    mbc->chain->m_len);
 		return;
 	}
 
 	if (memcmp(mbc->chain->m_data, wire, 8)) {
-		printf("Fail: mbm_put_utrunc cmp:\n");
+		printf("Fail: mbm_put_utrunc1 cmp:\n");
+		hexdump((uchar_t *)mbc->chain->m_data, 8);
+		return;
+	}
+
+	printf("Pass: mbm_put_utrunc1\n");
+
+out:
+	smb_mbc_free(mbc);
+}
+
+static void
+mbm_put_utrunc2()
+{
+	uint16_t wire[] = { 'o', 'n', 'e', 't', 0 };
+	mbuf_chain_t *mbc;
+	int rc;
+
+	mbc = smb_mbc_alloc(8);
+
+	/* Encode with wire length < strlen */
+	rc = smb_mbc_encodef(mbc, "U", "onetwo");
+	if (rc != 1) {
+		printf("Fail: mbm_put_utrunc2 encode rc=%d\n", rc);
+		goto out;
+	}
+	/* Trunc should put exactly 8 */
+	if (mbc->chain->m_len != 8) {
+		printf("Fail: mbm_put_utrunc2 len=%d\n",
+		    mbc->chain->m_len);
+		return;
+	}
+
+	if (memcmp(mbc->chain->m_data, wire, 10)) {
+		printf("Fail: mbm_put_utrunc2 cmp:\n");
 		hexdump((uchar_t *)mbc->chain->m_data, 8);
 		return;
 	}
 
-	printf("Pass: mbm_put_utrunc\n");
+	printf("Pass: mbm_put_utrunc2\n");
 
 out:
 	smb_mbc_free(mbc);
@@ -657,14 +725,16 @@ test_mbmarshal()
 	mbm_put_a0();
 	mbm_put_a1();
 	mbm_put_apad();
-	mbm_put_atrunc();
+	mbm_put_atrunc1();
+	mbm_put_atrunc2();
 
 	mbm_put_u0();
 	mbm_put_u1();
 	mbm_put_u3();
 	mbm_put_u4();
 	mbm_put_upad();
-	mbm_put_utrunc();
+	mbm_put_utrunc1();
+	mbm_put_utrunc2();
 
 	mbm_get_a0();
 	mbm_get_a1();
diff --git a/usr/src/cmd/smbsrv/test-msgbuf/test_msgbuf.c b/usr/src/cmd/smbsrv/test-msgbuf/test_msgbuf.c
index b58bd54b83..24bd62e8f1 100644
--- a/usr/src/cmd/smbsrv/test-msgbuf/test_msgbuf.c
+++ b/usr/src/cmd/smbsrv/test-msgbuf/test_msgbuf.c
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -127,7 +127,7 @@ out:
 }
 
 static void
-msg_put_atrunc()
+msg_put_atrunc1()
 {
 	uint8_t wire[] = { 'o', 'n', 'e', 't', };
 	uint8_t temp[32];
@@ -141,17 +141,49 @@ msg_put_atrunc()
 	rc = smb_msgbuf_encode(&mb, "4s", "onetwo");
 	/* Trunc should put exactly 4 */
 	if (rc != 4) {
-		printf("Fail: msg_put_atrunc encode\n");
+		printf("Fail: msg_put_atrunc1 encode\n");
 		goto out;
 	}
 
 	if (memcmp(temp, wire, 4)) {
-		printf("Fail: msg_put_atrunc cmp:\n");
+		printf("Fail: msg_put_atrunc1 cmp:\n");
 		hexdump((uchar_t *)temp, 4);
 		return;
 	}
 
-	printf("Pass: msg_put_atrunc\n");
+	printf("Pass: msg_put_atrunc1\n");
+
+out:
+	smb_msgbuf_term(&mb);
+}
+
+static void
+msg_put_atrunc2()
+{
+	uint8_t wire[] = { 'o', 'n', 'e', 't', 0};
+	uint8_t temp[32];
+	smb_msgbuf_t mb;
+	int mbflags = 0;
+	int rc;
+
+	(void) memset(temp, 0, sizeof (temp));
+	smb_msgbuf_init(&mb, temp, 4, mbflags);
+
+	/* Encode with wire length < strlen */
+	rc = smb_msgbuf_encode(&mb, "s", "onetwo");
+	/* Trunc should return "overflow" */
+	if (rc != -1) {
+		printf("Fail: msg_put_atrunc2 encode rc=%d\n", rc);
+		goto out;
+	}
+
+	if (memcmp(temp, wire, 5)) {
+		printf("Fail: msg_put_atrunc2 cmp:\n");
+		hexdump((uchar_t *)temp, 5);
+		return;
+	}
+
+	printf("Pass: msg_put_atrunc2\n");
 
 out:
 	smb_msgbuf_term(&mb);
@@ -308,7 +340,7 @@ out:
 }
 
 static void
-msg_put_utrunc()
+msg_put_utrunc1()
 {
 	uint16_t wire[] = { 'o', 'n', 'e', 't' };
 	uint8_t temp[32];
@@ -322,17 +354,49 @@ msg_put_utrunc()
 	rc = smb_msgbuf_encode(&mb, "8U", "onetwo");
 	/* Trunc should put exactly 8 */
 	if (rc != 8) {
-		printf("Fail: msg_put_utrunc encode\n");
+		printf("Fail: msg_put_utrunc1 encode\n");
 		goto out;
 	}
 
 	if (memcmp(temp, wire, 8)) {
-		printf("Fail: msg_put_utrunc cmp:\n");
+		printf("Fail: msg_put_utrunc1 cmp:\n");
 		hexdump((uchar_t *)temp, 8);
 		return;
 	}
 
-	printf("Pass: msg_put_utrunc\n");
+	printf("Pass: msg_put_utrunc1\n");
+
+out:
+	smb_msgbuf_term(&mb);
+}
+
+static void
+msg_put_utrunc2()
+{
+	uint16_t wire[] = { 'o', 'n', 'e', 't', 0 };
+	uint8_t temp[32];
+	smb_msgbuf_t mb;
+	int mbflags = 0;
+	int rc;
+
+	(void) memset(temp, 0, sizeof (temp));
+	smb_msgbuf_init(&mb, temp, 8, mbflags);
+
+	/* Encode with wire length < strlen */
+	rc = smb_msgbuf_encode(&mb, "U", "onetwo");
+	/* Trunc should return "overflow" */
+	if (rc != -1) {
+		printf("Fail: msg_put_utrunc2 encode rc=%d\n", rc);
+		goto out;
+	}
+
+	if (memcmp(temp, wire, 10)) {
+		printf("Fail: msg_put_utrunc2 cmp:\n");
+		hexdump((uchar_t *)temp, 10);
+		return;
+	}
+
+	printf("Pass: msg_put_utrunc2\n");
 
 out:
 	smb_msgbuf_term(&mb);
@@ -617,14 +681,16 @@ test_msgbuf()
 	msg_put_a0();
 	msg_put_a1();
 	msg_put_apad();
-	msg_put_atrunc();
+	msg_put_atrunc1();
+	msg_put_atrunc2();
 
 	msg_put_u0();
 	msg_put_u1();
 	msg_put_u3();
 	msg_put_u4();
 	msg_put_upad();
-	msg_put_utrunc();
+	msg_put_utrunc1();
+	msg_put_utrunc2();
 
 	msg_get_a0();
 	msg_get_a1();
diff --git a/usr/src/cmd/troff/Makefile b/usr/src/cmd/troff/Makefile
index ffff76cd96..20dcb6abba 100644
--- a/usr/src/cmd/troff/Makefile
+++ b/usr/src/cmd/troff/Makefile
@@ -20,12 +20,8 @@
 # CDDL HEADER END
 #
 #
-# ident	"%Z%%M%	%I%	%E% SMI"
-#
 # Copyright (c) 1989 by Sun Microsystems, Inc.
 #
-# cmd/troff/Makefile
-#
 
 include ../Makefile.cmd
 
@@ -47,11 +43,11 @@ POFILES= $(SUBDIRS:%=%/%.po)
 POFILE= troff.po
 
 
-.KEEP_STATE :
+.KEEP_STATE:
 
-all :		$(SUBDIRS)
+all:		$(SUBDIRS)
 
-install clean lint strip :	$(SUBDIRS)
+install clean lint strip:	$(SUBDIRS)
 
 clobber: $(SUBDIRS) local_clobber
 
@@ -60,14 +56,16 @@ local_clobber:
 
 $(POFILE):      $(SUBDIRS) $(POFILES2)
 	cat     $(POFILES) $(POFILES2)  >       $@
-	 
-_msg:   $(SUBDIRS)
+
+_msg:   $(MSGDOMAIN) $(SUBDIRS)
 	  $(RM)	$(POFILE)
 	  cat    $(POFILES)      > $(POFILE)
 	  $(RM) $(MSGDOMAIN)/$(POFILE)
 	  cp $(POFILE) $(MSGDOMAIN)
 
-$(SUBDIRS) :	FRC
-		@cd $@; pwd; $(MAKE) $(TARGET)
+$(SUBDIRS):	FRC
+	@cd $@; pwd; $(MAKE) $(TARGET)
 
 FRC:
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/common/smbsrv/smb_msgbuf.c b/usr/src/common/smbsrv/smb_msgbuf.c
index b11cd39a50..5a58a80f37 100644
--- a/usr/src/common/smbsrv/smb_msgbuf.c
+++ b/usr/src/common/smbsrv/smb_msgbuf.c
@@ -22,7 +22,7 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  *
- * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -733,8 +733,6 @@ msgbuf_put_oem_string(smb_msgbuf_t *mb, char *mbs, int repc)
 		if ((mb->flags & SMB_MSGBUF_NOTERM) == 0)
 			repc += sizeof (char);
 	}
-	if (smb_msgbuf_has_space(mb, repc) == 0)
-		return (SMB_MSGBUF_OVERFLOW);
 
 	/*
 	 * Convert into a temporary buffer
@@ -756,6 +754,8 @@ msgbuf_put_oem_string(smb_msgbuf_t *mb, char *mbs, int repc)
 	 */
 	s = oembuf;
 	while (repc > 0) {
+		if (smb_msgbuf_has_space(mb, 1) == 0)
+			return (SMB_MSGBUF_OVERFLOW);
 		*mb->scan++ = *s;
 		if (*s != '\0')
 			s++;
@@ -777,6 +777,7 @@ msgbuf_put_unicode_string(smb_msgbuf_t *mb, char *mbs, int repc)
 {
 	smb_wchar_t	*wcsbuf = NULL;
 	smb_wchar_t	*wp;
+	smb_wchar_t	wchar;
 	size_t		wcslen, wcsbytes;
 	size_t		rlen;
 
@@ -800,8 +801,6 @@ msgbuf_put_unicode_string(smb_msgbuf_t *mb, char *mbs, int repc)
 		if ((mb->flags & SMB_MSGBUF_NOTERM) == 0)
 			repc += sizeof (smb_wchar_t);
 	}
-	if (smb_msgbuf_has_space(mb, repc) == 0)
-		return (SMB_MSGBUF_OVERFLOW);
 
 	/*
 	 * Convert into a temporary buffer
@@ -824,16 +823,21 @@ msgbuf_put_unicode_string(smb_msgbuf_t *mb, char *mbs, int repc)
 	 * little-endian order while copying.
 	 */
 	wp = wcsbuf;
-	while (repc > 1) {
-		smb_wchar_t wchar = LE_IN16(wp);
+	while (repc >= sizeof (smb_wchar_t)) {
+		if (smb_msgbuf_has_space(mb, sizeof (smb_wchar_t)) == 0)
+			return (SMB_MSGBUF_OVERFLOW);
+		wchar = LE_IN16(wp);
 		LE_OUT16(mb->scan, wchar);
 		mb->scan += 2;
 		if (wchar != 0)
 			wp++;
 		repc -= sizeof (smb_wchar_t);
 	}
-	if (repc > 0)
+	if (repc > 0) {
+		if (smb_msgbuf_has_space(mb, 1) == 0)
+			return (SMB_MSGBUF_OVERFLOW);
 		*mb->scan++ = '\0';
+	}
 
 	return (0);
 }
diff --git a/usr/src/contrib/ast/src/cmd/ksh93/sh/main.c b/usr/src/contrib/ast/src/cmd/ksh93/sh/main.c
index e5fdc550b7..e334072821 100644
--- a/usr/src/contrib/ast/src/cmd/ksh93/sh/main.c
+++ b/usr/src/contrib/ast/src/cmd/ksh93/sh/main.c
@@ -580,13 +580,6 @@ static void	exfile(register Shell_t *shp, register Sfio_t *iop,register int fno)
 		if(t)
 		{
 			execflags = sh_state(SH_ERREXIT)|sh_state(SH_INTERACTIVE);
-			/* The last command may not have to fork */
-			if(!sh_isstate(SH_PROFILE) && sh_isoption(SH_CFLAG) &&
-				(fno<0 || !(shp->fdstatus[fno]&(IOTTY|IONOSEEK)))
-				&& !sfreserve(iop,0,0))
-			{
-					execflags |= sh_state(SH_NOFORK);
-			}
 			shp->st.execbrk = 0;
 			sh_exec(t,execflags);
 			if(shp->forked)
diff --git a/usr/src/contrib/ast/src/cmd/ksh93/tests/io.sh b/usr/src/contrib/ast/src/cmd/ksh93/tests/io.sh
index c4a5fdf6ac..819ce7ba86 100755
--- a/usr/src/contrib/ast/src/cmd/ksh93/tests/io.sh
+++ b/usr/src/contrib/ast/src/cmd/ksh93/tests/io.sh
@@ -496,4 +496,18 @@ done	{n}< /dev/null
 n=$( exec {n}< /dev/null; print -r -- $n)
 [[ -r /dev/fd/$n ]] && err_exit "file descriptor n=$n left open after subshell"
 
+# ==========
+# https://github.com/att/ast/issues/9
+tf=`mktemp`
+echo foo bar > $tf
+$SHELL -c 'echo xxx 1<>; '$tf
+actual=$(cat $tf)
+expect="xxx"
+[[ "$actual" = "$expect" ]] || err_exit "<>; does not truncate files - $expect - $actual"
+rm -f $tf
+
+cp /dev/null $tf
+$SHELL -c '{ echo "Foo"; echo "bar"; uname; } >; '$tf
+[[ -s "$tf" ]] || err_exit ">; does not work with -c"
+rm -f $tf
 exit $((Errors<125?Errors:125))
diff --git a/usr/src/lib/cfgadm_plugins/scsi/Makefile b/usr/src/lib/cfgadm_plugins/scsi/Makefile
index b4abc1bf76..d614a17db9 100644
--- a/usr/src/lib/cfgadm_plugins/scsi/Makefile
+++ b/usr/src/lib/cfgadm_plugins/scsi/Makefile
@@ -71,3 +71,5 @@ $(POFILES):
 	$(RM) messages.po
 
 FRC:
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/lib/libcurses/Makefile b/usr/src/lib/libcurses/Makefile
index 594a2c7ba7..df434327f4 100644
--- a/usr/src/lib/libcurses/Makefile
+++ b/usr/src/lib/libcurses/Makefile
@@ -134,3 +134,4 @@ generic.po:
 FRC:
 
 include ../Makefile.targ
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/lib/libmlrpc/common/ndr_marshal.c b/usr/src/lib/libmlrpc/common/ndr_marshal.c
index 33345aa3dd..9f3c383b96 100644
--- a/usr/src/lib/libmlrpc/common/ndr_marshal.c
+++ b/usr/src/lib/libmlrpc/common/ndr_marshal.c
@@ -20,12 +20,13 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2020 Tintri by DDN, Inc. All rights reserved.
+ * Copyright 2021 Tintri by DDN, Inc. All rights reserved.
  */
 
 #include <assert.h>
 #include <strings.h>
 #include <sys/param.h>
+#include <sys/debug.h>
 
 #include <libmlrpc.h>
 
@@ -419,6 +420,8 @@ ndr_decode_pac_hdr(ndr_stream_t *nds, ndr_pac_hdr_t *hdr)
 	return (NDR_DRC_PTYPE_RPCHDR(rc));
 }
 
+CTASSERT(sizeof (ndr_common_header_t) >= NDR_CMN_HDR_SIZE);
+
 /*
  * Decode an RPC fragment header.  Use ndr_decode_pdu_hdr() to process
  * the first fragment header then this function to process additional
@@ -432,7 +435,7 @@ ndr_decode_frag_hdr(ndr_stream_t *nds, ndr_common_header_t *hdr)
 	int byte_order;
 
 	pdu = (uint8_t *)nds->pdu_base_offset + nds->pdu_scan_offset;
-	bcopy(pdu, hdr, NDR_RSP_HDR_SIZE);
+	bcopy(pdu, hdr, NDR_CMN_HDR_SIZE);
 
 	/*
 	 * Swap non-byte fields if the PDU byte-order
diff --git a/usr/src/lib/libmlrpc/common/rpcpdu.ndl b/usr/src/lib/libmlrpc/common/rpcpdu.ndl
index fae76738da..f0bd9578e4 100644
--- a/usr/src/lib/libmlrpc/common/rpcpdu.ndl
+++ b/usr/src/lib/libmlrpc/common/rpcpdu.ndl
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2020 Tintri by DDN, Inc. All rights reserved.
+ * Copyright 2021 Tintri by DDN, Inc. All rights reserved.
  */
 
 #ifndef _RPCPDU_NDL_
@@ -557,9 +557,11 @@ struct ndr_request_hdr_with_object {
 
 /*
  * Convenient for response header sizing and multi-fragment responses.
- * We know the header is going to be 24 bytes.
+ * We know the header is going to be 24 bytes, and the 'common' part
+ * is 16 bytes.
  */
-#define NDR_RSP_HDR_SIZE			24
+#define	NDR_CMN_HDR_SIZE			16
+#define	NDR_RSP_HDR_SIZE			24
 
 
 /*
diff --git a/usr/src/lib/libslp/Makefile b/usr/src/lib/libslp/Makefile
index 2d7e391c32..8bc2c392a7 100644
--- a/usr/src/lib/libslp/Makefile
+++ b/usr/src/lib/libslp/Makefile
@@ -75,3 +75,5 @@ $(SUBDIRS):	FRC
 	@cd $@; pwd; $(MAKE) $(TARGET)
 
 FRC:
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/lib/libsmedia/plugins/Makefile.plugin b/usr/src/lib/libsmedia/plugins/Makefile.plugin
index 331d8bfc9e..6f3ac8ab63 100644
--- a/usr/src/lib/libsmedia/plugins/Makefile.plugin
+++ b/usr/src/lib/libsmedia/plugins/Makefile.plugin
@@ -62,3 +62,5 @@ $(POFILE) : $(POFILE_SRCS)
 	$(SED) -e '/^domain/d' messages.po > $@
 	$(RM) messages.po
 
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/lib/libsmedia/plugins/blkdev/Makefile b/usr/src/lib/libsmedia/plugins/blkdev/Makefile
index 9ccef361bf..6ac0f363f5 100644
--- a/usr/src/lib/libsmedia/plugins/blkdev/Makefile
+++ b/usr/src/lib/libsmedia/plugins/blkdev/Makefile
@@ -21,9 +21,9 @@
 #
 # Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 #
-#
-# lib/libsmedia/plugins/bd/Makefile
 
 include		../../../Makefile.lib
 include		Makefile.targ
 include		../Makefile.plugin
+
+include $(SRC)/Makefile.msg.targ
diff --git a/usr/src/man/man9f/Makefile b/usr/src/man/man9f/Makefile
index a61f028374..50e105c718 100644
--- a/usr/src/man/man9f/Makefile
+++ b/usr/src/man/man9f/Makefile
@@ -1028,6 +1028,7 @@ MANLINKS=	AVL_NEXT.9f					\
 		mac_fini_ops.9f					\
 		mac_free.9f					\
 		mac_hcksum_set.9f				\
+		mac_prop_info_set_default_fec.9f		\
 		mac_prop_info_set_default_link_flowctrl.9f	\
 		mac_prop_info_set_default_str.9f		\
 		mac_prop_info_set_default_uint32.9f		\
@@ -1912,6 +1913,8 @@ list_tail.9f				:= LINKSRC = list_create.9f
 mac_free.9f				:= LINKSRC = mac_alloc.9f
 mac_hcksum_set.9f			:= LINKSRC = mac_hcksum_get.9f
 mac_fini_ops.9f				:= LINKSRC = mac_init_ops.9f
+
+mac_prop_info_set_default_fec.9f	:= LINKSRC = mac_prop_info.9f
 mac_prop_info_set_default_link_flowctrl.9f	:= LINKSRC = mac_prop_info.9f
 mac_prop_info_set_default_str.9f	:= LINKSRC = mac_prop_info.9f
 mac_prop_info_set_default_uint8.9f	:= LINKSRC = mac_prop_info.9f
diff --git a/usr/src/man/man9f/mac_prop_info.9f b/usr/src/man/man9f/mac_prop_info.9f
index 0582665ce3..b24ee63694 100644
--- a/usr/src/man/man9f/mac_prop_info.9f
+++ b/usr/src/man/man9f/mac_prop_info.9f
@@ -10,12 +10,14 @@
 .\"
 .\"
 .\" Copyright 2016 Joyent, Inc.
+.\" Copyright 2021 Oxide Computer Company
 .\"
-.Dd May 31, 2016
+.Dd February 25, 2021
 .Dt MAC_PROP_INFO 9F
 .Os
 .Sh NAME
 .Nm mac_prop_info ,
+.Nm mac_prop_info_set_default_fec ,
 .Nm mac_prop_info_set_default_link_flowctrl ,
 .Nm mac_prop_info_set_default_str ,
 .Nm mac_prop_info_set_default_uint8 ,
@@ -27,6 +29,11 @@
 .Sh SYNOPSIS
 .In sys/mac_provider.h
 .Ft void
+.Fo mac_prop_info_set_default_fec
+.Fa "mac_prop_info_handle_t hdl"
+.Fa "link_fec_t fec"
+.Fc
+.Ft void
 .Fo mac_prop_info_set_default_link_flowctrl
 .Fa "mac_prop_info_handle_t hdl"
 .Fa "link_flowctrl_t fctl"
@@ -66,9 +73,9 @@
 illumos DDI specific
 .Sh PARAMETERS
 .Bl -tag -width Ds
-.It Ft hdl
+.It Fa hdl
 A pointer to the MAC property information handle.
-.It Ft fctl
+.It Fa fctl
 A valid link flow control entry.
 Valid values are documented in the
 .Sy MAC_PROP_FLOWCTRL
@@ -76,16 +83,26 @@ property description in the
 .Sx PROPERTIES
 section of
 .Xr mac 9E .
-.It Ft str
+.It Fa fec
+A valid link forward error correction
+.Pq fec
+scheme.
+Valid values are documented in the
+.Sy MAC_PROP_EN_FEC_CAP
+property description in the
+.Sx PROPERTIES
+section of
+.Xr mac 9E .
+.It Fa str
 A null-terminated ASCII character string that describes that contains a
 value of a property.
-.It Ft u8
+.It Fa u8
 An 8-bit unsigned value.
-.It Ft u16
+.It Fa u16
 An 16-bit unsigned value.
-.It Ft u32
+.It Fa u32
 An 32-bit unsigned value.
-.It Ft perm
+.It Fa perm
 An 8-bit unsigned value which is the bitwise inclusive OR of the
 following values:
 .Bl -tag -width Ds
@@ -105,10 +122,10 @@ This is equivalent to specifying both
 and
 .Sy MAC_PROP_PERM_WRITE .
 .El
-.It Ft low
+.It Fa low
 A 32-bit unsigned value that represents the lowest possible value of an
 integer property, generally inclusive.
-.It Ft high
+.It Fa high
 A 32-bit unsigned value that represents the highest possible value an
 integer property, generally inclusive.
 .El
@@ -156,6 +173,7 @@ function is called, a new property range is added, allowing for multiple
 disjoint ranges to be specified for a given property.
 .Pp
 The remaining functions,
+.Fn mac_prop_info_set_default_fec ,
 .Fn mac_prop_info_set_default_link_flowctrl ,
 .Fn mac_prop_info_set_default_str ,
 .Fn mac_prop_info_set_uint8 ,
@@ -193,6 +211,18 @@ and
 .Fn mac_prop_info_set_default_uint32
 functions set the default value for values whose properties are 8-, 16-,
 and 32-bit unsigned values respectively.
+.Pp
+The
+.Fn mac_prop_info_set_default_fec
+function is used for properties that describe link forward error
+correction values such as
+.Dv MAC_PROP_EN_FEC_CAP
+and
+.Dv MAC_PROP_ADV_FEC_CAP .
+The various values of a
+.Ft link_fec_t
+are documented in
+.Xr mac 9E .
 .Sh CONTEXT
 These functions are generally called on a handle passed into the
 .Xr mc_propinfo 9E
diff --git a/usr/src/pkg/manifests/system-kernel.man9f.inc b/usr/src/pkg/manifests/system-kernel.man9f.inc
index 1eb70a7e0a..867a6361f7 100644
--- a/usr/src/pkg/manifests/system-kernel.man9f.inc
+++ b/usr/src/pkg/manifests/system-kernel.man9f.inc
@@ -1038,6 +1038,8 @@ link path=usr/share/man/man9f/list_tail.9f target=list_create.9f
 link path=usr/share/man/man9f/mac_fini_ops.9f target=mac_init_ops.9f
 link path=usr/share/man/man9f/mac_free.9f target=mac_alloc.9f
 link path=usr/share/man/man9f/mac_hcksum_set.9f target=mac_hcksum_get.9f
+link path=usr/share/man/man9f/mac_prop_info_set_default_fec.9f \
+    target=mac_prop_info.9f
 link path=usr/share/man/man9f/mac_prop_info_set_default_link_flowctrl.9f \
     target=mac_prop_info.9f
 link path=usr/share/man/man9f/mac_prop_info_set_default_str.9f \
diff --git a/usr/src/tools/scripts/wsdiff.py b/usr/src/tools/scripts/wsdiff.py
index 259f2005fb..6ca296d3df 100644
--- a/usr/src/tools/scripts/wsdiff.py
+++ b/usr/src/tools/scripts/wsdiff.py
@@ -303,10 +303,12 @@ def str_prefix_trunc(s, prefix) :
 def fnFormat(fn) :
 	global baseWsRoot, ptchWsRoot
 
-	if len(os.path.commonprefix([fn, baseWsRoot])) == len(baseWsRoot):
+	if (baseWsRoot and
+	    len(os.path.commonprefix([fn, baseWsRoot])) == len(baseWsRoot)):
 		return fn[len(baseWsRoot) + 1:]
 
-	if len(os.path.commonprefix([fn, ptchWsRoot])) == len(ptchWsRoot):
+	if (ptchWsRoot and
+	    len(os.path.commonprefix([fn, ptchWsRoot])) == len(ptchWsRoot)):
 		return fn[len(ptchWsRoot) + 1:]
 
 	# Fall back to looking for the expected root_<arch>[-nd] string
diff --git a/usr/src/uts/common/fs/smbsrv/smb2_fsctl_fs.c b/usr/src/uts/common/fs/smbsrv/smb2_fsctl_fs.c
index 829beda2e4..381fd7663e 100644
--- a/usr/src/uts/common/fs/smbsrv/smb2_fsctl_fs.c
+++ b/usr/src/uts/common/fs/smbsrv/smb2_fsctl_fs.c
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -23,7 +23,16 @@
 #include <smbsrv/smb_fsops.h>
 #include <smb/winioctl.h>
 
-/* ARGSUSED */
+/*
+ * XXX: Should use smb2_fsctl_invalid in place of smb2_fsctl_notsup
+ * but that will require some re-testing.
+ */
+static uint32_t
+smb2_fsctl_invalid(smb_request_t *sr, smb_fsctl_t *fsctl)
+{
+	return (NT_STATUS_INVALID_DEVICE_REQUEST);
+}
+
 static uint32_t
 smb2_fsctl_notsup(smb_request_t *sr, smb_fsctl_t *fsctl)
 {
@@ -52,9 +61,12 @@ smb2_fsctl_get_compression(smb_request_t *sr, smb_fsctl_t *fsctl)
 {
 	_NOTE(ARGUNUSED(sr))
 	uint16_t compress_state = 0;
+	int rc;
 
-	(void) smb_mbc_encodef(fsctl->in_mbc, "w",
+	rc = smb_mbc_encodef(fsctl->in_mbc, "w",
 	    compress_state);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (NT_STATUS_SUCCESS);
 }
@@ -97,6 +109,7 @@ smb2_fsctl_get_resume_key(smb_request_t *sr, smb_fsctl_t *fsctl)
 {
 	smb_ofile_t *of = sr->fid_ofile;
 	smb2fid_t smb2fid;
+	int rc;
 
 	/* Caller makes sure we have of = sr->fid_ofile */
 	/* Don't insist on a plain file (see above). */
@@ -104,10 +117,12 @@ smb2_fsctl_get_resume_key(smb_request_t *sr, smb_fsctl_t *fsctl)
 	smb2fid.persistent = of->f_persistid;
 	smb2fid.temporal = of->f_fid;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    fsctl->out_mbc, "qq16.",
 	    smb2fid.persistent,
 	    smb2fid.temporal);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (NT_STATUS_SUCCESS);
 }
@@ -130,9 +145,11 @@ smb2_fsctl_fs(smb_request_t *sr, smb_fsctl_t *fsctl)
 		break;
 	case FSCTL_SET_REPARSE_POINT:		/* 41 */
 	case FSCTL_GET_REPARSE_POINT:		/* 42 */
-	case FSCTL_CREATE_OR_GET_OBJECT_ID:	/* 48 */
 		func = smb2_fsctl_notsup;
 		break;
+	case FSCTL_CREATE_OR_GET_OBJECT_ID:	/* 48 */
+		func = smb2_fsctl_invalid;
+		break;
 	case FSCTL_SET_SPARSE:			/* 49 */
 		func = smb2_fsctl_set_sparse;
 		break;
diff --git a/usr/src/uts/common/fs/smbsrv/smb2_qinfo_file.c b/usr/src/uts/common/fs/smbsrv/smb2_qinfo_file.c
index ab682b7966..929f02522b 100644
--- a/usr/src/uts/common/fs/smbsrv/smb2_qinfo_file.c
+++ b/usr/src/uts/common/fs/smbsrv/smb2_qinfo_file.c
@@ -10,7 +10,7 @@
  */
 
 /*
- * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -240,10 +240,11 @@ static uint32_t
 smb2_qif_basic(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	smb_attr_t *sa = &qi->qi_attr;
+	int rc;
 
 	ASSERT((sa->sa_mask & SMB_AT_BASIC) == SMB_AT_BASIC);
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "TTTTll",
 	    &sa->sa_crtime,		/* T */
 	    &sa->sa_vattr.va_atime,	/* T */
@@ -251,6 +252,8 @@ smb2_qif_basic(smb_request_t *sr, smb_queryinfo_t *qi)
 	    &sa->sa_vattr.va_ctime,	/* T */
 	    sa->sa_dosattr,		/* l */
 	    0); /* reserved */		/* l */
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -265,10 +268,11 @@ static uint32_t
 smb2_qif_standard(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	smb_attr_t *sa = &qi->qi_attr;
+	int rc;
 
 	ASSERT((sa->sa_mask & SMB_AT_STANDARD) == SMB_AT_STANDARD);
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "qqlbbw",
 	    sa->sa_allocsz,		/* q */
 	    sa->sa_vattr.va_size,	/* q */
@@ -276,6 +280,8 @@ smb2_qif_standard(smb_request_t *sr, smb_queryinfo_t *qi)
 	    qi->qi_delete_on_close,	/* b */
 	    qi->qi_isdir,		/* b */
 	    0); /* reserved */		/* w */
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -290,6 +296,7 @@ smb2_qif_internal(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	smb_attr_t *sa = &qi->qi_attr;
 	u_longlong_t nodeid;
+	int rc;
 
 	ASSERT((sa->sa_mask & SMB_AT_NODEID) == SMB_AT_NODEID);
 	nodeid = sa->sa_vattr.va_nodeid;
@@ -298,9 +305,11 @@ smb2_qif_internal(smb_request_t *sr, smb_queryinfo_t *qi)
 	    (sr->session->s_flags & SMB_SSN_AAPL_CCEXT) != 0)
 		nodeid = 0;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "q",
 	    nodeid);	/* q */
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -315,9 +324,12 @@ static uint32_t
 smb2_qif_ea_size(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	_NOTE(ARGUNUSED(qi))
+	int rc;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "l", 0);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -341,10 +353,13 @@ smb2_qif_access(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	_NOTE(ARGUNUSED(qi))
 	smb_ofile_t *of = sr->fid_ofile;
+	int rc;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "l",
 	    of->f_granted_access);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -358,14 +373,17 @@ smb2_qif_access(smb_request_t *sr, smb_queryinfo_t *qi)
 static uint32_t
 smb2_qif_name(smb_request_t *sr, smb_queryinfo_t *qi)
 {
+	int rc;
 
 	ASSERT(qi->qi_namelen > 0);
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "llU",
 	    0, /* FileIndex	 (l) */
 	    qi->qi_namelen,	/* l */
 	    qi->qi_name);	/* U */
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -379,13 +397,16 @@ smb2_qif_position(smb_request_t *sr, smb_queryinfo_t *qi)
 	_NOTE(ARGUNUSED(qi))
 	smb_ofile_t *of = sr->fid_ofile;
 	uint64_t pos;
+	int rc;
 
 	mutex_enter(&of->f_mutex);
 	pos = of->f_seek_pos;
 	mutex_exit(&of->f_mutex);
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "q", pos);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -399,9 +420,12 @@ static uint32_t
 smb2_qif_mode(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	_NOTE(ARGUNUSED(qi))
+	int rc;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "l", 0);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -413,9 +437,12 @@ static uint32_t
 smb2_qif_alignment(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	_NOTE(ARGUNUSED(qi))
+	int rc;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "l", 0);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -430,6 +457,7 @@ static uint32_t
 smb2_qif_altname(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	smb_ofile_t *of = sr->fid_ofile;
+	int rc;
 
 	ASSERT(qi->qi_namelen > 0);
 	ASSERT(qi->qi_attr.sa_mask & SMB_AT_NODEID);
@@ -442,10 +470,12 @@ smb2_qif_altname(smb_request_t *sr, smb_queryinfo_t *qi)
 	/* fill in qi->qi_shortname */
 	smb_query_shortname(of->f_node, qi);
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "%lU", sr,
 	    smb_wcequiv_strlen(qi->qi_shortname),
 	    qi->qi_shortname);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -481,6 +511,7 @@ smb2_qif_pipe(smb_request_t *sr, smb_queryinfo_t *qi)
 	smb_ofile_t *of = sr->fid_ofile;
 	uint32_t	pipe_mode;
 	uint32_t	nonblock;
+	int		rc;
 
 	switch (of->f_ftype) {
 	case SMB_FTYPE_BYTE_PIPE:
@@ -496,9 +527,11 @@ smb2_qif_pipe(smb_request_t *sr, smb_queryinfo_t *qi)
 	}
 	nonblock = 0;	/* XXX todo: Get this from the pipe handle. */
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "ll",
 	    pipe_mode, nonblock);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -532,13 +565,16 @@ smb2_qif_compr(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	smb_attr_t *sa = &qi->qi_attr;
 	uint16_t CompressionFormat = 0;	/* COMPRESSION_FORMAT_NONE */
+	int rc;
 
 	ASSERT(sa->sa_mask & SMB_AT_SIZE);
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "qw6.",
 	    sa->sa_vattr.va_size,	/* q */
 	    CompressionFormat);		/* w */
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -550,8 +586,9 @@ static uint32_t
 smb2_qif_opens(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	smb_attr_t *sa = &qi->qi_attr;
+	int rc;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "TTTTqqll",
 	    &sa->sa_crtime,		/* T */
 	    &sa->sa_vattr.va_atime,	/* T */
@@ -561,6 +598,8 @@ smb2_qif_opens(smb_request_t *sr, smb_queryinfo_t *qi)
 	    sa->sa_vattr.va_size,	/* q */
 	    sa->sa_dosattr,		/* l */
 	    0); /* reserved */		/* l */
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -578,8 +617,12 @@ static uint32_t
 smb2_qif_tags(smb_request_t *sr, smb_queryinfo_t *qi)
 {
 	_NOTE(ARGUNUSED(qi))
-	(void) smb_mbc_encodef(
+	int rc;
+
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "ll", 0, 0);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
diff --git a/usr/src/uts/common/fs/smbsrv/smb2_qinfo_fs.c b/usr/src/uts/common/fs/smbsrv/smb2_qinfo_fs.c
index 856a59e939..7bf3d1339e 100644
--- a/usr/src/uts/common/fs/smbsrv/smb2_qinfo_fs.c
+++ b/usr/src/uts/common/fs/smbsrv/smb2_qinfo_fs.c
@@ -20,7 +20,7 @@
  */
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -100,6 +100,7 @@ smb2_qfs_volume(smb_request_t *sr)
 	smb_node_t *snode;
 	fsid_t fsid;
 	uint32_t LabelLength;
+	int rc;
 
 	if (!STYPE_ISDSK(tree->t_res_type))
 		return (NT_STATUS_INVALID_PARAMETER);
@@ -112,14 +113,16 @@ smb2_qfs_volume(smb_request_t *sr)
 	/*
 	 * NT has the "supports objects" flag set to 1.
 	 */
-	(void) smb_mbc_encodef(
-	    &sr->raw_data, "qllb.U",
-	    0LL,	/* Volume creation time (q) */
+	rc = smb_mbc_encodef(
+	    &sr->raw_data, "Tllb.U",
+	    &tree->t_create_time,	/*	(T) */
 	    fsid.val[0],	/* serial no.   (l) */
 	    LabelLength,		/*	(l) */
 	    0,		/* Supports objects	(b) */
 	    /* reserved				(.) */
 	    tree->t_volume);		/*	(U) */
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -141,12 +144,14 @@ smb2_qfs_size(smb_request_t *sr)
 	if (rc)
 		return (smb_errno2status(rc));
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "qqll",
 	    fssize.fs_caller_units,
 	    fssize.fs_caller_avail,
 	    fssize.fs_sectors_per_unit,
 	    fssize.fs_bytes_per_sector);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -168,13 +173,15 @@ smb2_qfs_fullsize(smb_request_t *sr)
 	if (rc)
 		return (smb_errno2status(rc));
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "qqqll",
 	    fssize.fs_caller_units,
 	    fssize.fs_caller_avail,
 	    fssize.fs_volume_avail,
 	    fssize.fs_sectors_per_unit,
 	    fssize.fs_bytes_per_sector);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -188,6 +195,7 @@ smb2_qfs_device(smb_request_t *sr)
 	smb_tree_t *tree = sr->tid_tree;
 	uint32_t DeviceType;
 	uint32_t Characteristics;
+	int rc;
 
 	if (!STYPE_ISDSK(tree->t_res_type))
 		return (NT_STATUS_INVALID_PARAMETER);
@@ -195,10 +203,12 @@ smb2_qfs_device(smb_request_t *sr)
 	DeviceType = FILE_DEVICE_DISK;
 	Characteristics = FILE_DEVICE_IS_MOUNTED;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "ll",
 	    DeviceType,
 	    Characteristics);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -213,6 +223,7 @@ smb2_qfs_attr(smb_request_t *sr)
 	char *fsname;
 	uint32_t namelen;
 	uint32_t FsAttr;
+	int rc;
 
 	/* This call is OK on all tree types. */
 	switch (tree->t_res_type & STYPE_MASK) {
@@ -247,12 +258,14 @@ smb2_qfs_attr(smb_request_t *sr)
 	if (tree->t_flags & SMB_TREE_SPARSE)
 		FsAttr |= FILE_SUPPORTS_SPARSE_FILES;
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "lllU",
 	    FsAttr,
 	    MAXNAMELEN-1,
 	    namelen,
 	    fsname);
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -264,6 +277,7 @@ uint32_t
 smb2_qfs_control(smb_request_t *sr)
 {
 	smb_tree_t *tree = sr->tid_tree;
+	int rc;
 
 	if (!STYPE_ISDSK(tree->t_res_type))
 		return (NT_STATUS_INVALID_PARAMETER);
@@ -275,7 +289,7 @@ smb2_qfs_control(smb_request_t *sr)
 		return (NT_STATUS_VOLUME_NOT_UPGRADED);
 	}
 
-	(void) smb_mbc_encodef(
+	rc = smb_mbc_encodef(
 	    &sr->raw_data, "qqqqqll",
 	    0,		/* free space start filtering - MUST be 0 */
 	    0,		/* free space threshold - MUST be 0 */
@@ -284,6 +298,8 @@ smb2_qfs_control(smb_request_t *sr)
 	    SMB_QUOTA_UNLIMITED,	/* default quota limit */
 	    FILE_VC_QUOTA_ENFORCE,	/* fs control flag */
 	    0);				/* pad bytes */
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
@@ -364,7 +380,7 @@ smb2_qfs_sectorsize(smb_request_t *sr)
 	smb_fssize_t		fssize;
 	smb_tree_t *tree = sr->tid_tree;
 	uint32_t lbps, pbps;
-	uint32_t flags;
+	uint32_t flags, unk;
 	int rc;
 
 	if (!STYPE_ISDSK(tree->t_res_type))
@@ -373,24 +389,15 @@ smb2_qfs_sectorsize(smb_request_t *sr)
 	rc = smb_fssize(sr, &fssize);
 	if (rc)
 		return (smb_errno2status(rc));
+
+	// PhysicalBytesPerSector
 	pbps = fssize.fs_bytes_per_sector;
+
+	// LogicalBytesPerSector
 	lbps = fssize.fs_sectors_per_unit * pbps;
 	if (lbps > smb2_max_logical_sector_size)
 		lbps = smb2_max_logical_sector_size;
 
-	// LogicalBytesPerSector
-	(void) smb_mbc_encodef(&sr->raw_data, "l", lbps);
-
-	// PhysicalBytesPerSectorForAtomicity
-	(void) smb_mbc_encodef(&sr->raw_data, "l", pbps);
-
-	// PhysicalBytesPerSectorForPerformance
-	// Using logical size here.
-	(void) smb_mbc_encodef(&sr->raw_data, "l", lbps);
-
-	// FileSystemEffectivePhysicalBytesPerSectorForAtomicity
-	(void) smb_mbc_encodef(&sr->raw_data, "l", pbps);
-
 	// Flags
 	// We include "no seek penalty" because our files are
 	// always ZFS-backed, which can reorder things on disk.
@@ -398,15 +405,24 @@ smb2_qfs_sectorsize(smb_request_t *sr)
 	flags = SSINFO_FLAGS_ALIGNED_DEVICE |
 		SSINFO_FLAGS_PARTITION_ALIGNED_ON_DEVICE |
 		SSINFO_FLAGS_NO_SEEK_PENALTY;
-	(void) smb_mbc_encodef(&sr->raw_data, "l", flags);
 
 	// ByteOffsetForSectorAlignment
 	// ByteOffsetForPartitionAlignment
 	// Just say "unknown" for these two.
-	(void) smb_mbc_encodef(
-	    &sr->raw_data, "l",
-	    SSINFO_OFFSET_UNKNOWN,
-	    SSINFO_OFFSET_UNKNOWN);
+	unk = SSINFO_OFFSET_UNKNOWN;
+
+	rc = smb_mbc_encodef(
+	    &sr->raw_data,
+	    "lllllll",
+	    lbps, // LogicalBytesPerSector
+	    pbps, // PhysicalBytesPerSectorForAtomicity
+	    lbps, // PhysicalBytesPerSectorForPerformance
+	    pbps, // FileSystemEffectivePhysicalBytesPerSectorForAtomicity
+	    flags,
+	    unk, unk);
+
+	if (rc != 0)
+		return (NT_STATUS_BUFFER_OVERFLOW);
 
 	return (0);
 }
diff --git a/usr/src/uts/common/fs/smbsrv/smb_mbuf_marshaling.c b/usr/src/uts/common/fs/smbsrv/smb_mbuf_marshaling.c
index 132820a147..1476850683 100644
--- a/usr/src/uts/common/fs/smbsrv/smb_mbuf_marshaling.c
+++ b/usr/src/uts/common/fs/smbsrv/smb_mbuf_marshaling.c
@@ -22,7 +22,7 @@
  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  *
- * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -800,7 +800,7 @@ smb_mbc_poke(mbuf_chain_t *mbc, int offset, const char *fmt, ...)
  */
 int
 smb_mbc_copy(mbuf_chain_t *dst_mbc, const mbuf_chain_t *src_mbc,
-	int copy_offset, int copy_len)
+    int copy_offset, int copy_len)
 {
 	mbuf_t	*src_m;
 	int offset, len;
@@ -1109,8 +1109,6 @@ mbc_marshal_put_oem_string(mbuf_chain_t *mbc, char *mbs, int repc)
 	 */
 	if (repc <= 0)
 		repc = oemlen + 1;
-	if (mbc_marshal_make_room(mbc, repc))
-		return (DECODE_NO_MORE_DATA);
 
 	/*
 	 * Convert into a temporary buffer
@@ -1133,6 +1131,10 @@ mbc_marshal_put_oem_string(mbuf_chain_t *mbc, char *mbs, int repc)
 	 */
 	s = oembuf;
 	while (repc > 0) {
+		if (mbc_marshal_make_room(mbc, 1)) {
+			rc = DECODE_NO_MORE_DATA;
+			goto out;
+		}
 		mbc_marshal_store_byte(mbc, *s);
 		if (*s != '\0')
 			s++;
@@ -1158,6 +1160,7 @@ mbc_marshal_put_unicode_string(mbuf_chain_t *mbc, char *mbs, int repc)
 {
 	smb_wchar_t	*wcsbuf = NULL;
 	smb_wchar_t	*wp;
+	smb_wchar_t	wchar;
 	size_t		wcslen, wcsbytes;
 	size_t		rlen;
 	int		rc;
@@ -1183,8 +1186,6 @@ mbc_marshal_put_unicode_string(mbuf_chain_t *mbc, char *mbs, int repc)
 	 */
 	if (repc <= 0)
 		repc = wcsbytes + 2;
-	if (mbc_marshal_make_room(mbc, repc))
-		return (DECODE_NO_MORE_DATA);
 
 	/*
 	 * Convert into a temporary buffer
@@ -1208,18 +1209,27 @@ mbc_marshal_put_unicode_string(mbuf_chain_t *mbc, char *mbs, int repc)
 	 * little-endian order while copying.
 	 */
 	wp = wcsbuf;
-	while (repc > 1) {
-		smb_wchar_t wchar = LE_IN16(wp);
+	while (repc >= sizeof (smb_wchar_t)) {
+		if (mbc_marshal_make_room(mbc, sizeof (smb_wchar_t))) {
+			rc = DECODE_NO_MORE_DATA;
+			goto out;
+		}
+		wchar = LE_IN16(wp);
 		mbc_marshal_store_byte(mbc, wchar);
 		mbc_marshal_store_byte(mbc, wchar >> 8);
 		if (wchar != 0)
 			wp++;
 		repc -= sizeof (smb_wchar_t);
 	}
-	if (repc > 0)
+	if (repc > 0) {
+		if (mbc_marshal_make_room(mbc, 1)) {
+			rc = DECODE_NO_MORE_DATA;
+			goto out;
+		}
 		mbc_marshal_store_byte(mbc, 0);
-
+	}
 	rc = 0;
+
 out:
 	if (wcsbuf != NULL)
 		smb_mem_free(wcsbuf);
diff --git a/usr/src/uts/common/fs/smbsrv/smb_tree.c b/usr/src/uts/common/fs/smbsrv/smb_tree.c
index aedacf2123..639747962e 100644
--- a/usr/src/uts/common/fs/smbsrv/smb_tree.c
+++ b/usr/src/uts/common/fs/smbsrv/smb_tree.c
@@ -21,8 +21,8 @@
 
 /*
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2016 by Delphix. All rights reserved.
+ * Copyright 2019 Nexenta by DDN, Inc. All rights reserved.
  */
 
 /*
@@ -188,6 +188,7 @@ static void smb_tree_dealloc(void *);
 static boolean_t smb_tree_is_connected_locked(smb_tree_t *);
 static char *smb_tree_get_sharename(char *);
 static int smb_tree_getattr(const smb_kshare_t *, smb_node_t *, smb_tree_t *);
+static void smb_tree_get_creation(smb_node_t *, smb_tree_t *);
 static void smb_tree_get_volname(vfs_t *, smb_tree_t *);
 static void smb_tree_get_flags(const smb_kshare_t *, vfs_t *, smb_tree_t *);
 static void smb_tree_log(smb_request_t *, const char *, const char *, ...);
@@ -1106,6 +1107,7 @@ smb_tree_getattr(const smb_kshare_t *si, smb_node_t *node, smb_tree_t *tree)
 	if (getvfs(&vfsp->vfs_fsid) != vfsp)
 		return (ESTALE);
 
+	smb_tree_get_creation(node, tree);
 	smb_tree_get_volname(vfsp, tree);
 	smb_tree_get_flags(si, vfsp, tree);
 
@@ -1127,6 +1129,23 @@ smb_tree_getattr(const smb_kshare_t *si, smb_node_t *node, smb_tree_t *tree)
 }
 
 /*
+ * File volume creation time
+ */
+static void
+smb_tree_get_creation(smb_node_t *node, smb_tree_t *tree)
+{
+	smb_attr_t	attr;
+	cred_t		*kcr = zone_kcred();
+
+	bzero(&attr, sizeof (attr));
+	attr.sa_mask = SMB_AT_CRTIME;
+	(void) smb_node_getattr(NULL, node, kcr, NULL, &attr);
+	/* On failure we'll have time zero, which is OK */
+
+	tree->t_create_time = attr.sa_crtime;
+}
+
+/*
  * Extract the volume name.
  */
 static void
diff --git a/usr/src/uts/common/io/comstar/stmf/lun_map.c b/usr/src/uts/common/io/comstar/stmf/lun_map.c
index 41d5f7e9c8..a672534778 100644
--- a/usr/src/uts/common/io/comstar/stmf/lun_map.c
+++ b/usr/src/uts/common/io/comstar/stmf/lun_map.c
@@ -247,6 +247,7 @@ stmf_session_prepare_report_lun_data(stmf_lun_map_t *sm)
 	stmf_xfer_data_t *xd;
 	uint16_t nluns, ent;
 	uint32_t alloc_size, data_size;
+	uchar_t *buf;
 	int i;
 
 	nluns = sm->lm_nluns;
@@ -272,12 +273,13 @@ stmf_session_prepare_report_lun_data(stmf_lun_map_t *sm)
 
 	ent = 0;
 
+	buf = &(xd->buf[0]);
 	for (i = 0; ((i < sm->lm_nentries) && (ent < nluns)); i++) {
 		if (sm->lm_plus[i] == NULL)
 			continue;
 		/* Fill in the entry */
-		xd->buf[8 + (ent << 3) + 1] = (uchar_t)i;
-		xd->buf[8 + (ent << 3) + 0] = ((uchar_t)(i >> 8));
+		buf[8 + (ent << 3) + 1] = (uchar_t)i;
+		buf[8 + (ent << 3) + 0] = ((uchar_t)(i >> 8));
 		ent++;
 	}
 
diff --git a/usr/src/uts/common/io/ixgbe/ixgbe_tx.c b/usr/src/uts/common/io/ixgbe/ixgbe_tx.c
index b6926fc3b7..eb91f4af09 100644
--- a/usr/src/uts/common/io/ixgbe/ixgbe_tx.c
+++ b/usr/src/uts/common/io/ixgbe/ixgbe_tx.c
@@ -27,19 +27,21 @@
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
  * Copyright 2016 OmniTI Computer Consulting, Inc. All rights reserved.
- * Copyright 2017 Joyent, Inc.
+ * Copyright 2020 Joyent, Inc.
  */
 
 #include "ixgbe_sw.h"
 
-static int ixgbe_tx_copy(ixgbe_tx_ring_t *, tx_control_block_t *, mblk_t *,
-    uint32_t, boolean_t);
-static int ixgbe_tx_bind(ixgbe_tx_ring_t *, tx_control_block_t *, mblk_t *,
-    uint32_t);
+static int ixgbe_tx_copy(ixgbe_tx_ring_t *, tx_control_block_t **,
+    link_list_t *, const void *, size_t);
+static int ixgbe_tx_bind(ixgbe_tx_ring_t *, tx_control_block_t **,
+    link_list_t *, uint8_t *, size_t);
+static uint_t ixgbe_tcb_done(tx_control_block_t *);
 static int ixgbe_tx_fill_ring(ixgbe_tx_ring_t *, link_list_t *,
     ixgbe_tx_context_t *, size_t);
 static void ixgbe_save_desc(tx_control_block_t *, uint64_t, size_t);
-static tx_control_block_t *ixgbe_get_free_list(ixgbe_tx_ring_t *);
+static tx_control_block_t *ixgbe_get_free_list(ixgbe_tx_ring_t *,
+    link_list_t *);
 
 static int ixgbe_get_context(mblk_t *, ixgbe_tx_context_t *);
 static boolean_t ixgbe_check_context(ixgbe_tx_ring_t *,
@@ -65,42 +67,71 @@ static void ixgbe_fill_context(struct ixgbe_adv_tx_context_desc *,
  * they will be processed by using bcopy; otherwise, they will
  * be processed by using DMA binding.
  *
- * To process the mblk, a tx control block is got from the
- * free list. One tx control block contains one tx buffer, which
- * is used to copy mblk fragments' data; and one tx DMA handle,
- * which is used to bind a mblk fragment with DMA resource.
+ * To process the mblk, for each fragment, we pass a pointer to the location
+ * of the current transmit control block (tcb) (initialized to NULL) to either
+ * ixgbe_tx_copy() or ixgbe_tx_bind() (based on the size of the mblk fragment).
+ * ixgbe_tx_copy() and ixgbe_tx_bind() will either continue to use the current
+ * if possible, or close out the current tcb, allocate a new tcb, and update
+ * the passed location (tx_control_block_t **) to reflect the new current tcb.
  *
- * Several small mblk fragments can be copied into one tx control
- * block's buffer, and then the buffer will be transmitted with
- * one tx descriptor.
+ * Since bound mblk fragments require their own tcb, the close, allocate new,
+ * and update steps occur on every call to ixgbe_tx_bind(), but since
+ * consecutive small mblk fragments can be combined into a single tcb, the
+ * close, allocate new, and update steps may not occur on every call to
+ * ixgbe_tx_copy(). If the current tcb is already being used to copy data and
+ * we call ixgbe_tx_copy(), if there is enough room in the current tcb for
+ * the current mblk fragment, we append the data from the mblk fragment. If
+ * we call ixgbe_tx_copy() and the current tcb isn't being used to copy (i.e.
+ * the previous iteration of the loop called ixgbe_tx_bind()), or doesn't
+ * have enough space for the mblk fragment, we close out the current tcb,
+ * grab a new tcb from the free list, and update the current tcb to the
+ * newly obtained tcb.
  *
- * A large fragment only binds with one tx control block's DMA
- * handle, and it can span several tx descriptors for transmitting.
+ * When LSO (large segment offload) is enabled, we first copy the packet
+ * headers (ethernet, IP, and TCP/UDP) into their own descriptor before
+ * processing the remainder of the packet. The remaining bytes of the packet
+ * are then copied or mapped based on the fragment size as described above.
+ *
+ * Through the entire processing of a packet, we keep track of the number of
+ * DMA descriptors being used (either bound or pre-bound buffers used for
+ * copying) by this packet. Each tcb requires at least one DMA descriptor, but
+ * may require more than one. When a tcb is closed by ixgbe_tx_bind() or
+ * ixgbe_tx_copy(), it does so by calling ixgbe_tcb_done() which returns the
+ * number of DMA descriptors that are closed (ready for the HW). Since the
+ * hardware limits the number of descriptors that can be used to transmit a
+ * single packet, if the total number DMA descriptors required to transmit
+ * this packet exceeds this limit, we perform a msgpullup() and try again.
+ * Since our DMA attributes limit the number of DMA cookies allowed to
+ * map a single span of memory to a value (MAX_COOKIE) less than the
+ * maximum number of descriptors allowed for a packet (IXGBE_TX_DESC_LIMIT),
+ * as long as sufficient tcbs are available, we should always be able to
+ * process a packet that's contained in a single mblk_t (no additional
+ * fragments).
+ *
+ * Once all of the tcbs have been setup, ixgbe_tx_fill_ring() is called to
+ * setup the tx ring to transmit the tcbs and then tell the HW to start
+ * transmitting. When transmission is complete, an interrupt is triggered
+ * which calls the appropriate recycle routine to place the tcbs that were
+ * used in transmission back in the free list. We also may also try to
+ * recycle any available tcbs when the size of the tcb free list gets low
+ * or if the watchdog timer triggers.
  *
- * So to transmit a packet (mblk), several tx control blocks can
- * be used. After the processing, those tx control blocks will
- * be put to the work list.
  */
 mblk_t *
-ixgbe_ring_tx(void *arg, mblk_t *mp)
+ixgbe_ring_tx(void *arg, mblk_t *orig_mp)
 {
 	ixgbe_tx_ring_t *tx_ring = (ixgbe_tx_ring_t *)arg;
 	ixgbe_t *ixgbe = tx_ring->ixgbe;
-	tx_type_t current_flag, next_flag;
-	uint32_t current_len, next_len;
+	mblk_t *mp = orig_mp;
+	mblk_t *pull_mp = NULL;
+	tx_control_block_t *tcb;
+	size_t mbsize, offset, len;
 	uint32_t desc_total;
-	size_t mbsize;
+	uint32_t copy_thresh;
 	int desc_num;
-	boolean_t copy_done, eop;
-	mblk_t *current_mp, *next_mp, *nmp, *pull_mp = NULL;
-	tx_control_block_t *tcb;
-	ixgbe_tx_context_t tx_context, *ctx;
+	ixgbe_tx_context_t tx_context, *ctx = NULL;
 	link_list_t pending_list;
-	uint32_t len, hdr_frag_len, hdr_len;
-	uint32_t copy_thresh;
-	mblk_t *hdr_new_mp = NULL;
-	mblk_t *hdr_pre_mp = NULL;
-	mblk_t *hdr_nmp = NULL;
+	boolean_t limit_retry = B_FALSE;
 
 	ASSERT(mp->b_next == NULL);
 
@@ -115,11 +146,7 @@ ixgbe_ring_tx(void *arg, mblk_t *mp)
 
 	copy_thresh = ixgbe->tx_copy_thresh;
 
-	/* Get the mblk size */
-	mbsize = 0;
-	for (nmp = mp; nmp != NULL; nmp = nmp->b_cont) {
-		mbsize += MBLKL(nmp);
-	}
+	mbsize = msgsize(mp);
 
 	if (ixgbe->tx_hcksum_enable) {
 		/*
@@ -145,11 +172,16 @@ ixgbe_ring_tx(void *arg, mblk_t *mp)
 			IXGBE_DEBUGLOG_0(ixgbe, "ixgbe_tx: packet oversize");
 			return (NULL);
 		}
-	} else {
-		ctx = NULL;
 	}
 
 	/*
+	 * If we use too many descriptors (see comments below), we may do
+	 * pull_mp = msgpullup(orig_mp, -1), and jump back to here. As such,
+	 * any time we error return past here, we should check and free
+	 * pull_mp if != NULL.
+	 */
+retry:
+	/*
 	 * Check and recycle tx descriptors.
 	 * The recycle threshold here should be selected carefully
 	 */
@@ -165,7 +197,9 @@ ixgbe_ring_tx(void *arg, mblk_t *mp)
 	if (tx_ring->tbd_free < ixgbe->tx_overload_thresh) {
 		tx_ring->reschedule = B_TRUE;
 		tx_ring->stat_overload++;
-		return (mp);
+		if (pull_mp != NULL)
+			freemsg(pull_mp);
+		return (orig_mp);
 	}
 
 	/*
@@ -175,313 +209,149 @@ ixgbe_ring_tx(void *arg, mblk_t *mp)
 	 * It is used to reduce the lock contention of the tx_lock.
 	 */
 	LINK_LIST_INIT(&pending_list);
+
+	tcb = NULL;
 	desc_num = 0;
 	desc_total = 0;
+	offset = 0;
 
 	/*
-	 * The software should guarantee LSO packet header(MAC+IP+TCP)
-	 * to be within one descriptor. Here we reallocate and refill the
-	 * the header if it's physical memory non-contiguous.
+	 * For LSO, we always copy the packet header (Ethernet + IP + TCP/UDP)
+	 * into a single descriptor separate from the remaining data.
 	 */
 	if ((ctx != NULL) && ctx->lso_flag) {
-		/* find the last fragment of the header */
-		len = MBLKL(mp);
-		ASSERT(len > 0);
-		hdr_nmp = mp;
+		size_t hdr_len;
+
 		hdr_len = ctx->ip_hdr_len + ctx->mac_hdr_len + ctx->l4_hdr_len;
-		while (len < hdr_len) {
-			hdr_pre_mp = hdr_nmp;
-			hdr_nmp = hdr_nmp->b_cont;
-			len += MBLKL(hdr_nmp);
-		}
-		/*
-		 * If the header and the payload are in different mblks,
-		 * we simply force the header to be copied into pre-allocated
-		 * page-aligned buffer.
-		 */
-		if (len == hdr_len)
-			goto adjust_threshold;
 
-		hdr_frag_len = hdr_len - (len - MBLKL(hdr_nmp));
 		/*
-		 * There are two cases we need to reallocate a mblk for the
-		 * last header fragment:
-		 * 1. the header is in multiple mblks and the last fragment
-		 * share the same mblk with the payload
-		 * 2. the header is in a single mblk shared with the payload
-		 * and the header is physical memory non-contiguous
+		 * copy the first hdr_len bytes of mp (i.e. the Ethernet, IP,
+		 * and TCP/UDP headers) into tcb.
 		 */
-		if ((hdr_nmp != mp) ||
-		    (P2NPHASE((uintptr_t)hdr_nmp->b_rptr, ixgbe->sys_page_size)
-		    < hdr_len)) {
-			tx_ring->stat_lso_header_fail++;
+		for (len = hdr_len; mp != NULL && len > 0; mp = mp->b_cont) {
+			size_t mlen = MBLKL(mp);
+			size_t amt = MIN(mlen, len);
+			int ret;
+
+			ret = ixgbe_tx_copy(tx_ring, &tcb, &pending_list,
+			    mp->b_rptr, amt);
+			/*
+			 * Since we're trying to copy all of the headers into
+			 * a single buffer in a single tcb, if ixgbe_tx_copy()
+			 * returns anything but 0, it means either no tcbs
+			 * are available (< 0), or while copying, we spilled
+			 * over and couldn't fit all the headers into a
+			 * single tcb.
+			 */
+			if (ret != 0) {
+				if (ret > 0)
+					tx_ring->stat_lso_header_fail++;
+				goto tx_failure;
+			}
+
+			len -= amt;
+
 			/*
-			 * reallocate the mblk for the last header fragment,
-			 * expect to bcopy into pre-allocated page-aligned
-			 * buffer
+			 * If we copy less than the full amount of this
+			 * mblk_t, we have some amount to copy below.
 			 */
-			hdr_new_mp = allocb(hdr_frag_len, 0);
-			if (!hdr_new_mp)
-				return (mp);
-			bcopy(hdr_nmp->b_rptr, hdr_new_mp->b_rptr,
-			    hdr_frag_len);
-			/* link the new header fragment with the other parts */
-			hdr_new_mp->b_wptr = hdr_new_mp->b_rptr + hdr_frag_len;
-			hdr_new_mp->b_cont = hdr_nmp;
-			if (hdr_pre_mp)
-				hdr_pre_mp->b_cont = hdr_new_mp;
-			else
-				mp = hdr_new_mp;
-			hdr_nmp->b_rptr += hdr_frag_len;
+			if (amt < mlen) {
+				offset = amt;
+				break;
+			}
 		}
-adjust_threshold:
+
+		ASSERT0(len);
+
 		/*
-		 * adjust the bcopy threshhold to guarantee
-		 * the header to use bcopy way
+		 * Finish off the header tcb, and start anew for the
+		 * rest of the packet.
 		 */
-		if (copy_thresh < hdr_len)
-			copy_thresh = hdr_len;
+		desc_total += ixgbe_tcb_done(tcb);
+		tcb = NULL;
 	}
 
-	current_mp = mp;
-	current_len = MBLKL(current_mp);
-	/*
-	 * Decide which method to use for the first fragment
-	 */
-	current_flag = (current_len <= copy_thresh) ?
-	    USE_COPY : USE_DMA;
 	/*
-	 * If the mblk includes several contiguous small fragments,
-	 * they may be copied into one buffer. This flag is used to
-	 * indicate whether there are pending fragments that need to
-	 * be copied to the current tx buffer.
+	 * Process each remaining segment in the packet -- either binding
+	 * the dblk_t or copying the contents of the dblk_t to an already
+	 * bound buffer. When we copy, we will accumulate consecutive small
+	 * (less than copy_thresh bytes) segments into a single tcb buffer
+	 * until no more can fit (or we encounter a segment larger than
+	 * copy_thresh and bind the dblk_t).
 	 *
-	 * If this flag is B_TRUE, it indicates that a new tx control
-	 * block is needed to process the next fragment using either
-	 * copy or DMA binding.
+	 * Both ixgbe_tx_bind() and ixgbe_tx_copy() will allocate new
+	 * transmit control blocks (tcb)s as needed (and append them onto
+	 * 'pending_list'). Both functions also replace 'tcb' with the new
+	 * tcb when they allocate a new tcb.
 	 *
-	 * Otherwise, it indicates that the next fragment will be
-	 * copied to the current tx buffer that is maintained by the
-	 * current tx control block. No new tx control block is needed.
+	 * We stop trying to process the packet once the number of descriptors
+	 * used equals IXGBE_TX_DESC_LIMIT. Even if we're copying into the
+	 * IXGBE_TX_DESC_LIMIT-th descriptor, we won't have room to add a
+	 * context descriptor (since we're already at the limit), so there's
+	 * no point in continuing. We'll pull up the mblk_t (see below)
+	 * and try again.
 	 */
-	copy_done = B_TRUE;
-	while (current_mp) {
-		next_mp = current_mp->b_cont;
-		eop = (next_mp == NULL); /* Last fragment of the packet? */
-		next_len = eop ? 0: MBLKL(next_mp);
-
-		/*
-		 * When the current fragment is an empty fragment, if
-		 * the next fragment will still be copied to the current
-		 * tx buffer, we cannot skip this fragment here. Because
-		 * the copy processing is pending for completion. We have
-		 * to process this empty fragment in the tx_copy routine.
-		 *
-		 * If the copy processing is completed or a DMA binding
-		 * processing is just completed, we can just skip this
-		 * empty fragment.
-		 */
-		if ((current_len == 0) && (copy_done)) {
-			current_mp = next_mp;
-			current_len = next_len;
-			current_flag = (current_len <= copy_thresh) ?
-			    USE_COPY : USE_DMA;
-			continue;
-		}
-
-		if (copy_done) {
-			/*
-			 * Get a new tx control block from the free list
-			 */
-			tcb = ixgbe_get_free_list(tx_ring);
-
-			if (tcb == NULL) {
-				tx_ring->stat_fail_no_tcb++;
-				goto tx_failure;
-			}
-
-			/*
-			 * Push the tx control block to the pending list
-			 * to avoid using lock too early
-			 */
-			LIST_PUSH_TAIL(&pending_list, &tcb->link);
-		}
-
-		if (current_flag == USE_COPY) {
-			/*
-			 * Check whether to use bcopy or DMA binding to process
-			 * the next fragment, and if using bcopy, whether we
-			 * need to continue copying the next fragment into the
-			 * current tx buffer.
-			 */
-			ASSERT((tcb->tx_buf.len + current_len) <=
-			    tcb->tx_buf.size);
+	while (mp != NULL && desc_total < IXGBE_TX_DESC_LIMIT) {
+		uint8_t *rptr = mp->b_rptr + offset;
+		int ret;
 
-			if (eop) {
-				/*
-				 * This is the last fragment of the packet, so
-				 * the copy processing will be completed with
-				 * this fragment.
-				 */
-				next_flag = USE_NONE;
-				copy_done = B_TRUE;
-			} else if ((tcb->tx_buf.len + current_len + next_len) >
-			    tcb->tx_buf.size) {
-				/*
-				 * If the next fragment is too large to be
-				 * copied to the current tx buffer, we need
-				 * to complete the current copy processing.
-				 */
-				next_flag = (next_len > copy_thresh) ?
-				    USE_DMA: USE_COPY;
-				copy_done = B_TRUE;
-			} else if (next_len > copy_thresh) {
-				/*
-				 * The next fragment needs to be processed with
-				 * DMA binding. So the copy prcessing will be
-				 * completed with the current fragment.
-				 */
-				next_flag = USE_DMA;
-				copy_done = B_TRUE;
-			} else {
-				/*
-				 * Continue to copy the next fragment to the
-				 * current tx buffer.
-				 */
-				next_flag = USE_COPY;
-				copy_done = B_FALSE;
-			}
+		len = MBLKL(mp) - offset;
+		offset = 0;
 
-			desc_num = ixgbe_tx_copy(tx_ring, tcb, current_mp,
-			    current_len, copy_done);
+		if (len > copy_thresh) {
+			ret = ixgbe_tx_bind(tx_ring, &tcb, &pending_list, rptr,
+			    len);
 		} else {
-			/*
-			 * Check whether to use bcopy or DMA binding to process
-			 * the next fragment.
-			 */
-			next_flag = (next_len > copy_thresh) ?
-			    USE_DMA: USE_COPY;
-			ASSERT(copy_done == B_TRUE);
-
-			desc_num = ixgbe_tx_bind(tx_ring, tcb, current_mp,
-			    current_len);
+			ret = ixgbe_tx_copy(tx_ring, &tcb, &pending_list, rptr,
+			    len);
 		}
 
-		if (desc_num > 0)
-			desc_total += desc_num;
-		else if (desc_num < 0)
+		if (ret < 0)
 			goto tx_failure;
 
-		current_mp = next_mp;
-		current_len = next_len;
-		current_flag = next_flag;
+		desc_total += ret;
+		mp = mp->b_cont;
 	}
 
-	/*
-	 * Attach the mblk to the last tx control block
-	 */
-	ASSERT(tcb);
-	ASSERT(tcb->mp == NULL);
-	tcb->mp = mp;
+	/* Finish off the last tcb */
+	desc_total += ixgbe_tcb_done(tcb);
 
 	/*
 	 * 82598/82599 chipset has a limitation that no more than 32 tx
-	 * descriptors can be transmited out at one time.
+	 * descriptors can be transmited out at one time. As noted above,
+	 * we need to include space for a context descriptor in case its
+	 * necessary, so we do this even if desc_total == IXGBE_TX_DESC_LIMIT
+	 * as well as when it exceeds the limit.
 	 *
-	 * Here is a workaround for it: pull up the mblk then send it
-	 * out with bind way. By doing so, no more than MAX_COOKIE (18)
-	 * descriptors is needed.
+	 * If we exceed this limit, we take the hit, do a msgpullup(), and
+	 * then try again. Our DMA attributes guarantee we should never use
+	 * more than MAX_COOKIE (18) descriptors to map a single mblk_t, so we
+	 * should only need to retry once.
 	 */
-	if (desc_total + 1 > IXGBE_TX_DESC_LIMIT) {
-		tx_ring->stat_break_tbd_limit++;
+	if (desc_total >= IXGBE_TX_DESC_LIMIT) {
+		/* We shouldn't hit this path twice */
+		VERIFY0(limit_retry);
 
-		/*
-		 * Discard the mblk and free the used resources
-		 */
-		tcb = (tx_control_block_t *)LIST_GET_HEAD(&pending_list);
-		while (tcb) {
-			tcb->mp = NULL;
-			ixgbe_free_tcb(tcb);
-			tcb = (tx_control_block_t *)
-			    LIST_GET_NEXT(&pending_list, &tcb->link);
-		}
+		tx_ring->stat_break_tbd_limit++;
 
-		/*
-		 * Return the tx control blocks in the pending list to
-		 * the free list.
-		 */
+		/* Release all the tcbs we used previously */
 		ixgbe_put_free_list(tx_ring, &pending_list);
-
-		/*
-		 * pull up the mblk and send it out with bind way
-		 */
-		if ((pull_mp = msgpullup(mp, -1)) == NULL) {
-			tx_ring->reschedule = B_TRUE;
-
-			/*
-			 * If new mblk has been allocted for the last header
-			 * fragment of a LSO packet, we should restore the
-			 * modified mp.
-			 */
-			if (hdr_new_mp) {
-				hdr_new_mp->b_cont = NULL;
-				freeb(hdr_new_mp);
-				hdr_nmp->b_rptr -= hdr_frag_len;
-				if (hdr_pre_mp)
-					hdr_pre_mp->b_cont = hdr_nmp;
-				else
-					mp = hdr_nmp;
-			}
-			return (mp);
-		}
-
-		LINK_LIST_INIT(&pending_list);
 		desc_total = 0;
+		offset = 0;
 
-		/*
-		 * if the packet is a LSO packet, we simply
-		 * transmit the header in one descriptor using the copy way
-		 */
-		if ((ctx != NULL) && ctx->lso_flag) {
-			hdr_len = ctx->ip_hdr_len + ctx->mac_hdr_len +
-			    ctx->l4_hdr_len;
-
-			tcb = ixgbe_get_free_list(tx_ring);
-			if (tcb == NULL) {
-				tx_ring->stat_fail_no_tcb++;
-				goto tx_failure;
-			}
-			desc_num = ixgbe_tx_copy(tx_ring, tcb, pull_mp,
-			    hdr_len, B_TRUE);
-			LIST_PUSH_TAIL(&pending_list, &tcb->link);
-			desc_total  += desc_num;
-
-			pull_mp->b_rptr += hdr_len;
-		}
-
-		tcb = ixgbe_get_free_list(tx_ring);
-		if (tcb == NULL) {
-			tx_ring->stat_fail_no_tcb++;
-			goto tx_failure;
-		}
-		if ((ctx != NULL) && ctx->lso_flag) {
-			desc_num = ixgbe_tx_bind(tx_ring, tcb, pull_mp,
-			    mbsize - hdr_len);
-		} else {
-			desc_num = ixgbe_tx_bind(tx_ring, tcb, pull_mp,
-			    mbsize);
-		}
-		if (desc_num < 0) {
-			goto tx_failure;
+		pull_mp = msgpullup(orig_mp, -1);
+		if (pull_mp == NULL) {
+			tx_ring->reschedule = B_TRUE;
+			return (orig_mp);
 		}
-		LIST_PUSH_TAIL(&pending_list, &tcb->link);
 
-		desc_total += desc_num;
-		tcb->mp = pull_mp;
+		mp = pull_mp;
+		limit_retry = B_TRUE;
+		goto retry;
 	}
 
 	/*
-	 * Before fill the tx descriptor ring with the data, we need to
+	 * Before filling the tx descriptor ring with the data, we need to
 	 * ensure there are adequate free descriptors for transmit
 	 * (including one context descriptor).
 	 * Do not use up all the tx descriptors.
@@ -506,22 +376,31 @@ adjust_threshold:
 		goto tx_failure;
 	}
 
+	/*
+	 * Attach the mblk_t we've setup to the last control block.
+	 * This is only done once we know there are enough free descriptors
+	 * to transmit so that the cleanup in tx_failure doesn't try to
+	 * call freemsg() on mp (since we will want to return it).
+	 */
+	tcb->mp = (pull_mp != NULL) ? pull_mp : orig_mp;
+
 	desc_num = ixgbe_tx_fill_ring(tx_ring, &pending_list, ctx,
 	    mbsize);
 
 	ASSERT((desc_num == desc_total) || (desc_num == (desc_total + 1)));
 
 	tx_ring->stat_obytes += mbsize;
-	tx_ring->stat_opackets ++;
+	tx_ring->stat_opackets++;
 
 	mutex_exit(&tx_ring->tx_lock);
 
 	/*
-	 * now that the transmission succeeds, need to free the original
-	 * mp if we used the pulling up mblk for transmission.
+	 * Now that tx is done, if we pulled up the original message, we
+	 * can free the original message since it is no longer being
+	 * used.
 	 */
-	if (pull_mp) {
-		freemsg(mp);
+	if (pull_mp != NULL) {
+		freemsg(orig_mp);
 	}
 
 	return (NULL);
@@ -535,31 +414,10 @@ tx_failure:
 	}
 
 	/*
-	 * If new mblk has been allocted for the last header
-	 * fragment of a LSO packet, we should restore the
-	 * modified mp.
-	 */
-	if (hdr_new_mp) {
-		hdr_new_mp->b_cont = NULL;
-		freeb(hdr_new_mp);
-		hdr_nmp->b_rptr -= hdr_frag_len;
-		if (hdr_pre_mp)
-			hdr_pre_mp->b_cont = hdr_nmp;
-		else
-			mp = hdr_nmp;
-	}
-	/*
-	 * Discard the mblk and free the used resources
+	 * tcb->mp should not be set until we know we can transmit (see above),
+	 * so it should always be NULL if we get here.
 	 */
-	tcb = (tx_control_block_t *)LIST_GET_HEAD(&pending_list);
-	while (tcb) {
-		tcb->mp = NULL;
-
-		ixgbe_free_tcb(tcb);
-
-		tcb = (tx_control_block_t *)
-		    LIST_GET_NEXT(&pending_list, &tcb->link);
-	}
+	VERIFY3P(tcb->mp, ==, NULL);
 
 	/*
 	 * Return the tx control blocks in the pending list to the free list.
@@ -569,22 +427,44 @@ tx_failure:
 	/* Transmit failed, do not drop the mblk, rechedule the transmit */
 	tx_ring->reschedule = B_TRUE;
 
-	return (mp);
+	return (orig_mp);
 }
 
 /*
  * ixgbe_tx_copy
  *
- * Copy the mblk fragment to the pre-allocated tx buffer
+ * Copy the mblk fragment to the pre-allocated tx buffer. Return -1 on error,
+ * otherwise return the number of descriptors we've completed in this call.
  */
 static int
-ixgbe_tx_copy(ixgbe_tx_ring_t *tx_ring, tx_control_block_t *tcb, mblk_t *mp,
-    uint32_t len, boolean_t copy_done)
+ixgbe_tx_copy(ixgbe_tx_ring_t *tx_ring, tx_control_block_t **tcbp,
+    link_list_t *pending_list, const void *buf, size_t len)
 {
+	tx_control_block_t *tcb = *tcbp;
 	dma_buffer_t *tx_buf;
-	uint32_t desc_num;
-	_NOTE(ARGUNUSED(tx_ring));
+	uint32_t desc_num = 0;
+
+	/*
+	 * We need a new tcb -- either the current one (tcb) is NULL because
+	 * we just started, tcb is being used for DMA, or tcb isn't large enough
+	 * to hold the contents we need to copy.
+	 */
+	if (tcb == NULL || tcb->tx_type == USE_DMA ||
+	    tcb->tx_buf.len + len > tcb->tx_buf.size) {
+		tx_control_block_t *newtcb;
+
+		newtcb = ixgbe_get_free_list(tx_ring, pending_list);
+		if (newtcb == NULL)
+			return (-1);
 
+		newtcb->tx_type = USE_COPY;
+
+		if (tcb != NULL)
+			desc_num += ixgbe_tcb_done(tcb);
+		*tcbp = tcb = newtcb;
+	}
+
+	ASSERT3S(tcb->tx_type, ==, USE_COPY);
 	tx_buf = &tcb->tx_buf;
 
 	/*
@@ -598,62 +478,43 @@ ixgbe_tx_copy(ixgbe_tx_ring_t *tx_ring, tx_control_block_t *tcb, mblk_t *mp,
 	 * fragment.
 	 */
 	if (len > 0) {
-		bcopy(mp->b_rptr, tx_buf->address + tx_buf->len, len);
+		bcopy(buf, tx_buf->address + tx_buf->len, len);
 
 		tx_buf->len += len;
 		tcb->frag_num++;
 	}
 
-	desc_num = 0;
-
-	/*
-	 * If it is the last fragment copied to the current tx buffer,
-	 * in other words, if there's no remaining fragment or the remaining
-	 * fragment requires a new tx control block to process, we need to
-	 * complete the current copy processing by syncing up the current
-	 * DMA buffer and saving the descriptor data.
-	 */
-	if (copy_done) {
-		/*
-		 * Sync the DMA buffer of the packet data
-		 */
-		DMA_SYNC(tx_buf, DDI_DMA_SYNC_FORDEV);
-
-		tcb->tx_type = USE_COPY;
-
-		/*
-		 * Save the address and length to the private data structure
-		 * of the tx control block, which will be used to fill the
-		 * tx descriptor ring after all the fragments are processed.
-		 */
-		ixgbe_save_desc(tcb, tx_buf->dma_address, tx_buf->len);
-		desc_num++;
-	}
-
 	return (desc_num);
 }
 
 /*
  * ixgbe_tx_bind
  *
- * Bind the mblk fragment with DMA
+ * Bind the mblk fragment with DMA. Returns -1 on error, otherwise it
+ * returns the number of descriptors completed in this call. This count
+ * can include descriptors that weren't filled in by the current call to
+ * ixgbe_tx_bind() but were being used (but not yet completed) in previous
+ * calls to ixgbe_tx_bind() or ixgbe_tx_copy().
  */
 static int
-ixgbe_tx_bind(ixgbe_tx_ring_t *tx_ring, tx_control_block_t *tcb, mblk_t *mp,
-    uint32_t len)
+ixgbe_tx_bind(ixgbe_tx_ring_t *tx_ring, tx_control_block_t **tcbp,
+    link_list_t *pending_list, uint8_t *buf, size_t len)
 {
-	int status, i;
-	ddi_dma_cookie_t dma_cookie;
-	uint_t ncookies;
-	int desc_num;
+	tx_control_block_t *tcb = NULL;
+	uint_t desc_num = 0;
+	int status;
+
+	tcb = ixgbe_get_free_list(tx_ring, pending_list);
+	if (tcb == NULL)
+		return (-1);
 
 	/*
 	 * Use DMA binding to process the mblk fragment
 	 */
 	status = ddi_dma_addr_bind_handle(tcb->tx_dma_handle, NULL,
-	    (caddr_t)mp->b_rptr, len,
+	    (caddr_t)buf, len,
 	    DDI_DMA_WRITE | DDI_DMA_STREAMING, DDI_DMA_DONTWAIT,
-	    0, &dma_cookie, &ncookies);
+	    0, NULL, NULL);
 
 	if (status != DDI_DMA_MAPPED) {
 		tx_ring->stat_fail_dma_bind++;
@@ -662,25 +523,51 @@ ixgbe_tx_bind(ixgbe_tx_ring_t *tx_ring, tx_control_block_t *tcb, mblk_t *mp,
 
 	tcb->frag_num++;
 	tcb->tx_type = USE_DMA;
+
 	/*
-	 * Each fragment can span several cookies. One cookie will have
-	 * one tx descriptor to transmit.
+	 * If there was an old tcb, we're about to replace it. Finish
+	 * setting up the old tcb so we can replace it with the new one.
 	 */
-	desc_num = 0;
-	for (i = ncookies; i > 0; i--) {
-		/*
-		 * Save the address and length to the private data structure
-		 * of the tx control block, which will be used to fill the
-		 * tx descriptor ring after all the fragments are processed.
-		 */
-		ixgbe_save_desc(tcb,
-		    dma_cookie.dmac_laddress,
-		    dma_cookie.dmac_size);
+	if (*tcbp != NULL)
+		desc_num += ixgbe_tcb_done(*tcbp);
 
-		desc_num++;
+	*tcbp = tcb;
+	return (desc_num);
+}
+
+/*
+ * Once we're done populating a tcb (either by binding or copying into
+ * a buffer in the tcb), get it ready for tx and return the number of
+ * descriptors used.
+ */
+static uint_t
+ixgbe_tcb_done(tx_control_block_t *tcb)
+{
+	uint_t desc_num = 0;
+
+	if (tcb->tx_type == USE_DMA) {
+		const ddi_dma_cookie_t *c;
 
-		if (i > 1)
-			ddi_dma_nextcookie(tcb->tx_dma_handle, &dma_cookie);
+		for (c = ddi_dma_cookie_iter(tcb->tx_dma_handle, NULL);
+		    c != NULL;
+		    c = ddi_dma_cookie_iter(tcb->tx_dma_handle, c)) {
+			/*
+			 * Save the address and length to the private data
+			 * structure of the tx control block, which will be
+			 * used to fill the tx descriptor ring after all the
+			 * fragments are processed.
+			 */
+			ixgbe_save_desc(tcb, c->dmac_laddress, c->dmac_size);
+			desc_num++;
+		}
+	} else if (tcb->tx_type == USE_COPY) {
+		dma_buffer_t *tx_buf = &tcb->tx_buf;
+
+		DMA_SYNC(tx_buf, DDI_DMA_SYNC_FORDEV);
+		ixgbe_save_desc(tcb, tx_buf->dma_address, tx_buf->len);
+		desc_num++;
+	} else {
+		panic("invalid tcb type");
 	}
 
 	return (desc_num);
@@ -1364,21 +1251,6 @@ ixgbe_tx_recycle_legacy(ixgbe_tx_ring_t *tx_ring)
 	mutex_exit(&tx_ring->recycle_lock);
 
 	/*
-	 * Free the resources used by the tx control blocks
-	 * in the pending list
-	 */
-	tcb = (tx_control_block_t *)LIST_GET_HEAD(&pending_list);
-	while (tcb != NULL) {
-		/*
-		 * Release the resources occupied by the tx control block
-		 */
-		ixgbe_free_tcb(tcb);
-
-		tcb = (tx_control_block_t *)
-		    LIST_GET_NEXT(&pending_list, &tcb->link);
-	}
-
-	/*
 	 * Add the tx control blocks in the pending list to the free list.
 	 */
 	ixgbe_put_free_list(tx_ring, &pending_list);
@@ -1511,21 +1383,6 @@ ixgbe_tx_recycle_head_wb(ixgbe_tx_ring_t *tx_ring)
 	mutex_exit(&tx_ring->recycle_lock);
 
 	/*
-	 * Free the resources used by the tx control blocks
-	 * in the pending list
-	 */
-	tcb = (tx_control_block_t *)LIST_GET_HEAD(&pending_list);
-	while (tcb) {
-		/*
-		 * Release the resources occupied by the tx control block
-		 */
-		ixgbe_free_tcb(tcb);
-
-		tcb = (tx_control_block_t *)
-		    LIST_GET_NEXT(&pending_list, &tcb->link);
-	}
-
-	/*
 	 * Add the tx control blocks in the pending list to the free list.
 	 */
 	ixgbe_put_free_list(tx_ring, &pending_list);
@@ -1543,6 +1400,9 @@ ixgbe_tx_recycle_head_wb(ixgbe_tx_ring_t *tx_ring)
 void
 ixgbe_free_tcb(tx_control_block_t *tcb)
 {
+	if (tcb == NULL)
+		return;
+
 	switch (tcb->tx_type) {
 	case USE_COPY:
 		/*
@@ -1576,14 +1436,15 @@ ixgbe_free_tcb(tx_control_block_t *tcb)
 }
 
 /*
- * ixgbe_get_free_list - Get a free tx control block from the free list
+ * ixgbe_get_free_list - Get a free tx control block from the free list.
+ * Returns the tx control block and appends it to list.
  *
  * The atomic operation on the number of the available tx control block
  * in the free list is used to keep this routine mutual exclusive with
  * the routine ixgbe_put_check_list.
  */
 static tx_control_block_t *
-ixgbe_get_free_list(ixgbe_tx_ring_t *tx_ring)
+ixgbe_get_free_list(ixgbe_tx_ring_t *tx_ring, link_list_t *list)
 {
 	tx_control_block_t *tcb;
 
@@ -1591,8 +1452,10 @@ ixgbe_get_free_list(ixgbe_tx_ring_t *tx_ring)
 	 * Check and update the number of the free tx control block
 	 * in the free list.
 	 */
-	if (ixgbe_atomic_reserve(&tx_ring->tcb_free, 1) < 0)
+	if (ixgbe_atomic_reserve(&tx_ring->tcb_free, 1) < 0) {
+		tx_ring->stat_fail_no_tcb++;
 		return (NULL);
+	}
 
 	mutex_enter(&tx_ring->tcb_head_lock);
 
@@ -1604,6 +1467,7 @@ ixgbe_get_free_list(ixgbe_tx_ring_t *tx_ring)
 
 	mutex_exit(&tx_ring->tcb_head_lock);
 
+	LIST_PUSH_TAIL(list, &tcb->link);
 	return (tcb);
 }
 
@@ -1623,6 +1487,16 @@ ixgbe_put_free_list(ixgbe_tx_ring_t *tx_ring, link_list_t *pending_list)
 	int tcb_num;
 	tx_control_block_t *tcb;
 
+	for (tcb = (tx_control_block_t *)LIST_GET_HEAD(pending_list);
+	    tcb != NULL;
+	    tcb = (tx_control_block_t *)LIST_GET_NEXT(pending_list, tcb)) {
+		/*
+		 * Despite the name, ixgbe_free_tcb() just releases the
+		 * resources in tcb, but does not free tcb itself.
+		 */
+		ixgbe_free_tcb(tcb);
+	}
+
 	mutex_enter(&tx_ring->tcb_tail_lock);
 
 	index = tx_ring->tcb_tail;
diff --git a/usr/src/uts/common/io/usb/clients/ccid/ccid.c b/usr/src/uts/common/io/usb/clients/ccid/ccid.c
index 61003875d4..9631a99283 100644
--- a/usr/src/uts/common/io/usb/clients/ccid/ccid.c
+++ b/usr/src/uts/common/io/usb/clients/ccid/ccid.c
@@ -3989,7 +3989,7 @@ ccid_ioctl_status(ccid_slot_t *slot, intptr_t arg, int mode)
 
 	if ((slot->cs_flags & CCID_SLOT_F_ACTIVE) != 0) {
 		ucs.ucs_status |= UCCID_STATUS_F_PARAMS_VALID;
-		ucs.ucs_prot = slot->cs_icc.icc_cur_protocol;
+		ucs.ucs_prot = (uccid_prot_t)slot->cs_icc.icc_cur_protocol;
 		ucs.ucs_params = slot->cs_icc.icc_params;
 	}
 
diff --git a/usr/src/uts/common/mapfiles/ddi.mapfile b/usr/src/uts/common/mapfiles/ddi.mapfile
index 1d2d36900d..56c3a0bf99 100644
--- a/usr/src/uts/common/mapfiles/ddi.mapfile
+++ b/usr/src/uts/common/mapfiles/ddi.mapfile
@@ -10,7 +10,7 @@
 #
 
 #
-# Copyright 2019 Joyent, Inc.
+# Copyright 2020 Joyent, Inc.
 # Copyright 2020 RackTop Systems, Inc.
 #
 
@@ -77,6 +77,7 @@ SYMBOL_SCOPE {
 	ddi_dev_regsize			{ FLAGS = EXTERN };
 	ddi_dma_addr_bind_handle	{ FLAGS = EXTERN };
 	ddi_dma_alloc_handle		{ FLAGS = EXTERN };
+	ddi_dma_cookie_iter		{ FLAGS = EXTERN };
 	ddi_dma_free_handle		{ FLAGS = EXTERN };
 	ddi_dma_mem_alloc		{ FLAGS = EXTERN };
 	ddi_dma_mem_free		{ FLAGS = EXTERN };
diff --git a/usr/src/uts/common/smbsrv/smb_ktypes.h b/usr/src/uts/common/smbsrv/smb_ktypes.h
index 0a84506726..1b596dbb9f 100644
--- a/usr/src/uts/common/smbsrv/smb_ktypes.h
+++ b/usr/src/uts/common/smbsrv/smb_ktypes.h
@@ -1170,6 +1170,7 @@ typedef struct smb_tree {
 	time_t			t_connect_time;
 	volatile uint32_t	t_open_files;
 	smb_cfg_val_t		t_encrypt; /* Share.EncryptData */
+	timestruc_t		t_create_time;
 } smb_tree_t;
 
 #define	SMB_TREE_VFS(tree)	((tree)->t_snode->vp->v_vfsp)
diff --git a/usr/src/uts/common/sys/usb/clients/ccid/uccid.h b/usr/src/uts/common/sys/usb/clients/ccid/uccid.h
index f016df3879..032ac73274 100644
--- a/usr/src/uts/common/sys/usb/clients/ccid/uccid.h
+++ b/usr/src/uts/common/sys/usb/clients/ccid/uccid.h
@@ -83,6 +83,7 @@ typedef struct uccid_cmd_txn_end {
  * Protocol definitions. This should match common/ccid/atr.h.
  */
 typedef enum {
+	UCCID_PROT_NONE = 0,
 	UCCID_PROT_T0	= 1 << 0,
 	UCCID_PROT_T1	= 1 << 1
 } uccid_prot_t;
diff --git a/usr/src/uts/i86xpv/io/psm/mp_platform_xpv.c b/usr/src/uts/i86xpv/io/psm/mp_platform_xpv.c
index 1c20832721..5167decaf6 100644
--- a/usr/src/uts/i86xpv/io/psm/mp_platform_xpv.c
+++ b/usr/src/uts/i86xpv/io/psm/mp_platform_xpv.c
@@ -187,7 +187,7 @@ static	uchar_t	*apic_oldvec_to_newvec;
 static	uchar_t	*apic_newvec_to_oldvec;
 
 /* ACPI Interrupt Source Override Structure ptr */
-ACPI_MADT_INTERRUPT_OVERRIDE *acpi_isop;
+extern	ACPI_MADT_INTERRUPT_OVERRIDE *acpi_isop;
 extern	int acpi_iso_cnt;
 
 /*