Index: sys/kern/uipc_socket.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/kern/uipc_socket.c,v
diff -u -p -u -p -r1.347 uipc_socket.c
--- sys/kern/uipc_socket.c	19 Dec 2024 22:11:35 -0000	1.347
+++ sys/kern/uipc_socket.c	23 Dec 2024 21:25:23 -0000
@@ -927,9 +927,11 @@ soreceive(struct socket *so, struct mbuf
 		flags = 0;
 	if (flags & MSG_OOB) {
 		m = m_get(M_WAIT, MT_DATA);
-		solock(so);
+		if (dosolock)
+			solock_shared(so);
 		error = pru_rcvoob(so, m, flags & MSG_PEEK);
-		sounlock(so);
+		if (dosolock)
+			sounlock_shared(so);
 		if (error)
 			goto bad;
 		do {
Index: sys/netinet/in_pcb.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/in_pcb.c,v
diff -u -p -u -p -r1.306 in_pcb.c
--- sys/netinet/in_pcb.c	21 Dec 2024 00:10:04 -0000	1.306
+++ sys/netinet/in_pcb.c	23 Dec 2024 21:25:23 -0000
@@ -923,6 +923,8 @@ in_pcblookup_local_lock(struct inpcbtabl
 struct rtentry *
 in_pcbrtentry(struct inpcb *inp)
 {
+	soassertlocked(inp->inp_socket);
+
 #ifdef INET6
 	if (ISSET(inp->inp_flags, INP_IPV6))
 		return in6_pcbrtentry(inp);
Index: sys/netinet/in_pcb.h
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/in_pcb.h,v
diff -u -p -u -p -r1.160 in_pcb.h
--- sys/netinet/in_pcb.h	21 Dec 2024 00:10:04 -0000	1.160
+++ sys/netinet/in_pcb.h	23 Dec 2024 21:25:23 -0000
@@ -138,7 +138,7 @@ struct inpcb {
 	u_int16_t inp_lport;		/* [t] local port */
 	struct	  socket *inp_socket;	/* [I] back pointer to socket */
 	caddr_t	  inp_ppcb;		/* pointer to per-protocol pcb */
-	struct    route inp_route;	/* cached route */
+	struct    route inp_route;	/* [s] cached route */
 	struct    refcnt inp_refcnt;	/* refcount PCB, delay memory free */
 	int	  inp_flags;		/* generic IP/datagram flags */
 	union {				/* Header prototype. */
Index: sys/netinet/in_proto.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/in_proto.c,v
diff -u -p -u -p -r1.117 in_proto.c
--- sys/netinet/in_proto.c	19 Dec 2024 22:10:35 -0000	1.117
+++ sys/netinet/in_proto.c	23 Dec 2024 21:25:23 -0000
@@ -198,7 +198,7 @@ const struct protosw inetsw[] = {
   .pr_type	= SOCK_STREAM,
   .pr_domain	= &inetdomain,
   .pr_protocol	= IPPROTO_TCP,
-  .pr_flags	= PR_CONNREQUIRED|PR_WANTRCVD|PR_ABRTACPTDIS|PR_SPLICE,
+  .pr_flags	= PR_CONNREQUIRED|PR_WANTRCVD|PR_ABRTACPTDIS|PR_SPLICE|PR_MPSOCKET,
   .pr_input	= tcp_input,
   .pr_ctlinput	= tcp_ctlinput,
   .pr_ctloutput	= tcp_ctloutput,
Index: sys/netinet/ip_input.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/ip_input.c,v
diff -u -p -u -p -r1.402 ip_input.c
--- sys/netinet/ip_input.c	21 Nov 2024 20:15:44 -0000	1.402
+++ sys/netinet/ip_input.c	23 Dec 2024 21:25:23 -0000
@@ -83,23 +83,16 @@
 #include <netinet/ip_carp.h>
 #endif
 
-/*
- * Locks used to protect global variables in this file:
- *	I	immutable after creation
- *	a	atomic operations
- *	N	net lock
- */
-
 /* values controllable via sysctl */
-int	ip_forwarding = 0;			/* [a] */
+int	ip_forwarding = 0;
 int	ipmforwarding = 0;
 int	ipmultipath = 0;
-int	ip_sendredirects = 1;			/* [a] */
+int	ip_sendredirects = 1;
 int	ip_dosourceroute = 0;
 int	ip_defttl = IPDEFTTL;
 int	ip_mtudisc = 1;
 int	ip_mtudisc_timeout = IPMTUDISCTIMEOUT;
-int	ip_directedbcast = 0;			/* [a] */
+int	ip_directedbcast = 0;
 
 /* Protects `ipq' and `ip_frags'. */
 struct mutex	ipq_mutex = MUTEX_INITIALIZER(IPL_SOFTNET);
Index: sys/netinet/ip_var.h
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/ip_var.h,v
diff -u -p -u -p -r1.120 ip_var.h
--- sys/netinet/ip_var.h	12 Jul 2024 19:50:35 -0000	1.120
+++ sys/netinet/ip_var.h	23 Dec 2024 21:25:23 -0000
@@ -36,6 +36,13 @@
 #define _NETINET_IP_VAR_H_
 
 /*
+ * Locks used to protect global variables in this file:
+ *	I	immutable after creation
+ *	a	atomic operations
+ *	N	net lock
+ */
+
+/*
  * Structure stored in mbuf in inpcb.ip_options
  * and passed to ip_output when ip options are in use.
  * The actual length of the options (including ipopt_dst)
@@ -216,19 +223,20 @@ extern int ip_defttl;			/* default IP tt
 
 #define IPMTUDISCTIMEOUT (10 * 60)	/* as per RFC 1191 */
 
-extern int ip_mtudisc;			/* mtu discovery */
+extern int ip_mtudisc;			/* [N] mtu discovery */
 extern int ip_mtudisc_timeout;		/* seconds to timeout mtu discovery */
 
 extern int ipport_firstauto;		/* min port for port allocation */
 extern int ipport_lastauto;		/* max port for port allocation */
 extern int ipport_hifirstauto;		/* min dynamic/private port number */
 extern int ipport_hilastauto;		/* max dynamic/private port number */
-extern int ip_forwarding;		/* enable IP forwarding */
+extern int ip_forwarding;		/* [a] enable IP forwarding */
 #ifdef MROUTING
 extern int ipmforwarding;		/* enable multicast forwarding */
 #endif
 extern int ipmultipath;			/* enable multipath routing */
-extern int ip_directedbcast;		/* accept all broadcast packets */
+extern int ip_sendredirects;		/* [a] send icmp redirect while forwd */
+extern int ip_directedbcast;		/* [a] accept all broadcast packets */
 extern unsigned int la_hold_total;
 
 extern const struct pr_usrreqs rip_usrreqs;
Index: sys/netinet/tcp_input.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/tcp_input.c,v
diff -u -p -u -p -r1.410 tcp_input.c
--- sys/netinet/tcp_input.c	20 Dec 2024 19:20:34 -0000	1.410
+++ sys/netinet/tcp_input.c	23 Dec 2024 21:25:23 -0000
@@ -2804,17 +2804,13 @@ int
 tcp_mss(struct tcpcb *tp, int offer)
 {
 	struct rtentry *rt;
-	struct ifnet *ifp = NULL;
-	int mss, mssopt;
-	int iphlen;
-	struct inpcb *inp;
+	struct ifnet *ifp;
+	int mss, mssopt, mssdflt, iphlen, do_rfc3390;
+	u_int rtmtu;
 
-	inp = tp->t_inpcb;
-
-	mssopt = mss = tcp_mssdflt;
-
-	rt = in_pcbrtentry(inp);
+	mss = mssopt = mssdflt = atomic_load_int(&tcp_mssdflt);
 
+	rt = in_pcbrtentry(tp->t_inpcb);
 	if (rt == NULL)
 		goto out;
 
@@ -2823,29 +2819,29 @@ tcp_mss(struct tcpcb *tp, int offer)
 		goto out;
 
 	switch (tp->pf) {
+	case AF_INET:
+		iphlen = sizeof(struct ip);
+		break;
 #ifdef INET6
 	case AF_INET6:
 		iphlen = sizeof(struct ip6_hdr);
 		break;
 #endif
-	case AF_INET:
-		iphlen = sizeof(struct ip);
-		break;
 	default:
-		/* the family does not support path MTU discovery */
-		goto out;
+		unhandled_af(tp->pf);
 	}
 
 	/*
 	 * if there's an mtu associated with the route and we support
 	 * path MTU discovery for the underlying protocol family, use it.
 	 */
-	if (rt->rt_mtu) {
+	rtmtu = READ_ONCE(rt->rt_mtu);
+	if (rtmtu) {
 		/*
 		 * One may wish to lower MSS to take into account options,
 		 * especially security-related options.
 		 */
-		if (tp->pf == AF_INET6 && rt->rt_mtu < IPV6_MMTU) {
+		if (tp->pf == AF_INET6 && rtmtu < IPV6_MMTU) {
 			/*
 			 * RFC2460 section 5, last paragraph: if path MTU is
 			 * smaller than 1280, use 1280 as packet size and
@@ -2854,8 +2850,7 @@ tcp_mss(struct tcpcb *tp, int offer)
 			mss = IPV6_MMTU - iphlen - sizeof(struct ip6_frag) -
 			    sizeof(struct tcphdr);
 		} else {
-			mss = rt->rt_mtu - iphlen -
-			    sizeof(struct tcphdr);
+			mss = rtmtu - iphlen - sizeof(struct tcphdr);
 		}
 	} else if (ifp->if_flags & IFF_LOOPBACK) {
 		mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr);
@@ -2876,10 +2871,10 @@ tcp_mss(struct tcpcb *tp, int offer)
 	/* Calculate the value that we offer in TCPOPT_MAXSEG */
 	if (offer != -1) {
 		mssopt = ifp->if_mtu - iphlen - sizeof(struct tcphdr);
-		mssopt = max(tcp_mssdflt, mssopt);
+		mssopt = imax(mssopt, mssdflt);
 	}
- out:
 	if_put(ifp);
+ out:
 	/*
 	 * The current mss, t_maxseg, is initialized to the default value.
 	 * If we compute a smaller value, reduce the current mss.
@@ -2893,10 +2888,10 @@ tcp_mss(struct tcpcb *tp, int offer)
 	if (offer > 0)
 		tp->t_peermss = offer;
 	if (tp->t_peermss)
-		mss = min(mss, max(tp->t_peermss, 216));
+		mss = imin(mss, max(tp->t_peermss, 216));
 
 	/* sanity - at least max opt. space */
-	mss = max(mss, 64);
+	mss = imax(mss, 64);
 
 	/*
 	 * maxopd stores the maximum length of data AND options
@@ -2915,6 +2910,7 @@ tcp_mss(struct tcpcb *tp, int offer)
 		mss -= TCPOLEN_SIGLEN;
 #endif
 
+	do_rfc3390 = atomic_load_int(&tcp_do_rfc3390);
 	if (offer == -1) {
 		/* mss changed due to Path MTU discovery */
 		tp->t_flags &= ~TF_PMTUD_PEND;
@@ -2929,10 +2925,10 @@ tcp_mss(struct tcpcb *tp, int offer)
 			tp->snd_cwnd = ulmax((tp->snd_cwnd / tp->t_maxseg) *
 			    mss, mss);
 		}
-	} else if (tcp_do_rfc3390 == 2) {
+	} else if (do_rfc3390 == 2) {
 		/* increase initial window  */
 		tp->snd_cwnd = ulmin(10 * mss, ulmax(2 * mss, 14600));
-	} else if (tcp_do_rfc3390) {
+	} else if (do_rfc3390) {
 		/* increase initial window  */
 		tp->snd_cwnd = ulmin(4 * mss, ulmax(2 * mss, 4380));
 	} else
@@ -2999,8 +2995,10 @@ tcp_mss_update(struct tcpcb *tp)
 	if (rt == NULL)
 		return;
 
+	mtx_enter(&so->so_snd.sb_mtx);
 	bufsize = so->so_snd.sb_hiwat;
 	if (bufsize < mss) {
+		mtx_leave(&so->so_snd.sb_mtx);
 		mss = bufsize;
 		/* Update t_maxseg and t_maxopd */
 		tcp_mss(tp, mss);
@@ -3009,6 +3007,7 @@ tcp_mss_update(struct tcpcb *tp)
 		if (bufsize > sb_max)
 			bufsize = sb_max;
 		(void)sbreserve(so, &so->so_snd, bufsize);
+		mtx_leave(&so->so_snd.sb_mtx);
 	}
 
 	mtx_enter(&so->so_rcv.sb_mtx);
@@ -3020,7 +3019,6 @@ tcp_mss_update(struct tcpcb *tp)
 		(void)sbreserve(so, &so->so_rcv, bufsize);
 	}
 	mtx_leave(&so->so_rcv.sb_mtx);
-
 }
 
 /*
Index: sys/netinet/tcp_output.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/tcp_output.c,v
diff -u -p -u -p -r1.146 tcp_output.c
--- sys/netinet/tcp_output.c	19 Dec 2024 22:11:35 -0000	1.146
+++ sys/netinet/tcp_output.c	23 Dec 2024 21:25:23 -0000
@@ -103,8 +103,6 @@
 extern struct mbuf *m_copypack();
 #endif
 
-extern int tcprexmtthresh;
-
 #ifdef TCP_SACK_DEBUG
 void tcp_print_holes(struct tcpcb *tp);
 
@@ -350,7 +348,7 @@ again:
 	txmaxseg = ulmin(so->so_snd.sb_hiwat / 2, tp->t_maxseg);
 
 	if (len > txmaxseg) {
-		if (tcp_do_tso &&
+		if (atomic_load_int(&tcp_do_tso) &&
 		    tp->t_inpcb->inp_options == NULL &&
 		    tp->t_inpcb->inp_outputopts6 == NULL &&
 #ifdef TCP_SIGNATURE
Index: sys/netinet/tcp_timer.h
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/tcp_timer.h,v
diff -u -p -u -p -r1.22 tcp_timer.h
--- sys/netinet/tcp_timer.h	20 Dec 2024 21:30:17 -0000	1.22
+++ sys/netinet/tcp_timer.h	23 Dec 2024 21:25:23 -0000
@@ -154,7 +154,6 @@ typedef void (*tcp_timer_func_t)(void *)
 extern const tcp_timer_func_t tcp_timer_funcs[TCPT_NTIMERS];
 
 extern int tcp_delack_msecs;		/* delayed ACK timeout in millisecs */
-extern int tcptv_keep_init;
 extern int tcp_always_keepalive;	/* assume SO_KEEPALIVE is always set */
 extern int tcp_keepidle;		/* time before keepalive probes begin */
 extern int tcp_keepintvl;		/* time between keepalive probes */
Index: sys/netinet/tcp_var.h
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/tcp_var.h,v
diff -u -p -u -p -r1.178 tcp_var.h
--- sys/netinet/tcp_var.h	13 May 2024 01:15:53 -0000	1.178
+++ sys/netinet/tcp_var.h	23 Dec 2024 21:25:23 -0000
@@ -227,7 +227,9 @@ struct tcp_opt_info {
 
 /*
  * Locks used to protect global data and struct members:
+ *	a	atomic operations
  *	I	immutable after creation
+ *	a	atomic operations
  *	N	net lock
  *	S	syn_cache_mtx		tcp syn cache global mutex
  */
@@ -678,16 +680,17 @@ extern	const struct pr_usrreqs tcp6_usrr
 extern	struct pool tcpcb_pool;
 extern	struct inpcbtable tcbtable, tcb6table;	/* queue of active tcpcb's */
 extern	int tcp_do_rfc1323;	/* enabled/disabled? */
+extern	int tcprexmtthresh;	/* [I] */
 extern	int tcptv_keep_init;	/* [N] time to keep alive initial SYN packet */
-extern	int tcp_mssdflt;	/* default maximum segment size */
+extern	int tcp_mssdflt;	/* [N] default maximum segment size */
 extern	int tcp_rst_ppslim;	/* maximum outgoing RST packet per second */
 extern	int tcp_ack_on_push;	/* ACK immediately on PUSH */
 extern	int tcp_do_sack;	/* SACK enabled/disabled */
 extern	struct pool sackhl_pool;
 extern	int tcp_sackhole_limit;	/* max entries for tcp sack queues */
-extern	int tcp_do_ecn;		/* RFC3168 ECN enabled/disabled? */
-extern	int tcp_do_rfc3390;	/* RFC3390 Increasing TCP's Initial Window */
-extern	int tcp_do_tso;		/* enable TSO for TCP output packets */
+extern	int tcp_do_ecn;		/* [N] RFC3168 ECN enabled/disabled? */
+extern	int tcp_do_rfc3390;	/* [a] RFC3390 Increasing TCP Initial Window */
+extern	int tcp_do_tso;		/* [a] enable TSO for TCP output packets */
 
 extern	struct pool tcpqe_pool;
 extern	int tcp_reass_limit;	/* max entries for tcp reass queues */
Index: sys/netinet6/in6_proto.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet6/in6_proto.c,v
diff -u -p -u -p -r1.121 in6_proto.c
--- sys/netinet6/in6_proto.c	19 Dec 2024 22:10:35 -0000	1.121
+++ sys/netinet6/in6_proto.c	23 Dec 2024 21:25:23 -0000
@@ -148,7 +148,7 @@ const struct protosw inet6sw[] = {
   .pr_type	= SOCK_STREAM,
   .pr_domain	= &inet6domain,
   .pr_protocol	= IPPROTO_TCP,
-  .pr_flags	= PR_CONNREQUIRED|PR_WANTRCVD|PR_ABRTACPTDIS|PR_SPLICE,
+  .pr_flags	= PR_CONNREQUIRED|PR_WANTRCVD|PR_ABRTACPTDIS|PR_SPLICE|PR_MPSOCKET,
   .pr_input	= tcp_input,
   .pr_ctlinput	= tcp6_ctlinput,
   .pr_ctloutput	= tcp_ctloutput,
Index: sys/sys/mbuf.h
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/sys/mbuf.h,v
diff -u -p -u -p -r1.265 mbuf.h
--- sys/sys/mbuf.h	5 Nov 2024 13:15:13 -0000	1.265
+++ sys/sys/mbuf.h	23 Dec 2024 21:25:23 -0000
@@ -411,7 +411,7 @@ struct mbuf_queue {
 struct pool;
 
 extern	long nmbclust;			/* limit on the # of clusters */
-extern	int max_linkhdr;		/* largest link-level header */
+extern	int max_linkhdr;		/* [I] largest link-level header */
 extern	int max_protohdr;		/* largest protocol header */
 extern	int max_hdr;			/* largest link+protocol header */
 extern	struct cpumem *mbstat;		/* mbuf statistics counter */
Index: sys/sys/socketvar.h
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/sys/socketvar.h,v
diff -u -p -u -p -r1.134 socketvar.h
--- sys/sys/socketvar.h	9 Sep 2024 07:38:45 -0000	1.134
+++ sys/sys/socketvar.h	23 Dec 2024 21:25:23 -0000
@@ -376,7 +376,7 @@ sbassertlocked(struct sockbuf *sb)
 	}								\
 } while (/*CONSTCOND*/0)
 
-extern u_long sb_max;
+extern u_long sb_max;			/* [I] */
 
 extern struct pool	socket_pool;