[illumos-gate merge]

commit 19325e87abbf92e73010df2342fc48019027aee1
    12481 attempting to change MTU size of aggregate over mlxcx can cause dladm to hang
commit c11c816fbf1bf201998f795321092b084ad65f58
    12525 unix: sparc is missing do_hotinlines()
commit 525fef19ebb4e2f27b3a0e5f2df600ade73fdc0c
    12535 luxadm: NULL pointer errors
commit de172e901a45d2c11bb3be066bc4af11c104d52e
    12362 audio: buffer overflow
commit e4a991eb9ba3d449515f2fe5f9f2a9e1c33ca0fd
    12624 add_drv crashes when given many aliases
    12625 modload tools should be smatch and gcc warning clean
commit fd3215f7b5f6c48fd7b7b7e85d5f595a2b3808fa
    12537 dcs: NULL pointer errors
commit 2f602de35d44213d39581c59632aa8365348850b
    12585 insufficient validation in svccfg for service name

	Conflicts:
	usr/src/uts/sun4/os/machdep.c

21 files changed, 317 insertions, 211 deletions

diff --git a/usr/src/cmd/dcs/sparc/sun4u/rdr_messages.c b/usr/src/cmd/dcs/sparc/sun4u/rdr_messages.c
index 51b836a57b..187319c234 100644
--- a/usr/src/cmd/dcs/sparc/sun4u/rdr_messages.c
+++ b/usr/src/cmd/dcs/sparc/sun4u/rdr_messages.c
@@ -23,8 +23,6 @@
  * Use is subject to license terms.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
-
 /*
  * WARNING: The contents of this file are shared by all projects
  * that  wish to  perform  remote  Dynamic Reconfiguration  (DR)
@@ -121,7 +119,7 @@ struct {
 	{  SHORTMSG,	NOMSG	  },	/*  RDR_CONF_HELP		*/
 	{  SHORTMSG,	NOMSG	  },	/*  RDR_CONF_AP_ID_CMP		*/
 	{  SHORTMSG,	NOMSG	  },	/*  RDR_CONF_ABORT_CMD		*/
-	{  SHORTMSG,	SHORTMSG  },	/*  RDR_CONF_CONFIRM_CALLBACK 	*/
+	{  SHORTMSG,	SHORTMSG  },	/*  RDR_CONF_CONFIRM_CALLBACK	*/
 	{  SHORTMSG,	NOMSG	  },	/*  RDR_CONF_MSG_CALLBACK	*/
 	{  SHORTMSG,	LONGMSG	  }	/*  RDR_RSRC_INFO		*/
 };
@@ -129,7 +127,7 @@ struct {
 
 #define	RDR_BAD_FD		(-1)
 
-#define	RDR_MSG_HDR_SIZE 	sizeof (rdr_msg_hdr_t)
+#define	RDR_MSG_HDR_SIZE	sizeof (rdr_msg_hdr_t)
 
 static const int RDR_ALIGN_64_BIT = 8;   /* 8 bytes */
 
@@ -364,7 +362,7 @@ rdr_open(int family)
 	int	newfd;
 
 
-	if ((newfd = socket(family, SOCK_STREAM, 0)) == NULL) {
+	if ((newfd = socket(family, SOCK_STREAM, 0)) == -1) {
 		return (RDR_BAD_FD);
 	}
 
@@ -2013,7 +2011,7 @@ static int
 unpack_change_state_request(change_state_params_t *params, const char *buf)
 {
 	char				*bufptr;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 	rdr_change_state_t		change_state_data;
 
 
@@ -2105,7 +2103,7 @@ pack_change_state_reply(change_state_params_t *params, char **buf,
 	int				i;
 	char				*bufptr;
 	rdr_change_state_reply_t	change_state_data;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 
 
 	(void) memset(&var_msg_info, 0, sizeof (rdr_variable_message_info_t));
@@ -2348,7 +2346,7 @@ static int
 unpack_private_func_request(private_func_params_t *params, const char *buf)
 {
 	char				*bufptr;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 	rdr_private_func_t		private_func_data;
 
 
@@ -2443,7 +2441,7 @@ pack_private_func_reply(private_func_params_t *params, char **buf,
 	int				i;
 	char				*bufptr;
 	rdr_private_func_reply_t	private_func_data;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 
 
 	(void) memset(&var_msg_info, 0, sizeof (rdr_variable_message_info_t));
@@ -2657,7 +2655,7 @@ static int
 unpack_test_request(test_params_t *params, const char *buf)
 {
 	char				*bufptr;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 	rdr_test_t			test_data;
 
 
@@ -2733,7 +2731,7 @@ pack_test_reply(test_params_t *params, char **buf, int *buf_size)
 	int				i;
 	char				*bufptr;
 	rdr_test_reply_t		test_data;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 
 
 	if ((params == NULL) || (buf == NULL) || (buf_size == NULL)) {
@@ -2836,8 +2834,8 @@ pack_list_ext_request(list_ext_params_t *params, char **buf, int *buf_size)
 {
 	int				i;
 	char				*bufptr;
-	rdr_list_ext_t 			list_ext_data;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_list_ext_t			list_ext_data;
+	rdr_variable_message_info_t	var_msg_info;
 
 
 	if ((params == NULL) || (buf == NULL) || (buf_size == NULL)) {
@@ -2959,7 +2957,7 @@ static int
 unpack_list_ext_request(list_ext_params_t *params, const char *buf)
 {
 	char				*bufptr;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 	rdr_list_ext_t			list_ext_data;
 
 
@@ -3024,7 +3022,7 @@ unpack_list_ext_request(list_ext_params_t *params, const char *buf)
 		}
 		*(params->errstring) = NULL;
 	} else {	/* error_msg_ctl == RDR_DONT_GENERATE_ERR_MSGS */
-	    params->errstring = NULL;
+		params->errstring = NULL;
 	}
 	params->flags = list_ext_data.flags;
 	params->permissions = list_ext_data.permissions;
@@ -3044,8 +3042,8 @@ pack_list_ext_reply(list_ext_params_t *params, char **buf, int *buf_size)
 	int				i;
 	char				*bufptr;
 	rdr_list_ext_reply_t		list_ext_data;
-	rdr_variable_message_info_t 	var_msg_info;
-	int 				list_data_size;
+	rdr_variable_message_info_t	var_msg_info;
+	int				list_data_size;
 
 
 	(void) memset(&var_msg_info, 0, sizeof (rdr_variable_message_info_t));
@@ -3132,8 +3130,8 @@ pack_list_ext_reply(list_ext_params_t *params, char **buf, int *buf_size)
 static int
 unpack_list_ext_reply(list_ext_params_t *params, const char *buf)
 {
-	int 			list_data_size;
-	char 			*bufptr;
+	int			list_data_size;
+	char			*bufptr;
 	rdr_list_ext_reply_t	list_ext_data;
 
 
@@ -3160,7 +3158,7 @@ unpack_list_ext_reply(list_ext_params_t *params, const char *buf)
 			return (RDR_MEM_ALLOC);
 		}
 		*(params->ap_id_list) = (rdr_list_t *)
-		malloc(sizeof (rdr_list_t) * list_ext_data.num_ap_ids);
+		    malloc(sizeof (rdr_list_t) * list_ext_data.num_ap_ids);
 		if (*(params->ap_id_list) == NULL) {
 			return (RDR_MEM_ALLOC);
 		}
@@ -3177,7 +3175,7 @@ unpack_list_ext_reply(list_ext_params_t *params, const char *buf)
 		return (RDR_MEM_ALLOC);
 	}
 	if (get_string_from_buf(params->errstring,
-			list_ext_data.errstring_size, bufptr)) {
+	    list_ext_data.errstring_size, bufptr)) {
 		return (RDR_ERROR);
 	}
 	bufptr += list_ext_data.errstring_size;
@@ -3300,7 +3298,7 @@ static int
 unpack_help_request(help_params_t *params, const char *buf)
 {
 	char				*bufptr;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 	rdr_help_t			help_data;
 
 
@@ -3569,8 +3567,8 @@ pack_confirm_request(confirm_callback_params_t *params, char **buf,
 	int				i;
 	char				*bufptr;
 	rdr_confirm_callback_t		confirm_callback_data;
-	int 				message_strlen;
-	int 				message_pad_sz;
+	int				message_strlen;
+	int				message_pad_sz;
 
 
 	if ((params == NULL) || (buf == NULL) || (buf_size == NULL)) {
@@ -3919,7 +3917,7 @@ pack_rsrc_info_request(rsrc_info_params_t *params, char **buf, int *buf_size)
 {
 	char				*bufptr;
 	rdr_rsrc_info_t			rsrc_info_data;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 
 
 	if ((params == NULL) || (buf == NULL) || (buf_size == NULL)) {
@@ -3992,7 +3990,7 @@ static int
 unpack_rsrc_info_request(rsrc_info_params_t *params, const char *buf)
 {
 	char				*bufptr;
-	rdr_variable_message_info_t 	var_msg_info;
+	rdr_variable_message_info_t	var_msg_info;
 	rdr_rsrc_info_t			rsrc_info_data;
 
 
@@ -4040,7 +4038,7 @@ pack_rsrc_info_reply(rsrc_info_params_t *params, char **buf, int *buf_size,
 	rdr_rsrc_info_reply_t		rsrc_info_data;
 	int				pack_status;
 	caddr_t				rsrc_info_bufp = NULL;
-	size_t 				rsrc_info_size;
+	size_t				rsrc_info_size;
 
 
 	if ((params == NULL) || (buf == NULL) || (buf_size == NULL)) {
@@ -4100,7 +4098,7 @@ static int
 unpack_rsrc_info_reply(rsrc_info_params_t *params, const char *buf)
 {
 	int			unpack_status;
-	char 			*bufptr;
+	char			*bufptr;
 	rdr_rsrc_info_reply_t	rsrc_info_data;
 
 
@@ -4220,7 +4218,7 @@ unpack_ap_ids(int num_ap_ids, char **ap_ids, const char *buf,
 	var_msg_info->ap_id_int_size = sizeof (int) * num_ap_ids;
 	if (num_ap_ids > 0) {
 		var_msg_info->ap_id_sizes = (int *)
-		malloc(sizeof (int) * var_msg_info->ap_id_int_size);
+		    malloc(sizeof (int) * var_msg_info->ap_id_int_size);
 		if (var_msg_info->ap_id_sizes == NULL) {
 			return (RDR_MEM_ALLOC);
 		}
@@ -4236,7 +4234,7 @@ unpack_ap_ids(int num_ap_ids, char **ap_ids, const char *buf,
 			continue;
 		}
 		if ((chars_copied + ap_id_size) >
-			var_msg_info->ap_id_char_size) {
+		    var_msg_info->ap_id_char_size) {
 			return (RDR_ERROR);
 		}
 		ap_ids[i] = (char *)malloc(ap_id_size);
diff --git a/usr/src/cmd/luxadm/fcalupdate.c b/usr/src/cmd/luxadm/fcalupdate.c
index c9a8e158fa..41f800f3bd 100644
--- a/usr/src/cmd/luxadm/fcalupdate.c
+++ b/usr/src/cmd/luxadm/fcalupdate.c
@@ -66,7 +66,7 @@
 #include	<l_common.h>
 #include	"luxadm.h"
 
-/*	Defines 	*/
+/*	Defines		*/
 #define	FEPROM_SIZE		256*1024
 #define	FEPROM_MAX_PROGRAM	25
 #define	FEPROM_MAX_ERASE	1000
@@ -632,7 +632,7 @@ getbootdev(unsigned int verbose)
 			char *slot = ",0:slot";
 
 			ls = (char *)malloc(PATH_MAX);
-			(void) memset((char *)ls, NULL, PATH_MAX);
+			(void) memset((char *)ls, 0, PATH_MAX);
 			(void) strcpy(ls, "ls -l ");
 			(void) strcat(ls, bootdev);
 			if ((ptr = popen(ls, "r")) != NULL) {
@@ -827,9 +827,9 @@ loop1:
 
 /*
  * getsocpath():
- * 	Searches the /devices directory recursively returning all soc_name
+ *	Searches the /devices directory recursively returning all soc_name
  *	entries in sbussoc_list (global). This excludes port entries and
- * 	onboard socal (which leaves only directory entries with
+ *	onboard socal (which leaves only directory entries with
  *	soc_name included). devcnt is updated to reflect number of soc_name
  *	devices found.
  */
diff --git a/usr/src/cmd/luxadm/g_adm.c b/usr/src/cmd/luxadm/g_adm.c
index b6377b00da..ed6a389c75 100644
--- a/usr/src/cmd/luxadm/g_adm.c
+++ b/usr/src/cmd/luxadm/g_adm.c
@@ -94,7 +94,7 @@ static	void	display_lun_info(L_disk_state, Path_struct *,
 		struct mode_page *, int, WWN_list *, char *);
 static	void	display_fc_disk(struct path_struct *, char *, gfc_map_t *,
 		L_inquiry, int);
-static 	void	adm_display_err(char *, int);
+static	void	adm_display_err(char *, int);
 static	void	temperature_messages(struct l_state_struct *, int);
 static	void	ctlr_messages(struct l_state_struct *, int, int);
 static	void	fan_messages(struct l_state_struct *, int, int);
@@ -285,7 +285,7 @@ char		last_logical_path[MAXPATHLEN];
 				retval++;
 				continue;
 			}
-			*ptr = NULL;
+			*ptr = '\0';
 			slot = path_struct->slot;
 			f_r = path_struct->f_flag;
 			path_phys = NULL;
@@ -482,7 +482,7 @@ char		 err_path[MAXNAMELEN];
 			if (((ptr = strstr(err_path, ", ")) != NULL) &&
 				((*(ptr + 1) == 'f') || (*(ptr + 1) == 'r') ||
 							(*(ptr +1) == 's'))) {
-				*ptr = NULL;
+				*ptr = '\0';
 				slot = path_struct->slot;
 				f_r = path_struct->f_flag;
 				path_phys = NULL;
@@ -573,7 +573,7 @@ char		ses_path[MAXPATHLEN], inq_path[MAXNAMELEN];
 					retval++;
 					continue;
 				}
-				*ptr = NULL;
+				*ptr = '\0';
 				slot = path_struct->slot;
 				f_r = path_struct->f_flag;
 				if ((err = l_convert_name(inq_path, &path_phys,
@@ -2317,15 +2317,15 @@ int		num_status_entries;
 		(void) fprintf(stdout, MSGSTR(32,
 			"Information from %s"), fc_stats->drvr_name);
 		(void) fprintf(stdout, "\n");
-		if ((*fc_stats->node_wwn != NULL) &&
-			(*fc_stats->port_wwn[port] != NULL)) {
+		if ((*fc_stats->node_wwn != '\0') &&
+			(*fc_stats->port_wwn[port] != '\0')) {
 			(void) fprintf(stdout, MSGSTR(104,
 				"  Host Adapter WWN's: Node:%s"
 				"  Port:%s\n"),
 				fc_stats->node_wwn,
 				fc_stats->port_wwn[port]);
 		}
-		if (*fc_stats->fw_revision != NULL) {
+		if (*fc_stats->fw_revision != '\0') {
 			(void) fprintf(stdout, MSGSTR(105,
 				"  Host Adapter Firmware Revision: %s\n"),
 				fc_stats->fw_revision);
@@ -2613,15 +2613,15 @@ int		p_on = 0, p_st = 0;
 				"Information from %s"),
 				ifp_stats.drvr_name);
 			(void) fprintf(stdout, "\n");
-			if ((*ifp_stats.node_wwn != NULL) &&
-				(*ifp_stats.port_wwn != NULL)) {
+			if ((*ifp_stats.node_wwn != '\0') &&
+				(*ifp_stats.port_wwn != '\0')) {
 				(void) fprintf(stdout, MSGSTR(104,
 					"  Host Adapter WWN's: Node:%s"
 					"  Port:%s\n"),
 					ifp_stats.node_wwn,
 					ifp_stats.port_wwn);
 			}
-			if (*ifp_stats.fw_revision != NULL) {
+			if (*ifp_stats.fw_revision != 0) {
 				(void) fprintf(stdout, MSGSTR(105,
 				"  Host Adapter Firmware Revision: %s\n"),
 				ifp_stats.fw_revision);
@@ -2925,7 +2925,7 @@ char		temp2path[MAXPATHLEN];
 mp_pathlist_t	pathlist;
 int		p_pw = 0, p_on = 0, p_st = 0;
 gfc_dev_t	map_root, map_dev;
-int 		*port_addr, *hard_addr, pos = 0, count;
+int		*port_addr, *hard_addr, pos = 0, count;
 uchar_t		*hba_port_wwn, *port_wwn, *node_wwn, *dtype_prop;
 uint_t		map_topo;
 
@@ -4062,7 +4062,7 @@ struct mode_page	*pg_hdr;
 
 	if (no_path_flag) {
 		(void) fprintf(stdout, "  ");
-		if (port_a_flag != NULL) {
+		if (port_a_flag != 0) {
 			(void) fprintf(stdout, MSGSTR(142, "Status(Port B):"));
 		} else {
 			(void) fprintf(stdout, MSGSTR(141, "Status(Port A):"));
@@ -4870,7 +4870,7 @@ Interconnect_st	interconnect;
 			(void) fprintf(stdout,
 			MSGSTR(30, "Not Installed"));
 		} else if (interconnect.code == S_CRITICAL) {
-			if (interconnect.eprom_fail != NULL) {
+			if (interconnect.eprom_fail != 0) {
 				(void) fprintf(stdout, MSGSTR(2140,
 					"Critical Failure: EEPROM failure"));
 			} else {
@@ -4879,7 +4879,7 @@ Interconnect_st	interconnect;
 			}
 			revision_msg(l_state, elem_index + j);
 		} else if (interconnect.code == S_NONCRITICAL) {
-			if (interconnect.eprom_fail != NULL) {
+			if (interconnect.eprom_fail != 0) {
 				(void) fprintf(stdout, MSGSTR(2142,
 				"Non-Critical Failure: EEPROM failure"));
 			} else {
@@ -5566,7 +5566,7 @@ cleanup_and_go:
  *
  * Sample output for ifp:
  *
- * /devices/pci@1f,4000/SUNW,ifp@2:devctl 		CONNECTED
+ * /devices/pci@1f,4000/SUNW,ifp@2:devctl		CONNECTED
  * /devices/pci@1f,2000/SUNW,ifp@1:devctl		NOT CONNECTED
  *
  * Sample output for socal:
diff --git a/usr/src/cmd/luxadm/hotplug.c b/usr/src/cmd/luxadm/hotplug.c
index 2efec8ba3c..f3e962ae8f 100644
--- a/usr/src/cmd/luxadm/hotplug.c
+++ b/usr/src/cmd/luxadm/hotplug.c
@@ -104,7 +104,7 @@ static	int	h_pre_hotplug_sena(Hotplug_Devlist *,
 static	int	h_post_hotplug_sena(Hotplug_Devlist *,
 		WWN_list *, int, int, int, int);
 static	int	h_remove_ses_nodes(struct dlist *);
-static 	int	h_print_list_warn(Hotplug_Devlist *, int, int);
+static	int	h_print_list_warn(Hotplug_Devlist *, int, int);
 static	int	h_display_logical_nodes(struct dlist *);
 static	void	h_print_logical_nodes(struct dlist *);
 static	int	h_remove_nodes(struct dlist *);
@@ -394,7 +394,7 @@ char		choice[2];
 	for (list = bsyRsrv_disk_list; list != NULL; list = list->next, i++) {
 	    if ((list->dev_type == DTYPE_DIRECT) &&
 		(list->dev_location == SENA)) {
-		if (list->f_flag != NULL) {
+		if (list->f_flag != 0) {
 		    if (enc_type == DAK_ENC_TYPE) {
 			(void) fprintf(stdout, MSGSTR(5663,
 			    "  %d: Box Name:    \"%s\"  slot %d\n"),
@@ -549,7 +549,7 @@ int		p_pw = 0, p_on = 0, p_st = 0;
 					err = 0;
 					continue;
 				}
-				*ptr = NULL;
+				*ptr = '\0';
 				slot = path_struct->slot;
 				f_r = path_struct->f_flag;
 				if ((err = l_convert_name(inq_path, &path_phys,
@@ -687,7 +687,7 @@ int		p_pw = 0, p_on = 0, p_st = 0;
 				 * set dev_path to NULL,
 				 * if disk has null wwn.
 				 */
-				*dev_path = NULL;
+				*dev_path = '\0';
 				dev_location = SENA;
 				goto getinfo;
 			}
@@ -2193,12 +2193,12 @@ Box_list		*bl1, *box_list = NULL;
  */
 static	int
 h_post_remove_dev(Hotplug_Devlist *hotplug_disk,
-				int todo, int verbose_flag)
+    int todo, int verbose_flag)
 {
-char   		device_name[MAXNAMELEN], *dev_path = NULL;
-int		tid, err;
-gfc_map_t	map;
-int		nArg;
+	char		device_name[MAXNAMELEN], *dev_path = NULL;
+	int		tid, err;
+	gfc_map_t	map;
+	int		nArg;
 
 
 	tid = hotplug_disk->tid;
@@ -2669,7 +2669,7 @@ char		*tape_entries[] = { "", "b", "bn", "c", "cb", "cbn", "cn",
 		(void) strcpy(buf, ptr);
 		if ((ptr = strrchr(buf, 's')) == NULL)
 			continue;
-		*(++ptr) = NULL;
+		*(++ptr) = '\0';
 		found_dev++;
 		if (found_dev == 1)
 			(void) fprintf(stdout,
@@ -2695,7 +2695,7 @@ char		*tape_entries[] = { "", "b", "bn", "c", "cb", "cbn", "cn",
 			buf_ptr = ptr;
 			while (*ptr >= '0' && *ptr <= '9')
 				ptr++;
-			*ptr = NULL;
+			*ptr = '\0';
 			for (i = 0, ptr = tape_entries[0];
 					ptr != NULL;
 					i++, ptr = tape_entries[i]) {
@@ -2795,7 +2795,7 @@ Hotplug_Devlist		*disk_list = disk_list_head;
 	for (i = 1; disk_list; i++, disk_list = disk_list->next) {
 		if ((disk_list->dev_type == DTYPE_DIRECT) &&
 			(disk_list->dev_location == SENA)) {
-		    if (disk_list->f_flag != NULL) {
+		    if (disk_list->f_flag != 0) {
 			if (enc_type == DAK_ENC_TYPE) {
 			    (void) fprintf(stdout, MSGSTR(5665,
 				"  %d: Box Name:    \"%s\" slot %d\n"),
diff --git a/usr/src/cmd/luxadm/qlgcupdate.c b/usr/src/cmd/luxadm/qlgcupdate.c
index 404f4b7c06..07b6941b91 100644
--- a/usr/src/cmd/luxadm/qlgcupdate.c
+++ b/usr/src/cmd/luxadm/qlgcupdate.c
@@ -159,8 +159,8 @@ q_qlgc_update(unsigned int verbose, char *file)
 	 * is "sbus@12". They are initialized to a random value and are
 	 * set such that they are not equal initially.
 	 */
-	static char port1[MAXNAMELEN] = {NULL};
-	static char port2[MAXNAMELEN] = {NULL};
+	static char port1[MAXNAMELEN] = { 0 };
+	static char port2[MAXNAMELEN] = { 0 };
 
 	if (file) {
 		fflag++;
@@ -401,8 +401,8 @@ q_findversion(int verbose, int index, uchar_t *version, uint16_t *chip_id)
 {
 	int fd, ntries;
 	struct	ifp_fm_version *version_buffer = NULL;
-	char	prom_ver[100] = {NULL};
-	char	mcode_ver[100] = {NULL};
+	char	prom_ver[100] = { 0 };
+	char	mcode_ver[100] = { 0 };
 	fcio_t	fcio;
 
 	if (strstr(&pcibus_list[index][0], fc_trans)) {
@@ -516,7 +516,7 @@ q_findfileversion(char *dl_fcode, uchar_t *version_file, uint16_t *file_id,
 {
 	int mark;
 	int qlc_offset = 0;
-	char temp[4] = {NULL};
+	char temp[4] = { 0 };
 
 
 	/*
@@ -1328,7 +1328,7 @@ emulex_fcodeversion(di_node_t node, uchar_t *ver) {
 			promprop)) != NULL) &&
 			(strcmp(promname, "fcode-version") == 0)) {
 			size = di_prom_prop_data(promprop, &ver_data);
-			(void) memset(ver, NULL, size);
+			(void) memset(ver, 0, size);
 			(void) memcpy(ver, ver_data, size);
 			found = 1;
 		}
diff --git a/usr/src/cmd/modload/Makefile b/usr/src/cmd/modload/Makefile
index c186767c6a..7e258fa01a 100644
--- a/usr/src/cmd/modload/Makefile
+++ b/usr/src/cmd/modload/Makefile
@@ -21,9 +21,7 @@
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
-# cmd/modload/Makefile
-#
-# makefile for loadable module utilities
+# Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
 
 DRVPROG = add_drv rem_drv update_drv
 MODPROG = modinfo modunload modload
@@ -36,19 +34,18 @@ XPRIV = $(ETCSEC)/extra_privs
 
 $(XPRIV) := FILEMODE = 644
 
-SUBDIRS += 	$(MACH64)
+SUBDIRS +=	$(MACH64)
 
 all	:=	TARGET = all
 install	:=	TARGET = install
 clean	:=	TARGET = clean
 clobber	:=	TARGET = clobber
-lint	:=	TARGET = lint
 
 .KEEP_STATE:
 
 all:	$(SUBDIRS)
 
-clean clobber lint:	$(SUBDIRS)
+clean clobber:	$(SUBDIRS)
 
 install:	$(SUBDIRS) $(XPRIV)
 
diff --git a/usr/src/cmd/modload/Makefile.com b/usr/src/cmd/modload/Makefile.com
index cf82649c7d..19d24ebb74 100644
--- a/usr/src/cmd/modload/Makefile.com
+++ b/usr/src/cmd/modload/Makefile.com
@@ -23,6 +23,7 @@
 # Use is subject to license terms.
 #
 # Copyright (c) 2018, Joyent, Inc.
+# Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
 #
 # makefile for loadable module utilities
 
@@ -52,18 +53,6 @@ COMMONSRC = $(DRVCOMMONSRC) $(MODCOMMONSRC)
 
 CLOBBERFILES = $(PROG)
 
-# lint is complicated here by the fact that we
-# build multiple commands and with differing
-# common source, drvsubr vs modsubr/plcysubr
-#
-LINT_PROG= $(PROG:%=lint_%.c)
-LINTFLAGS += -erroff=E_NAME_DEF_NOT_USED2
-
-CERRWARN += -_gcc=-Wno-parentheses
-
-# not linted
-SMATCH=off
-
 # install specifics
 
 $(ROOTDRVPROG) := FILEMODE = 0555
@@ -72,10 +61,6 @@ add_drv			:= LDLIBS += -ldevinfo -lelf
 rem_drv			:= LDLIBS += -ldevinfo
 update_drv		:= LDLIBS += -ldevinfo
 
-lint_add_drv.c		:= LDLIBS += -ldevinfo -lelf
-lint_rem_drv.c		:= LDLIBS += -ldevinfo
-lint_update_drv.c	:= LDLIBS += -ldevinfo
-
 .KEEP_STATE:
 
 %.o:	../%.c
@@ -110,9 +95,4 @@ modinfo:	modinfo.o $(MODCOMMONOBJ)
 clean:
 	$(RM) $(OBJECTS)
 
-lint_%.c:
-	$(LINT.c) $(@:lint_%.c=../%.c) $(COMMONSRC) $(LDLIBS)
-
-lint:	$(LINT_PROG)
-
 include ../../Makefile.targ
diff --git a/usr/src/cmd/modload/addrem.h b/usr/src/cmd/modload/addrem.h
index 98448a0625..dc2a1732d4 100644
--- a/usr/src/cmd/modload/addrem.h
+++ b/usr/src/cmd/modload/addrem.h
@@ -20,6 +20,7 @@
  */
 /*
  * Copyright (c) 1993, 2010, Oracle and/or its affiliates. All rights reserved.
+ * Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
  */
 
 #ifndef _CMD_MODLOAD_ADDREM_H
@@ -44,7 +45,7 @@ extern "C" {
 
 #define	MAX_CMD_LINE	256
 #define	MAX_N2M_ALIAS_LINE	FILENAME_MAX + FILENAME_MAX + 1
-#define	MAXLEN_NAM_TO_MAJ_ENT 	FILENAME_MAX + MAX_STR_MAJOR + 1
+#define	MAXLEN_NAM_TO_MAJ_ENT	FILENAME_MAX + MAX_STR_MAJOR + 1
 #define	OPT_LEN		128
 #define	CADDR_HEX_STR	16
 #define	UINT_STR	10
@@ -118,7 +119,7 @@ extern char *get_perm_entry(char *, char *);
 extern int check_perms_aliases(int, int);
 extern int check_name_to_major(int);
 extern void enter_lock(void);
-extern void err_exit(void);
+extern void err_exit(void) __NORETURN;
 extern void exit_unlock(void);
 extern char *get_entry(char *, char *, char, int);
 extern int build_filenames(char *);
diff --git a/usr/src/cmd/modload/amd64/Makefile b/usr/src/cmd/modload/amd64/Makefile
index cd2153b08c..87cd1cb261 100644
--- a/usr/src/cmd/modload/amd64/Makefile
+++ b/usr/src/cmd/modload/amd64/Makefile
@@ -22,10 +22,9 @@
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
 
 include ../Makefile.com
 include ../../Makefile.cmd.64
 
-LINTFLAGS64 += -erroff=E_NAME_DEF_NOT_USED2
-
 install: all $(ROOTUSRSBINPROG)
diff --git a/usr/src/cmd/modload/drvsubr.c b/usr/src/cmd/modload/drvsubr.c
index 83282f471f..75662833e9 100644
--- a/usr/src/cmd/modload/drvsubr.c
+++ b/usr/src/cmd/modload/drvsubr.c
@@ -26,6 +26,9 @@
  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
+/*
+ * Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
+ */
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -116,7 +119,7 @@ log_minorperm_error(minorperm_err_t err, int key)
  *  open file
  * for each entry in list
  *	where list entries are separated by <list_separator>
- * 	append entry : driver_name <entry_separator> entry
+ *	append entry : driver_name <entry_separator> entry
  * close file
  * return error/noerr
  */
@@ -207,7 +210,7 @@ append_to_file(
  *  open file
  * for each entry in list
  *	where list entries are separated by <list_separator>
- * 	append entry : driver_name <entry_separator> entry
+ *	append entry : driver_name <entry_separator> entry
  * close file
  * return error/noerr
  */
@@ -347,7 +350,7 @@ delete_entry(
 	int		rv, i;
 	int		status = NOERR;
 	int		drvr_found = 0;
-	boolean_t 	nomatch = B_TRUE;
+	boolean_t	nomatch = B_TRUE;
 	char		newfile[MAXPATHLEN];
 	char		*cp;
 	char		line[MAX_DBFILE_ENTRY];
@@ -1213,9 +1216,6 @@ exec_devfsadm(
 	int n = 0;
 	char *cmdline[MAX_CMD_LINE];
 	char maj_num[128];
-	char *previous;
-	char *current;
-	int len;
 	int rv;
 
 	/* build command line */
@@ -1242,24 +1242,35 @@ exec_devfsadm(
 		cmdline[n++] = "-x";
 
 	if (aliases != NULL) {
+		char *buf, *p;
+		size_t len;
+		int n_start = n;
+
 		len = strlen(aliases);
-		previous = aliases;
-		do {
-			cmdline[n++] = "-a";
-			cmdline[n] = calloc(len + 1, 1);
-			if (cmdline[n] == NULL) {
-				(void) fprintf(stderr,
-				    gettext(ERR_NO_MEM));
-				return (ERROR);
-			}
-			current = get_entry(previous,
-			    cmdline[n++], ' ', 0);
-			previous = current;
 
-		} while (*current != '\0');
+		p = buf = calloc(len + 1, 1);
+		if (buf == NULL) {
+			(void) fprintf(stderr, gettext(ERR_NO_MEM));
+			return (ERROR);
+		}
 
+		while (*aliases != '\0') {
+			while (n < MAX_CMD_LINE - 3 && *aliases != '\0') {
+				cmdline[n++] = "-a";
+				aliases = get_entry(aliases, p, ' ', 0);
+				cmdline[n++] = p;
+				p += strlen(p) + 1;
+			}
+			cmdline[n] = NULL;
+			rv = exec_command(DRVCONFIG_PATH, cmdline);
+			if (rv != NOERR)
+				break;
+			n = n_start;
+		}
+		free(buf);
+		return (rv == NOERR ? NOERR : ERROR);
 	}
-	cmdline[n] = (char *)0;
+	cmdline[n] = NULL;
 
 	rv = exec_command(DRVCONFIG_PATH, cmdline);
 	if (rv == NOERR)
@@ -1387,7 +1398,7 @@ create_reconfig(char *basedir)
  *	open file
  *	for each entry in list
  *		where list entries are separated by <list_separator>
- * 		modify entry : driver_name <entry_separator> entry
+ *		modify entry : driver_name <entry_separator> entry
  *	close file
  *
  *	return error/noerr
@@ -1538,7 +1549,7 @@ update_minor_entry(char *driver_name, char *perm_list)
 	}
 
 	if (!match) {
-		(void) bzero(line, sizeof (&line[0]));
+		(void) bzero(line, sizeof (line));
 		(void) snprintf(line, sizeof (line),
 		    "%s:%s %s %s %s\n",
 		    driver_name, minor, perm, own, grp);
@@ -1929,7 +1940,7 @@ unique_drv_alias(char *drv_alias)
 				continue;
 			/* sanity-check */
 			if (sscanf(line,
-			    "%" VAL2STR(FILENAME_MAX) "s" 	/* drv */
+			    "%" VAL2STR(FILENAME_MAX) "s"	/* drv */
 			    "%" VAL2STR(FILENAME_MAX) "s",	/* alias */
 			    drv, alias) != 2)
 				(void) fprintf(stderr, gettext(ERR_BAD_LINE),
@@ -1965,8 +1976,7 @@ unique_drv_alias(char *drv_alias)
  * from the remainder of the line by white space.
  */
 int
-unique_driver_name(char *driver_name, char *file_name,
-	int *is_unique)
+unique_driver_name(char *driver_name, char *file_name, int *is_unique)
 {
 	int ret, err;
 
@@ -2174,7 +2184,7 @@ update_name_to_major(char *driver_name, major_t *major_num, int server)
 
 	/*
 	 * if driver_name already in rem_name_to_major
-	 * 	delete entry from rem_nam_to_major
+	 *	delete entry from rem_nam_to_major
 	 *	put entry into name_to_major
 	 */
 
diff --git a/usr/src/cmd/modload/plcysubr.c b/usr/src/cmd/modload/plcysubr.c
index 1fa59159ac..c17d6e9245 100644
--- a/usr/src/cmd/modload/plcysubr.c
+++ b/usr/src/cmd/modload/plcysubr.c
@@ -27,7 +27,9 @@
  * drvsubr.c because of static linking requirements.
  */
 
-#pragma ident	"%Z%%M%	%I%	%E% SMI"
+/*
+ * Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
+ */
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -87,18 +89,16 @@ devplcy_init(void)
 	devplcysys_sz = DEVPLCYSYS_SZ(privimplinfo);
 
 	toktab[RDPOL].off =
-		(char *)DEVPLCYSYS_RDP((devplcysys_t *)0, privimplinfo) -
-				(char *)0;
+	    (char *)DEVPLCYSYS_RDP((devplcysys_t *)0, privimplinfo) - (char *)0;
 	toktab[WRPOL].off =
-		(char *)DEVPLCYSYS_WRP((devplcysys_t *)0, privimplinfo) -
-				(char *)0;
+	    (char *)DEVPLCYSYS_WRP((devplcysys_t *)0, privimplinfo) - (char *)0;
 }
 
 /*
  * Read a configuration file line and return a static buffer pointing to it.
  * It returns a static struct fileentry which has several fields:
  *	- rawbuf, which includes the lines including empty lines and comments
- * 	leading up to the file and the entry as found in the file
+ *	leading up to the file and the entry as found in the file
  *	- orgentry, pointer in rawbuf to the start of the entry proper.
  *	- entry, a pre-parsed entry, escaped newlines removed.
  *	- startline, the line number of the first line in the file
@@ -481,13 +481,14 @@ parse_plcy_token(char *token, devplcysys_t *dp)
 			case PSET:
 				pset = priv_str_to_set(val, ",", &perr);
 				if (pset == NULL) {
-					if (perr == NULL)
-					    (void) fprintf(stderr,
-							gettext(ERR_NO_MEM));
-					else
-					    (void) fprintf(stderr,
-						gettext(ERR_BAD_PRIVS),
-						perr - val, val, perr);
+					if (perr == NULL) {
+						(void) fprintf(stderr,
+						    gettext(ERR_NO_MEM));
+					} else {
+						(void) fprintf(stderr,
+						    gettext(ERR_BAD_PRIVS),
+						    perr - val, val, perr);
+					}
 					return (1);
 				}
 				priv_copyset(pset, item);
@@ -495,8 +496,8 @@ parse_plcy_token(char *token, devplcysys_t *dp)
 				break;
 			default:
 				(void) fprintf(stderr,
-					"Internal Error: bad token type: %d\n",
-						toktab[i].type);
+				    "Internal Error: bad token type: %d\n",
+				    toktab[i].type);
 				return (1);
 			}
 			/* Standard cleanup & return for good tokens */
@@ -547,6 +548,7 @@ check_plcy_entry(char *entry, const char *driver, boolean_t todel)
 
 	if (res == NULL || ds == NULL) {
 		(void) fprintf(stderr, gettext(ERR_NO_MEM));
+		free(res);
 		return (NULL);
 	}
 
@@ -612,7 +614,7 @@ check_plcy_entry(char *entry, const char *driver, boolean_t todel)
 			tokseen = B_TRUE;
 		}
 	}
-	if (todel && tokseen || *res == '\0' || !todel && !tokseen) {
+	if ((todel && tokseen) || *res == '\0' || (!todel && !tokseen)) {
 		(void) fprintf(stderr, gettext(ERR_INVALID_PLCY));
 		free(res);
 		return (NULL);
@@ -690,7 +692,7 @@ check_priv_entry(const char *privlist, boolean_t add)
 
 		if (add && modctl(MODALLOCPRIV, pr) != 0) {
 			(void) fprintf(stderr, gettext(ERR_BAD_PRIV), pr,
-				strerror(errno));
+			    strerror(errno));
 			return (ERROR);
 		}
 	}
diff --git a/usr/src/cmd/modload/sparcv9/Makefile b/usr/src/cmd/modload/sparcv9/Makefile
index cd2153b08c..87cd1cb261 100644
--- a/usr/src/cmd/modload/sparcv9/Makefile
+++ b/usr/src/cmd/modload/sparcv9/Makefile
@@ -22,10 +22,9 @@
 # Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
+# Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
 
 include ../Makefile.com
 include ../../Makefile.cmd.64
 
-LINTFLAGS64 += -erroff=E_NAME_DEF_NOT_USED2
-
 install: all $(ROOTUSRSBINPROG)
diff --git a/usr/src/cmd/svc/svccfg/svccfg_xml.c b/usr/src/cmd/svc/svccfg/svccfg_xml.c
index 13c7a90d12..c0810de2ab 100644
--- a/usr/src/cmd/svc/svccfg/svccfg_xml.c
+++ b/usr/src/cmd/svc/svccfg/svccfg_xml.c
@@ -23,7 +23,7 @@
  */
 /*
  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
- * Copyright 2019 Joyent, Inc.
+ * Copyright 2020 Joyent, Inc.
  */
 
 
@@ -3404,6 +3404,28 @@ out:
 }
 
 /*
+ * Validate the svc:/-prefixed FMRI generated from the service name.
+ */
+static void
+validate_service_name(const entity_t *s)
+{
+	char *fmri;
+	int ftype;
+	const char *finst;
+
+	if ((fmri = uu_strdup(s->sc_fmri)) == NULL)
+		uu_die(gettext("couldn't allocate memory"));
+
+	if (scf_parse_fmri(fmri, &ftype, NULL, NULL, &finst, NULL, NULL) != 0 ||
+	    finst != NULL || ftype != SCF_FMRI_TYPE_SVC) {
+		uu_die(gettext("invalid value \"%s\": should be a bare "
+		    "service name\n"), s->sc_name);
+	}
+
+	uu_free(fmri);
+}
+
+/*
  * Translate a service element into an internal instance/property tree, added
  * to bundle.
  *
@@ -3427,6 +3449,8 @@ lxml_get_service(bundle_t *bundle, xmlNodePtr svc, svccfg_op_t op)
 	s = internal_service_new((char *)xmlGetProp(svc,
 	    (xmlChar *)name_attr));
 
+	validate_service_name(s);
+
 	version = xmlGetProp(svc, (xmlChar *)version_attr);
 	s->sc_u.sc_service.sc_service_version = atol((const char *)version);
 	xmlFree(version);
diff --git a/usr/src/uts/common/io/audio/impl/audio_grc3.h b/usr/src/uts/common/io/audio/impl/audio_grc3.h
index 0003dc1574..4472307edf 100644
--- a/usr/src/uts/common/io/audio/impl/audio_grc3.h
+++ b/usr/src/uts/common/io/audio/impl/audio_grc3.h
@@ -53,7 +53,7 @@ typedef struct grc3state {
 	int32_t *historyptr;
 	int32_t dummy_pad1;
 
-	int32_t history[GRC3_MAXHISTORY * 2];
+	int32_t history[GRC3_MAXHISTORY * 2 + 1];
 
 	uint32_t outsz;
 } grc3state_t;
diff --git a/usr/src/uts/common/io/mlxcx/mlxcx.c b/usr/src/uts/common/io/mlxcx/mlxcx.c
index c90fa0969b..9fae7c5f77 100644
--- a/usr/src/uts/common/io/mlxcx/mlxcx.c
+++ b/usr/src/uts/common/io/mlxcx/mlxcx.c
@@ -273,11 +273,16 @@
  * before making a WQE for it.
  *
  * After a completion event occurs, the packet is either discarded (and the
- * buffer_t returned to the free list), or it is readied for loaning to MAC.
+ * buffer_t returned to the free list), or it is readied for loaning to MAC
+ * and placed on the "loaned" list in the mlxcx_buffer_shard_t.
  *
  * Once MAC and the rest of the system have finished with the packet, they call
- * freemsg() on its mblk, which will call mlxcx_buf_mp_return and return the
- * buffer_t to the free list.
+ * freemsg() on its mblk, which will call mlxcx_buf_mp_return. At this point
+ * the fate of the buffer_t is determined by the state of the
+ * mlxcx_buffer_shard_t. When the shard is in its normal state the buffer_t
+ * will be returned to the free list, potentially to be recycled and used
+ * again. But if the shard is draining (E.g. after a ring stop) there will be
+ * no recycling and the buffer_t is immediately destroyed.
  *
  * At detach/teardown time, buffers are only every destroyed from the free list.
  *
@@ -289,18 +294,18 @@
  *                         v
  *                    +----+----+
  *                    | created |
- *                    +----+----+
- *                         |
- *                         |
- *                         | mlxcx_buf_return
- *                         |
- *                         v
- * mlxcx_buf_destroy  +----+----+
- *          +---------|  free   |<---------------+
- *          |         +----+----+                |
+ *                    +----+----+                        +------+
+ *                         |                             | dead |
+ *                         |                             +------+
+ *                         | mlxcx_buf_return                ^
+ *                         |                                 |
+ *                         v                                 | mlxcx_buf_destroy
+ * mlxcx_buf_destroy  +----+----+          +-----------+     |
+ *          +---------|  free   |<------no-| draining? |-yes-+
+ *          |         +----+----+          +-----------+
+ *          |              |                     ^
  *          |              |                     |
- *          |              |                     | mlxcx_buf_return
- *          v              | mlxcx_buf_take      |
+ *          v              | mlxcx_buf_take      | mlxcx_buf_return
  *      +---+--+           v                     |
  *      | dead |       +---+---+                 |
  *      +------+       | on WQ |- - - - - - - - >O
@@ -759,13 +764,19 @@ mlxcx_mlbs_teardown(mlxcx_t *mlxp, mlxcx_buf_shard_t *s)
 	mlxcx_buffer_t *buf;
 
 	mutex_enter(&s->mlbs_mtx);
+
 	while (!list_is_empty(&s->mlbs_busy))
 		cv_wait(&s->mlbs_free_nonempty, &s->mlbs_mtx);
-	while ((buf = list_head(&s->mlbs_free)) != NULL) {
+
+	while (!list_is_empty(&s->mlbs_loaned))
+		cv_wait(&s->mlbs_free_nonempty, &s->mlbs_mtx);
+
+	while ((buf = list_head(&s->mlbs_free)) != NULL)
 		mlxcx_buf_destroy(mlxp, buf);
-	}
+
 	list_destroy(&s->mlbs_free);
 	list_destroy(&s->mlbs_busy);
+	list_destroy(&s->mlbs_loaned);
 	mutex_exit(&s->mlbs_mtx);
 
 	cv_destroy(&s->mlbs_free_nonempty);
@@ -1336,6 +1347,8 @@ mlxcx_mlbs_create(mlxcx_t *mlxp)
 	    offsetof(mlxcx_buffer_t, mlb_entry));
 	list_create(&s->mlbs_free, sizeof (mlxcx_buffer_t),
 	    offsetof(mlxcx_buffer_t, mlb_entry));
+	list_create(&s->mlbs_loaned, sizeof (mlxcx_buffer_t),
+	    offsetof(mlxcx_buffer_t, mlb_entry));
 	cv_init(&s->mlbs_free_nonempty, NULL, CV_DRIVER, NULL);
 
 	list_insert_tail(&mlxp->mlx_buf_shards, s);
diff --git a/usr/src/uts/common/io/mlxcx/mlxcx.h b/usr/src/uts/common/io/mlxcx/mlxcx.h
index da048b4ac3..52240df3a3 100644
--- a/usr/src/uts/common/io/mlxcx/mlxcx.h
+++ b/usr/src/uts/common/io/mlxcx/mlxcx.h
@@ -424,11 +424,18 @@ typedef enum {
 	MLXCX_BUFFER_ON_CHAIN,
 } mlxcx_buffer_state_t;
 
+typedef enum {
+	MLXCX_SHARD_READY,
+	MLXCX_SHARD_DRAINING,
+} mlxcx_shard_state_t;
+
 typedef struct mlxcx_buf_shard {
+	mlxcx_shard_state_t	mlbs_state;
 	list_node_t		mlbs_entry;
 	kmutex_t		mlbs_mtx;
 	list_t			mlbs_busy;
 	list_t			mlbs_free;
+	list_t			mlbs_loaned;
 	kcondvar_t		mlbs_free_nonempty;
 } mlxcx_buf_shard_t;
 
@@ -1171,6 +1178,8 @@ extern boolean_t mlxcx_buf_loan(mlxcx_t *, mlxcx_buffer_t *);
 extern void mlxcx_buf_return(mlxcx_t *, mlxcx_buffer_t *);
 extern void mlxcx_buf_return_chain(mlxcx_t *, mlxcx_buffer_t *, boolean_t);
 extern void mlxcx_buf_destroy(mlxcx_t *, mlxcx_buffer_t *);
+extern void mlxcx_shard_ready(mlxcx_buf_shard_t *);
+extern void mlxcx_shard_draining(mlxcx_buf_shard_t *);
 
 extern uint_t mlxcx_buf_bind_or_copy(mlxcx_t *, mlxcx_work_queue_t *,
     mblk_t *, size_t, mlxcx_buffer_t **);
diff --git a/usr/src/uts/common/io/mlxcx/mlxcx_gld.c b/usr/src/uts/common/io/mlxcx/mlxcx_gld.c
index a08cec3980..5d15ec1fbb 100644
--- a/usr/src/uts/common/io/mlxcx/mlxcx_gld.c
+++ b/usr/src/uts/common/io/mlxcx/mlxcx_gld.c
@@ -451,7 +451,8 @@ mlxcx_mac_ring_tx(void *arg, mblk_t *mp)
 		return (NULL);
 	}
 
-	if (sq->mlwq_state & MLXCX_WQ_TEARDOWN) {
+	if ((sq->mlwq_state & (MLXCX_WQ_TEARDOWN | MLXCX_WQ_STARTED)) !=
+	    MLXCX_WQ_STARTED) {
 		mutex_exit(&sq->mlwq_mtx);
 		mlxcx_buf_return_chain(mlxp, b, B_FALSE);
 		return (NULL);
@@ -725,8 +726,28 @@ mlxcx_mac_ring_stop(mac_ring_driver_t rh)
 	mlxcx_buf_shard_t *s;
 	mlxcx_buffer_t *buf;
 
+	/*
+	 * To prevent deadlocks and sleeping whilst holding either the
+	 * CQ mutex or WQ mutex, we split the stop processing into two
+	 * parts.
+	 *
+	 * With the CQ amd WQ mutexes held the appropriate WQ is stopped.
+	 * The Q in the HCA is set to Reset state and flagged as no
+	 * longer started. Atomic with changing this WQ state, the buffer
+	 * shards are flagged as draining.
+	 *
+	 * Now, any requests for buffers and attempts to submit messages
+	 * will fail and once we're in this state it is safe to relinquish
+	 * the CQ and WQ mutexes. Allowing us to complete the ring stop
+	 * by waiting for the buffer lists, with the exception of
+	 * the loaned list, to drain. Buffers on the loaned list are
+	 * not under our control, we will get them back when the mblk tied
+	 * to the buffer is freed.
+	 */
+
 	mutex_enter(&cq->mlcq_mtx);
 	mutex_enter(&wq->mlwq_mtx);
+
 	if (wq->mlwq_state & MLXCX_WQ_STARTED) {
 		if (wq->mlwq_type == MLXCX_WQ_TYPE_RECVQ &&
 		    !mlxcx_cmd_stop_rq(mlxp, wq)) {
@@ -743,7 +764,15 @@ mlxcx_mac_ring_stop(mac_ring_driver_t rh)
 	}
 	ASSERT0(wq->mlwq_state & MLXCX_WQ_STARTED);
 
+	mlxcx_shard_draining(wq->mlwq_bufs);
+	if (wq->mlwq_foreign_bufs != NULL)
+		mlxcx_shard_draining(wq->mlwq_foreign_bufs);
+
+
 	if (wq->mlwq_state & MLXCX_WQ_BUFFERS) {
+		mutex_exit(&wq->mlwq_mtx);
+		mutex_exit(&cq->mlcq_mtx);
+
 		/* Return any outstanding buffers to the free pool. */
 		while ((buf = list_remove_head(&cq->mlcq_buffers)) != NULL) {
 			mlxcx_buf_return_chain(mlxp, buf, B_FALSE);
@@ -775,12 +804,13 @@ mlxcx_mac_ring_stop(mac_ring_driver_t rh)
 			mutex_exit(&s->mlbs_mtx);
 		}
 
+		mutex_enter(&wq->mlwq_mtx);
 		wq->mlwq_state &= ~MLXCX_WQ_BUFFERS;
+		mutex_exit(&wq->mlwq_mtx);
+	} else {
+		mutex_exit(&wq->mlwq_mtx);
+		mutex_exit(&cq->mlcq_mtx);
 	}
-	ASSERT0(wq->mlwq_state & MLXCX_WQ_BUFFERS);
-
-	mutex_exit(&wq->mlwq_mtx);
-	mutex_exit(&cq->mlcq_mtx);
 }
 
 static int
@@ -1137,7 +1167,8 @@ mlxcx_mac_setprop(void *arg, const char *pr_name, mac_prop_id_t pr_num,
 		for (; sh != NULL; sh = list_next(&mlxp->mlx_buf_shards, sh)) {
 			mutex_enter(&sh->mlbs_mtx);
 			if (!list_is_empty(&sh->mlbs_free) ||
-			    !list_is_empty(&sh->mlbs_busy)) {
+			    !list_is_empty(&sh->mlbs_busy) ||
+			    !list_is_empty(&sh->mlbs_loaned)) {
 				allocd = B_TRUE;
 				mutex_exit(&sh->mlbs_mtx);
 				break;
diff --git a/usr/src/uts/common/io/mlxcx/mlxcx_ring.c b/usr/src/uts/common/io/mlxcx/mlxcx_ring.c
index 492f8fd8a5..da98a5cf40 100644
--- a/usr/src/uts/common/io/mlxcx/mlxcx_ring.c
+++ b/usr/src/uts/common/io/mlxcx/mlxcx_ring.c
@@ -1213,6 +1213,8 @@ mlxcx_rx_ring_start(mlxcx_t *mlxp, mlxcx_ring_group_t *g,
 	ASSERT0(rq->mlwq_state & MLXCX_WQ_BUFFERS);
 	rq->mlwq_state |= MLXCX_WQ_BUFFERS;
 
+	mlxcx_shard_ready(rq->mlwq_bufs);
+
 	for (j = 0; j < rq->mlwq_nents; ++j) {
 		if (!mlxcx_buf_create(mlxp, rq->mlwq_bufs, &b))
 			break;
@@ -1409,6 +1411,9 @@ mlxcx_tx_ring_start(mlxcx_t *mlxp, mlxcx_ring_group_t *g,
 	}
 	sq->mlwq_state |= MLXCX_WQ_BUFFERS;
 
+	mlxcx_shard_ready(sq->mlwq_bufs);
+	mlxcx_shard_ready(sq->mlwq_foreign_bufs);
+
 	if (!mlxcx_cmd_start_sq(mlxp, sq)) {
 		mutex_exit(&sq->mlwq_mtx);
 		mutex_exit(&cq->mlcq_mtx);
@@ -1799,22 +1804,29 @@ mlxcx_rq_refill_task(void *arg)
 	mlxcx_completion_queue_t *cq = wq->mlwq_cq;
 	mlxcx_t *mlxp = wq->mlwq_mlx;
 	mlxcx_buf_shard_t *s = wq->mlwq_bufs;
-	boolean_t refill;
+	boolean_t refill, draining;
 
 	do {
 		/*
-		 * Wait until there are some free buffers.
+		 * Wait here until one of 3 conditions:
+		 * 1. The shard is draining, or
+		 * 2. There are buffers on the free list, or
+		 * 3. The WQ is being shut down.
 		 */
 		mutex_enter(&s->mlbs_mtx);
-		while (list_is_empty(&s->mlbs_free) &&
-		    (cq->mlcq_state & MLXCX_CQ_TEARDOWN) == 0)
+		while (s->mlbs_state != MLXCX_SHARD_DRAINING &&
+		    list_is_empty(&s->mlbs_free) &&
+		    (cq->mlcq_state & MLXCX_CQ_TEARDOWN) == 0) {
 			cv_wait(&s->mlbs_free_nonempty, &s->mlbs_mtx);
+		}
+
+		draining = (s->mlbs_state == MLXCX_SHARD_DRAINING);
 		mutex_exit(&s->mlbs_mtx);
 
 		mutex_enter(&cq->mlcq_mtx);
 		mutex_enter(&wq->mlwq_mtx);
 
-		if ((cq->mlcq_state & MLXCX_CQ_TEARDOWN) != 0) {
+		if (draining || (cq->mlcq_state & MLXCX_CQ_TEARDOWN) != 0) {
 			refill = B_FALSE;
 			wq->mlwq_state &= ~MLXCX_WQ_REFILLING;
 		} else {
@@ -1851,7 +1863,10 @@ mlxcx_rq_refill(mlxcx_t *mlxp, mlxcx_work_queue_t *mlwq)
 	target = mlwq->mlwq_nents - MLXCX_RQ_REFILL_STEP;
 	cq = mlwq->mlwq_cq;
 
-	if (cq->mlcq_state & MLXCX_CQ_TEARDOWN)
+	if ((mlwq->mlwq_state & MLXCX_WQ_STARTED) == 0)
+		return;
+
+	if ((cq->mlcq_state & MLXCX_CQ_TEARDOWN) != 0)
 		return;
 
 	current = cq->mlcq_bufcnt;
@@ -1883,7 +1898,7 @@ mlxcx_rq_refill(mlxcx_t *mlxp, mlxcx_work_queue_t *mlwq)
 			return;
 		}
 
-		if (mlwq->mlwq_state & MLXCX_WQ_TEARDOWN) {
+		if ((mlwq->mlwq_state & MLXCX_WQ_TEARDOWN) != 0) {
 			for (i = 0; i < n; ++i)
 				mlxcx_buf_return(mlxp, b[i]);
 			return;
@@ -2058,7 +2073,6 @@ mlxcx_rx_completion(mlxcx_t *mlxp, mlxcx_completion_queue_t *mlcq,
 	wqe_index = buf->mlb_wqe_index;
 
 	if (!mlxcx_buf_loan(mlxp, buf)) {
-		mlxcx_warn(mlxp, "!loan failed, dropping packet");
 		mlxcx_buf_return(mlxp, buf);
 		return (NULL);
 	}
@@ -2101,16 +2115,11 @@ mlxcx_buf_mp_return(caddr_t arg)
 	mlxcx_buffer_t *b = (mlxcx_buffer_t *)arg;
 	mlxcx_t *mlxp = b->mlb_mlx;
 
-	if (b->mlb_state != MLXCX_BUFFER_ON_LOAN) {
-		b->mlb_mp = NULL;
-		return;
-	}
-	/*
-	 * The mblk for this buffer_t (in its mlb_mp field) has been used now,
-	 * so NULL it out.
-	 */
+	/* The mblk has been used now, so NULL it out. */
 	b->mlb_mp = NULL;
-	mlxcx_buf_return(mlxp, b);
+
+	if (b->mlb_state == MLXCX_BUFFER_ON_LOAN)
+		mlxcx_buf_return(mlxp, b);
 }
 
 boolean_t
@@ -2177,6 +2186,11 @@ mlxcx_buf_take_foreign(mlxcx_t *mlxp, mlxcx_work_queue_t *wq)
 	mlxcx_buf_shard_t *s = wq->mlwq_foreign_bufs;
 
 	mutex_enter(&s->mlbs_mtx);
+	if (s->mlbs_state != MLXCX_SHARD_READY) {
+		mutex_exit(&s->mlbs_mtx);
+		return (NULL);
+	}
+
 	if ((b = list_remove_head(&s->mlbs_free)) != NULL) {
 		ASSERT3U(b->mlb_state, ==, MLXCX_BUFFER_FREE);
 		ASSERT(b->mlb_foreign);
@@ -2345,6 +2359,11 @@ mlxcx_buf_take(mlxcx_t *mlxp, mlxcx_work_queue_t *wq)
 	mlxcx_buf_shard_t *s = wq->mlwq_bufs;
 
 	mutex_enter(&s->mlbs_mtx);
+	if (s->mlbs_state != MLXCX_SHARD_READY) {
+		mutex_exit(&s->mlbs_mtx);
+		return (NULL);
+	}
+
 	if ((b = list_remove_head(&s->mlbs_free)) != NULL) {
 		ASSERT3U(b->mlb_state, ==, MLXCX_BUFFER_FREE);
 		b->mlb_state = MLXCX_BUFFER_ON_WQ;
@@ -2366,6 +2385,11 @@ mlxcx_buf_take_n(mlxcx_t *mlxp, mlxcx_work_queue_t *wq,
 	s = wq->mlwq_bufs;
 
 	mutex_enter(&s->mlbs_mtx);
+	if (s->mlbs_state != MLXCX_SHARD_READY) {
+		mutex_exit(&s->mlbs_mtx);
+		return (0);
+	}
+
 	while (done < nbufs && (b = list_remove_head(&s->mlbs_free)) != NULL) {
 		ASSERT3U(b->mlb_state, ==, MLXCX_BUFFER_FREE);
 		b->mlb_state = MLXCX_BUFFER_ON_WQ;
@@ -2379,6 +2403,8 @@ mlxcx_buf_take_n(mlxcx_t *mlxp, mlxcx_work_queue_t *wq,
 boolean_t
 mlxcx_buf_loan(mlxcx_t *mlxp, mlxcx_buffer_t *b)
 {
+	mlxcx_buf_shard_t *s = b->mlb_shard;
+
 	VERIFY3U(b->mlb_state, ==, MLXCX_BUFFER_ON_WQ);
 	ASSERT3P(b->mlb_mlx, ==, mlxp);
 
@@ -2391,6 +2417,12 @@ mlxcx_buf_loan(mlxcx_t *mlxp, mlxcx_buffer_t *b)
 
 	b->mlb_state = MLXCX_BUFFER_ON_LOAN;
 	b->mlb_wqe_index = 0;
+
+	mutex_enter(&s->mlbs_mtx);
+	list_remove(&s->mlbs_busy, b);
+	list_insert_tail(&s->mlbs_loaned, b);
+	mutex_exit(&s->mlbs_mtx);
+
 	return (B_TRUE);
 }
 
@@ -2453,7 +2485,23 @@ mlxcx_buf_return(mlxcx_t *mlxp, mlxcx_buffer_t *b)
 		break;
 	case MLXCX_BUFFER_ON_LOAN:
 		ASSERT(!b->mlb_foreign);
-		list_remove(&s->mlbs_busy, b);
+		list_remove(&s->mlbs_loaned, b);
+		if (s->mlbs_state == MLXCX_SHARD_DRAINING) {
+			/*
+			 * When we're draining, Eg during mac_stop(),
+			 * we destroy the buffer immediately rather than
+			 * recycling it. Otherwise we risk leaving it
+			 * on the free list and leaking it.
+			 */
+			list_insert_tail(&s->mlbs_free, b);
+			mlxcx_buf_destroy(mlxp, b);
+			/*
+			 * Teardown might be waiting for loaned list to empty.
+			 */
+			cv_broadcast(&s->mlbs_free_nonempty);
+			mutex_exit(&s->mlbs_mtx);
+			return;
+		}
 		break;
 	case MLXCX_BUFFER_FREE:
 		VERIFY(0);
@@ -2466,7 +2514,7 @@ mlxcx_buf_return(mlxcx_t *mlxp, mlxcx_buffer_t *b)
 	}
 
 	list_insert_tail(&s->mlbs_free, b);
-	cv_signal(&s->mlbs_free_nonempty);
+	cv_broadcast(&s->mlbs_free_nonempty);
 
 	mutex_exit(&s->mlbs_mtx);
 
@@ -2484,9 +2532,11 @@ void
 mlxcx_buf_destroy(mlxcx_t *mlxp, mlxcx_buffer_t *b)
 {
 	mlxcx_buf_shard_t *s = b->mlb_shard;
+
 	VERIFY(b->mlb_state == MLXCX_BUFFER_FREE ||
 	    b->mlb_state == MLXCX_BUFFER_INIT);
 	ASSERT(mutex_owned(&s->mlbs_mtx));
+
 	if (b->mlb_state == MLXCX_BUFFER_FREE)
 		list_remove(&s->mlbs_free, b);
 
@@ -2506,3 +2556,20 @@ mlxcx_buf_destroy(mlxcx_t *mlxp, mlxcx_buffer_t *b)
 
 	kmem_cache_free(mlxp->mlx_bufs_cache, b);
 }
+
+void
+mlxcx_shard_ready(mlxcx_buf_shard_t *s)
+{
+	mutex_enter(&s->mlbs_mtx);
+	s->mlbs_state = MLXCX_SHARD_READY;
+	mutex_exit(&s->mlbs_mtx);
+}
+
+void
+mlxcx_shard_draining(mlxcx_buf_shard_t *s)
+{
+	mutex_enter(&s->mlbs_mtx);
+	s->mlbs_state = MLXCX_SHARD_DRAINING;
+	cv_broadcast(&s->mlbs_free_nonempty);
+	mutex_exit(&s->mlbs_mtx);
+}
diff --git a/usr/src/uts/intel/audio/Makefile b/usr/src/uts/intel/audio/Makefile
index 3a7a1d6c21..04b193ee64 100644
--- a/usr/src/uts/intel/audio/Makefile
+++ b/usr/src/uts/intel/audio/Makefile
@@ -36,7 +36,6 @@ UTSBASE = ../..
 #
 MODULE		= audio
 OBJECTS		= $(AUDIO_OBJS:%=$(OBJS_DIR)/%)
-LINTS		= $(AUDIO_OBJS:%.o=$(LINTS_DIR)/%.ln)
 ROOTMODULE	= $(ROOT_DRV_DIR)/$(MODULE)
 CONF_SRCDIR	= $(UTSBASE)/common/io/audio/impl
 
@@ -47,14 +46,10 @@ include $(UTSBASE)/intel/Makefile.intel
 
 CERRWARN	+= $(CNOWARN_UNINIT)
 
-# needs work
-$(OBJS_DIR)/audio_grc3.o := SMOFF += index_overflow
-
 #
 #	Define targets
 #
 ALL_TARGET	= $(BINARY) $(SRC_CONFFILE)
-LINT_TARGET	= $(MODULE).lint
 INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 
 #
@@ -70,12 +65,6 @@ clean:		$(CLEAN_DEPS)
 
 clobber:	$(CLOBBER_DEPS)
 
-lint:		$(LINT_DEPS)
-
-modlintlib:	$(MODLINTLIB_DEPS)
-
-clean.lint:	$(CLEAN_LINT_DEPS)
-
 install:	$(INSTALL_DEPS)
 
 #
diff --git a/usr/src/uts/sparc/audio/Makefile b/usr/src/uts/sparc/audio/Makefile
index a77b4bd8c1..8721dc9800 100644
--- a/usr/src/uts/sparc/audio/Makefile
+++ b/usr/src/uts/sparc/audio/Makefile
@@ -37,7 +37,6 @@ UTSBASE = ../..
 #
 MODULE		= audio
 OBJECTS		= $(AUDIO_OBJS:%=$(OBJS_DIR)/%)
-LINTS		= $(AUDIO_OBJS:%.o=$(LINTS_DIR)/%.ln)
 ROOTMODULE	= $(ROOT_DRV_DIR)/$(MODULE)
 CONF_SRCDIR	= $(UTSBASE)/common/io/audio/impl
 
@@ -52,7 +51,6 @@ CERRWARN	+= $(CNOWARN_UNINIT)
 #	Define targets
 #
 ALL_TARGET	= $(BINARY) $(SRC_CONFFILE)
-LINT_TARGET	= $(MODULE).lint
 INSTALL_TARGET	= $(BINARY) $(ROOTMODULE) $(ROOT_CONFFILE)
 
 #
@@ -68,12 +66,6 @@ clean:		$(CLEAN_DEPS)
 
 clobber:	$(CLOBBER_DEPS)
 
-lint:		$(LINT_DEPS)
-
-modlintlib:	$(MODLINTLIB_DEPS)
-
-clean.lint:	$(CLEAN_LINT_DEPS)
-
 install:	$(INSTALL_DEPS)
 
 #
diff --git a/usr/src/uts/sun4/os/machdep.c b/usr/src/uts/sun4/os/machdep.c
index 4409f2ad8f..ca06f151c9 100644
--- a/usr/src/uts/sun4/os/machdep.c
+++ b/usr/src/uts/sun4/os/machdep.c
@@ -901,11 +901,6 @@ lbolt_softint_post(void)
 }
 
 void
-thread_splitstack_run(caddr_t addr, void (*func)(void *), void *)
+do_hotinlines(struct module *mp __unused)
 {
-	panic("thread_splitstack() not supported on SPARC");
 }
-
-void
-thread_splitstack_cleanup(void)
-{}