Pullup ticket #6493 - requested by taca

net/bind916: security fix

Revisions pulled up:
- net/bind916/Makefile                                          1.20-1.25
- net/bind916/distinfo                                          1.17-1.21
- net/bind916/patches/patch-lib_dns_include_dns_zone.h          1.2
- net/bind916/patches/patch-lib_dns_zone.c                      1.3-1.4
- net/bind916/patches/patch-lib_isc_include_isc_types.h         1.3
- net/bind916/patches/patch-lib_isc_stats.c                     1.2
- net/bind916/patches/patch-lib_ns_client.c                     1.4
- net/bind916/patches/patch-lib_ns_include_ns_client.h          1.2

---
   Module Name:	pkgsrc
   Committed By:	rin
   Date:		Tue Jul 20 06:39:45 UTC 2021

   Modified Files:
   	pkgsrc/net/bind916: Makefile distinfo
   	pkgsrc/net/bind916/patches: patch-lib_dns_include_dns_zone.h
   	    patch-lib_dns_zone.c patch-lib_isc_stats.c
   	    patch-lib_ns_include_ns_client.h
   Added Files:
   	pkgsrc/net/bind916/patches: patch-lib_isc_include_isc_types.h
   	    patch-lib_ns_client.c

   Log Message:
   net/bind916 Use atomic 32-bit integers where appropriate, revision++

   Mostly taken from NetBSD base:

   - For counters, make sure to use 32-bit integers for !_LP64 platforms.
     In the previous revisions, this is partially done, i.e., incomplete.

   - For flags fit within 32-bit width, use 32-bit integers for everyone.
     In the previous, this is incomplete, and restricted for __NetBSD__.
     Fix and generalize to everyone.

   - Make comments in patches more helpful.

   Fix build for ILP32 platforms as reported in PR pkg/56315.

   Thanks jklos@ for testing.

---
   Module Name:	pkgsrc
   Committed By:	rin
   Date:		Tue Jul 20 06:41:46 UTC 2021

   Modified Files:
   	pkgsrc/net/bind916: Makefile

   Log Message:
   net/bind916 --disable-atomic is no longer supported

---
   Module Name:	pkgsrc
   Committed By:	rin
   Date:		Tue Jul 20 07:23:04 UTC 2021

   Modified Files:
   	pkgsrc/net/bind916: distinfo
   	pkgsrc/net/bind916/patches: patch-lib_dns_zone.c

   Log Message:
   net/bind916: Oops, fix reversed ``#if''

---
   Module Name:	pkgsrc
   Committed By:	he
   Date:		Thu Jul 22 13:30:24 UTC 2021

   Modified Files:
   	pkgsrc/net/bind916: Makefile distinfo

   Log Message:
   Upgrade net/bind916 to version 9.16.19.

   Upstream changes:

           --- 9.16.19 released ---

   5671.   [bug]           A race condition could occur where two threads were
                           competing for the same set of key file locks, leading to
                           a deadlock. This has been fixed. [GL #2786]

   5670.   [bug]           create_keydata() created an invalid placeholder keydata
                           record upon a refresh failure, which prevented the
                           database of managed keys from subsequently being read
                           back. This has been fixed. [GL #2686]

   5669.   [func]          KASP support was extended with the "check DS" feature.
                           Zones with "dnssec-policy" and "parental-agents"
                           configured now check for DS presence and can perform
                           automatic KSK rollovers. [GL #1126]

   5668.   [bug]           Rescheduling a setnsec3param() task when a zone failed
                           to load on startup caused a hang on shutdown. This has
                           been fixed. [GL #2791]

   5667.   [bug]           The configuration-checking code failed to account for
                           the inheritance rules of the "dnssec-policy" option.
                           This has been fixed. [GL #2780]

   5666.   [doc]           The safe "edns-udp-size" value was tweaked to match the
                           probing value from BIND 9.16 for better compatibility.
                           [GL #2183]

   5665.   [bug]           If nsupdate sends an SOA request and receives a REFUSED
                           response, it now fails over to the next available
                           server. [GL #2758]

   5664.   [func]          For UDP messages larger than the path MTU, named now
                           sends an empty response with the TC (TrunCated) bit set.
                           In addition, setting the DF (Don't Fragment) flag on
                           outgoing UDP sockets was re-enabled. [GL #2790]

   5662.   [bug]           Views with recursion disabled are now configured with a
                           default cache size of 2 MB unless "max-cache-size" is
                           explicitly set. This prevents cache RBT hash tables from
                           being needlessly preallocated for such views. [GL #2777]

   5661.   [bug]           Change 5644 inadvertently introduced a deadlock: when
                           locking the key file mutex for each zone structure in a
                           different view, the "in-view" logic was not considered.
                           This has been fixed. [GL #2783]

   5658.   [bug]           Increasing "max-cache-size" for a running named instance
                           (using "rndc reconfig") did not cause the hash tables
                           used by cache databases to be grown accordingly. This
                           has been fixed. [GL #2770]

   5655.   [bug]           Signed, insecure delegation responses prepared by named
                           either lacked the necessary NSEC records or contained
                           duplicate NSEC records when both wildcard expansion and
                           CNAME chaining were required to prepare the response.
                           This has been fixed. [GL #2759]

   5653.   [bug]           A bug that caused the NSEC3 salt to be changed on every
                           restart for zones using KASP has been fixed. [GL #2725]

---
   Module Name:	pkgsrc
   Committed By:	jklos
   Date:		Mon Aug  2 18:45:35 UTC 2021

   Modified Files:
   	pkgsrc/net/bind916: Makefile

   Log Message:
   Fixed COMMENT because package is at 9.16.

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Thu Aug 19 03:33:49 UTC 2021

   Modified Files:
   	pkgsrc/net/bind916: Makefile distinfo

   Log Message:
   net/bind916: update to 9.16.20

   This update contains security fix: CVE-2021-25218.

   	--- 9.16.20 released ---

   5689.	[security]	An assertion failure occurred when named attempted to
   			send a UDP packet that exceeded the MTU size, if
   			Response Rate Limiting (RRL) was enabled.
   			(CVE-2021-25218) [GL #2856]

   5688.	[bug]		Zones using KASP and inline-signed zones failed to apply
   			changes from the unsigned zone to the signed zone under
   			certain circumstances. This has been fixed. [GL #2735]

   5687.	[bug]		"rndc reload <zonename>" could trigger a redundant
   			reload for an inline-signed zone whose zone file was not
   			modified since the last "rndc reload". This has been
   			fixed. [GL #2855]

   5686.	[func]		The number of internal data structures allocated for
   			each zone was reduced. [GL #2829]

   5685.	[bug]		named failed to check the opcode of responses when
   			performing zone refreshes, stub zone updates, and UPDATE
   			forwarding. This has been fixed. [GL #2762]

   5682.	[bug]		Some changes to "zone-statistics" settings were not
   			properly processed by "rndc reconfig". This has been
   			fixed. [GL #2820]

   5681.	[func]		Relax the checks in the dns_zone_cdscheck() function to
   			allow CDS and CDNSKEY records in the zone that do not
   			match an existing DNSKEY record, as long as the
   			algorithm matches. This allows a clean rollover from one
   			provider to another in a multi-signer DNSSEC
   			configuration. [GL #2710]

   5679.	[func]		Thread affinity is no longer set. [GL #2822]

   5678.	[bug]		The "check DS" code failed to release all resources upon
   			named shutdown when a refresh was in progress. This has
   			been fixed. [GL #2811]

   5672.	[bug]		Authentication of rndc messages could fail if a
   			"controls" statement was configured with multiple key
   			algorithms for the same listener. This has been fixed.
   			[GL #2756]

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Sat Aug 21 03:55:54 UTC 2021

   Modified Files:
   	pkgsrc/net/bind916: Makefile distinfo

   Log Message:
   net/bind916: add patch for map zone file problem

   Add patch: <https://kb.isc.org/docs/map-zone-format-incompatibility-in-bind-9-16-20-and-9-17-17>.

   Bump PKGREVISION.

8 files changed, 78 insertions, 38 deletions

diff --git a/net/bind916/Makefile b/net/bind916/Makefile
index 684e5b7e0f1..92cddc9f059 100644
--- a/net/bind916/Makefile
+++ b/net/bind916/Makefile
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.18 2021/06/19 13:18:21 otis Exp $
+# $NetBSD: Makefile,v 1.18.2.1 2021/08/28 09:22:55 bsiegert Exp $
 
 DISTNAME=	bind-${BIND_VERSION}
 PKGNAME=	${DISTNAME:S/-P/pl/}
@@ -6,16 +6,20 @@ CATEGORIES=	net
 MASTER_SITES=	ftp://ftp.isc.org/isc/bind9/${BIND_VERSION}/
 EXTRACT_SUFX=	.tar.xz
 
+PATCH_SITES=		https://downloads.isc.org/isc/bind9/9.16.20/patches/
+PATCHFILES=		bind-9.16.20-map-format-fix.patch
+PATCH_DIST_STRIP=	-p1
+
 MAINTAINER=	pkgsrc-users@NetBSD.org
 HOMEPAGE=	https://www.isc.org/software/bind/
-COMMENT=	Berkeley Internet Name Daemon implementation of DNS, version 9.14
+COMMENT=	Berkeley Internet Name Daemon implementation of DNS, version 9.16
 LICENSE=	mpl-2.0
 
 CONFLICTS+=	host-[0-9]*
 
 MAKE_JOBS_SAFE=	no
 
-BIND_VERSION=	9.16.18
+BIND_VERSION=	9.16.20
 
 BUILD_DEFS+=	BIND_DIR VARBASE
 
@@ -36,12 +40,6 @@ CONFIGURE_ARGS+=		--sysconfdir=${PKG_SYSCONFDIR}
 CONFIGURE_ARGS+=		--localstatedir=${VARBASE}
 CONFIGURE_ARGS+=		--with-openssl=${SSLBASE:Q}
 CONFIGURE_ARGS+=		--with-python=no
-.if !empty(MACHINE_PLATFORM:MNetBSD-*-m68k) || \
-    !empty(MACHINE_PLATFORM:MNetBSD-*-mipsel) || \
-    !empty(MACHINE_PLATFORM:MNetBSD-*-vax) || \
-    !empty(MACHINE_PLATFORM:MNetBSD-*-i386)
-CONFIGURE_ARGS+=		--disable-atomic
-.endif
 CONFIGURE_ARGS.DragonFly+=	--disable-kqueue
 CONFIGURE_ARGS.SunOS+=		--disable-epoll
 
diff --git a/net/bind916/distinfo b/net/bind916/distinfo
index 5378627e4c6..edb1fbb47da 100644
--- a/net/bind916/distinfo
+++ b/net/bind916/distinfo
@@ -1,9 +1,13 @@
-$NetBSD: distinfo,v 1.16 2021/06/19 13:18:21 otis Exp $
+$NetBSD: distinfo,v 1.16.2.1 2021/08/28 09:22:55 bsiegert Exp $
 
-SHA1 (bind-9.16.18.tar.xz) = d4d5dc9097647a75732ff3fdd9ed370bb3bca7d4
-RMD160 (bind-9.16.18.tar.xz) = c26ba6a638f4dafe766fff7c45ee22d3fe56c049
-SHA512 (bind-9.16.18.tar.xz) = 6ba2f14324ebdc66d2a6d60e929fb47e170dd7662cf4b18ef3ad9da30a61b43c7d5539e931c483ab36e63ae0398aeed255fd672489fb332dccf182df9aa102f9
-Size (bind-9.16.18.tar.xz) = 5023512 bytes
+SHA1 (bind-9.16.20-map-format-fix.patch) = 8c3a0b8f5c375c798563ae597a23f4be482ab68f
+RMD160 (bind-9.16.20-map-format-fix.patch) = 7a1beddce439359117f7b94befafacfd3e9a9121
+SHA512 (bind-9.16.20-map-format-fix.patch) = d9224712ee2c6f6d0ff483ed253497548935fe35f45e5bdf26c9bd25c6234adde00727df7eb49fbfbfb34aad9d9fa0f112e900804794ad90a5cd8a64e9db61c6
+Size (bind-9.16.20-map-format-fix.patch) = 258 bytes
+SHA1 (bind-9.16.20.tar.xz) = 771bbb31ab0bfcf3f50effa0af4df6014853ac86
+RMD160 (bind-9.16.20.tar.xz) = d8104c704a599b9d3bd4247bfe22ea0f8f60e559
+SHA512 (bind-9.16.20.tar.xz) = bd4ffcc2589ca8f1ac228576ec11e86f317d5a78d7964a0a7ae70b2fa38831d5bd65c2e8c35d8190502de7139f85d8b080b3b8ee968811a8df78e5761781525d
+Size (bind-9.16.20.tar.xz) = 5042196 bytes
 SHA1 (patch-bin_dig_dighost.c) = b1073911d80ecd519af98b6678968296ff8c0c98
 SHA1 (patch-bin_dig_include_dig_dig.h) = 10166f5bb98b208c7b10d63eb31e8253f704acc8
 SHA1 (patch-bin_named_Makefile.in) = f1367da6a226ba44d0ee13acf00b8abeb5b1b7eb
@@ -23,7 +27,7 @@ SHA1 (patch-contrib_dlz_modules_wildcard_dlz__wildcard__dynamic.c) = 37ba5f06f49
 SHA1 (patch-lib_dns_byaddr.c) = 647ddaaaf040233e18d1a87d83bc2bd63d2a20e3
 SHA1 (patch-lib_dns_dnsrps.c) = b4c66a808eeb1e859801028afacd7237cd89903a
 SHA1 (patch-lib_dns_gssapi__link.c) = acd5f3c975d4edf391e77fd39cfa91810ad17ba2
-SHA1 (patch-lib_dns_include_dns_zone.h) = 8abf4c18935629624e68a14361dbeaf00a440c90
+SHA1 (patch-lib_dns_include_dns_zone.h) = aafd99bf0b0c84aa69b444106608c6cff61938f1
 SHA1 (patch-lib_dns_lookup.c) = 6c7463aca16abf6bd578aba1733a3217608a39d3
 SHA1 (patch-lib_dns_peer.c) = 16cc26fd4e792a23caef6e091f94f974041179e7
 SHA1 (patch-lib_dns_pkcs11ecdsa__link.c) = 99f386b056c5a6471f69841c41a2698d36b6b275
@@ -35,23 +39,21 @@ SHA1 (patch-lib_dns_sdb.c) = ed447ec7a134e620765b25ee36124a19dfd9fab0
 SHA1 (patch-lib_dns_sdlz.c) = 4fc15a577c64501c10c144eab147e54686e80309
 SHA1 (patch-lib_dns_validator.c) = 03dd60d4c38be7248d1e07f2c29ddd543b5f7454
 SHA1 (patch-lib_dns_view.c) = 5b092f0344b92d003f1fe1f28e4cc4c76b2505cf
-SHA1 (patch-lib_dns_zone.c) = cad37c0fc4a05a2adb6159d4e1453fdbd3f08b41
+SHA1 (patch-lib_dns_zone.c) = 04a224863c8860c5f1b5bf4291b1af920c57fcd2
 SHA1 (patch-lib_isc_backtrace.c) = 1b6bca9b3de7f7298882c6c88274b0baf1dad507
 SHA1 (patch-lib_isc_include_isc_netmgr.h) = 48ac44c6a9b81e6b442deba6c075653d3691464b
 SHA1 (patch-lib_isc_include_isc_socket.h) = dc6376cd9e8391fa96efd805faee1a5d0647a142
-SHA1 (patch-lib_isc_include_isc_types.h) = bc0cdeb762d974b7be6e602b7dc2aac17fa7fe2f
-SHA1 (patch-lib_isc_include_isc_util.h) = 4a3998c2f0c95bffedf2e00b16a9c80475159775
+SHA1 (patch-lib_isc_include_isc_types.h) = e5fcf15ee03d1d032a67f2e6d23b2e409042ab64
 SHA1 (patch-lib_isc_netmgr_netmgr.c) = 63168c8901646e7b2079e1dc3324087508bb1e62
 SHA1 (patch-lib_isc_rwlock.c) = 1d114248ddee20db7a7429afab446f8b2f0dca82
-SHA1 (patch-lib_isc_stats.c) = 024a372d9919fa751b894f8fc8267691297f00f4
-SHA1 (patch-lib_isc_task.c) = 1947084d986f8e7fda5babd308171c498e20b7ec
+SHA1 (patch-lib_isc_stats.c) = 8d962fa360740770588fccf1d303d7fe22ae724b
 SHA1 (patch-lib_isc_unix_include_isc_align.h) = 1bbd78f1617a40079d1044175cfe037bbd1d95b2
 SHA1 (patch-lib_isc_unix_net.c) = c654f60a1feefdba9bf980dcfa46ce37f46918aa
 SHA1 (patch-lib_isc_unix_socket.c) = ed1816b50698107cb2034e0e3c61406ee458e697
 SHA1 (patch-lib_isc_unix_time.c) = fac9e66754e099f53ba8c499f5f179825a0b0fbd
 SHA1 (patch-lib_ns_Makefile.in) = 5d3ecf4d6673cf227635c03779e9969e6eeb8227
-SHA1 (patch-lib_ns_client.c) = c5d9e41f58027bdfa6a1cb43cd2cd35b44e85227
-SHA1 (patch-lib_ns_include_ns_client.h) = 56009c601d54491ffd16f6438d55206705a5aa23
+SHA1 (patch-lib_ns_client.c) = db2ee0cc915f20ae09beb2c8a917e0b3e60dfedc
+SHA1 (patch-lib_ns_include_ns_client.h) = 3ccd630aee77ea638fb3b954b85bad9c74b0c86e
 SHA1 (patch-lib_ns_include_ns_pfilter.h) = cc86752971b4f9f7492283c4ad3ff29bc1bae237
 SHA1 (patch-lib_ns_interfacemgr.c) = fc31720734b02155acd7fa9b370a6ebb82022532
 SHA1 (patch-lib_ns_pfilter.c) = 8f4a3b3a729360a131eb1962c42a9f9f985c7e7b
diff --git a/net/bind916/patches/patch-lib_dns_include_dns_zone.h b/net/bind916/patches/patch-lib_dns_include_dns_zone.h
index 049957322f7..220d92ab348 100644
--- a/net/bind916/patches/patch-lib_dns_include_dns_zone.h
+++ b/net/bind916/patches/patch-lib_dns_include_dns_zone.h
@@ -1,6 +1,6 @@
-$NetBSD: patch-lib_dns_include_dns_zone.h,v 1.1 2020/08/09 15:20:22 taca Exp $
+$NetBSD: patch-lib_dns_include_dns_zone.h,v 1.1.8.1 2021/08/28 09:22:55 bsiegert Exp $
 
-* Take from NetBSD base.
+No need to use atomic 64-bit integers for flags fit within 32-bit width.
 
 --- lib/dns/include/dns/zone.h.orig	2020-05-06 09:59:35.000000000 +0000
 +++ lib/dns/include/dns/zone.h
@@ -8,7 +8,7 @@ $NetBSD: patch-lib_dns_include_dns_zone.h,v 1.1 2020/08/09 15:20:22 taca Exp $
  	DNS_ZONEOPT_CHECKSPF = 1 << 27,		/*%< check SPF records */
  	DNS_ZONEOPT_CHECKTTL = 1 << 28,		/*%< check max-zone-ttl */
  	DNS_ZONEOPT_AUTOEMPTY = 1 << 29,	/*%< automatic empty zone */
-+#ifndef __NetBSD__
++#if 0
  	DNS_ZONEOPT___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 +#endif
  } dns_zoneopt_t;
@@ -18,7 +18,7 @@ $NetBSD: patch-lib_dns_include_dns_zone.h,v 1.1 2020/08/09 15:20:22 taca Exp $
  	DNS_ZONEKEY_CREATE = 0x00000004U,   /*%< make keys when needed */
  	DNS_ZONEKEY_FULLSIGN = 0x00000008U, /*%< roll to new keys immediately */
  	DNS_ZONEKEY_NORESIGN = 0x00000010U, /*%< no automatic resigning */
-+#ifndef __NetBSD__
++#if 0
  	DNS_ZONEKEY___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
 +#endif
  } dns_zonekey_t;
diff --git a/net/bind916/patches/patch-lib_dns_zone.c b/net/bind916/patches/patch-lib_dns_zone.c
index 557cd8f9464..856d9d7d590 100644
--- a/net/bind916/patches/patch-lib_dns_zone.c
+++ b/net/bind916/patches/patch-lib_dns_zone.c
@@ -1,14 +1,14 @@
-$NetBSD: patch-lib_dns_zone.c,v 1.2 2021/03/21 04:16:17 taca Exp $
+$NetBSD: patch-lib_dns_zone.c,v 1.2.4.1 2021/08/28 09:22:55 bsiegert Exp $
 
-* Take from NetBSD base.
+No need to use atomic 64-bit integers for flags fit within 32-bit width.
 
---- lib/dns/zone.c.orig	2021-03-11 13:20:59.000000000 +0000
-+++ lib/dns/zone.c
-@@ -224,8 +224,13 @@ struct dns_zone {
+--- lib/dns/zone.c.orig	2021-06-18 19:08:07.000000000 +0900
++++ lib/dns/zone.c	2021-07-19 08:46:21.613595923 +0900
+@@ -241,8 +241,13 @@ struct dns_zone {
  	int32_t journalsize;
  	dns_rdataclass_t rdclass;
  	dns_zonetype_t type;
-+#ifdef __NetBSD__
++#if 1
 +	atomic_uint_fast32_t flags;
 +	atomic_uint_fast32_t options;
 +#else
@@ -18,11 +18,11 @@ $NetBSD: patch-lib_dns_zone.c,v 1.2 2021/03/21 04:16:17 taca Exp $
  	unsigned int db_argc;
  	char **db_argv;
  	isc_time_t expiretime;
-@@ -370,7 +375,11 @@ struct dns_zone {
+@@ -387,7 +392,11 @@ struct dns_zone {
  	/*%
  	 * Autosigning/key-maintenance options
  	 */
-+#ifdef __NetBSD__
++#if 1
 +	atomic_uint_fast32_t keyopts;
 +#else
  	atomic_uint_fast64_t keyopts;
@@ -30,3 +30,13 @@ $NetBSD: patch-lib_dns_zone.c,v 1.2 2021/03/21 04:16:17 taca Exp $
  
  	/*%
  	 * True if added by "rndc addzone"
+@@ -524,7 +533,9 @@ typedef enum {
+ 	 * support 64-bit enum values. Currently they fail on
+ 	 * Windows.
+ 	 */
++#if 0
+ 	DNS_ZONEFLG___MAX = UINT64_MAX, /* trick to make the ENUM 64-bit wide */
++#endif
+ } dns_zoneflg_t;
+ 
+ #define DNS_ZONE_OPTION(z, o)	 ((atomic_load_relaxed(&(z)->options) & (o)) != 0)
diff --git a/net/bind916/patches/patch-lib_isc_include_isc_types.h b/net/bind916/patches/patch-lib_isc_include_isc_types.h
new file mode 100644
index 00000000000..0a91a07e925
--- /dev/null
+++ b/net/bind916/patches/patch-lib_isc_include_isc_types.h
@@ -0,0 +1,15 @@
+$NetBSD: patch-lib_isc_include_isc_types.h,v 1.3.2.2 2021/08/28 09:22:55 bsiegert Exp $
+
+Use 32-bit atomic integers for !_LP64 platforms.
+
+--- lib/isc/include/isc/types.h.orig	2021-07-19 01:22:42.547182690 +0900
++++ lib/isc/include/isc/types.h	2021-07-19 01:22:47.029721976 +0900
+@@ -83,7 +83,7 @@ typedef struct isc_socket      isc_socke
+ typedef struct isc_socketevent isc_socketevent_t;     /*%< Socket Event */
+ typedef struct isc_socketmgr   isc_socketmgr_t;	      /*%< Socket Manager */
+ typedef struct isc_stats       isc_stats_t;	      /*%< Statistics */
+-#if defined(_WIN32) && !defined(_WIN64)
++#if (defined(_WIN32) && !defined(_WIN64)) || !defined(_LP64)
+ typedef int_fast32_t isc_statscounter_t; /*%< Statistics Counter */
+ #else  /* if defined(_WIN32) && !defined(_WIN64) */
+ typedef int_fast64_t isc_statscounter_t;
diff --git a/net/bind916/patches/patch-lib_isc_stats.c b/net/bind916/patches/patch-lib_isc_stats.c
index 24d963212a7..80ecb27627e 100644
--- a/net/bind916/patches/patch-lib_isc_stats.c
+++ b/net/bind916/patches/patch-lib_isc_stats.c
@@ -1,6 +1,6 @@
-$NetBSD: patch-lib_isc_stats.c,v 1.1 2020/08/09 15:20:22 taca Exp $
+$NetBSD: patch-lib_isc_stats.c,v 1.1.8.1 2021/08/28 09:22:55 bsiegert Exp $
 
-* Platform fixes from NetBSD base system.
+Use 32-bit atomic integers for !_LP64 platforms.
 
 --- lib/isc/stats.c.orig	2020-05-06 09:59:35.000000000 +0000
 +++ lib/isc/stats.c
diff --git a/net/bind916/patches/patch-lib_ns_client.c b/net/bind916/patches/patch-lib_ns_client.c
new file mode 100644
index 00000000000..9c3a3bf8a09
--- /dev/null
+++ b/net/bind916/patches/patch-lib_ns_client.c
@@ -0,0 +1,15 @@
+$NetBSD: patch-lib_ns_client.c,v 1.4.2.2 2021/08/28 09:22:55 bsiegert Exp $
+
+Use 32-bit atomic integers for !_LP64 platforms.
+
+--- lib/ns/client.c.orig	2021-07-19 08:32:57.384417149 +0900
++++ lib/ns/client.c	2021-07-19 08:33:25.780329755 +0900
+@@ -126,7 +126,7 @@
+  * Number of tasks to be used by clients - those are used only when recursing
+  */
+ 
+-#if defined(_WIN32) && !defined(_WIN64)
++#if (defined(_WIN32) && !defined(_WIN64)) || !defined(_LP64)
+ LIBNS_EXTERNAL_DATA atomic_uint_fast32_t ns_client_requests =
+ 	ATOMIC_VAR_INIT(0);
+ #else  /* if defined(_WIN32) && !defined(_WIN64) */
diff --git a/net/bind916/patches/patch-lib_ns_include_ns_client.h b/net/bind916/patches/patch-lib_ns_include_ns_client.h
index 02a50cff32f..54c2e831242 100644
--- a/net/bind916/patches/patch-lib_ns_include_ns_client.h
+++ b/net/bind916/patches/patch-lib_ns_include_ns_client.h
@@ -1,6 +1,6 @@
-$NetBSD: patch-lib_ns_include_ns_client.h,v 1.1 2020/08/09 15:20:22 taca Exp $
+$NetBSD: patch-lib_ns_include_ns_client.h,v 1.1.8.1 2021/08/28 09:22:55 bsiegert Exp $
 
-* Take from NetBSD base.
+Use 32-bit atomic integers for !_LP64 platforms.
 
 --- lib/ns/include/ns/client.h.orig	2020-05-06 09:59:35.000000000 +0000
 +++ lib/ns/include/ns/client.h