Index: sys/arch/amd64/conf/GENERIC.MP
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/arch/amd64/conf/GENERIC.MP,v
diff -u -p -u -p -r1.16 GENERIC.MP
--- sys/arch/amd64/conf/GENERIC.MP	9 Feb 2021 14:06:19 -0000	1.16
+++ sys/arch/amd64/conf/GENERIC.MP	5 Apr 2024 16:45:45 -0000
@@ -4,6 +4,6 @@ include "arch/amd64/conf/GENERIC"
 
 option	MULTIPROCESSOR
 #option	MP_LOCKDEBUG
-#option	WITNESS
+option	WITNESS
 
 cpu*		at mainbus?
Index: sys/arch/arm64/conf/GENERIC.MP
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/arch/arm64/conf/GENERIC.MP,v
diff -u -p -u -p -r1.5 GENERIC.MP
--- sys/arch/arm64/conf/GENERIC.MP	1 Jul 2018 21:05:07 -0000	1.5
+++ sys/arch/arm64/conf/GENERIC.MP	5 Apr 2024 16:45:45 -0000
@@ -4,6 +4,6 @@ include "arch/arm64/conf/GENERIC"
 
 option	MULTIPROCESSOR
 #option	MP_LOCKDEBUG
-#option	WITNESS
+option	WITNESS
 
 cpu*		at mainbus?
Index: sys/arch/i386/conf/GENERIC.MP
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/arch/i386/conf/GENERIC.MP,v
diff -u -p -u -p -r1.11 GENERIC.MP
--- sys/arch/i386/conf/GENERIC.MP	3 Jun 2018 05:18:33 -0000	1.11
+++ sys/arch/i386/conf/GENERIC.MP	5 Apr 2024 16:45:45 -0000
@@ -7,6 +7,6 @@ include "arch/i386/conf/GENERIC"
 
 option		MULTIPROCESSOR	# Multiple processor support
 #option		MP_LOCKDEBUG
-#option		WITNESS
+option		WITNESS
 
 cpu*		at mainbus?
Index: sys/arch/macppc/conf/GENERIC.MP
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/arch/macppc/conf/GENERIC.MP,v
diff -u -p -u -p -r1.2 GENERIC.MP
--- sys/arch/macppc/conf/GENERIC.MP	15 Apr 2020 08:09:33 -0000	1.2
+++ sys/arch/macppc/conf/GENERIC.MP	5 Apr 2024 16:45:45 -0000
@@ -4,6 +4,6 @@ include "arch/macppc/conf/GENERIC"
 
 option	MULTIPROCESSOR
 #option	MP_LOCKDEBUG
-#option	WITNESS
+option	WITNESS
 
 cpu*	at mainbus?
Index: sys/arch/powerpc64/conf/GENERIC.MP
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/arch/powerpc64/conf/GENERIC.MP,v
diff -u -p -u -p -r1.1 GENERIC.MP
--- sys/arch/powerpc64/conf/GENERIC.MP	21 Jul 2020 21:38:31 -0000	1.1
+++ sys/arch/powerpc64/conf/GENERIC.MP	5 Apr 2024 16:45:45 -0000
@@ -4,6 +4,6 @@ include "arch/powerpc64/conf/GENERIC"
 
 option	MULTIPROCESSOR
 #option	MP_LOCKDEBUG
-#option	WITNESS
+option	WITNESS
 
 cpu*		at mainbus?
Index: sys/arch/riscv64/conf/GENERIC.MP
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/arch/riscv64/conf/GENERIC.MP,v
diff -u -p -u -p -r1.1 GENERIC.MP
--- sys/arch/riscv64/conf/GENERIC.MP	29 Jun 2021 21:27:52 -0000	1.1
+++ sys/arch/riscv64/conf/GENERIC.MP	5 Apr 2024 16:45:45 -0000
@@ -4,6 +4,6 @@ include "arch/riscv64/conf/GENERIC"
 
 option	MULTIPROCESSOR
 #option	MP_LOCKDEBUG
-#option	WITNESS
+option	WITNESS
 
 cpu*		at mainbus?
Index: sys/netinet/ip_mroute.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet/ip_mroute.c,v
diff -u -p -u -p -r1.141 ip_mroute.c
--- sys/netinet/ip_mroute.c	11 Feb 2024 18:14:26 -0000	1.141
+++ sys/netinet/ip_mroute.c	5 Apr 2024 16:45:40 -0000
@@ -430,8 +430,9 @@ mrt_rtwalk_mfcsysctl(struct rtentry *rt,
 	}
 
 	for (minfo = msa->msa_minfos;
-	     (uint8_t *)minfo < ((uint8_t *)msa->msa_minfos + msa->msa_len);
-	     minfo++) {
+	    (uint8_t *)(minfo + 1) <=
+	    (uint8_t *)msa->msa_minfos + msa->msa_len;
+	    minfo++) {
 		/* Find a new entry or update old entry. */
 		if (minfo->mfc_origin.s_addr !=
 		    satosin(rt->rt_gateway)->sin_addr.s_addr ||
@@ -471,13 +472,11 @@ mrt_sysctl_mfc(void *oldp, size_t *oldle
 	if (oldp != NULL && *oldlenp > MAXPHYS)
 		return (EINVAL);
 
-	if (oldp != NULL)
+	memset(&msa, 0, sizeof(msa));
+	if (oldp != NULL && *oldlenp > 0) {
 		msa.msa_minfos = malloc(*oldlenp, M_TEMP, M_WAITOK | M_ZERO);
-	else
-		msa.msa_minfos = NULL;
-
-	msa.msa_len = *oldlenp;
-	msa.msa_needed = 0;
+		msa.msa_len = *oldlenp;
+	}
 
 	for (rtableid = 0; rtableid <= RT_TABLEID_MAX; rtableid++) {
 		rtable_walk(rtableid, AF_INET, NULL, mrt_rtwalk_mfcsysctl,
@@ -486,11 +485,11 @@ mrt_sysctl_mfc(void *oldp, size_t *oldle
 
 	if (msa.msa_minfos != NULL && msa.msa_needed > 0 &&
 	    (error = copyout(msa.msa_minfos, oldp, msa.msa_needed)) != 0) {
-		free(msa.msa_minfos, M_TEMP, *oldlenp);
+		free(msa.msa_minfos, M_TEMP, msa.msa_len);
 		return (error);
 	}
 
-	free(msa.msa_minfos, M_TEMP, *oldlenp);
+	free(msa.msa_minfos, M_TEMP, msa.msa_len);
 	*oldlenp = msa.msa_needed;
 
 	return (0);
Index: sys/netinet6/ip6_mroute.c
===================================================================
RCS file: /mount/openbsd/cvs/src/sys/netinet6/ip6_mroute.c,v
diff -u -p -u -p -r1.140 ip6_mroute.c
--- sys/netinet6/ip6_mroute.c	11 Feb 2024 18:14:27 -0000	1.140
+++ sys/netinet6/ip6_mroute.c	5 Apr 2024 16:45:40 -0000
@@ -406,8 +406,9 @@ mrt6_rtwalk_mf6csysctl(struct rtentry *r
 	}
 
 	for (minfo = msa->ms6a_minfos;
-	     (uint8_t *)minfo < ((uint8_t *)msa->ms6a_minfos + msa->ms6a_len);
-	     minfo++) {
+	    (uint8_t *)(minfo + 1) <=
+	    (uint8_t *)msa->ms6a_minfos + msa->ms6a_len;
+	    minfo++) {
 		/* Find a new entry or update old entry. */
 		if (!IN6_ARE_ADDR_EQUAL(&minfo->mf6c_origin.sin6_addr,
 		    &satosin6(rt->rt_gateway)->sin6_addr) ||
@@ -449,13 +450,11 @@ mrt6_sysctl_mfc(void *oldp, size_t *oldl
 	if (oldp != NULL && *oldlenp > MAXPHYS)
 		return EINVAL;
 
-	if (oldp != NULL)
+	memset(&msa, 0, sizeof(msa));
+	if (oldp != NULL && *oldlenp > 0) {
 		msa.ms6a_minfos = malloc(*oldlenp, M_TEMP, M_WAITOK | M_ZERO);
-	else
-		msa.ms6a_minfos = NULL;
-
-	msa.ms6a_len = *oldlenp;
-	msa.ms6a_needed = 0;
+		msa.ms6a_len = *oldlenp;
+	}
 
 	for (rtableid = 0; rtableid <= RT_TABLEID_MAX; rtableid++) {
 		rtable_walk(rtableid, AF_INET6, NULL, mrt6_rtwalk_mf6csysctl,
@@ -464,11 +463,11 @@ mrt6_sysctl_mfc(void *oldp, size_t *oldl
 
 	if (msa.ms6a_minfos != NULL && msa.ms6a_needed > 0 &&
 	    (error = copyout(msa.ms6a_minfos, oldp, msa.ms6a_needed)) != 0) {
-		free(msa.ms6a_minfos, M_TEMP, *oldlenp);
+		free(msa.ms6a_minfos, M_TEMP, msa.ms6a_len);
 		return error;
 	}
 
-	free(msa.ms6a_minfos, M_TEMP, *oldlenp);
+	free(msa.ms6a_minfos, M_TEMP, msa.ms6a_len);
 	*oldlenp = msa.ms6a_needed;
 
 	return 0;