Release 2.3 (2026/09/20)

New features

Latest changes from FreeBSD main and ports at 2026/09/20
bird2 to bird3 (major version upgrade)
pimd 2.3.2b to 3.1.0 (major version upgrade): the daemon rescans the
kernel interface list while running, so an interface configured after
pimd started (PPP or L2TP link, tunnel, VLAN added in service) becomes
a PIM vif on its own, including the phyint lines of a pimd.conf
naming an interface that did not exist at startup. Daemonizing now
releases the controlling terminal, so a pimd started from its rc script
on a console no longer dies on the next INTR typed there. SSM support
is advertised (PIM-SM/SSM).
Add lab-reinstall-test: remote reinstall via RAM-boot + ssh|dd
Replace gpartfix rc script with stock growfs
Ship additional USB and serial kernel modules
jail tenant tool: add -l flag to list configured jails
Python 3.11 to 3.12; ExaBGP and related tools rebuilt on Python 3.12
New Intel NIC maintenance tools: intel-epct (Ethernet Port
Configuration Tool) and the NVM update utilities for I210, I225/I226
and X550 adapters

config save: validate rc.conf before persisting
config save: exclude ssh agent socket directories from saved config
config: setlock no longer removes another instance's lock, and reports
a failure instead of exiting 0
autosave: a refused instance no longer tears down the running daemon
Add extra delay to reliably detect the UFS label at boot
jail tenant tool: don't fight with autosave, and stop failing on an
existing jail
jail tenant tool: harden against edge cases in cleanup and ID derivation
jail tenant tool: recover gracefully from orphan configs on delete
jail tenant tool: fix broken grep pattern for interface duplicate check
jail tenant tool: trap-based cleanup on partial jail creation failure
jail tenant tool: derive next jail ID from configs, avoid jail.lastid single point of failure

New "simple_tx" transmit path: packets are sent directly while the
transmit queue mutex is available, and only contending threads defer
through a bounded buf_ring. It outperforms mp_ring by a wide margin
when the CPU, not the NIC, is the bottleneck. It is not the default
yet: set the loader tunable net.iflib.prefer_mpring=0 for all iflib
interfaces, or dev.<driver>.<unit>.iflib.simple_tx=1 for one of them.
Related knobs: net.iflib.max_producers,
net.iflib.simple_drain_quota, net.iflib.simple_txbr_size. Note that
tx_abdicate is ignored when simple_tx is used, and simple_tx is
disabled on an interface using ALTQ.
Driver-provided transmit queue selection, RSS configuration queries,
and per-packet RX hardware timestamps plumbed to mbufs
led(4) devices created for the NICs that expose one
TX watchdog now requires sustained demand before firing, and counts
its resets in a sysctl
Many SR-IOV hardening fixes (ice, ixgbe, igbv): VF requests made
idempotent, VFs isolated after malicious-driver detection, mailbox
flood protection, VF status reported through netlink and ifconfig

pf: syncookies are now sent from the receiving thread
pf: a crafted reset packet can no longer drop a TCP state
pf: fragment reassembly key includes the direction
pf: securelevel off-by-one, and several crash fixes (low memory,
sendfile, outbound NULL dereference, overlapping group and interface
names)
pfsync: works over interfaces with a large MTU
libalias: buffer overflow in RTSP aliasing fixed
ipfw/nat64 and nat64lsn: type confusion panic when using the wrong
NAT64 instance type fixed; checksum fixed after NAT
ipfilter: PPTP proxy length underflow fixed

fib-aware address selection: ifa_ifwithroute(), rt_getifa_fib(),
ICMP redirect verification and bind(2) with *.bind_all_fibs all
look the address up in the right FIB
fib_algo: nexthop index collision across address families fixed, and a
radix_masks leak in radix_lockless
Nexthop groups subscribe to interface link events and replace
unreachable nexthops
ICMP redirects only update the FIB the redirect arrived on
netlink: RTA_PREFSRC support, if_gif netlink support, FreeBSD-specific
IFLAF_GROUP, PF command decoding

vlan: the parent is notified when a VLAN ID is replaced
if_bridge: only the inspected headers are pulled up, drops on the
fragmentation path are counted, NULL softc dereference fixed
epair: IFCAP_MEXTPG support, receive checksum offloading can be
disabled
New media types: 800GBase-X, 200Gbit/s per lane, 10GBase-BX BiDi

intel-nvmupdate-100g: renamed upstream to intel-nvmupdate-e810, which
is not in the BSDRP package list: the image no longer carries an NVM
update utility for E810 100G adapters
bird2, python311 and py311-* were upgraded/renamed, not dropped