78 files changed, 5170 insertions, 1912 deletions

diff --git a/src/regress/lib/libc/Makefile b/src/regress/lib/libc/Makefile
index 3cd970e49d..7a8db225ef 100644
--- a/src/regress/lib/libc/Makefile
+++ b/src/regress/lib/libc/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.59 2024/07/14 09:48:48 jca Exp $
+#       $OpenBSD: Makefile,v 1.62 2025/08/04 06:10:40 tb Exp $
 
 SUBDIR+= _setjmp
 SUBDIR+= alloca arc4random-fork atexit
@@ -9,8 +9,9 @@ SUBDIR+= elf_aux_info
 SUBDIR+= env explicit_bzero
 SUBDIR+= ffs fmemopen fnmatch fpclassify fread
 SUBDIR+= gcvt getaddrinfo getcap getopt getopt_long glob
+SUBDIR+= hash
 SUBDIR+= hsearch
-SUBDIR+= ieeefp ifnameindex
+SUBDIR+= ieeefp ifnameindex illumos
 SUBDIR+= ldexp locale longjmp
 SUBDIR+= malloc mkstemp modf
 SUBDIR+= netdb
@@ -18,9 +19,9 @@ SUBDIR+= open_memstream orientation
 SUBDIR+= popen printf
 SUBDIR+= qsort
 SUBDIR+= regex
-SUBDIR+= setjmp setjmp-signal sigsetjmp sigthr sleep sprintf stdio_threading
-SUBDIR+= stpncpy strchr strerror strlcat strlcpy strnlen strtod strtol strtonum
-SUBDIR+= sys
+SUBDIR+= setjmp setjmp-signal sigsetjmp sigthr sleep sprintf stdio
+SUBDIR+= stdio_threading stpncpy strchr strerror strlcat strlcpy strnlen
+SUBDIR+= strtod strtol strtonum sys
 SUBDIR+= telldir time timingsafe
 SUBDIR+= uuid
 SUBDIR+= vis
diff --git a/src/regress/lib/libc/arc4random-fork/arc4random-fork.c b/src/regress/lib/libc/arc4random-fork/arc4random-fork.c
index 4bc9c634f1..9b334945af 100644
--- a/src/regress/lib/libc/arc4random-fork/arc4random-fork.c
+++ b/src/regress/lib/libc/arc4random-fork/arc4random-fork.c
@@ -111,7 +111,7 @@ main(int argc, char *argv[])
         }
 
         if (flagprefork)
-                arc4random();
+                (void)arc4random();
 
         bufparent = mmap(NULL, sizeof(Buf), PROT_READ|PROT_WRITE,
             MAP_ANON|MAP_PRIVATE, -1, 0);
diff --git a/src/regress/lib/libc/explicit_bzero/explicit_bzero.c b/src/regress/lib/libc/explicit_bzero/explicit_bzero.c
index 496bafb208..30c86290e8 100644
--- a/src/regress/lib/libc/explicit_bzero/explicit_bzero.c
+++ b/src/regress/lib/libc/explicit_bzero/explicit_bzero.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: explicit_bzero.c,v 1.9 2022/02/10 08:39:32 tb Exp $   */
+/*      $OpenBSD: explicit_bzero.c,v 1.10 2025/05/31 15:31:40 tb Exp $  */
 /*
  * Copyright (c) 2014 Google Inc.
  *
@@ -28,9 +28,11 @@
 
 #if defined(__has_feature)
 #if __has_feature(address_sanitizer)
+#ifndef __SANITIZE_ADDRESS__
 #define __SANITIZE_ADDRESS__
 #endif
 #endif
+#endif
 #ifdef __SANITIZE_ADDRESS__
 #define ATTRIBUTE_NO_SANITIZE_ADDRESS __attribute__((no_sanitize_address))
 #else
diff --git a/src/regress/lib/libc/hash/Makefile b/src/regress/lib/libc/hash/Makefile
new file mode 100644
index 0000000000..9bd69bf8df
--- /dev/null
+++ b/src/regress/lib/libc/hash/Makefile
@@ -0,0 +1,5 @@
+#       $OpenBSD: Makefile,v 1.2 2025/04/14 18:33:56 tb Exp $
+
+PROG = hash_test
+
+.include <bsd.regress.mk>
diff --git a/src/regress/lib/libc/hash/hash_test.c b/src/regress/lib/libc/hash/hash_test.c
new file mode 100644
index 0000000000..c04a0458fe
--- /dev/null
+++ b/src/regress/lib/libc/hash/hash_test.c
@@ -0,0 +1,935 @@
+/*      $OpenBSD: hash_test.c,v 1.3 2025/08/02 06:05:13 tb Exp $ */
+
+/*
+ * Copyright (c) 2025 Theo Buehler <tb@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/types.h>
+
+#include <md5.h>
+#include <rmd160.h>
+#include <sha1.h>
+#include <sha2.h>
+#include <stdio.h>
+#include <string.h>
+
+#define MAX_DIGEST_LENGTH SHA512_DIGEST_LENGTH
+
+struct hash_test_case {
+        const char      *in;
+        const uint8_t    out[MAX_DIGEST_LENGTH];
+};
+
+enum {
+        hash_md5,
+        hash_rmd160,
+        hash_sha1,
+        hash_sha224,
+        hash_sha256,
+        hash_sha384,
+        hash_sha512,
+        hash_sha512_256,
+        NUM_HASHES,
+};
+
+/* RFC 1321, Appendix A.5 */
+static const struct hash_test_case md5_tests[] = {
+        {
+                .out = {
+                        0xd4, 0x1d, 0x8c, 0xd9, 0x8f, 0x00, 0xb2, 0x04,
+                        0xe9, 0x80, 0x09, 0x98, 0xec, 0xf8, 0x42, 0x7e,
+                },
+        },
+        {
+                .in = "",
+                .out = {
+                        0xd4, 0x1d, 0x8c, 0xd9, 0x8f, 0x00, 0xb2, 0x04,
+                        0xe9, 0x80, 0x09, 0x98, 0xec, 0xf8, 0x42, 0x7e,
+                },
+        },
+        {
+                .in = "a",
+                .out = {
+                        0x0c, 0xc1, 0x75, 0xb9, 0xc0, 0xf1, 0xb6, 0xa8,
+                        0x31, 0xc3, 0x99, 0xe2, 0x69, 0x77, 0x26, 0x61,
+                },
+        },
+        {
+                .in = "abc",
+                .out = {
+                        0x90, 0x01, 0x50, 0x98, 0x3c, 0xd2, 0x4f, 0xb0,
+                        0xd6, 0x96, 0x3f, 0x7d, 0x28, 0xe1, 0x7f, 0x72,
+                },
+        },
+        {
+                .in = "message digest",
+                .out = {
+                        0xf9, 0x6b, 0x69, 0x7d, 0x7c, 0xb7, 0x93, 0x8d,
+                        0x52, 0x5a, 0x2f, 0x31, 0xaa, 0xf1, 0x61, 0xd0,
+                },
+        },
+        {
+                .in = "abcdefghijklmnopqrstuvwxyz",
+                .out = {
+                        0xc3, 0xfc, 0xd3, 0xd7, 0x61, 0x92, 0xe4, 0x00,
+                        0x7d, 0xfb, 0x49, 0x6c, 0xca, 0x67, 0xe1, 0x3b,
+                },
+        },
+        {
+                .in = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+                    "abcdefghijklmnopqrstuvwxyz0123456789",
+                .out = {
+                        0xd1, 0x74, 0xab, 0x98, 0xd2, 0x77, 0xd9, 0xf5,
+                        0xa5, 0x61, 0x1c, 0x2c, 0x9f, 0x41, 0x9d, 0x9f,
+                },
+        },
+        {
+                .in = "1234567890123456789012345678901234567890"
+                    "1234567890123456789012345678901234567890",
+                .out = {
+                        0x57, 0xed, 0xf4, 0xa2, 0x2b, 0xe3, 0xc9, 0x55,
+                        0xac, 0x49, 0xda, 0x2e, 0x21, 0x07, 0xb6, 0x7a,
+                },
+        },
+};
+
+#define N_MD5_TESTS (sizeof(md5_tests) / sizeof(md5_tests[0]))
+
+static void
+md5_init(void *ctx)
+{
+        MD5Init(ctx);
+}
+
+static void
+md5_update(void *ctx, const uint8_t *data, size_t len)
+{
+        MD5Update(ctx, data, len);
+}
+
+static void
+md5_final(void *digest, void *ctx)
+{
+        MD5Final(digest, ctx);
+}
+
+/* https://homes.esat.kuleuven.be/~bosselae/ripemd160.html */
+static const struct hash_test_case rmd160_tests[] = {
+        {
+                .out = {
+                        0x9c, 0x11, 0x85, 0xa5, 0xc5, 0xe9, 0xfc, 0x54,
+                        0x61, 0x28, 0x08, 0x97, 0x7e, 0xe8, 0xf5, 0x48,
+                        0xb2, 0x25, 0x8d, 0x31,
+                },
+        },
+        {
+                .in = "",
+                .out = {
+                        0x9c, 0x11, 0x85, 0xa5, 0xc5, 0xe9, 0xfc, 0x54,
+                        0x61, 0x28, 0x08, 0x97, 0x7e, 0xe8, 0xf5, 0x48,
+                        0xb2, 0x25, 0x8d, 0x31,
+                },
+        },
+        {
+                .in = "a",
+                .out = {
+                        0x0b, 0xdc, 0x9d, 0x2d, 0x25, 0x6b, 0x3e, 0xe9,
+                        0xda, 0xae, 0x34, 0x7b, 0xe6, 0xf4, 0xdc, 0x83,
+                        0x5a, 0x46, 0x7f, 0xfe,
+                },
+        },
+        {
+                .in = "abc",
+                .out = {
+                        0x8e, 0xb2, 0x08, 0xf7, 0xe0, 0x5d, 0x98, 0x7a,
+                        0x9b, 0x04, 0x4a, 0x8e, 0x98, 0xc6, 0xb0, 0x87,
+                        0xf1, 0x5a, 0x0b, 0xfc,
+                },
+        },
+        {
+                .in = "message digest",
+                .out = {
+                        0x5d, 0x06, 0x89, 0xef, 0x49, 0xd2, 0xfa, 0xe5,
+                        0x72, 0xb8, 0x81, 0xb1, 0x23, 0xa8, 0x5f, 0xfa,
+                        0x21, 0x59, 0x5f, 0x36,
+                },
+        },
+        {
+                .in = "abcdefghijklmnopqrstuvwxyz",
+                .out = {
+                        0xf7, 0x1c, 0x27, 0x10, 0x9c, 0x69, 0x2c, 0x1b,
+                        0x56, 0xbb, 0xdc, 0xeb, 0x5b, 0x9d, 0x28, 0x65,
+                        0xb3, 0x70, 0x8d, 0xbc,
+                },
+        },
+        {
+                .in = "abcdbcdecdefdefgefghfghighijhijkijkljkl"
+                    "mklmnlmnomnopnopq",
+                .out = {
+                        0x12, 0xa0, 0x53, 0x38, 0x4a, 0x9c, 0x0c, 0x88,
+                        0xe4, 0x05, 0xa0, 0x6c, 0x27, 0xdc, 0xf4, 0x9a,
+                        0xda, 0x62, 0xeb, 0x2b,
+                },
+        },
+        {
+                .in = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+                    "0123456789",
+                .out = {
+                        0xb0, 0xe2, 0x0b, 0x6e, 0x31, 0x16, 0x64, 0x02,
+                        0x86, 0xed, 0x3a, 0x87, 0xa5, 0x71, 0x30, 0x79,
+                        0xb2, 0x1f, 0x51, 0x89,
+                },
+        },
+        {
+                .in = "1234567890123456789012345678901234567890"
+                    "1234567890123456789012345678901234567890",
+                .out = {
+                        0x9b, 0x75, 0x2e, 0x45, 0x57, 0x3d, 0x4b, 0x39,
+                        0xf4, 0xdb, 0xd3, 0x32, 0x3c, 0xab, 0x82, 0xbf,
+                        0x63, 0x32, 0x6b, 0xfb,
+                },
+        },
+};
+
+#define N_RMD160_TESTS (sizeof(rmd160_tests) / sizeof(rmd160_tests[0]))
+
+static void
+rmd160_init(void *ctx)
+{
+        RMD160Init(ctx);
+}
+
+static void
+rmd160_update(void *ctx, const uint8_t *data, size_t len)
+{
+        RMD160Update(ctx, data, len);
+}
+
+static void
+rmd160_final(void *digest, void *ctx)
+{
+        RMD160Final(digest, ctx);
+}
+
+/* RFC 3174 - Appendix A (plus two zero-length tests) */
+static const struct hash_test_case sha1_tests[] = {
+        {
+                .out = {
+                        0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b, 0x0d,
+                        0x32, 0x55, 0xbf, 0xef, 0x95, 0x60, 0x18, 0x90,
+                        0xaf, 0xd8, 0x07, 0x09,
+                },
+        },
+        {
+                .in = "",
+                .out = {
+                        0xda, 0x39, 0xa3, 0xee, 0x5e, 0x6b, 0x4b, 0x0d,
+                        0x32, 0x55, 0xbf, 0xef, 0x95, 0x60, 0x18, 0x90,
+                        0xaf, 0xd8, 0x07, 0x09,
+                },
+        },
+        {
+                .in = "abc",
+                .out = {
+                        0xa9, 0x99, 0x3e, 0x36, 0x47, 0x06, 0x81, 0x6a,
+                        0xba, 0x3e, 0x25, 0x71, 0x78, 0x50, 0xc2, 0x6c,
+                        0x9c, 0xd0, 0xd8, 0x9d,
+                },
+        },
+        {
+                .in = "abcdbcdecdefdefgefghfghighijhi"
+                    "jkijkljklmklmnlmnomnopnopq",
+                .out = {
+                        0x84, 0x98, 0x3e, 0x44, 0x1c, 0x3b, 0xd2, 0x6e,
+                        0xba, 0xae, 0x4a, 0xa1, 0xf9, 0x51, 0x29, 0xe5,
+                        0xe5, 0x46, 0x70, 0xf1,
+                },
+        },
+        {
+                .in = "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567",
+                .out = {
+                        0xde, 0xa3, 0x56, 0xa2, 0xcd, 0xdd, 0x90, 0xc7,
+                        0xa7, 0xec, 0xed, 0xc5, 0xeb, 0xb5, 0x63, 0x93,
+                        0x4f, 0x46, 0x04, 0x52,
+                },
+        },
+};
+
+#define N_SHA1_TESTS (sizeof(sha1_tests) / sizeof(sha1_tests[0]))
+
+static void
+sha1_init(void *ctx)
+{
+        SHA1Init(ctx);
+}
+
+static void
+sha1_update(void *ctx, const uint8_t *data, size_t len)
+{
+        SHA1Update(ctx, data, len);
+}
+
+static void
+sha1_final(void *digest, void *ctx)
+{
+        SHA1Final(digest, ctx);
+}
+
+static const struct hash_test_case sha224_tests[] = {
+        {
+                .out = {
+                        0xd1, 0x4a, 0x02, 0x8c, 0x2a, 0x3a, 0x2b, 0xc9,
+                        0x47, 0x61, 0x02, 0xbb, 0x28, 0x82, 0x34, 0xc4,
+                        0x15, 0xa2, 0xb0, 0x1f, 0x82, 0x8e, 0xa6, 0x2a,
+                        0xc5, 0xb3, 0xe4, 0x2f,
+                },
+        },
+        {
+                .in = "",
+                .out = {
+                        0xd1, 0x4a, 0x02, 0x8c, 0x2a, 0x3a, 0x2b, 0xc9,
+                        0x47, 0x61, 0x02, 0xbb, 0x28, 0x82, 0x34, 0xc4,
+                        0x15, 0xa2, 0xb0, 0x1f, 0x82, 0x8e, 0xa6, 0x2a,
+                        0xc5, 0xb3, 0xe4, 0x2f,
+                },
+        },
+        {
+                .in = "abc",
+                .out = {
+                        0x23, 0x09, 0x7d, 0x22, 0x34, 0x05, 0xd8, 0x22,
+                        0x86, 0x42, 0xa4, 0x77, 0xbd, 0xa2, 0x55, 0xb3,
+                        0x2a, 0xad, 0xbc, 0xe4, 0xbd, 0xa0, 0xb3, 0xf7,
+                        0xe3, 0x6c, 0x9d, 0xa7,
+                },
+        },
+        {
+                .in = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
+                .out = {
+                        0x75, 0x38, 0x8b, 0x16, 0x51, 0x27, 0x76, 0xcc,
+                        0x5d, 0xba, 0x5d, 0xa1, 0xfd, 0x89, 0x01, 0x50,
+                        0xb0, 0xc6, 0x45, 0x5c, 0xb4, 0xf5, 0x8b, 0x19,
+                        0x52, 0x52, 0x25, 0x25,
+                },
+        },
+        {
+                .in = "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567",
+                .out = {
+                        0x56, 0x7f, 0x69, 0xf1, 0x68, 0xcd, 0x78, 0x44,
+                        0xe6, 0x52, 0x59, 0xce, 0x65, 0x8f, 0xe7, 0xaa,
+                        0xdf, 0xa2, 0x52, 0x16, 0xe6, 0x8e, 0xca, 0x0e,
+                        0xb7, 0xab, 0x82, 0x62,
+                },
+        },
+        {
+                .in = "\x07",
+                .out = {
+                        0x00, 0xec, 0xd5, 0xf1, 0x38, 0x42, 0x2b, 0x8a,
+                        0xd7, 0x4c, 0x97, 0x99, 0xfd, 0x82, 0x6c, 0x53,
+                        0x1b, 0xad, 0x2f, 0xca, 0xbc, 0x74, 0x50, 0xbe,
+                        0xe2, 0xaa, 0x8c, 0x2a,
+                },
+        },
+};
+
+#define N_SHA224_TESTS (sizeof(sha224_tests) / sizeof(sha224_tests[0]))
+
+static void
+sha224_init(void *ctx)
+{
+        SHA224Init(ctx);
+}
+
+static void
+sha224_update(void *ctx, const uint8_t *data, size_t len)
+{
+        SHA224Update(ctx, data, len);
+}
+
+static void
+sha224_final(void *digest, void *ctx)
+{
+        SHA224Final(digest, ctx);
+}
+
+static const struct hash_test_case sha256_tests[] = {
+        {
+                .out = {
+                        0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14,
+                        0x9a, 0xfb, 0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24,
+                        0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c,
+                        0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55,
+                },
+        },
+        {
+                .in = "",
+                .out = {
+                        0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14,
+                        0x9a, 0xfb, 0xf4, 0xc8, 0x99, 0x6f, 0xb9, 0x24,
+                        0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c,
+                        0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55,
+                },
+        },
+        {
+                .in = "abc",
+                .out = {
+                        0xBA, 0x78, 0x16, 0xBF, 0x8F, 0x01, 0xCF, 0xEA,
+                        0x41, 0x41, 0x40, 0xDE, 0x5D, 0xAE, 0x22, 0x23,
+                        0xB0, 0x03, 0x61, 0xA3, 0x96, 0x17, 0x7A, 0x9C,
+                        0xB4, 0x10, 0xFF, 0x61, 0xF2, 0x00, 0x15, 0xAD,
+                },
+        },
+        {
+                .in = "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq",
+                .out = {
+                        0x24, 0x8d, 0x6a, 0x61, 0xd2, 0x06, 0x38, 0xb8,
+                        0xe5, 0xc0, 0x26, 0x93, 0x0c, 0x3e, 0x60, 0x39,
+                        0xa3, 0x3c, 0xe4, 0x59, 0x64, 0xff, 0x21, 0x67,
+                        0xf6, 0xec, 0xed, 0xd4, 0x19, 0xdb, 0x06, 0xc1,
+                },
+        },
+        {
+                .in = "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567",
+                .out = {
+                        0x59, 0x48, 0x47, 0x32, 0x84, 0x51, 0xBD, 0xFA,
+                        0x85, 0x05, 0x62, 0x25, 0x46, 0x2C, 0xC1, 0xD8,
+                        0x67, 0xD8, 0x77, 0xFB, 0x38, 0x8D, 0xF0, 0xCE,
+                        0x35, 0xF2, 0x5A, 0xB5, 0x56, 0x2B, 0xFB, 0xB5,
+                },
+        },
+        {
+                .in = "\x19",
+                .out = {
+                        0x68, 0xaa, 0x2e, 0x2e, 0xe5, 0xdf, 0xf9, 0x6e,
+                        0x33, 0x55, 0xe6, 0xc7, 0xee, 0x37, 0x3e, 0x3d,
+                        0x6a, 0x4e, 0x17, 0xf7, 0x5f, 0x95, 0x18, 0xd8,
+                        0x43, 0x70, 0x9c, 0x0c, 0x9b, 0xc3, 0xe3, 0xd4,
+                },
+        },
+};
+
+#define N_SHA256_TESTS (sizeof(sha256_tests) / sizeof(sha256_tests[0]))
+
+static void
+sha256_init(void *ctx)
+{
+        SHA256Init(ctx);
+}
+
+static void
+sha256_update(void *ctx, const uint8_t *data, size_t len)
+{
+        SHA256Update(ctx, data, len);
+}
+
+static void
+sha256_final(void *digest, void *ctx)
+{
+        SHA256Final(digest, ctx);
+}
+
+static const struct hash_test_case sha384_tests[] = {
+        {
+                .out = {
+                        0x38, 0xb0, 0x60, 0xa7, 0x51, 0xac, 0x96, 0x38,
+                        0x4c, 0xd9, 0x32, 0x7e, 0xb1, 0xb1, 0xe3, 0x6a,
+                        0x21, 0xfd, 0xb7, 0x11, 0x14, 0xbe, 0x07, 0x43,
+                        0x4c, 0x0c, 0xc7, 0xbf, 0x63, 0xf6, 0xe1, 0xda,
+                        0x27, 0x4e, 0xde, 0xbf, 0xe7, 0x6f, 0x65, 0xfb,
+                        0xd5, 0x1a, 0xd2, 0xf1, 0x48, 0x98, 0xb9, 0x5b,
+                },
+        },
+        {
+                .in = "",
+                .out = {
+                        0x38, 0xb0, 0x60, 0xa7, 0x51, 0xac, 0x96, 0x38,
+                        0x4c, 0xd9, 0x32, 0x7e, 0xb1, 0xb1, 0xe3, 0x6a,
+                        0x21, 0xfd, 0xb7, 0x11, 0x14, 0xbe, 0x07, 0x43,
+                        0x4c, 0x0c, 0xc7, 0xbf, 0x63, 0xf6, 0xe1, 0xda,
+                        0x27, 0x4e, 0xde, 0xbf, 0xe7, 0x6f, 0x65, 0xfb,
+                        0xd5, 0x1a, 0xd2, 0xf1, 0x48, 0x98, 0xb9, 0x5b,
+                },
+        },
+        {
+                .in = "abc",
+                .out = {
+                        0xcb, 0x00, 0x75, 0x3f, 0x45, 0xa3, 0x5e, 0x8b,
+                        0xb5, 0xa0, 0x3d, 0x69, 0x9a, 0xc6, 0x50, 0x07,
+                        0x27, 0x2c, 0x32, 0xab, 0x0e, 0xde, 0xd1, 0x63,
+                        0x1A, 0x8B, 0x60, 0x5A, 0x43, 0xFF, 0x5B, 0xED,
+                        0x80, 0x86, 0x07, 0x2B, 0xA1, 0xE7, 0xCC, 0x23,
+                        0x58, 0xBA, 0xEC, 0xA1, 0x34, 0xC8, 0x25, 0xA7,
+                },
+        },
+        {
+                .in = "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn"
+                    "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu",
+                .out = {
+                        0x09, 0x33, 0x0c, 0x33, 0xf7, 0x11, 0x47, 0xe8,
+                        0x3d, 0x19, 0x2f, 0xc7, 0x82, 0xcd, 0x1b, 0x47,
+                        0x53, 0x11, 0x1b, 0x17, 0x3b, 0x3b, 0x05, 0xd2,
+                        0x2f, 0xa0, 0x80, 0x86, 0xe3, 0xb0, 0xf7, 0x12,
+                        0xfc, 0xc7, 0xc7, 0x1a, 0x55, 0x7e, 0x2d, 0xb9,
+                        0x66, 0xc3, 0xe9, 0xfa, 0x91, 0x74, 0x60, 0x39,
+                },
+        },
+        {
+                .in = "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567",
+                .out = {
+                        0x2f, 0xc6, 0x4a, 0x4f, 0x50, 0x0d, 0xdb, 0x68,
+                        0x28, 0xf6, 0xa3, 0x43, 0x0b, 0x8d, 0xd7, 0x2a,
+                        0x36, 0x8e, 0xb7, 0xf3, 0xa8, 0x32, 0x2a, 0x70,
+                        0xbc, 0x84, 0x27, 0x5b, 0x9c, 0x0b, 0x3a, 0xb0,
+                        0x0d, 0x27, 0xa5, 0xcc, 0x3c, 0x2d, 0x22, 0x4a,
+                        0xa6, 0xb6, 0x1a, 0x0d, 0x79, 0xfb, 0x45, 0x96,
+                },
+        },
+        {
+                .in = "\xb9",
+                .out = {
+                        0xbc, 0x80, 0x89, 0xa1, 0x90, 0x07, 0xc0, 0xb1,
+                        0x41, 0x95, 0xf4, 0xec, 0xc7, 0x40, 0x94, 0xfe,
+                        0xc6, 0x4f, 0x01, 0xf9, 0x09, 0x29, 0x28, 0x2c,
+                        0x2f, 0xb3, 0x92, 0x88, 0x15, 0x78, 0x20, 0x8a,
+                        0xd4, 0x66, 0x82, 0x8b, 0x1c, 0x6c, 0x28, 0x3d,
+                        0x27, 0x22, 0xcf, 0x0a, 0xd1, 0xab, 0x69, 0x38,
+                },
+        },
+};
+
+#define N_SHA384_TESTS (sizeof(sha384_tests) / sizeof(sha384_tests[0]))
+
+static void
+sha384_init(void *ctx)
+{
+        SHA384Init(ctx);
+}
+
+static void
+sha384_update(void *ctx, const uint8_t *data, size_t len)
+{
+        SHA384Update(ctx, data, len);
+}
+
+static void
+sha384_final(void *digest, void *ctx)
+{
+        SHA384Final(digest, ctx);
+}
+
+static const struct hash_test_case sha512_tests[] = {
+        {
+                .out = {
+                        0xcf, 0x83, 0xe1, 0x35, 0x7e, 0xef, 0xb8, 0xbd,
+                        0xf1, 0x54, 0x28, 0x50, 0xd6, 0x6d, 0x80, 0x07,
+                        0xd6, 0x20, 0xe4, 0x05, 0x0b, 0x57, 0x15, 0xdc,
+                        0x83, 0xf4, 0xa9, 0x21, 0xd3, 0x6c, 0xe9, 0xce,
+                        0x47, 0xd0, 0xd1, 0x3c, 0x5d, 0x85, 0xf2, 0xb0,
+                        0xff, 0x83, 0x18, 0xd2, 0x87, 0x7e, 0xec, 0x2f,
+                        0x63, 0xb9, 0x31, 0xbd, 0x47, 0x41, 0x7a, 0x81,
+                        0xa5, 0x38, 0x32, 0x7a, 0xf9, 0x27, 0xda, 0x3e,
+                },
+        },
+        {
+                .in = "",
+                .out = {
+                        0xcf, 0x83, 0xe1, 0x35, 0x7e, 0xef, 0xb8, 0xbd,
+                        0xf1, 0x54, 0x28, 0x50, 0xd6, 0x6d, 0x80, 0x07,
+                        0xd6, 0x20, 0xe4, 0x05, 0x0b, 0x57, 0x15, 0xdc,
+                        0x83, 0xf4, 0xa9, 0x21, 0xd3, 0x6c, 0xe9, 0xce,
+                        0x47, 0xd0, 0xd1, 0x3c, 0x5d, 0x85, 0xf2, 0xb0,
+                        0xff, 0x83, 0x18, 0xd2, 0x87, 0x7e, 0xec, 0x2f,
+                        0x63, 0xb9, 0x31, 0xbd, 0x47, 0x41, 0x7a, 0x81,
+                        0xa5, 0x38, 0x32, 0x7a, 0xf9, 0x27, 0xda, 0x3e,
+                },
+        },
+        {
+                .in = "abc",
+                .out = {
+                        0xdd, 0xaf, 0x35, 0xa1, 0x93, 0x61, 0x7a, 0xba,
+                        0xcc, 0x41, 0x73, 0x49, 0xae, 0x20, 0x41, 0x31,
+                        0x12, 0xe6, 0xfa, 0x4e, 0x89, 0xa9, 0x7e, 0xa2,
+                        0x0a, 0x9e, 0xee, 0xe6, 0x4b, 0x55, 0xd3, 0x9a,
+                        0x21, 0x92, 0x99, 0x2a, 0x27, 0x4f, 0xc1, 0xa8,
+                        0x36, 0xba, 0x3c, 0x23, 0xa3, 0xfe, 0xeb, 0xbd,
+                        0x45, 0x4d, 0x44, 0x23, 0x64, 0x3c, 0xe8, 0x0e,
+                        0x2a, 0x9a, 0xc9, 0x4f, 0xa5, 0x4c, 0xa4, 0x9f,
+                },
+        },
+        {
+                .in = "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn"
+                    "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu",
+                .out = {
+                        0x8e, 0x95, 0x9b, 0x75, 0xda, 0xe3, 0x13, 0xda,
+                        0x8c, 0xf4, 0xf7, 0x28, 0x14, 0xfc, 0x14, 0x3f,
+                        0x8f, 0x77, 0x79, 0xc6, 0xeb, 0x9f, 0x7f, 0xa1,
+                        0x72, 0x99, 0xae, 0xad, 0xb6, 0x88, 0x90, 0x18,
+                        0x50, 0x1d, 0x28, 0x9e, 0x49, 0x00, 0xf7, 0xe4,
+                        0x33, 0x1b, 0x99, 0xde, 0xc4, 0xb5, 0x43, 0x3a,
+                        0xc7, 0xd3, 0x29, 0xee, 0xb6, 0xdd, 0x26, 0x54,
+                        0x5e, 0x96, 0xe5, 0x5b, 0x87, 0x4b, 0xe9, 0x09,
+                },
+        },
+        {
+                .in = "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567",
+                .out = {
+                        0x89, 0xd0, 0x5b, 0xa6, 0x32, 0xc6, 0x99, 0xc3,
+                        0x12, 0x31, 0xde, 0xd4, 0xff, 0xc1, 0x27, 0xd5,
+                        0xa8, 0x94, 0xda, 0xd4, 0x12, 0xc0, 0xe0, 0x24,
+                        0xdb, 0x87, 0x2d, 0x1a, 0xbd, 0x2b, 0xa8, 0x14,
+                        0x1a, 0x0f, 0x85, 0x07, 0x2a, 0x9b, 0xe1, 0xe2,
+                        0xaa, 0x04, 0xcf, 0x33, 0xc7, 0x65, 0xcb, 0x51,
+                        0x08, 0x13, 0xa3, 0x9c, 0xd5, 0xa8, 0x4c, 0x4a,
+                        0xca, 0xa6, 0x4d, 0x3f, 0x3f, 0xb7, 0xba, 0xe9,
+                },
+        },
+        {
+                .in = "\xd0",
+                .out = {
+                        0x99, 0x92, 0x20, 0x29, 0x38, 0xe8, 0x82, 0xe7,
+                        0x3e, 0x20, 0xf6, 0xb6, 0x9e, 0x68, 0xa0, 0xa7,
+                        0x14, 0x90, 0x90, 0x42, 0x3d, 0x93, 0xc8, 0x1b,
+                        0xab, 0x3f, 0x21, 0x67, 0x8d, 0x4a, 0xce, 0xee,
+                        0xe5, 0x0e, 0x4e, 0x8c, 0xaf, 0xad, 0xa4, 0xc8,
+                        0x5a, 0x54, 0xea, 0x83, 0x06, 0x82, 0x6c, 0x4a,
+                        0xd6, 0xe7, 0x4c, 0xec, 0xe9, 0x63, 0x1b, 0xfa,
+                        0x8a, 0x54, 0x9b, 0x4a, 0xb3, 0xfb, 0xba, 0x15,
+                },
+        },
+};
+
+#define N_SHA512_TESTS (sizeof(sha512_tests) / sizeof(sha512_tests[0]))
+
+static void
+sha512_init(void *ctx)
+{
+        SHA512Init(ctx);
+}
+
+static void
+sha512_update(void *ctx, const uint8_t *data, size_t len)
+{
+        SHA512Update(ctx, data, len);
+}
+
+static void
+sha512_final(void *digest, void *ctx)
+{
+        SHA512Final(digest, ctx);
+}
+
+static const struct hash_test_case sha512_256_tests[] = {
+        {
+                .out = {
+                        0xc6, 0x72, 0xb8, 0xd1, 0xef, 0x56, 0xed, 0x28,
+                        0xab, 0x87, 0xc3, 0x62, 0x2c, 0x51, 0x14, 0x06,
+                        0x9b, 0xdd, 0x3a, 0xd7, 0xb8, 0xf9, 0x73, 0x74,
+                        0x98, 0xd0, 0xc0, 0x1e, 0xce, 0xf0, 0x96, 0x7a,
+                },
+        },
+        {
+                .in = "",
+                .out = {
+                        0xc6, 0x72, 0xb8, 0xd1, 0xef, 0x56, 0xed, 0x28,
+                        0xab, 0x87, 0xc3, 0x62, 0x2c, 0x51, 0x14, 0x06,
+                        0x9b, 0xdd, 0x3a, 0xd7, 0xb8, 0xf9, 0x73, 0x74,
+                        0x98, 0xd0, 0xc0, 0x1e, 0xce, 0xf0, 0x96, 0x7a,
+                },
+        },
+        {
+                .in = "abc",
+                .out = {
+                        0x53, 0x04, 0x8e, 0x26, 0x81, 0x94, 0x1e, 0xf9,
+                        0x9b, 0x2e, 0x29, 0xb7, 0x6b, 0x4c, 0x7d, 0xab,
+                        0xe4, 0xc2, 0xd0, 0xc6, 0x34, 0xfc, 0x6d, 0x46,
+                        0xe0, 0xe2, 0xf1, 0x31, 0x07, 0xe7, 0xaf, 0x23,
+                },
+        },
+        {
+                .in = "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmn"
+                    "hijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu",
+                .out = {
+                        0x39, 0x28, 0xe1, 0x84, 0xfb, 0x86, 0x90, 0xf8,
+                        0x40, 0xda, 0x39, 0x88, 0x12, 0x1d, 0x31, 0xbe,
+                        0x65, 0xcb, 0x9d, 0x3e, 0xf8, 0x3e, 0xe6, 0x14,
+                        0x6f, 0xea, 0xc8, 0x61, 0xe1, 0x9b, 0x56, 0x3a,
+                },
+        },
+        {
+                .in = "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567"
+                      "0123456701234567012345670123456701234567012345670123456701234567",
+                .out = {
+                        0xcf, 0x78, 0xe4, 0xba, 0x93, 0x5b, 0x4d, 0x9e,
+                        0xb9, 0x10, 0x52, 0xae, 0xdd, 0xf8, 0xe2, 0xd6,
+                        0x06, 0xc5, 0x90, 0xf7, 0x08, 0x57, 0x36, 0x93,
+                        0xea, 0x94, 0xbe, 0x82, 0x6a, 0x66, 0x6e, 0xe4,
+                },
+        },
+};
+
+#define N_SHA512_256_TESTS (sizeof(sha512_256_tests) / sizeof(sha512_256_tests[0]))
+
+static void
+sha512_256_init(void *ctx)
+{
+        SHA512_256Init(ctx);
+}
+
+static void
+sha512_256_update(void *ctx, const uint8_t *data, size_t len)
+{
+        SHA512_256Update(ctx, data, len);
+}
+
+static void
+sha512_256_final(void *digest, void *ctx)
+{
+        SHA512_256Final(digest, ctx);
+}
+
+struct hash_ctx {
+        uint8_t         *digest;
+        size_t           digest_len;
+        void            *ctx;
+        void            (*init)(void *);
+        void            (*update)(void *, const uint8_t *, size_t);
+        void            (*final)(void *, void *);
+};
+
+static const struct hash_tests {
+        const char                      *name;
+        size_t                           num_tests;
+        const struct hash_test_case     *tests;
+} hash_tests[] = {
+        [hash_md5] = {
+                .name = "RFC 1321 MD5",
+                .num_tests = N_MD5_TESTS,
+                .tests = md5_tests,
+        },
+        [hash_rmd160] = {
+                .name = "Bosselaers RMD160",
+                .num_tests = N_RMD160_TESTS,
+                .tests = rmd160_tests,
+        },
+        [hash_sha1] = {
+                .name = "RFC 3174 SHA1",
+                .num_tests = N_SHA1_TESTS,
+                .tests = sha1_tests,
+        },
+        [hash_sha224] = {
+                .name = "RFC 6234 SHA224",
+                .num_tests = N_SHA224_TESTS,
+                .tests = sha224_tests,
+        },
+        [hash_sha256] = {
+                .name = "RFC 6234 SHA256",
+                .num_tests = N_SHA256_TESTS,
+                .tests = sha256_tests,
+        },
+        [hash_sha384] = {
+                .name = "RFC 6234 SHA384",
+                .num_tests = N_SHA384_TESTS,
+                .tests = sha384_tests,
+        },
+        [hash_sha512] = {
+                .name = "RFC 6234 SHA512",
+                .num_tests = N_SHA512_TESTS,
+                .tests = sha512_tests,
+        },
+        [hash_sha512_256] = {
+                .name = "RFC 6234 SHA512_256 (generated)",
+                .num_tests = N_SHA512_256_TESTS,
+                .tests = sha512_256_tests,
+        },
+};
+
+static int
+hash_test_case(struct hash_ctx *ctx, const struct hash_test_case *tc,
+    const char *name, size_t testno)
+{
+        size_t in_len = tc->in != NULL ? strlen(tc->in) : 0;
+
+        ctx->init(ctx->ctx);
+        ctx->update(ctx->ctx, (const uint8_t *)tc->in, in_len);
+        ctx->final(ctx->digest, ctx->ctx);
+
+        if (memcmp(tc->out, ctx->digest, ctx->digest_len) != 0) {
+                fprintf(stderr, "FAIL: %s test %zu\n", name, testno);
+                return 1;
+        }
+
+        return 0;
+}
+
+static int
+hash_test(struct hash_ctx *ctx, const struct hash_tests *tests)
+{
+        size_t i;
+        int failed = 0;
+
+        for (i = 0; i < tests->num_tests; i++) {
+                const struct hash_test_case *tc = &tests->tests[i];
+
+                failed |= hash_test_case(ctx, tc, tests->name, i);
+        }
+
+        return failed;
+}
+
+int
+main(void)
+{
+        uint8_t         md5_digest[MD5_DIGEST_LENGTH];
+        uint8_t         rmd160_digest[RMD160_DIGEST_LENGTH];
+        uint8_t         sha1_digest[SHA1_DIGEST_LENGTH];
+        uint8_t         sha224_digest[SHA224_DIGEST_LENGTH];
+        uint8_t         sha256_digest[SHA256_DIGEST_LENGTH];
+        uint8_t         sha384_digest[SHA384_DIGEST_LENGTH];
+        uint8_t         sha512_digest[SHA512_DIGEST_LENGTH];
+        uint8_t         sha512_256_digest[SHA512_256_DIGEST_LENGTH];
+        MD5_CTX         md5_ctx;
+        RMD160_CTX      rmd160_ctx;
+        SHA1_CTX        sha1_ctx;
+        SHA2_CTX        sha224_ctx;
+        SHA2_CTX        sha256_ctx;
+        SHA2_CTX        sha384_ctx;
+        SHA2_CTX        sha512_ctx;
+        SHA2_CTX        sha512_256_ctx;
+        struct hash_ctx ctx[] = {
+                [hash_md5] = {
+                        .digest = md5_digest,
+                        .digest_len = sizeof(md5_digest),
+                        .ctx = &md5_ctx,
+                        .init = md5_init,
+                        .update = md5_update,
+                        .final = md5_final,
+                },
+                [hash_rmd160] = {
+                        .digest = rmd160_digest,
+                        .digest_len = sizeof(rmd160_digest),
+                        .ctx = &rmd160_ctx,
+                        .init = rmd160_init,
+                        .update = rmd160_update,
+                        .final = rmd160_final,
+                },
+                [hash_sha1] = {
+                        .digest = sha1_digest,
+                        .digest_len = sizeof(sha1_digest),
+                        .ctx = &sha1_ctx,
+                        .init = sha1_init,
+                        .update = sha1_update,
+                        .final = sha1_final,
+                },
+                [hash_sha224] = {
+                        .digest = sha224_digest,
+                        .digest_len = sizeof(sha224_digest),
+                        .ctx = &sha224_ctx,
+                        .init = sha224_init,
+                        .update = sha224_update,
+                        .final = sha224_final,
+                },
+                [hash_sha256] = {
+                        .digest = sha256_digest,
+                        .digest_len = sizeof(sha256_digest),
+                        .ctx = &sha256_ctx,
+                        .init = sha256_init,
+                        .update = sha256_update,
+                        .final = sha256_final,
+                },
+                [hash_sha384] = {
+                        .digest = sha384_digest,
+                        .digest_len = sizeof(sha384_digest),
+                        .ctx = &sha384_ctx,
+                        .init = sha384_init,
+                        .update = sha384_update,
+                        .final = sha384_final,
+                },
+                [hash_sha512] = {
+                        .digest = sha512_digest,
+                        .digest_len = sizeof(sha512_digest),
+                        .ctx = &sha512_ctx,
+                        .init = sha512_init,
+                        .update = sha512_update,
+                        .final = sha512_final,
+                },
+                [hash_sha512_256] = {
+                        .digest = sha512_256_digest,
+                        .digest_len = sizeof(sha512_256_digest),
+                        .ctx = &sha512_256_ctx,
+                        .init = sha512_256_init,
+                        .update = sha512_256_update,
+                        .final = sha512_256_final,
+                },
+        };
+        int i;
+        int failed = 0;
+
+        for (i = 0; i < NUM_HASHES; i++)
+                failed |= hash_test(&ctx[i], &hash_tests[i]);
+
+        return failed;
+}
diff --git a/src/regress/lib/libc/illumos/Makefile b/src/regress/lib/libc/illumos/Makefile
new file mode 100644
index 0000000000..cf2d22eb44
--- /dev/null
+++ b/src/regress/lib/libc/illumos/Makefile
@@ -0,0 +1,7 @@
+#       $OpenBSD: Makefile,v 1.1.1.1 2025/08/02 06:16:34 tb Exp $
+
+SUBDIR += oclo
+
+install:
+
+.include <bsd.subdir.mk>
diff --git a/src/regress/lib/libc/illumos/Makefile.inc b/src/regress/lib/libc/illumos/Makefile.inc
new file mode 100644
index 0000000000..4296b6e690
--- /dev/null
+++ b/src/regress/lib/libc/illumos/Makefile.inc
@@ -0,0 +1,9 @@
+#       $OpenBSD: Makefile.inc,v 1.1.1.1 2025/08/02 06:16:34 tb Exp $
+
+ILLUMOS_OS_TESTDIR = /usr/local/share/illumos-os-tests
+
+.if !exists(${ILLUMOS_OS_TESTDIR})
+regress:
+        @echo package illumos-os-tests is required for this regress
+        @echo SKIPPED
+.endif
diff --git a/src/regress/lib/libc/illumos/oclo/Makefile b/src/regress/lib/libc/illumos/oclo/Makefile
new file mode 100644
index 0000000000..284e49dc73
--- /dev/null
+++ b/src/regress/lib/libc/illumos/oclo/Makefile
@@ -0,0 +1,18 @@
+#       $OpenBSD: Makefile,v 1.2 2025/08/09 18:17:42 anton Exp $
+
+.if exists(/usr/local/share/illumos-os-tests)
+
+PROGS =         oclo
+PROGS +=        oclo_errors
+PROGS +=        ocloexec_verify
+
+LDADD_ocloexec_verify = -lkvm
+
+WARNINGS =      yes
+
+regress: ${PROGS}
+
+.PATH: /usr/local/share/illumos-os-tests/tests/oclo
+.endif
+
+.include <bsd.regress.mk>
diff --git a/src/regress/lib/libc/malloc/malloc_errs/malloc_errs.c b/src/regress/lib/libc/malloc/malloc_errs/malloc_errs.c
index 486c247f0d..57d799f49d 100644
--- a/src/regress/lib/libc/malloc/malloc_errs/malloc_errs.c
+++ b/src/regress/lib/libc/malloc/malloc_errs/malloc_errs.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: malloc_errs.c,v 1.5 2024/04/14 17:47:41 otto Exp $    */
+/*      $OpenBSD: malloc_errs.c,v 1.6 2025/05/24 06:40:29 otto Exp $    */
 /*
  * Copyright (c) 2023 Otto Moerbeek <otto@drijf.net>
  *
@@ -286,11 +286,10 @@ int main(int argc, char *argv[])
         int i, status;
         pid_t pid;
         char num[10];
-        char options[10];
-        extern char* malloc_options;
+        char options[40];
+        char const *env[2];
 
-        if (argc == 3) {
-                malloc_options = argv[2];
+        if (argc == 2) {
                 /* prevent coredumps */
                 setrlimit(RLIMIT_CORE, &lim);
                 i = atoi(argv[1]);
@@ -303,9 +302,11 @@ int main(int argc, char *argv[])
                 pid = fork();
                 switch (pid) {
                 case 0:
-                        snprintf(options, sizeof(options), "us%s", tests[i].flags);
+                        snprintf(options, sizeof(options), "MALLOC_OPTIONS=us%s", tests[i].flags);
                         snprintf(num, sizeof(num), "%d", i);
-                        execl(argv[0], argv[0], num, options, NULL);
+                        env[0] = options;
+                        env[1] = NULL;
+                        execle(argv[0], argv[0], num, NULL, env);
                         err(1, "exec");
                 break;
                 case -1:
diff --git a/src/regress/lib/libc/malloc/malloc_ulimit1/malloc_ulimit1.c b/src/regress/lib/libc/malloc/malloc_ulimit1/malloc_ulimit1.c
index 799d2b9117..7e53c32dbc 100644
--- a/src/regress/lib/libc/malloc/malloc_ulimit1/malloc_ulimit1.c
+++ b/src/regress/lib/libc/malloc/malloc_ulimit1/malloc_ulimit1.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: malloc_ulimit1.c,v 1.5 2019/06/12 11:31:36 bluhm Exp $        */
+/*      $OpenBSD: malloc_ulimit1.c,v 1.6 2025/05/24 06:47:27 otto Exp $ */
 
 /* Public Domain, 2006, Otto Moerbeek <otto@drijf.net> */
 
@@ -23,7 +23,7 @@
 #define FACTOR  1024
 
 /* This test takes forever with junking turned on. */
-char *malloc_options = "jj";
+const char * const malloc_options = "jj";
 
 int
 main()
diff --git a/src/regress/lib/libc/stdio/Makefile b/src/regress/lib/libc/stdio/Makefile
new file mode 100644
index 0000000000..f1e980f688
--- /dev/null
+++ b/src/regress/lib/libc/stdio/Makefile
@@ -0,0 +1,29 @@
+# $OpenBSD: Makefile,v 1.4 2025/06/03 14:35:27 yasuoka Exp $
+
+PROGS=          test_fflush
+CLEANFILES=     test_fflush.tmp
+
+PROGS+=         test_ungetwc
+CLEANFILES+=    test_ungetwc.tmp
+
+PROGS+=         test___freading
+CLEANFILES+=    test___freading.tmp
+
+PROGS+=         test___fwriting
+CLEANFILES+=    test___fwriting.tmp
+
+PROGS+=         test___fpending
+CLEANFILES+=    test___fpending.tmp
+
+PROGS+=         test___freadahead
+CLEANFILES+=    test___freadahead.tmp
+
+PROGS+=         test___freadptr
+CLEANFILES+=    test___freadptr.tmp
+
+PROGS+=         test___fseterr
+CLEANFILES+=    test___fseterr.tmp
+
+WARNINGS=       yes
+
+.include <bsd.regress.mk>
diff --git a/src/regress/lib/libc/stdio/test___fpending.c b/src/regress/lib/libc/stdio/test___fpending.c
new file mode 100644
index 0000000000..96ace2e481
--- /dev/null
+++ b/src/regress/lib/libc/stdio/test___fpending.c
@@ -0,0 +1,58 @@
+/*      $OpenBSD: test___fpending.c,v 1.1 2025/05/25 00:20:54 yasuoka Exp $     */
+
+/*
+ * Copyright (c) 2025 YASUOKA Masahiko <yasuoka@yasuoka.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdio_ext.h>
+#include <stdlib.h>
+
+/* we use assert() */
+#undef  NDEBUG
+
+#define TMPFILENAME     "test___fpending.tmp"
+
+void test___fpending0(void);
+
+void
+test___fpending0(void)
+{
+        FILE    *fp;
+        int      r;
+        size_t   s;
+
+        fp = fopen(TMPFILENAME, "w");
+        assert(fp != NULL);
+        r = fputs("Hello world", fp);
+        assert(r >= 0);
+        s = __fpending(fp);
+        assert(s > 0);          /* assume buffered */
+        r = fflush(fp);
+        assert(r == 0);
+        s = __fpending(fp);
+        assert(s == 0);         /* buffer must be 0 */
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+int
+main(int argc, char *argv[])
+{
+        test___fpending0();
+
+        exit(0);
+}
diff --git a/src/regress/lib/libc/stdio/test___freadahead.c b/src/regress/lib/libc/stdio/test___freadahead.c
new file mode 100644
index 0000000000..66d5e3492a
--- /dev/null
+++ b/src/regress/lib/libc/stdio/test___freadahead.c
@@ -0,0 +1,71 @@
+/*      $OpenBSD: test___freadahead.c,v 1.2 2025/06/03 14:35:27 yasuoka Exp $   */
+
+/*
+ * Copyright (c) 2025 YASUOKA Masahiko <yasuoka@yasuoka.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <assert.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdio_ext.h>
+#include <stdlib.h>
+
+/* we use assert() */
+#undef  NDEBUG
+
+#define TMPFILENAME     "test___freadahead.tmp"
+
+void test___freadahead0(void);
+
+void
+test___freadahead0(void)
+{
+        FILE    *fp;
+        int      r;
+        size_t   s;
+
+        fp = fopen(TMPFILENAME, "w");
+        assert(fp != NULL);
+        r = fputs("Hello world", fp);
+        assert(r >= 0);
+        r = fclose(fp);
+
+        fp = fopen(TMPFILENAME, "r");
+        s = __freadahead(fp);
+        assert(s == 0);
+        assert(fgetc(fp) == 'H');
+        s = __freadahead(fp);
+        assert(s == 10);
+        r = fflush(fp);
+#if 0
+        /* fflush() to reading file is not supported (yet) */
+        assert(errno == EBADF);
+#else
+        assert(r == 0);
+        s = __freadahead(fp);
+        assert(s == 0);
+#endif
+
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+int
+main(int argc, char *argv[])
+{
+        test___freadahead0();
+
+        exit(0);
+}
diff --git a/src/regress/lib/libc/stdio/test___freading.c b/src/regress/lib/libc/stdio/test___freading.c
new file mode 100644
index 0000000000..f74eb78d35
--- /dev/null
+++ b/src/regress/lib/libc/stdio/test___freading.c
@@ -0,0 +1,125 @@
+/*      $OpenBSD: test___freading.c,v 1.2 2025/06/12 07:39:26 yasuoka Exp $     */
+
+/*
+ * Copyright (c) 2025 YASUOKA Masahiko <yasuoka@yasuoka.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdio_ext.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+/* we use assert() */
+#undef  NDEBUG
+
+#define TMPFILENAME     "test___freading.tmp"
+
+void setup(void);
+
+void test___freading0(void);
+void test___freading1(void);
+void test___freading2(void);
+
+void
+setup(void)
+{
+        FILE    *fp;
+
+        /* common setup */
+        unlink(TMPFILENAME);
+        fp = fopen(TMPFILENAME, "w+");
+        assert(fp != NULL);
+        fputs("Hello world\n", fp);
+        fclose(fp);
+}
+
+void
+test___freading0(void)
+{
+        FILE    *fp;
+        int      r;
+        char     buf[80];
+
+        fp = popen("echo Hello world", "r");
+        assert(fp != NULL);
+        assert(__freading(fp) != 0);
+        assert(fgets(buf, sizeof(buf), fp) != NULL);
+        assert(strcmp(buf, "Hello world\n") == 0);
+        r = pclose(fp);
+        assert(r == 0);
+}
+
+void
+test___freading1(void)
+{
+        FILE    *fp;
+        int      r;
+
+        /* when the last operaiton is read, __freading() returns true */
+        fp = fopen(TMPFILENAME, "w+");
+        assert(fp != NULL);
+        assert(__freading(fp) == 0);
+        r = fputs("Hello world\n", fp);
+        assert(r >= 0);
+        assert(__freading(fp) == 0);
+        rewind(fp);
+        assert(fgetc(fp) == 'H');
+        assert(__freading(fp) != 0);
+        /* write */
+        fseek(fp, 0, SEEK_END);
+        r = fputs("\n", fp);
+        assert(__freading(fp) == 0);
+        /* ungetc */
+        rewind(fp);
+        assert(ungetc('X', fp) != 0);
+        assert(__freading(fp) != 0);    /* reading */
+
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+void
+test___freading2(void)
+{
+        int      r;
+        FILE    *fp;
+
+        /*
+         * until v1.10 of fpurge.c mistakenly enables the writing buffer
+         * without _SRD flag set.
+         */
+        fp = fopen(TMPFILENAME, "r+");
+        assert(fp != NULL);
+        assert(fgetc(fp) == 'H');
+        fpurge(fp);
+        fseek(fp, 0, SEEK_CUR);
+        assert(fputc('X', fp) == 'X');
+        assert(__freading(fp) == 0);
+
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+int
+main(int argc, char *argv[])
+{
+        test___freading0();
+        test___freading1();
+        test___freading2();
+
+        exit(0);
+}
diff --git a/src/regress/lib/libc/stdio/test___freadptr.c b/src/regress/lib/libc/stdio/test___freadptr.c
new file mode 100644
index 0000000000..cce362f2ae
--- /dev/null
+++ b/src/regress/lib/libc/stdio/test___freadptr.c
@@ -0,0 +1,78 @@
+/*      $OpenBSD: test___freadptr.c,v 1.1 2025/05/25 00:20:54 yasuoka Exp $     */
+
+/*
+ * Copyright (c) 2025 YASUOKA Masahiko <yasuoka@yasuoka.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <assert.h>
+#include <stdio.h>
+#include <stdio_ext.h>
+#include <stdlib.h>
+#include <string.h>
+
+/* we use assert() */
+#undef  NDEBUG
+
+#define TMPFILENAME     "test___freadptr.tmp"
+
+void test___freadptr0(void);
+
+/* test __freadptr() and __freadptrinc() */
+void
+test___freadptr0(void)
+{
+        FILE            *fp;
+        int              r;
+        ssize_t          s;
+        const char      *p;
+
+        fp = fopen(TMPFILENAME, "w");
+        assert(fp != NULL);
+        r = fputs("Hello world", fp);
+        assert(r >= 0);
+        r = fclose(fp);
+
+        fp = fopen(TMPFILENAME, "r");
+        assert(fgetc(fp) == 'H');
+        p = __freadptr(fp, &s);
+        assert(p != NULL);
+        assert(s > 4);          /* this test assume this (not by the spec) */
+        assert(*p == 'e');
+        assert(strncmp(p, "ello world", s) == 0);
+
+        __freadptrinc(fp, 4);
+        assert(fgetc(fp) == ' ');
+
+        ungetc('A', fp);
+        ungetc('A', fp);
+        ungetc('A', fp);
+        p = __freadptr(fp, &s);
+        assert(s > 0);
+        assert(*p == 'A');
+        /* ptr will contains only the pushback buffer */
+        assert(strncmp(p, "AAAworld", s) == 0);
+
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+int
+main(int argc, char *argv[])
+{
+        test___freadptr0();
+
+        exit(0);
+}
diff --git a/src/regress/lib/libc/stdio/test___fseterr.c b/src/regress/lib/libc/stdio/test___fseterr.c
new file mode 100644
index 0000000000..70fb491c6c
--- /dev/null
+++ b/src/regress/lib/libc/stdio/test___fseterr.c
@@ -0,0 +1,60 @@
+/*      $OpenBSD: test___fseterr.c,v 1.1 2025/05/25 00:20:54 yasuoka Exp $      */
+
+/*
+ * Copyright (c) 2025 YASUOKA Masahiko <yasuoka@yasuoka.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdio_ext.h>
+#include <stdlib.h>
+
+/* we use assert() */
+#undef  NDEBUG
+
+#define TMPFILENAME     "test___fseterr.tmp"
+
+void test___fseterr0(void);
+
+void
+test___fseterr0(void)
+{
+        FILE    *fp;
+        int      r;
+
+        fp = fopen(TMPFILENAME, "w+");
+        assert(fp != NULL);
+
+        assert(!ferror(fp));
+
+        r = fprintf(fp, "hello world\n");
+        assert(r > 0);
+
+        __fseterr(fp);
+        assert(ferror(fp));
+
+        r = fprintf(fp, "hello world\n");
+        assert(r == -1);
+
+        fclose(fp);
+}
+
+int
+main(int argc, char *argv[])
+{
+        test___fseterr0();
+
+        exit(0);
+}
diff --git a/src/regress/lib/libc/stdio/test___fwriting.c b/src/regress/lib/libc/stdio/test___fwriting.c
new file mode 100644
index 0000000000..eb4671d3cf
--- /dev/null
+++ b/src/regress/lib/libc/stdio/test___fwriting.c
@@ -0,0 +1,83 @@
+/*      $OpenBSD: test___fwriting.c,v 1.1 2025/05/25 00:20:54 yasuoka Exp $     */
+
+/*
+ * Copyright (c) 2025 YASUOKA Masahiko <yasuoka@yasuoka.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdio_ext.h>
+#include <stdlib.h>
+
+/* we use assert() */
+#undef  NDEBUG
+
+#define TMPFILENAME     "test___fwriting.tmp"
+
+void test___fwriting0(void);
+void test___fwriting1(void);
+
+void
+test___fwriting0(void)
+{
+        FILE    *fp;
+        int      r;
+
+        fp = fopen(TMPFILENAME, "w");   /* write only */
+        assert(fp != NULL);
+        assert(__fwriting(fp) != 0);    /* writing is true immediately */
+        r = fputs("Hello world\n", fp);
+        assert(r >= 0);
+        r = fclose(fp);
+        assert(r == 0);
+
+        fp = fopen(TMPFILENAME, "a");   /* append only */
+        assert(fp != NULL);
+        assert(__fwriting(fp) != 0);    /* writing immediately */
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+void
+test___fwriting1(void)
+{
+        FILE    *fp;
+        int      r;
+
+        fp = fopen(TMPFILENAME, "w+");  /* read / write */
+        assert(fp != NULL);
+        r = fputs("Hello world\n", fp);
+        assert(r >= 0);
+        assert(__fwriting(fp) != 0);
+        rewind(fp);
+        assert(fgetc(fp) == 'H');       /* read */
+        assert(__fwriting(fp) == 0);    /* writing becomes false */
+        fputc('e', fp);
+        assert(__fwriting(fp) != 0);    /* writing becomes true */
+        ungetc('e', fp);
+        assert(__fwriting(fp) == 0);    /* ungetc -> writing becomes false */
+
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+int
+main(int argc, char *argv[])
+{
+        test___fwriting0();
+        test___fwriting1();
+
+        exit(0);
+}
diff --git a/src/regress/lib/libc/stdio/test_fflush.c b/src/regress/lib/libc/stdio/test_fflush.c
new file mode 100644
index 0000000000..a0586b7d14
--- /dev/null
+++ b/src/regress/lib/libc/stdio/test_fflush.c
@@ -0,0 +1,345 @@
+/*      $OpenBSD: test_fflush.c,v 1.3 2025/06/08 08:53:53 yasuoka Exp $ */
+
+/*
+ * Copyright (c) 2025 YASUOKA Masahiko <yasuoka@yasuoka.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <assert.h>
+#include <locale.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <wchar.h>
+
+/* we use assert() */
+#undef  NDEBUG
+
+#define TMPFILENAME     "test_fflush.tmp"
+
+void setup(void);
+
+void test_fflush_read0(void);
+void test_fflush_read1(void);
+void test_fflush_read2(void);
+void test_fflush_read3(void);
+void test_fflush_read4(void);
+void setupw(void);
+void test_fflush_read5(void);
+void test_fflush_read6(void);
+
+void
+setup(void)
+{
+        FILE    *fp;
+
+        /* common setup */
+        unlink(TMPFILENAME);
+        fp = fopen(TMPFILENAME, "w+");
+        assert(fp != NULL);
+        fputs("Hello world\n", fp);
+        fclose(fp);
+}
+
+/* fflush work with reading file and seekable */
+void
+test_fflush_read0(void)
+{
+        int      r;
+        char     buf[80];
+        FILE    *fp;
+
+        setup();
+
+        /* In POSIX 2008, fflush() must work with the file object for reading */
+        fp = fopen(TMPFILENAME, "r");
+        assert(fp != NULL);
+        assert(fgetc(fp) == 'H');
+        r = fflush(fp);
+        assert(r == 0);
+
+        /* the position is moved to 1 */
+        assert(ftell(fp) == 1);
+
+        /* can read rest of that */
+        fgets(buf, sizeof(buf), fp);
+        assert(strcmp(buf, "ello world\n") == 0);
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+/* fflush work with reading file and seekable + unget */
+void
+test_fflush_read1(void)
+{
+        int      r;
+        char     buf[80];
+        FILE    *fp;
+
+        setup();
+
+        fp = fopen(TMPFILENAME, "r");
+        assert(fp != NULL);
+        assert(fgetc(fp) == 'H');
+        assert(fgetc(fp) == 'e');
+        assert(fgetc(fp) == 'l');
+        assert(fgetc(fp) == 'l');
+        assert(fgetc(fp) == 'o');
+
+        /* push the 'AAAA' back */
+        ungetc('A', fp);
+        ungetc('A', fp);
+        ungetc('A', fp);
+        ungetc('A', fp);
+
+        /* can read rest of that */
+        fgets(buf, sizeof(buf), fp);
+        assert(strcmp(buf, "AAAA world\n") == 0);
+        r = fclose(fp);
+        assert(r == 0);
+
+        /* do the same thing + fflush */
+
+        fp = fopen(TMPFILENAME, "r");
+        assert(fp != NULL);
+        assert(fgetc(fp) == 'H');
+        assert(fgetc(fp) == 'e');
+        assert(fgetc(fp) == 'l');
+        assert(fgetc(fp) == 'l');
+        assert(fgetc(fp) == 'o');
+
+        /* push 'AAAA' back */
+        ungetc('A', fp);
+        ungetc('A', fp);
+        ungetc('A', fp);
+        ungetc('A', fp);
+
+        /* then fflush */
+        r = fflush(fp);
+        assert(r == 0);
+
+        /* fllush() clears the all pushed back chars */
+
+        /* can read rest of that */
+        fgets(buf, sizeof(buf), fp);
+        assert(strcmp(buf, " world\n") == 0);
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+/* fflush() to reading and non-seekable stream */
+void
+test_fflush_read2(void)
+{
+        int      r;
+        FILE    *fp;
+        char     buf[80];
+
+        /* In POSIX-2008, fflush() must work with the file object for reading */
+        fp = popen("echo Hello world", "r");
+        assert(fp != NULL);
+        assert(fgetc(fp) == 'H');
+        r = fflush(fp);
+        assert(r == 0);
+
+        /*
+         * FILE object for read and NOT seekable.  In that case, fflush does
+         * nothing, but must keep the buffer.
+         */
+
+        /* can read rest of that */
+        fgets(buf, sizeof(buf), fp);
+        assert(strcmp(buf, "ello world\n") == 0);
+        r = pclose(fp);
+        assert(r == 0);
+}
+
+/* fflush() to the file which doesn't have any buffer */
+void
+test_fflush_read3(void)
+{
+        int      r;
+        FILE    *fp;
+
+        setup();
+
+        /* In POSIX-2008, fflush() must work with the file object for reading */
+        fp = fopen(TMPFILENAME, "r");
+        assert(fp != NULL);
+        r = fflush(fp);
+        assert(r == 0);
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+/* freopen() should call fflush() internal */
+void
+test_fflush_read4(void)
+{
+        int      r;
+        FILE    *fp;
+        off_t    pos;
+        char     buf[80];
+
+        setup();
+
+        /* In POSIX-2008, fflush() must work with the file object for reading */
+        fp = fopen(TMPFILENAME, "r");
+        assert(fp != NULL);
+
+        assert(fgetc(fp) == 'H');       /* read 1 */
+
+        pos = lseek(fileno(fp), 0, SEEK_CUR);
+        assert(pos >= 1);
+        assert(pos > 1);        /* this test assume the buffer is used */
+
+        /* freopen() should call fflush() internal */
+        fp = freopen(TMPFILENAME, "r", fp);
+        assert(fp != NULL);
+
+        /* can read rest of that on fp */
+        fgets(buf, sizeof(buf), fp);
+        assert(strcmp(buf, "Hello world\n") == 0);
+
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+void
+setupw(void)
+{
+        FILE    *fp;
+
+        /* common setup */
+        unlink(TMPFILENAME);
+        fp = fopen(TMPFILENAME, "w+");
+        assert(fp != NULL);
+        /* Konnitiwa Sekai(in Kanji) */
+        fputws(L"\u3053\u3093\u306b\u3061\u308f \u4e16\u754c\n", fp);
+        fclose(fp);
+}
+
+/* fflush work with reading file and seekable + ungetwc */
+void
+test_fflush_read5(void)
+{
+        int      r;
+        wchar_t  buf[80];
+        FILE    *fp;
+
+        setupw();
+
+        fp = fopen(TMPFILENAME, "r");
+
+        assert(fp != NULL);
+        assert(fgetwc(fp) == L'\u3053');        /* Ko */
+        assert(fgetwc(fp) == L'\u3093');        /* N  */
+        assert(fgetwc(fp) == L'\u306b');        /* Ni */
+        assert(fgetwc(fp) == L'\u3061');        /* Ti */
+        assert(fgetwc(fp) == L'\u308f');        /* Wa */
+
+        /* push 263A(smile) back */
+        assert(ungetwc(L'\u263a', fp));
+
+        /* we support 1 push back wchar_t */
+        assert(fgetwc(fp) == L'\u263a');
+
+        /* can read reset of that */
+        fgetws(buf, sizeof(buf), fp);
+        assert(wcscmp(buf, L" \u4e16\u754c\n") == 0);
+
+        r = fclose(fp);
+        assert(r == 0);
+
+        /* do the same thing + fflush */
+        fp = fopen(TMPFILENAME, "r");
+
+        assert(fp != NULL);
+        assert(fgetwc(fp) == L'\u3053');        /* Ko */
+        assert(fgetwc(fp) == L'\u3093');        /* N  */
+        assert(fgetwc(fp) == L'\u306b');        /* Ni */
+        assert(fgetwc(fp) == L'\u3061');        /* Ti */
+        assert(fgetwc(fp) == L'\u308f');        /* Wa */
+
+        /* push 263A(smile) back */
+        assert(ungetwc(L'\u263a', fp));
+
+        /* we support 1 push back wchar_t */
+        assert(fgetwc(fp) == L'\u263a');
+
+        /* then fflush */
+        r = fflush(fp);
+        assert(r == 0);
+
+        /* fllush() clears the all pushed back chars */
+
+        /* can read rest of that */
+        fgetws(buf, sizeof(buf), fp);
+        assert(wcscmp(buf, L" \u4e16\u754c\n") == 0);
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+void
+test_fflush_read6(void)
+{
+        int      r, c;
+        FILE    *fp;
+
+        setup();
+        fp = fopen(TMPFILENAME, "r");
+        assert(fp != NULL);
+
+        /*
+         * https://pubs.opengroup.org/onlinepubs/9699919799/functions/fflush.html
+         * .. any characters pushed back onto the stream by ungetc() or ungetwc()
+         * that have not subsequently been read from the stream shall be discarded
+         * (without further changing the file offset).
+         */
+
+        assert(fgetc(fp) == 'H');
+        c = getc(fp);
+        ungetc(c, fp);  /* push back the character has been read */
+        r = fflush(fp);
+        assert(r == 0);
+        assert(getc(fp) == c);
+
+        fseek(fp, 0, SEEK_SET);
+        assert(fgetc(fp) == 'H');
+        c = getc(fp);
+        ungetc('X', fp); /* push back the character has not been read */
+        r = fflush(fp);
+        assert(r == 0);
+        assert(getc(fp) == 'l');
+
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+int
+main(int argc, char *argv[])
+{
+        setlocale(LC_ALL, "C.UTF-8");
+
+        test_fflush_read0();
+        test_fflush_read1();
+        test_fflush_read2();
+        test_fflush_read3();
+        test_fflush_read4();
+        test_fflush_read5();
+        test_fflush_read6();
+
+        exit(0);
+}
diff --git a/src/regress/lib/libc/stdio/test_ungetwc.c b/src/regress/lib/libc/stdio/test_ungetwc.c
new file mode 100644
index 0000000000..bb4e853020
--- /dev/null
+++ b/src/regress/lib/libc/stdio/test_ungetwc.c
@@ -0,0 +1,90 @@
+/*      $OpenBSD: test_ungetwc.c,v 1.1 2025/05/25 05:32:45 yasuoka Exp $        */
+
+/*
+ * Copyright (c) 2025 YASUOKA Masahiko <yasuoka@yasuoka.net>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <assert.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <locale.h>
+#include <wchar.h>
+
+/* we use assert() */
+#undef  NDEBUG
+
+#define TMPFILENAME     "test_ungetwc.tmp"
+
+void setupw(void);
+void test_fflush_ungetwc0(void);
+
+void
+setupw(void)
+{
+        FILE    *fp;
+
+        /* common setup */
+        unlink(TMPFILENAME);
+        fp = fopen(TMPFILENAME, "w+");
+        assert(fp != NULL);
+        /* Konnitiwa Sekai(in Kanji) */
+        fputws(L"\u3053\u3093\u306b\u3061\u308f \u4e16\u754c\n", fp);
+        fclose(fp);
+}
+
+/* fflush work with reading file and seekable + ungetwc */
+void
+test_fflush_ungetwc0(void)
+{
+        int      r;
+        wchar_t  buf[80];
+        FILE    *fp;
+
+        setupw();
+
+        fp = fopen(TMPFILENAME, "r");
+
+        assert(fp != NULL);
+        assert(fgetwc(fp) == L'\u3053');        /* Ko */
+        assert(fgetwc(fp) == L'\u3093');        /* N  */
+        assert(fgetwc(fp) == L'\u306b');        /* Ni */
+        assert(fgetwc(fp) == L'\u3061');        /* Ti */
+        assert(fgetwc(fp) == L'\u308f');        /* Wa */
+
+        /* push 263A(smile) back */
+        assert(ungetwc(L'\u263a', fp));
+
+        /* we support 1 push back wchar_t */
+        assert(fgetwc(fp) == L'\u263a');
+
+        /* can read reset of that */
+        fgetws(buf, sizeof(buf), fp);
+        assert(wcscmp(buf, L" \u4e16\u754c\n") == 0);
+
+        r = fclose(fp);
+        assert(r == 0);
+}
+
+int
+main(int argc, char *argv[])
+{
+        setlocale(LC_ALL, "C.UTF-8");
+
+        test_fflush_ungetwc0();
+
+        exit(0);
+}
diff --git a/src/regress/lib/libc/time/time_conversion/timetest.c b/src/regress/lib/libc/time/time_conversion/timetest.c
index 0706704ee1..1405f1c6a5 100644
--- a/src/regress/lib/libc/time/time_conversion/timetest.c
+++ b/src/regress/lib/libc/time/time_conversion/timetest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: timetest.c,v 1.4 2023/04/13 11:32:06 mbuhl Exp $ */
+/*      $OpenBSD: timetest.c,v 1.5 2025/08/17 08:43:03 phessler Exp $ */
 
 /*
  * Copyright (c) 2022 Bob Beck <beck@openbsd.org>
@@ -79,12 +79,12 @@ struct timetest timetests[] = {
                         .tm_yday=171,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="moon",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=-16751025,
                 .local_tm=              {
                         .tm_year=69,
@@ -97,7 +97,7 @@ struct timetest timetests[] = {
                         .tm_yday=171,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=69,
@@ -110,7 +110,7 @@ struct timetest timetests[] = {
                         .tm_yday=171,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -141,7 +141,7 @@ struct timetest timetests[] = {
                         .tm_yday=171,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -172,12 +172,12 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="epoch",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=0,
                 .local_tm=              {
                         .tm_year=70,
@@ -190,7 +190,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=70,
@@ -203,7 +203,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -234,7 +234,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -265,12 +265,12 @@ struct timetest timetests[] = {
                         .tm_yday=364,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="epoch - 1",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=-1,
                 .local_tm=              {
                         .tm_year=69,
@@ -283,7 +283,7 @@ struct timetest timetests[] = {
                         .tm_yday=364,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=69,
@@ -296,7 +296,7 @@ struct timetest timetests[] = {
                         .tm_yday=364,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -327,7 +327,7 @@ struct timetest timetests[] = {
                         .tm_yday=364,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -358,12 +358,12 @@ struct timetest timetests[] = {
                         .tm_yday=346,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="legacy min",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=-2147483648,
                 .local_tm=              {
                         .tm_year=1,
@@ -376,7 +376,7 @@ struct timetest timetests[] = {
                         .tm_yday=346,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=1,
@@ -389,7 +389,7 @@ struct timetest timetests[] = {
                         .tm_yday=346,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -420,12 +420,12 @@ struct timetest timetests[] = {
                         .tm_yday=346,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="legacy min - 1",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=-2147483649,
                 .local_tm=              {
                         .tm_year=1,
@@ -438,7 +438,7 @@ struct timetest timetests[] = {
                         .tm_yday=346,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=1,
@@ -451,7 +451,7 @@ struct timetest timetests[] = {
                         .tm_yday=346,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -482,12 +482,12 @@ struct timetest timetests[] = {
                         .tm_yday=18,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="legacy max",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=2147483647,
                 .local_tm=              {
                         .tm_year=138,
@@ -500,7 +500,7 @@ struct timetest timetests[] = {
                         .tm_yday=18,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=138,
@@ -513,7 +513,7 @@ struct timetest timetests[] = {
                         .tm_yday=18,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -544,12 +544,12 @@ struct timetest timetests[] = {
                         .tm_yday=18,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="legacy max + 1",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=2147483648,
                 .local_tm=              {
                         .tm_year=138,
@@ -562,7 +562,7 @@ struct timetest timetests[] = {
                         .tm_yday=18,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=138,
@@ -575,7 +575,7 @@ struct timetest timetests[] = {
                         .tm_yday=18,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -611,7 +611,7 @@ struct timetest timetests[] = {
         },
         {
                 .descr="min",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=INT64_MIN,
                 .local_tm=              {
                         .tm_year=0,
@@ -704,7 +704,7 @@ struct timetest timetests[] = {
         },
         {
                 .descr="max",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=9223372036854775807,
                 .local_tm=              {
                         .tm_year=0,
@@ -792,7 +792,7 @@ struct timetest timetests[] = {
                         .tm_yday=30,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -823,12 +823,12 @@ struct timetest timetests[] = {
                         .tm_yday=30,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="maxint struct tm",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=67767976204675199,
                 .local_tm=              {
                         .tm_year=2147481747,
@@ -841,7 +841,7 @@ struct timetest timetests[] = {
                         .tm_yday=30,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=2147481747,
@@ -854,12 +854,12 @@ struct timetest timetests[] = {
                         .tm_yday=30,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="minint struct tm",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=-67768038398073601,
                 .local_tm=              {
                         .tm_year=-2147483578,
@@ -872,7 +872,7 @@ struct timetest timetests[] = {
                         .tm_yday=30,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=-2147483578,
@@ -885,7 +885,7 @@ struct timetest timetests[] = {
                         .tm_yday=30,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -916,12 +916,12 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="0000",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=-62167219200,
                 .local_tm=              {
                         .tm_year=-1900,
@@ -934,7 +934,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=-1900,
@@ -947,7 +947,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -978,7 +978,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1009,12 +1009,12 @@ struct timetest timetests[] = {
                         .tm_yday=364,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="9999",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=253402300799,
                 .local_tm=              {
                         .tm_year=8099,
@@ -1027,7 +1027,7 @@ struct timetest timetests[] = {
                         .tm_yday=364,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=8099,
@@ -1040,7 +1040,7 @@ struct timetest timetests[] = {
                         .tm_yday=364,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1071,7 +1071,7 @@ struct timetest timetests[] = {
                         .tm_yday=364,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1102,7 +1102,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1133,7 +1133,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1164,12 +1164,12 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="leap second - 1",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=1483228825,
                 .local_tm=              {
                         .tm_year=116,
@@ -1182,7 +1182,7 @@ struct timetest timetests[] = {
                         .tm_yday=365,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=117,
@@ -1195,12 +1195,12 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="leap second",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=1483228826,
                 .local_tm=              {
                         .tm_year=116,
@@ -1213,7 +1213,7 @@ struct timetest timetests[] = {
                         .tm_yday=365,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=117,
@@ -1226,12 +1226,12 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
                 .descr="leap second + 1",
-                .timezone="right/UTC",
+                .timezone="right/GMT",
                 .time=1483228827,
                 .local_tm=              {
                         .tm_year=117,
@@ -1244,7 +1244,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="UTC"
+                        .tm_zone="GMT"
                 },
                 .gmt_tm=                {
                         .tm_year=117,
@@ -1257,7 +1257,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1288,7 +1288,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1319,7 +1319,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1350,7 +1350,7 @@ struct timetest timetests[] = {
                         .tm_yday=0,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1381,7 +1381,7 @@ struct timetest timetests[] = {
                         .tm_yday=72,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1412,7 +1412,7 @@ struct timetest timetests[] = {
                         .tm_yday=72,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1443,7 +1443,7 @@ struct timetest timetests[] = {
                         .tm_yday=72,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1474,7 +1474,7 @@ struct timetest timetests[] = {
                         .tm_yday=72,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1505,7 +1505,7 @@ struct timetest timetests[] = {
                         .tm_yday=72,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1536,7 +1536,7 @@ struct timetest timetests[] = {
                         .tm_yday=72,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1567,7 +1567,7 @@ struct timetest timetests[] = {
                         .tm_yday=310,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1598,7 +1598,7 @@ struct timetest timetests[] = {
                         .tm_yday=310,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1629,7 +1629,7 @@ struct timetest timetests[] = {
                         .tm_yday=310,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1660,7 +1660,7 @@ struct timetest timetests[] = {
                         .tm_yday=310,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1691,7 +1691,7 @@ struct timetest timetests[] = {
                         .tm_yday=310,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
@@ -1722,7 +1722,7 @@ struct timetest timetests[] = {
                         .tm_yday=310,
                         .tm_isdst=0,
                         .tm_gmtoff=0,
-                        .tm_zone="GMT"
+                        .tm_zone="UTC"
                 },
         },
         {
diff --git a/src/regress/lib/libcrypto/aes/aes_test.c b/src/regress/lib/libcrypto/aes/aes_test.c
index 37bee05ca7..8d5947a031 100644
--- a/src/regress/lib/libcrypto/aes/aes_test.c
+++ b/src/regress/lib/libcrypto/aes/aes_test.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: aes_test.c,v 1.3 2023/09/28 08:21:43 tb Exp $ */
+/*      $OpenBSD: aes_test.c,v 1.5 2025/07/05 14:32:47 jsing Exp $ */
 /*
  * Copyright (c) 2022 Joshua Sing <joshua@hypera.dev>
  *
@@ -524,6 +524,161 @@ static const struct aes_test aes_tests[] = {
                 },
                 .out_len = 64,
         },
+
+        /* XTS128 - Test vectors from NIST SP 800-38A */
+        {
+                /* XTSGenAES128 1 */
+                .mode = NID_aes_128_xts,
+                .key = {
+                        0xa1, 0xb9, 0x0c, 0xba, 0x3f, 0x06, 0xac, 0x35,
+                        0x3b, 0x2c, 0x34, 0x38, 0x76, 0x08, 0x17, 0x62,
+                        0x09, 0x09, 0x23, 0x02, 0x6e, 0x91, 0x77, 0x18,
+                        0x15, 0xf2, 0x9d, 0xab, 0x01, 0x93, 0x2f, 0x2f,
+                },
+                .iv = {
+                        0x4f, 0xae, 0xf7, 0x11, 0x7c, 0xda, 0x59, 0xc6,
+                        0x6e, 0x4b, 0x92, 0x01, 0x3e, 0x76, 0x8a, 0xd5,
+                },
+                .iv_len = 16,
+                .in = {
+                        0xeb, 0xab, 0xce, 0x95, 0xb1, 0x4d, 0x3c, 0x8d,
+                        0x6f, 0xb3, 0x50, 0x39, 0x07, 0x90, 0x31, 0x1c,
+                },
+                .in_len = 16,
+                .out = {
+                        0x77, 0x8a, 0xe8, 0xb4, 0x3c, 0xb9, 0x8d, 0x5a,
+                        0x82, 0x50, 0x81, 0xd5, 0xbe, 0x47, 0x1c, 0x63,
+                },
+                .out_len = 16,
+        },
+        {
+                /* XTSGenAES128 385 */
+                .mode = NID_aes_128_xts,
+                .key = {
+                        0xb8, 0xdb, 0x0b, 0x9e, 0x63, 0xf5, 0xf0, 0xe6,
+                        0x60, 0x97, 0x98, 0xa6, 0xcb, 0x42, 0xbb, 0x5b,
+                        0x5d, 0x71, 0x39, 0xbb, 0x95, 0x57, 0x99, 0xf5,
+                        0x2a, 0x7c, 0x58, 0x1f, 0x84, 0x63, 0x31, 0x76,
+                },
+                .iv = {
+                        0x8d, 0x46, 0xf9, 0x67, 0x01, 0x16, 0x7a, 0x1d,
+                        0x77, 0xcd, 0x1e, 0x44, 0xda, 0x92, 0xf3, 0xa8,
+                },
+                .iv_len = 16,
+                .in = {
+                        0xb4, 0x64, 0x4d, 0xc1, 0xb3, 0x8d, 0xd5, 0x98,
+                        0xca, 0x84, 0x0a, 0x82, 0xd4, 0xd9, 0xc0, 0x65,
+                        0x67, 0x23, 0xb1, 0x58, 0x01, 0xaa, 0x18, 0xe6,
+                        0x6e,
+                },
+                .in_len = 25,
+                .out = {
+                        0x09, 0x28, 0x8c, 0xf5, 0x1f, 0x1e, 0xb4, 0xad,
+                        0xb8, 0x54, 0x23, 0xd0, 0xe0, 0xd6, 0xe9, 0x58,
+                        0x18, 0x87, 0x06, 0xaf, 0x26, 0x0e, 0x24, 0x67,
+                        0x4e,
+                },
+                .out_len = 25,
+        },
+        {
+                /* XTSGenAES128 404 */
+                .mode = NID_aes_128_xts,
+                .key = {
+                        0xbe, 0x5c, 0xf1, 0xf9, 0x9d, 0x51, 0x59, 0xf2,
+                        0x11, 0xdb, 0xc4, 0xc1, 0x47, 0xf7, 0x9c, 0x55,
+                        0x6b, 0x2d, 0xa5, 0xc6, 0x91, 0xde, 0xed, 0x74,
+                        0x0d, 0x01, 0x57, 0xea, 0xb8, 0xc9, 0xc8, 0x9a,
+                },
+                .iv = {
+                        0x89, 0x24, 0x86, 0x24, 0xb6, 0x96, 0xcf, 0x9c,
+                        0xb1, 0xb5, 0x77, 0x9c, 0xdc, 0xbc, 0xfe, 0x1c,
+                },
+                .iv_len = 16,
+                .in = {
+                        0x3b, 0x80, 0xf8, 0x22, 0xc4, 0xee, 0xe1, 0x31,
+                        0x3f, 0x79, 0xca, 0x3d, 0xb1, 0x34, 0xd9, 0xca,
+                        0x8b, 0x09, 0xa3, 0x53, 0x4d, 0x4e, 0x18, 0xe6,
+                        0x43, 0x9e, 0x1c, 0xdb, 0x86, 0x18, 0x2a, 0x4f,
+                },
+                .in_len = 32,
+                .out = {
+                        0x4b, 0x6a, 0xf4, 0x3a, 0x88, 0xb6, 0x33, 0xeb,
+                        0xd1, 0xe1, 0x27, 0xc1, 0xec, 0x90, 0xcc, 0x47,
+                        0xa2, 0xf1, 0x6e, 0x3b, 0xc7, 0x9f, 0x88, 0x45,
+                        0xe3, 0xbd, 0x00, 0x25, 0xda, 0x87, 0x26, 0x45,
+                },
+                .out_len = 32,
+        },
+        {
+                /* XTSGenAES256 1 */
+                .mode = NID_aes_256_xts,
+                .key = {
+                        0x1e, 0xa6, 0x61, 0xc5, 0x8d, 0x94, 0x3a, 0x0e,
+                        0x48, 0x01, 0xe4, 0x2f, 0x4b, 0x09, 0x47, 0x14,
+                        0x9e, 0x7f, 0x9f, 0x8e, 0x3e, 0x68, 0xd0, 0xc7,
+                        0x50, 0x52, 0x10, 0xbd, 0x31, 0x1a, 0x0e, 0x7c,
+                        0xd6, 0xe1, 0x3f, 0xfd, 0xf2, 0x41, 0x8d, 0x8d,
+                        0x19, 0x11, 0xc0, 0x04, 0xcd, 0xa5, 0x8d, 0xa3,
+                        0xd6, 0x19, 0xb7, 0xe2, 0xb9, 0x14, 0x1e, 0x58,
+                        0x31, 0x8e, 0xea, 0x39, 0x2c, 0xf4, 0x1b, 0x08,
+                },
+                .iv = {
+                        0xad, 0xf8, 0xd9, 0x26, 0x27, 0x46, 0x4a, 0xd2,
+                        0xf0, 0x42, 0x8e, 0x84, 0xa9, 0xf8, 0x75, 0x64,
+                },
+                .iv_len = 16,
+                .in = {
+                        0x2e, 0xed, 0xea, 0x52, 0xcd, 0x82, 0x15, 0xe1,
+                        0xac, 0xc6, 0x47, 0xe8, 0x10, 0xbb, 0xc3, 0x64,
+                        0x2e, 0x87, 0x28, 0x7f, 0x8d, 0x2e, 0x57, 0xe3,
+                        0x6c, 0x0a, 0x24, 0xfb, 0xc1, 0x2a, 0x20, 0x2e,
+                },
+                .in_len = 32,
+                .out = {
+                        0xcb, 0xaa, 0xd0, 0xe2, 0xf6, 0xce, 0xa3, 0xf5,
+                        0x0b, 0x37, 0xf9, 0x34, 0xd4, 0x6a, 0x9b, 0x13,
+                        0x0b, 0x9d, 0x54, 0xf0, 0x7e, 0x34, 0xf3, 0x6a,
+                        0xf7, 0x93, 0xe8, 0x6f, 0x73, 0xc6, 0xd7, 0xdb,
+                },
+                .out_len = 32,
+        },
+        {
+                /* XTSGenAES256 172 */
+                .mode = NID_aes_256_xts,
+                .key= {
+                        0x5c, 0x7f, 0x7a, 0x36, 0x08, 0x01, 0x78, 0x43,
+                        0x00, 0x83, 0xff, 0x54, 0x92, 0xef, 0x77, 0x26,
+                        0x0f, 0x68, 0x0a, 0x15, 0xa7, 0x66, 0x24, 0xb8,
+                        0x9e, 0x85, 0x4c, 0x94, 0xf0, 0x48, 0x8a, 0x9e,
+                        0x7d, 0xaa, 0x4f, 0x33, 0x01, 0x1f, 0x91, 0xdf,
+                        0x5e, 0x33, 0x80, 0x53, 0xf4, 0x6c, 0xee, 0x65,
+                        0x0f, 0xb0, 0xee, 0x69, 0xf8, 0xc2, 0x15, 0x75,
+                        0x5a, 0x4a, 0x63, 0xcd, 0x42, 0x28, 0xc2, 0x19,
+                },
+                .iv = {
+                        0xa4, 0x01, 0xd7, 0x3c, 0x88, 0x75, 0xe7, 0x59,
+                        0xaa, 0x3e, 0xef, 0x53, 0xe0, 0xfb, 0x62, 0x63,
+                },
+                .iv_len = 16,
+                .in = {
+                        0xb1, 0xe6, 0x29, 0xa6, 0x2a, 0x03, 0xca, 0x96,
+                        0x9b, 0x16, 0x91, 0x52, 0x02, 0xbc, 0xaa, 0x09,
+                        0xe7, 0x8a, 0xe1, 0x85, 0x1b, 0xc8, 0x85, 0x81,
+                        0x16, 0x49, 0x68, 0xa5, 0x65, 0x6c, 0x82, 0xc0,
+                        0xe5, 0xc4, 0x03, 0xba, 0x54, 0xb9, 0xb5, 0xed,
+                        0x9b, 0xab, 0xe8, 0xb0, 0x75, 0x1d, 0x1b, 0x34,
+                },
+                .in_len = 48,
+                .out = {
+                        0xf5, 0xbc, 0xa6, 0x0f, 0xb9, 0x35, 0x2b, 0x1d,
+                        0xe0, 0x4d, 0x71, 0x29, 0x40, 0x56, 0x26, 0xb3,
+                        0xa4, 0x74, 0xa2, 0x64, 0xfb, 0xac, 0x2d, 0x6b,
+                        0xe1, 0x19, 0xe1, 0xd5, 0x7a, 0xa9, 0x98, 0xd0,
+                        0xe0, 0xe4, 0xd9, 0xf9, 0xc9, 0x76, 0x21, 0x0d,
+                        0x93, 0xc4, 0x65, 0xa3, 0xe3, 0x60, 0xcd, 0x92,
+                },
+                .out_len = 48,
+        },
 };
 
 #define N_AES_TESTS (sizeof(aes_tests) / sizeof(aes_tests[0]))
@@ -542,7 +697,10 @@ aes_ecb_test(size_t test_number, const char *label, int key_bits,
 
         /* Encryption */
         memset(out, 0, sizeof(out));
-        AES_set_encrypt_key(at->key, key_bits, &key);
+        if (AES_set_encrypt_key(at->key, key_bits, &key) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): AES_set_encrypt_key failed\n", label, test_number);
+                return 0;
+        }
         AES_ecb_encrypt(at->in, out, &key, 1);
 
         if (memcmp(at->out, out, at->out_len) != 0) {
@@ -553,7 +711,10 @@ aes_ecb_test(size_t test_number, const char *label, int key_bits,
 
         /* Decryption */
         memset(out, 0, sizeof(out));
-        AES_set_decrypt_key(at->key, key_bits, &key);
+        if (AES_set_decrypt_key(at->key, key_bits, &key) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): AES_set_decrypt_key failed\n", label, test_number);
+                return 0;
+        }
         AES_ecb_encrypt(at->out, out, &key, 0);
 
         if (memcmp(at->in, out, at->in_len) != 0) {
@@ -582,7 +743,10 @@ aes_cbc_test(size_t test_number, const char *label, int key_bits,
         /* Encryption */
         memset(out, 0, sizeof(out));
         memcpy(iv, at->iv, at->iv_len);
-        AES_set_encrypt_key(at->key, key_bits, &key);
+        if (AES_set_encrypt_key(at->key, key_bits, &key) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): AES_set_encrypt_key failed\n", label, test_number);
+                return 0;
+        }
         AES_cbc_encrypt(at->in, out, at->in_len, &key, iv, 1);
 
         if (memcmp(at->out, out, at->out_len) != 0) {
@@ -594,7 +758,10 @@ aes_cbc_test(size_t test_number, const char *label, int key_bits,
         /* Decryption */
         memset(out, 0, sizeof(out));
         memcpy(iv, at->iv, at->iv_len);
-        AES_set_decrypt_key(at->key, key_bits, &key);
+        if (AES_set_decrypt_key(at->key, key_bits, &key) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): AES_set_decrypt_key failed\n", label, test_number);
+                return 0;
+        }
         AES_cbc_encrypt(at->out, out, at->out_len, &key, iv, 0);
 
         if (memcmp(at->in, out, at->in_len) != 0) {
@@ -607,6 +774,96 @@ aes_cbc_test(size_t test_number, const char *label, int key_bits,
 }
 
 static int
+aes_cfb128_test(size_t test_number, const char *label, int key_bits,
+    const struct aes_test *at)
+{
+        AES_KEY key;
+        uint8_t out[64];
+        uint8_t iv[16];
+        int num = 0;
+
+        /* CFB mode has no padding */
+
+        /* Encryption */
+        memset(out, 0, sizeof(out));
+        memcpy(iv, at->iv, at->iv_len);
+        if (AES_set_encrypt_key(at->key, key_bits, &key) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): AES_set_encrypt_key failed\n", label, test_number);
+                return 0;
+        }
+        AES_cfb128_encrypt(at->in, out, at->in_len, &key, iv, &num, AES_ENCRYPT);
+
+        if (memcmp(at->out, out, at->out_len) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): encryption mismatch\n",
+                    label, test_number);
+                return 0;
+        }
+
+        /* Decryption */
+        memset(out, 0, sizeof(out));
+        memcpy(iv, at->iv, at->iv_len);
+        num = 0;
+        if (AES_set_encrypt_key(at->key, key_bits, &key) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): AES_set_encrypt_key failed\n", label, test_number);
+                return 0;
+        }
+        AES_cfb128_encrypt(at->out, out, at->out_len, &key, iv, &num, AES_DECRYPT);
+
+        if (memcmp(at->in, out, at->in_len) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): decryption mismatch\n",
+                    label, test_number);
+                return 0;
+        }
+
+        return 1;
+}
+
+static int
+aes_ofb128_test(size_t test_number, const char *label, int key_bits,
+    const struct aes_test *at)
+{
+        AES_KEY key;
+        uint8_t out[64];
+        uint8_t iv[16];
+        int num = 0;
+
+        /* OFB mode has no padding */
+
+        /* Encryption */
+        memset(out, 0, sizeof(out));
+        memcpy(iv, at->iv, at->iv_len);
+        if (AES_set_encrypt_key(at->key, key_bits, &key) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): AES_set_encrypt_key failed\n", label, test_number);
+                return 0;
+        }
+        AES_ofb128_encrypt(at->in, out, at->in_len, &key, iv, &num);
+
+        if (memcmp(at->out, out, at->out_len) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): encryption mismatch\n",
+                    label, test_number);
+                return 0;
+        }
+
+        /* Decryption */
+        memset(out, 0, sizeof(out));
+        memcpy(iv, at->iv, at->iv_len);
+        num = 0;
+        if (AES_set_encrypt_key(at->key, key_bits, &key) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): AES_set_encrypt_key failed\n", label, test_number);
+                return 0;
+        }
+        AES_ofb128_encrypt(at->out, out, at->out_len, &key, iv, &num);
+
+        if (memcmp(at->in, out, at->in_len) != 0) {
+                fprintf(stderr, "FAIL (%s:%zu): decryption mismatch\n",
+                    label, test_number);
+                return 0;
+        }
+
+        return 1;
+}
+
+static int
 aes_evp_test(size_t test_number, const struct aes_test *at, const char *label,
     int key_bits, const EVP_CIPHER *cipher)
 {
@@ -649,6 +906,10 @@ aes_evp_test(size_t test_number, const struct aes_test *at, const char *label,
                 if (in_len > at->in_len - i)
                         in_len = at->in_len - i;
 
+                /* XTS needs to be single shot. */
+                if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_XTS_MODE)
+                        in_len = at->in_len;
+
                 if (!EVP_EncryptUpdate(ctx, out + total_len, &out_len,
                     at->in + i, in_len)) {
                         fprintf(stderr,
@@ -715,6 +976,10 @@ aes_evp_test(size_t test_number, const struct aes_test *at, const char *label,
                 if (in_len > at->out_len - i)
                         in_len = at->out_len - i;
 
+                /* XTS needs to be single shot. */
+                if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_XTS_MODE)
+                        in_len = at->in_len;
+
                 if (!EVP_DecryptUpdate(ctx, out + total_len, &out_len,
                     at->out + i, in_len)) {
                         fprintf(stderr,
@@ -881,6 +1146,16 @@ aes_cipher_from_nid(int nid, const char **out_label,
                 *out_cipher = EVP_aes_256_ccm();
                 break;
 
+        /* XTS */
+        case NID_aes_128_xts:
+                *out_label = SN_aes_128_xts;
+                *out_cipher = EVP_aes_128_xts();
+                break;
+        case NID_aes_256_xts:
+                *out_label = SN_aes_256_xts;
+                *out_cipher = EVP_aes_256_xts();
+                break;
+
         /* Unknown */
         default:
                 return 0;
@@ -902,8 +1177,10 @@ aes_test(void)
         for (i = 0; i < N_AES_TESTS; i++) {
                 at = &aes_tests[i];
                 key_bits = aes_key_bits_from_nid(at->mode);
-                if (!aes_cipher_from_nid(at->mode, &label, &cipher))
+                if (!aes_cipher_from_nid(at->mode, &label, &cipher)) {
+                        fprintf(stderr, "unknown cipher\n");
                         goto failed;
+                }
 
                 switch (at->mode) {
                 /* ECB */
@@ -926,14 +1203,16 @@ aes_test(void)
                 case NID_aes_128_cfb128:
                 case NID_aes_192_cfb128:
                 case NID_aes_256_cfb128:
-                        /* XXX - CFB128 non-EVP tests */
+                        if (!aes_cfb128_test(i, label, key_bits, at))
+                                goto failed;
                         break;
 
                 /* OFB128 */
                 case NID_aes_128_ofb128:
                 case NID_aes_192_ofb128:
                 case NID_aes_256_ofb128:
-                        /* XXX - OFB128 non-EVP tests */
+                        if (!aes_ofb128_test(i, label, key_bits, at))
+                                goto failed;
                         break;
 
                 /* GCM */
@@ -947,7 +1226,13 @@ aes_test(void)
                 case NID_aes_128_ccm:
                 case NID_aes_192_ccm:
                 case NID_aes_256_ccm:
-                        /* XXX - CCM non-EVP tests */
+                        /* CCM is EVP-only */
+                        break;
+
+                /* XTS */
+                case NID_aes_128_xts:
+                case NID_aes_256_xts:
+                        /* XTS is EVP-only */
                         break;
 
                 /* Unknown */
diff --git a/src/regress/lib/libcrypto/asn1/asn1time.c b/src/regress/lib/libcrypto/asn1/asn1time.c
index 7223ad9c9b..e0e5139808 100644
--- a/src/regress/lib/libcrypto/asn1/asn1time.c
+++ b/src/regress/lib/libcrypto/asn1/asn1time.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: asn1time.c,v 1.30 2024/07/21 13:25:11 tb Exp $ */
+/* $OpenBSD: asn1time.c,v 1.31 2025/05/22 04:54:14 joshua Exp $ */
 /*
  * Copyright (c) 2015 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2024 Google Inc.
@@ -33,6 +33,7 @@ struct asn1_time_test {
         const char *data;
         const unsigned char der[32];
         time_t time;
+        int generalized_time;
 };
 
 static const struct asn1_time_test asn1_invtime_tests[] = {
@@ -73,20 +74,19 @@ static const struct asn1_time_test asn1_invtime_tests[] = {
         {
                 .str = "aaaaaaaaaaaaaaZ",
         },
-        /* utc time with omitted seconds, should fail */
         {
+                /* UTC time with omitted seconds, should fail */
                 .str = "1609082343Z",
         },
-};
-
-static const struct asn1_time_test asn1_invgentime_tests[] = {
-        /* Generalized time with omitted seconds, should fail */
         {
+                /* Generalized time with omitted seconds, should fail */
                 .str = "201612081934Z",
+                .generalized_time = 1,
         },
-        /* Valid UTC time, should fail as a generalized time */
         {
+                /* Valid UTC time, should fail as a generalized time */
                 .str = "160908234300Z",
+                .generalized_time = 1,
         },
 };
 
@@ -235,7 +235,7 @@ asn1_compare_str(int test_no, const struct asn1_string_st *asn1str,
 }
 
 static int
-asn1_invtime_test(int test_no, const struct asn1_time_test *att, int gen)
+asn1_invtime_test(int test_no, const struct asn1_time_test *att)
 {
         ASN1_GENERALIZEDTIME *gt = NULL;
         ASN1_UTCTIME *ut = NULL;
@@ -255,7 +255,7 @@ asn1_invtime_test(int test_no, const struct asn1_time_test *att, int gen)
                 goto done;
         }
 
-        if (gen)  {
+        if (att->generalized_time)  {
                 failure = 0;
                 goto done;
         }
@@ -842,13 +842,7 @@ main(int argc, char **argv)
         fprintf(stderr, "Invalid time tests...\n");
         for (i = 0; i < N_INVTIME_TESTS; i++) {
                 att = &asn1_invtime_tests[i];
-                failed |= asn1_invtime_test(i, att, 0);
-        }
-
-        fprintf(stderr, "Invalid generalized time tests...\n");
-        for (i = 0; i < N_INVGENTIME_TESTS; i++) {
-                att = &asn1_invgentime_tests[i];
-                failed |= asn1_invtime_test(i, att, 1);
+                failed |= asn1_invtime_test(i, att);
         }
 
         fprintf(stderr, "GENERALIZEDTIME tests...\n");
diff --git a/src/regress/lib/libcrypto/bio/bio_dump.c b/src/regress/lib/libcrypto/bio/bio_dump.c
index 22db80fa3d..fd2bb285fb 100644
--- a/src/regress/lib/libcrypto/bio/bio_dump.c
+++ b/src/regress/lib/libcrypto/bio/bio_dump.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: bio_dump.c,v 1.4 2024/02/09 12:48:32 tb Exp $ */
+/*      $OpenBSD: bio_dump.c,v 1.5 2025/05/18 06:41:51 tb Exp $ */
 /*
  * Copyright (c) 2024 Theo Buehler <tb@openbsd.org>
  *
@@ -809,7 +809,7 @@ bio_dump_test(const struct bio_dump_testcase *tc)
                     tc->indent, ret, got_len, strlen(tc->output));
                 goto err;
         }
-        if (strncmp(tc->output, got, got_len) != 0) {
+        if (got_len > 0 && strncmp(tc->output, got, got_len) != 0) {
                 fprintf(stderr, "%d: mismatch\n", tc->indent);
                 goto err;
         }
diff --git a/src/regress/lib/libcrypto/bn/bn_mul_div.c b/src/regress/lib/libcrypto/bn/bn_mul_div.c
index 625d5e318e..dbad01004e 100644
--- a/src/regress/lib/libcrypto/bn/bn_mul_div.c
+++ b/src/regress/lib/libcrypto/bn/bn_mul_div.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: bn_mul_div.c,v 1.7 2023/06/21 07:18:10 jsing Exp $ */
+/*      $OpenBSD: bn_mul_div.c,v 1.8 2025/08/12 10:29:35 jsing Exp $ */
 /*
  * Copyright (c) 2023 Joel Sing <jsing@openbsd.org>
  *
@@ -233,6 +233,13 @@ struct benchmark benchmarks[] = {
                 .b_bits = 256,
         },
         {
+                .desc = "BN_mul (384 bit x 384 bit)",
+                .setup = benchmark_bn_mul_setup,
+                .run_once = benchmark_bn_mul_run_once,
+                .a_bits = 384,
+                .b_bits = 384,
+        },
+        {
                 .desc = "BN_mul (512 bit x 512 bit)",
                 .setup = benchmark_bn_mul_setup,
                 .run_once = benchmark_bn_mul_run_once,
@@ -294,6 +301,12 @@ struct benchmark benchmarks[] = {
                 .a_bits = 256,
         },
         {
+                .desc = "BN_sqr (384 bit)",
+                .setup = benchmark_bn_sqr_setup,
+                .run_once = benchmark_bn_sqr_run_once,
+                .a_bits = 384,
+        },
+        {
                 .desc = "BN_sqr (512 bit)",
                 .setup = benchmark_bn_sqr_setup,
                 .run_once = benchmark_bn_sqr_run_once,
diff --git a/src/regress/lib/libcrypto/c2sp/Makefile b/src/regress/lib/libcrypto/c2sp/Makefile
index 9b2c944ba4..73ee0b8c22 100644
--- a/src/regress/lib/libcrypto/c2sp/Makefile
+++ b/src/regress/lib/libcrypto/c2sp/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.4 2024/10/28 16:27:14 tb Exp $
+# $OpenBSD: Makefile,v 1.7 2025/07/23 07:35:21 tb Exp $
 
 C2SP_TESTVECTORS = /usr/local/share/c2sp-testvectors/
 
@@ -13,12 +13,12 @@ PROGS += cctv
 SRCS_cctv =
 
 cctv: cctv.go
-        go build -o $@ ${.CURDIR}/cctv.go
+        env GOCACHE=${.OBJDIR}/go-build go build -o $@ ${.CURDIR}/cctv.go
 
 OSSL_LIB =      /usr/local/lib/eopenssl
 OSSL_INC =      /usr/local/include/eopenssl
 
-. for V in 11 32 33 34
+. for V in 35
 .  if exists(/usr/local/bin/eopenssl$V)
 PROGS +=        cctv-openssl$V
 SRCS_cctv-openssl$V =
@@ -29,10 +29,17 @@ CGO_LDFLAGS_$V += 	-L${OSSL_LIB}$V
 
 cctv-openssl$V: cctv.go
         env CGO_CFLAGS="${CGO_CFLAGS_$V}" CGO_LDFLAGS="${CGO_LDFLAGS_$V}" \
+            GOCACHE=${.OBJDIR}/go-build \
             go build -o $@ ${.CURDIR}/cctv.go
 .  endif
 . endfor
 
+REGRESS_CLEANUP =       clean-go-cache
+
+clean-go-cache:
+        env GOCACHE=${.OBJDIR}/go-build go clean -cache
+        rm -rf ${.OBJDIR}/go-build
+
 .endif
 
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libcrypto/certs/Makefile b/src/regress/lib/libcrypto/certs/Makefile
index 621c60907f..f7ba9fcad8 100644
--- a/src/regress/lib/libcrypto/certs/Makefile
+++ b/src/regress/lib/libcrypto/certs/Makefile
@@ -1,21 +1,24 @@
-#       $OpenBSD: Makefile,v 1.1 2020/07/14 18:27:28 jsing Exp $
+#       $OpenBSD: Makefile,v 1.2 2025/07/09 05:04:35 tb Exp $
 
-.if ! (make(clean) || make(cleandir) || make(obj))
-GO_VERSION != sh -c "(go version) 2>/dev/null || true"
-.endif
-
-.if empty(GO_VERSION)
+.if !exists(/usr/local/bin/go)
 regress:
         @echo package go is required for this regress
         @echo SKIPPED
-.endif
+.else
 
 REGRESS_TARGETS=regress-go-verify
+REGRESS_CLEANUP=clean-go-cache
 
 certs:
         cd ${.CURDIR} && sh ./make-certs.sh
 
 regress-go-verify:
-        cd ${.CURDIR} && go test -test.v .
+        cd ${.CURDIR} && env GOCACHE=${.OBJDIR}/go-build go test -test.v .
+
+clean-go-cache:
+        env GOCACHE=${.OBJDIR}/go-build go clean -cache
+        rm -rf ${.OBJDIR}/go-build
+
+.endif
 
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libcrypto/ec/Makefile b/src/regress/lib/libcrypto/ec/Makefile
index b21eacb4bc..1d976c77d0 100644
--- a/src/regress/lib/libcrypto/ec/Makefile
+++ b/src/regress/lib/libcrypto/ec/Makefile
@@ -1,12 +1,13 @@
-#       $OpenBSD: Makefile,v 1.11 2025/03/08 20:09:35 tb Exp $
+#       $OpenBSD: Makefile,v 1.13 2025/08/03 08:29:39 jsing Exp $
 
-.ifdef EOPENSSL33
-LDADD +=        -Wl,-rpath,/usr/local/lib/eopenssl33 -L/usr/local/lib/eopenssl33
-CFLAGS +=       -I/usr/local/include/eopenssl33/
+.ifdef EOPENSSL35
+LDADD +=        -Wl,-rpath,/usr/local/lib/eopenssl35 -L/usr/local/lib/eopenssl35
+CFLAGS +=       -I/usr/local/include/eopenssl35/
 CFLAGS +=       -DOPENSSL_SUPPRESS_DEPRECATED
 .endif
 
 PROGS +=        ectest
+PROGS +=        ec_arithmetic
 PROGS +=        ec_asn1_test
 PROGS +=        ec_point_conversion
 
diff --git a/src/regress/lib/libcrypto/ec/ec_arithmetic.c b/src/regress/lib/libcrypto/ec/ec_arithmetic.c
new file mode 100644
index 0000000000..c6f7cd4f8c
--- /dev/null
+++ b/src/regress/lib/libcrypto/ec/ec_arithmetic.c
@@ -0,0 +1,210 @@
+/*      $OpenBSD: ec_arithmetic.c,v 1.1 2025/08/03 08:29:39 jsing Exp $ */
+/*
+ * Copyright (c) 2022,2025 Joel Sing <jsing@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/time.h>
+
+#include <err.h>
+#include <signal.h>
+#include <stdio.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#include <openssl/bn.h>
+#include <openssl/ec.h>
+#include <openssl/objects.h>
+
+static void
+benchmark_ec_point_add(const EC_GROUP *group, EC_POINT *result,
+    const BIGNUM *scalar, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
+{
+        if (!EC_POINT_add(group, result, a, b, ctx))
+                errx(1, "EC_POINT_add");
+}
+
+static void
+benchmark_ec_point_dbl(const EC_GROUP *group, EC_POINT *result,
+    const BIGNUM *scalar, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
+{
+        if (!EC_POINT_dbl(group, result, a, ctx))
+                errx(1, "EC_POINT_dbl");
+}
+
+static void
+benchmark_ec_point_mul_generator(const EC_GROUP *group, EC_POINT *result,
+    const BIGNUM *scalar, const EC_POINT *a, const EC_POINT *b, BN_CTX *ctx)
+{
+        if (!EC_POINT_mul(group, result, scalar, NULL, NULL, ctx))
+                errx(1, "EC_POINT_mul");
+}
+
+struct benchmark {
+        int curve;
+        const char *desc;
+        void (*func)(const EC_GROUP *, EC_POINT *, const BIGNUM *,
+            const EC_POINT *, const EC_POINT *, BN_CTX *);
+};
+
+static const struct benchmark benchmarks[] = {
+        {
+                .curve = NID_X9_62_prime256v1,
+                .desc = "EC_POINT_add() p256",
+                .func = benchmark_ec_point_add,
+        },
+        {
+                .curve = NID_secp384r1,
+                .desc = "EC_POINT_add() p384",
+                .func = benchmark_ec_point_add,
+        },
+        {
+                .curve = NID_secp521r1,
+                .desc = "EC_POINT_add() p521",
+                .func = benchmark_ec_point_add,
+        },
+        {
+                .curve = NID_X9_62_prime256v1,
+                .desc = "EC_POINT_dbl() p256",
+                .func = benchmark_ec_point_dbl,
+        },
+        {
+                .curve = NID_secp384r1,
+                .desc = "EC_POINT_dbl() p384",
+                .func = benchmark_ec_point_dbl,
+        },
+        {
+                .curve = NID_secp521r1,
+                .desc = "EC_POINT_dbl() p521",
+                .func = benchmark_ec_point_dbl,
+        },
+        {
+                .curve = NID_X9_62_prime256v1,
+                .desc = "EC_POINT_mul() generator p256",
+                .func = benchmark_ec_point_mul_generator,
+        },
+        {
+                .curve = NID_secp384r1,
+                .desc = "EC_POINT_mul() generator p384",
+                .func = benchmark_ec_point_mul_generator,
+        },
+        {
+                .curve = NID_secp521r1,
+                .desc = "EC_POINT_mul() generator p521",
+                .func = benchmark_ec_point_mul_generator,
+        },
+};
+
+#define N_BENCHMARKS (sizeof(benchmarks) / sizeof(benchmarks[0]))
+
+static volatile sig_atomic_t benchmark_stop;
+
+static void
+benchmark_sig_alarm(int sig)
+{
+        benchmark_stop = 1;
+}
+
+static void
+benchmark_run(const struct benchmark *bm, int seconds)
+{
+        struct timespec start, end, duration;
+        EC_GROUP *group = NULL;
+        EC_POINT *a = NULL, *b = NULL, *result = NULL;
+        BIGNUM *order = NULL, *scalar = NULL;
+        BN_CTX *ctx = NULL;
+        int i;
+
+        signal(SIGALRM, benchmark_sig_alarm);
+
+        if ((ctx = BN_CTX_new()) == NULL)
+                errx(1, "BN_CTX_new");
+
+        if ((group = EC_GROUP_new_by_curve_name(bm->curve)) == NULL)
+                errx(1, "EC_GROUP_new_by_curve_name");
+        if ((order = BN_new()) == NULL)
+                errx(1, "BN_new");
+        if (!EC_GROUP_get_order(group, order, ctx))
+                errx(1, "EC_GROUP_get_order");
+
+        if ((scalar = BN_new()) == NULL)
+                errx(1, "BN_new");
+        if (!BN_rand_range(scalar, order))
+                errx(1, "BN_rand_range");
+        if (!BN_set_bit(scalar, EC_GROUP_order_bits(group) - 1))
+                errx(1, "BN_set_bit");
+
+        if ((result = EC_POINT_new(group)) == NULL)
+                errx(1, "EC_POINT_new");
+        if ((a = EC_POINT_new(group)) == NULL)
+                errx(1, "EC_POINT_new");
+        if ((b = EC_POINT_new(group)) == NULL)
+                errx(1, "EC_POINT_new");
+
+        if (!EC_POINT_mul(group, a, scalar, NULL, NULL, ctx))
+                errx(1, "EC_POINT_mul");
+        if (!EC_POINT_mul(group, b, scalar, NULL, NULL, ctx))
+                errx(1, "EC_POINT_mul");
+
+        benchmark_stop = 0;
+        i = 0;
+        alarm(seconds);
+
+        clock_gettime(CLOCK_MONOTONIC, &start);
+
+        fprintf(stderr, "Benchmarking %s for %ds: ", bm->desc, seconds);
+        while (!benchmark_stop) {
+                bm->func(group, result, scalar, a, b, ctx);
+                i++;
+        }
+        clock_gettime(CLOCK_MONOTONIC, &end);
+        timespecsub(&end, &start, &duration);
+        fprintf(stderr, "%d iterations in %f seconds\n", i,
+            duration.tv_sec + duration.tv_nsec / 1000000000.0);
+
+        EC_GROUP_free(group);
+        EC_POINT_free(result);
+        EC_POINT_free(a);
+        EC_POINT_free(b);
+        BN_free(order);
+        BN_free(scalar);
+        BN_CTX_free(ctx);
+}
+
+static void
+benchmark_ec_mul_single(void)
+{
+        const struct benchmark *bm;
+        size_t i;
+
+        for (i = 0; i < N_BENCHMARKS; i++) {
+                bm = &benchmarks[i];
+                benchmark_run(bm, 5);
+        }
+}
+
+int
+main(int argc, char **argv)
+{
+        int benchmark = 0, failed = 0;
+
+        if (argc == 2 && strcmp(argv[1], "--benchmark") == 0)
+                benchmark = 1;
+
+        if (benchmark && !failed)
+                benchmark_ec_mul_single();
+
+        return failed;
+}
diff --git a/src/regress/lib/libcrypto/ec/ec_asn1_test.c b/src/regress/lib/libcrypto/ec/ec_asn1_test.c
index 03358e69ca..c89ab0e7ab 100644
--- a/src/regress/lib/libcrypto/ec/ec_asn1_test.c
+++ b/src/regress/lib/libcrypto/ec/ec_asn1_test.c
@@ -1,7 +1,7 @@
-/* $OpenBSD: ec_asn1_test.c,v 1.32 2025/03/08 20:09:35 tb Exp $ */
+/* $OpenBSD: ec_asn1_test.c,v 1.39 2025/08/26 17:57:10 tb Exp $ */
 /*
  * Copyright (c) 2017, 2021 Joel Sing <jsing@openbsd.org>
- * Copyright (c) 2024 Theo Buehler <tb@openbsd.org>
+ * Copyright (c) 2024, 2025 Theo Buehler <tb@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -17,12 +17,17 @@
  */
 
 #include <err.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
 #include <string.h>
 
 #include <openssl/bio.h>
+#include <openssl/bn.h>
 #include <openssl/ec.h>
 #include <openssl/err.h>
 #include <openssl/objects.h>
+#include <openssl/sha.h>
 
 #include "ec_local.h"
 
@@ -1025,6 +1030,62 @@ ec_group_non_builtin_curves(void)
         return failed;
 }
 
+static int
+ec_group_check_prime_order(EC_builtin_curve *curve, BN_CTX *ctx)
+{
+        EC_GROUP *group;
+        BIGNUM *order;
+        int rv;
+        int failed = 0;
+
+        if ((group = EC_GROUP_new_by_curve_name(curve->nid)) == NULL)
+                errx(1, "EC_GROUP_new_by_curve_name");
+
+        BN_CTX_start(ctx);
+
+        if ((order = BN_CTX_get(ctx)) == NULL)
+                errx(1, "order = BN_CTX_get()");
+
+        if (!EC_GROUP_get_order(group, order, ctx))
+                errx(1, "EC_GROUP_get_order");
+
+        if ((rv = BN_is_prime_ex(order, 0, ctx, NULL)) != 1) {
+                fprintf(stderr, "%s: nid %d: BN_is_prime_ex() returned %d, want 1\n",
+                    __func__, curve->nid, rv);
+                failed = 1;
+        }
+
+        BN_CTX_end(ctx);
+        EC_GROUP_free(group);
+
+        return failed;
+}
+
+static int
+ec_group_builtin_curves_have_prime_order(void)
+{
+        BN_CTX *ctx = NULL;
+        EC_builtin_curve *all_curves = NULL;
+        size_t curve_id, ncurves;
+        int failed = 0;
+
+        if ((ctx = BN_CTX_new()) == NULL)
+                errx(1, "BN_CTX_new");
+
+        ncurves = EC_get_builtin_curves(NULL, 0);
+        if ((all_curves = calloc(ncurves, sizeof(*all_curves))) == NULL)
+                err(1, "calloc builtin curves");
+        EC_get_builtin_curves(all_curves, ncurves);
+
+        for (curve_id = 0; curve_id < ncurves; curve_id++)
+                failed |= ec_group_check_prime_order(&all_curves[curve_id], ctx);
+
+        free(all_curves);
+        BN_CTX_free(ctx);
+
+        return failed;
+}
+
 static const struct ec_private_key {
         const char *name;
         size_t der_len;
@@ -1281,126 +1342,6 @@ static const struct ec_private_key {
                 },
         },
         {
-                .name = "prime239v1",
-                .der_len = 115,
-                .der = {
-                        0x30, 0x71, 0x02, 0x01, 0x01, 0x04, 0x1e, 0x6e,
-                        0x26, 0x5e, 0xde, 0x5b, 0x67, 0xd6, 0x38, 0x52,
-                        0xe7, 0x1e, 0x8d, 0x44, 0xb1, 0xfb, 0xf8, 0xaf,
-                        0xf9, 0x94, 0x2c, 0xe2, 0x0d, 0xa8, 0x5f, 0x03,
-                        0x67, 0x53, 0x7b, 0x8b, 0x2e, 0xa0, 0x0a, 0x06,
-                        0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01,
-                        0x04, 0xa1, 0x40, 0x03, 0x3e, 0x00, 0x04, 0x33,
-                        0xc6, 0xe5, 0x8a, 0xc1, 0x8b, 0x7c, 0x96, 0x19,
-                        0xc9, 0xe1, 0x54, 0x7f, 0x81, 0x9e, 0x59, 0x62,
-                        0xec, 0xc0, 0x1e, 0xe5, 0x53, 0xd5, 0xae, 0x6b,
-                        0xd3, 0xe0, 0x09, 0x07, 0xc5, 0x27, 0x81, 0xa6,
-                        0x8d, 0x39, 0x8e, 0xfe, 0x01, 0xc2, 0x1d, 0xda,
-                        0xde, 0x7b, 0xdc, 0x76, 0x27, 0x17, 0xf9, 0x6f,
-                        0xe3, 0x04, 0xef, 0x5d, 0x65, 0x75, 0x98, 0x7f,
-                        0x2d, 0xd0, 0x68,
-                },
-                .hex =  "0433C6E58AC18B7C"
-                        "9619C9E1547F819E"
-                        "5962ECC01EE553D5"
-                        "AE6BD3E00907C527"
-                        "81A68D398EFE01C2"
-                        "1DDADE7BDC762717"
-                        "F96FE304EF5D6575"
-                        "987F2DD068",
-                .oct_len = 61,
-                .oct = {
-                        0x04, 0x33, 0xc6, 0xe5, 0x8a, 0xc1, 0x8b, 0x7c,
-                        0x96, 0x19, 0xc9, 0xe1, 0x54, 0x7f, 0x81, 0x9e,
-                        0x59, 0x62, 0xec, 0xc0, 0x1e, 0xe5, 0x53, 0xd5,
-                        0xae, 0x6b, 0xd3, 0xe0, 0x09, 0x07, 0xc5, 0x27,
-                        0x81, 0xa6, 0x8d, 0x39, 0x8e, 0xfe, 0x01, 0xc2,
-                        0x1d, 0xda, 0xde, 0x7b, 0xdc, 0x76, 0x27, 0x17,
-                        0xf9, 0x6f, 0xe3, 0x04, 0xef, 0x5d, 0x65, 0x75,
-                        0x98, 0x7f, 0x2d, 0xd0, 0x68,
-                },
-        },
-        {
-                .name = "prime239v2",
-                .der_len = 115,
-                .der = {
-                        0x30, 0x71, 0x02, 0x01, 0x01, 0x04, 0x1e, 0x30,
-                        0x2f, 0x01, 0x10, 0xe9, 0x09, 0x15, 0xdd, 0xe3,
-                        0xdd, 0xae, 0xcb, 0x9d, 0x3a, 0x58, 0x92, 0x02,
-                        0x1e, 0x6e, 0x02, 0x57, 0xa8, 0x36, 0x0b, 0x20,
-                        0x0b, 0x7e, 0xf4, 0xad, 0x0b, 0xa0, 0x0a, 0x06,
-                        0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01,
-                        0x05, 0xa1, 0x40, 0x03, 0x3e, 0x00, 0x04, 0x3c,
-                        0x10, 0x27, 0x7b, 0xac, 0xdf, 0x86, 0xc9, 0x4f,
-                        0xf8, 0x39, 0x87, 0x02, 0x39, 0xaf, 0x41, 0xbc,
-                        0x4b, 0x67, 0xd8, 0x5e, 0x04, 0x96, 0x84, 0xb5,
-                        0x60, 0x50, 0x48, 0x6a, 0x20, 0x1d, 0x2b, 0x7e,
-                        0x9f, 0xaf, 0xf8, 0x8e, 0x7e, 0xa4, 0xcd, 0x00,
-                        0xad, 0xb1, 0xad, 0x22, 0x69, 0x32, 0x10, 0x6c,
-                        0xe0, 0xcc, 0xdd, 0x45, 0xd8, 0xa6, 0x29, 0x2f,
-                        0xad, 0x6b, 0xf9,
-                },
-                .hex =  "043C10277BACDF86"
-                        "C94FF839870239AF"
-                        "41BC4B67D85E0496"
-                        "84B56050486A201D"
-                        "2B7E9FAFF88E7EA4"
-                        "CD00ADB1AD226932"
-                        "106CE0CCDD45D8A6"
-                        "292FAD6BF9",
-                .oct_len = 61,
-                .oct = {
-                        0x04, 0x3c, 0x10, 0x27, 0x7b, 0xac, 0xdf, 0x86,
-                        0xc9, 0x4f, 0xf8, 0x39, 0x87, 0x02, 0x39, 0xaf,
-                        0x41, 0xbc, 0x4b, 0x67, 0xd8, 0x5e, 0x04, 0x96,
-                        0x84, 0xb5, 0x60, 0x50, 0x48, 0x6a, 0x20, 0x1d,
-                        0x2b, 0x7e, 0x9f, 0xaf, 0xf8, 0x8e, 0x7e, 0xa4,
-                        0xcd, 0x00, 0xad, 0xb1, 0xad, 0x22, 0x69, 0x32,
-                        0x10, 0x6c, 0xe0, 0xcc, 0xdd, 0x45, 0xd8, 0xa6,
-                        0x29, 0x2f, 0xad, 0x6b, 0xf9,
-                },
-        },
-        {
-                .name = "prime239v3",
-                .der_len = 115,
-                .der = {
-                        0x30, 0x71, 0x02, 0x01, 0x01, 0x04, 0x1e, 0x26,
-                        0x3f, 0x23, 0x4c, 0xe7, 0xbd, 0xa8, 0xe4, 0xfe,
-                        0x7c, 0xf6, 0x18, 0x6a, 0xb2, 0xa6, 0x39, 0x15,
-                        0x6d, 0x72, 0xe8, 0x9e, 0x3f, 0x0f, 0x10, 0x1e,
-                        0xe5, 0xdf, 0xac, 0xe8, 0x2f, 0xa0, 0x0a, 0x06,
-                        0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01,
-                        0x06, 0xa1, 0x40, 0x03, 0x3e, 0x00, 0x04, 0x37,
-                        0xba, 0x07, 0x7f, 0xd9, 0x46, 0x5a, 0x33, 0x03,
-                        0x31, 0x77, 0x38, 0xef, 0xee, 0xcc, 0x3d, 0xe1,
-                        0xaa, 0x57, 0xe3, 0x8d, 0xb7, 0xcd, 0xe3, 0x01,
-                        0xf4, 0xd6, 0x75, 0x49, 0x72, 0x61, 0x4c, 0xbf,
-                        0xc0, 0x1f, 0x8b, 0x5f, 0x98, 0x9b, 0xa7, 0xe5,
-                        0x6a, 0xb7, 0xfe, 0x63, 0xdb, 0xb0, 0x40, 0xcb,
-                        0x26, 0x81, 0x2a, 0x91, 0x14, 0x0f, 0xc7, 0x31,
-                        0x13, 0x78, 0x16,
-                },
-                .hex =  "0437BA077FD9465A"
-                        "3303317738EFEECC"
-                        "3DE1AA57E38DB7CD"
-                        "E301F4D675497261"
-                        "4CBFC01F8B5F989B"
-                        "A7E56AB7FE63DBB0"
-                        "40CB26812A91140F"
-                        "C731137816",
-                .oct_len = 61,
-                .oct = {
-                        0x04, 0x37, 0xba, 0x07, 0x7f, 0xd9, 0x46, 0x5a,
-                        0x33, 0x03, 0x31, 0x77, 0x38, 0xef, 0xee, 0xcc,
-                        0x3d, 0xe1, 0xaa, 0x57, 0xe3, 0x8d, 0xb7, 0xcd,
-                        0xe3, 0x01, 0xf4, 0xd6, 0x75, 0x49, 0x72, 0x61,
-                        0x4c, 0xbf, 0xc0, 0x1f, 0x8b, 0x5f, 0x98, 0x9b,
-                        0xa7, 0xe5, 0x6a, 0xb7, 0xfe, 0x63, 0xdb, 0xb0,
-                        0x40, 0xcb, 0x26, 0x81, 0x2a, 0x91, 0x14, 0x0f,
-                        0xc7, 0x31, 0x13, 0x78, 0x16,
-                },
-        },
-        {
                 .name = "prime256v1",
                 .der_len = 121,
                 .der = {
@@ -2468,6 +2409,197 @@ ec_group_check_private_keys(void)
         return failed;
 }
 
+static void
+ec_group_sha1_bignum(BIGNUM *out, const BIGNUM *in)
+{
+        char md[SHA_DIGEST_LENGTH];
+        unsigned char *bin;
+        size_t bin_len;
+
+        if (BN_num_bytes(in) <= 0)
+                errx(1, "%s: invalid bignum", __func__);
+
+        bin_len = BN_num_bytes(in);
+        if ((bin = calloc(1, bin_len)) == NULL)
+                err(1, "calloc");
+        if (BN_bn2bin(in, bin) <= 0)
+                errx(1, "BN_bn2bin");
+
+        SHA1(bin, bin_len, md);
+        free(bin);
+
+        if (BN_bin2bn(md, sizeof(md), out) == NULL)
+                errx(1, "BN_bin2bn");
+}
+
+static int
+ec_group_check_seed(const EC_builtin_curve *curve, BN_CTX *ctx)
+{
+        EC_GROUP *group = NULL;
+        BIGNUM *p, *a, *b, *pow2, *r, *seed_bn, *w;
+        const unsigned char *seed;
+        size_t seed_len;
+        int i, g, h, s, t;
+        int failed = 1;
+
+        if ((group = EC_GROUP_new_by_curve_name(curve->nid)) == NULL)
+                errx(1, "EC_GROUP_new_by_curve_name");
+
+        BN_CTX_start(ctx);
+
+        if ((p = BN_CTX_get(ctx)) == NULL)
+                errx(1, "p = BN_CTX_get()");
+        if ((a = BN_CTX_get(ctx)) == NULL)
+                errx(1, "a = BN_CTX_get()");
+        if ((b = BN_CTX_get(ctx)) == NULL)
+                errx(1, "b = BN_CTX_get()");
+        if ((r = BN_CTX_get(ctx)) == NULL)
+                errx(1, "r = BN_CTX_get()");
+        if ((pow2 = BN_CTX_get(ctx)) == NULL)
+                errx(1, "pow2 = BN_CTX_get()");
+        if ((seed_bn = BN_CTX_get(ctx)) == NULL)
+                errx(1, "seed_bn = BN_CTX_get()");
+        if ((w = BN_CTX_get(ctx)) == NULL)
+                errx(1, "w = BN_CTX_get()");
+
+        /*
+         * If the curve has a seed, verify that its parameters a and b have
+         * been selected using that seed, loosely following X9.62, F.3.4.b.
+         * Otherwise there's nothing to do.
+         */
+        if ((seed = EC_GROUP_get0_seed(group)) == NULL)
+                goto done;
+        seed_len = EC_GROUP_get_seed_len(group);
+
+        /*
+         * This isn't a requirement but happens to be the case for NIST
+         * curves - the only built-in curves that have a seed.
+         */
+        if (seed_len != SHA_DIGEST_LENGTH) {
+                fprintf(stderr, "%s FAIL: unexpected seed length. "
+                    "want %d, got %zu\n", __func__, SHA_DIGEST_LENGTH, seed_len);
+                goto err;
+        }
+
+        /* Seed length in bits, per F.3.3.b. */
+        g = 8 * seed_len;
+
+        /*
+         * Prepare to build the verifiably random element r of GFp by
+         * concatenating the SHA-1 of modifications of the seed as a number.
+         */
+        if (BN_bin2bn(seed, seed_len, seed_bn) == NULL)
+                errx(1, "BN_bin2bn");
+
+        if (!EC_GROUP_get_curve(group, p, a, b, ctx))
+                errx(1, "EC_GROUP_get_curve");
+
+        t = BN_num_bits(p);     /* bit length needed. */
+        s = (t - 1) / 160;      /* number of SHA-1 fitting in bit length. */
+        h = t - 160 * s;        /* remaining number of bits in r. */
+
+        /*
+         * Steps 1 - 3: compute hash of the seed and take h - 1 rightmost bits.
+         */
+
+        ec_group_sha1_bignum(r, seed_bn);
+        BN_zero(pow2);
+        if (!BN_set_bit(pow2, h - 1))
+                errx(1, "BN_set_bit");
+        if (!BN_mod(r, r, pow2, ctx))
+                errx(1, "BN_nnmod");
+
+        /*
+         * Steps 4 - 6: for i from 1 to s do Wi = SHA-1(SEED + i mod 2^g),
+         * With W0 = r as already computed, let r = W0 || W1 || ... || Ws.
+         */
+
+        BN_zero(pow2);
+        if (!BN_set_bit(pow2, g))
+                errx(1, "BN_set_bit");
+
+        for (i = 0; i < s; i++) {
+                /*
+                 * This is a bit silly since the seed isn't going to have all
+                 * its bits set, so BN_add_word(seed_bn, 1) would do, but for
+                 * the sake of correctness...
+                 */
+                if (!BN_mod_add(seed_bn, seed_bn, BN_value_one(), pow2, ctx))
+                        errx(1, "BN_mod_add");
+
+                ec_group_sha1_bignum(w, seed_bn);
+
+                if (!BN_lshift(r, r, 8 * SHA_DIGEST_LENGTH))
+                        errx(1, "BN_lshift");
+                if (!BN_add(r, r, w))
+                        errx(1, "BN_add");
+        }
+
+        /*
+         * Step 7: check that r * b^2 == a^3 (mod p)
+         */
+
+        /* Compute r = r * b^2 (mod p). */
+        if (!BN_mod_sqr(b, b, p, ctx))
+                errx(1, "BN_mod_sqr");
+        if (!BN_mod_mul(r, r, b, p, ctx))
+                errx(1, "BN_mod_mul");
+
+        /* Compute a = a^3 (mod p). */
+        if (!BN_mod_sqr(b, a, p, ctx))
+                errx(1, "BN_mod_sqr");
+        if (!BN_mod_mul(a, a, b, p, ctx))
+                errx(1, "BN_mod_mul");
+
+        /*
+         * XXX - this assumes that a, b, p >= 0, so the results are in [0, p).
+         * This is currently enforced in the EC code.
+         */
+        if (BN_cmp(r, a) != 0) {
+                fprintf(stderr, "FAIL: %s verification failed for %s\nr * b^2:\t",
+                    __func__, curve->comment);
+                BN_print_fp(stderr, r);
+                fprintf(stderr, "\na^3:\t\t");
+                BN_print_fp(stderr, a);
+                fprintf(stderr, "\n");
+                goto err;
+        }
+
+ done:
+        failed = 0;
+
+ err:
+        BN_CTX_end(ctx);
+        EC_GROUP_free(group);
+
+        return failed;
+}
+
+static int
+ec_group_check_seeds(void)
+{
+        BN_CTX *ctx = NULL;
+        EC_builtin_curve *all_curves = NULL;
+        size_t curve_id, ncurves;
+        int failed = 0;
+
+        if ((ctx = BN_CTX_new()) == NULL)
+                errx(1, "BN_CTX_new");
+
+        ncurves = EC_get_builtin_curves(NULL, 0);
+        if ((all_curves = calloc(ncurves, sizeof(*all_curves))) == NULL)
+                err(1, "calloc builtin curves");
+        EC_get_builtin_curves(all_curves, ncurves);
+
+        for (curve_id = 0; curve_id < ncurves; curve_id++)
+                failed |= ec_group_check_seed(&all_curves[curve_id], ctx);
+
+        free(all_curves);
+        BN_CTX_free(ctx);
+
+        return failed;
+}
+
 int
 main(int argc, char **argv)
 {
@@ -2478,7 +2610,9 @@ main(int argc, char **argv)
         failed |= ec_group_pkparameters_correct_padding_test();
         failed |= ec_group_roundtrip_builtin_curves();
         failed |= ec_group_non_builtin_curves();
+        failed |= ec_group_builtin_curves_have_prime_order();
         failed |= ec_group_check_private_keys();
+        failed |= ec_group_check_seeds();
 
         return failed;
 }
diff --git a/src/regress/lib/libcrypto/ec/ectest.c b/src/regress/lib/libcrypto/ec/ectest.c
index fc44f9c886..3e81954174 100644
--- a/src/regress/lib/libcrypto/ec/ectest.c
+++ b/src/regress/lib/libcrypto/ec/ectest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ectest.c,v 1.35 2025/01/24 11:49:13 tb Exp $  */
+/*      $OpenBSD: ectest.c,v 1.36 2025/07/23 07:40:07 tb Exp $  */
 /*
  * Originally written by Bodo Moeller for the OpenSSL project.
  */
@@ -71,14 +71,11 @@
 
 #include <stdio.h>
 #include <stdlib.h>
-#include <string.h>
-#include <time.h>
 
+#include <openssl/bn.h>
+#include <openssl/crypto.h>
 #include <openssl/ec.h>
 #include <openssl/err.h>
-#include <openssl/obj_mac.h>
-#include <openssl/objects.h>
-#include <openssl/bn.h>
 #include <openssl/opensslconf.h>
 
 #define ABORT do { \
diff --git a/src/regress/lib/libcrypto/evp/evp_pkey_cleanup.c b/src/regress/lib/libcrypto/evp/evp_pkey_cleanup.c
index d4825f68e8..1d2fa60be7 100644
--- a/src/regress/lib/libcrypto/evp/evp_pkey_cleanup.c
+++ b/src/regress/lib/libcrypto/evp/evp_pkey_cleanup.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: evp_pkey_cleanup.c,v 1.5 2024/02/29 20:02:00 tb Exp $ */
+/*      $OpenBSD: evp_pkey_cleanup.c,v 1.6 2025/05/21 03:53:20 kenjiro Exp $ */
 
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -38,6 +38,8 @@ int pkey_ids[] = {
         EVP_PKEY_RSA,
         EVP_PKEY_RSA_PSS,
         EVP_PKEY_X25519,
+        EVP_PKEY_HKDF,
+        EVP_PKEY_TLS1_PRF,
 };
 
 static const size_t N_PKEY_IDS = sizeof(pkey_ids) / sizeof(pkey_ids[0]);
diff --git a/src/regress/lib/libcrypto/evp/evp_test.c b/src/regress/lib/libcrypto/evp/evp_test.c
index a699832c45..0bd8b4d092 100644
--- a/src/regress/lib/libcrypto/evp/evp_test.c
+++ b/src/regress/lib/libcrypto/evp/evp_test.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: evp_test.c,v 1.20 2024/07/09 17:24:12 tb Exp $ */
+/*      $OpenBSD: evp_test.c,v 1.21 2025/05/22 00:13:47 kenjiro Exp $ */
 /*
  * Copyright (c) 2017, 2022 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2023, 2024 Theo Buehler <tb@openbsd.org>
@@ -802,6 +802,85 @@ kdf_compare_bytes(const char *label, const unsigned char *d1, int len1,
 }
 
 static int
+evp_kdf_hkdf_basic(void)
+{
+        EVP_PKEY_CTX *pctx;
+        unsigned char out[42];
+        size_t outlen = sizeof(out);
+        int failed = 1;
+
+        /* Test vector from RFC 5869, Appendix A.1. */
+        const unsigned char ikm[] = {
+                0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+                0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+                0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+                0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
+                0x0b, 0x0b,
+        };
+        const unsigned char salt[] = {
+                0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
+                0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
+                0x0c,
+        };
+        const unsigned char info[] = {
+                0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5,
+                0xf6, 0xf7, 0xf8, 0xf9,
+        };
+        const unsigned char expected[42] = {
+                0x3c, 0xb2, 0x5f, 0x25, 0xfa, 0xac, 0xd5, 0x7a,
+                0x90, 0x43, 0x4f, 0x64, 0xd0, 0x36, 0x2f, 0x2a,
+                0x2d, 0x2d, 0x0a, 0x90, 0xcf, 0x1a, 0x5a, 0x4c,
+                0x5d, 0xb0, 0x2d, 0x56, 0xec, 0xc4, 0xc5, 0xbf,
+                0x34, 0x00, 0x72, 0x08, 0xd5, 0xb8, 0x87, 0x18,
+                0x58, 0x65,
+        };
+
+        if ((pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL)) == NULL) {
+                fprintf(stderr, "FAIL: EVP_PKEY_CTX_new_id\n");
+                goto err;
+        }
+
+        if (EVP_PKEY_derive_init(pctx) <= 0) {
+                fprintf(stderr, "FAIL: EVP_PKEY_derive_init\n");
+                goto err;
+        }
+
+        if (EVP_PKEY_CTX_set_hkdf_md(pctx, EVP_sha256()) <= 0) {
+                fprintf(stderr, "FAIL: EVP_PKEY_CTX_set_hkdf_md\n");
+                goto err;
+        }
+
+        if (EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, sizeof(salt)) <= 0) {
+                fprintf(stderr, "FAIL: EVP_PKEY_CTX_set1_hkdf_salt\n");
+                goto err;
+        }
+
+        if (EVP_PKEY_CTX_set1_hkdf_key(pctx, ikm, sizeof(ikm)) <= 0) {
+                fprintf(stderr, "FAIL: EVP_PKEY_CTX_set1_hkdf_key\n");
+                goto err;
+        }
+
+        if (EVP_PKEY_CTX_add1_hkdf_info(pctx, info, sizeof(info)) <= 0) {
+                fprintf(stderr, "FAIL: EVP_PKEY_CTX_add1_hkdf_info\n");
+                goto err;
+        }
+
+        if (EVP_PKEY_derive(pctx, out, &outlen) <= 0) {
+                fprintf(stderr, "FAIL: EVP_PKEY_derive\n");
+                goto err;
+        }
+
+        if (!kdf_compare_bytes("HKDF test", out, outlen, expected, sizeof(expected)))
+                goto err;
+
+        failed = 0;
+
+ err:
+        EVP_PKEY_CTX_free(pctx);
+        return failed;
+}
+
+static int
 evp_kdf_tls1_prf_basic(void)
 {
         EVP_PKEY_CTX *pctx;
@@ -1038,6 +1117,7 @@ main(int argc, char **argv)
         failed |= obj_name_do_all_test();
         failed |= evp_get_cipherbyname_test();
         failed |= evp_get_digestbyname_test();
+        failed |= evp_kdf_hkdf_basic();
         failed |= evp_kdf_tls1_prf_basic();
         failed |= evp_kdf_tls1_prf();
 
diff --git a/src/regress/lib/libcrypto/free/Makefile b/src/regress/lib/libcrypto/free/Makefile
index 21516f1172..9171393c0f 100644
--- a/src/regress/lib/libcrypto/free/Makefile
+++ b/src/regress/lib/libcrypto/free/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.5 2023/04/15 14:10:09 tb Exp $
+#       $OpenBSD: Makefile,v 1.6 2025/08/25 06:08:33 tb Exp $
 
 TESTS = \
         freenull
@@ -10,9 +10,11 @@ REGRESS_TARGETS= all_tests
 LDADD=          -lcrypto
 DPADD=          ${LIBCRYPTO}
 
+CFLAGS+=        -Wall -Werror
+
 CLEANFILES+= freenull.c freenull.c.body freenull.c.tmp
 
-freenull.c: freenull.awk ../../../../lib/libcrypto/Symbols.list
+freenull.c: freenull.awk freenull.c.head freenull.c.tail ../../../../lib/libcrypto/Symbols.list
         awk -f ${.CURDIR}/freenull.awk \
                 < ${BSDSRCDIR}/lib/libcrypto/Symbols.list > freenull.c.body
         cat ${.CURDIR}/freenull.c.head freenull.c.body \
diff --git a/src/regress/lib/libcrypto/free/freenull.c.head b/src/regress/lib/libcrypto/free/freenull.c.head
index db652bfb01..747f174a4c 100644
--- a/src/regress/lib/libcrypto/free/freenull.c.head
+++ b/src/regress/lib/libcrypto/free/freenull.c.head
@@ -1,4 +1,4 @@
-/*      $OpenBSD: freenull.c.head,v 1.10 2024/08/30 05:00:38 tb Exp $   */
+/*      $OpenBSD: freenull.c.head,v 1.11 2025/08/25 06:01:33 tb Exp $   */
 
 #include <openssl/asn1.h>
 #include <openssl/cmac.h>
@@ -10,6 +10,7 @@
 #include <openssl/gost.h>
 #endif
 #include <openssl/hmac.h>
+#include <openssl/mlkem.h>
 #include <openssl/ocsp.h>
 #include <openssl/pkcs12.h>
 #include <openssl/ts.h>
diff --git a/src/regress/lib/libcrypto/gcm128/gcm128test.c b/src/regress/lib/libcrypto/gcm128/gcm128test.c
index def7653c7b..78631979fe 100644
--- a/src/regress/lib/libcrypto/gcm128/gcm128test.c
+++ b/src/regress/lib/libcrypto/gcm128/gcm128test.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: gcm128test.c,v 1.7 2022/09/05 21:06:31 tb Exp $       */
+/*      $OpenBSD: gcm128test.c,v 1.8 2025/05/16 14:03:49 jsing Exp $    */
 /* ====================================================================
  * Copyright (c) 2010 The OpenSSL Project.  All rights reserved.
  *
@@ -57,11 +57,6 @@
 #include <openssl/aes.h>
 #include <openssl/modes.h>
 
-/* XXX - something like this should be in the public headers. */
-struct gcm128_context {
-        uint64_t opaque[64];
-};
-
 struct gcm128_test {
         const uint8_t K[128];
         size_t K_len;
@@ -856,7 +851,7 @@ struct gcm128_test gcm128_tests[] = {
 static int
 do_gcm128_test(int test_no, struct gcm128_test *tv)
 {
-        GCM128_CONTEXT ctx;
+        GCM128_CONTEXT *ctx;
         AES_KEY key;
         uint8_t *out = NULL;
         size_t out_len;
@@ -873,13 +868,16 @@ do_gcm128_test(int test_no, struct gcm128_test *tv)
 
         if (out_len != 0)
                 memset(out, 0, out_len);
-        CRYPTO_gcm128_init(&ctx, &key, (block128_f)AES_encrypt);
-        CRYPTO_gcm128_setiv(&ctx, tv->IV, tv->IV_len);
+
+        if ((ctx = CRYPTO_gcm128_new(&key, (block128_f)AES_encrypt)) == NULL)
+                err(1, "CRYPTO_gcm128_new");
+
+        CRYPTO_gcm128_setiv(ctx, tv->IV, tv->IV_len);
         if (tv->A_len > 0)
-                CRYPTO_gcm128_aad(&ctx, tv->A, tv->A_len);
+                CRYPTO_gcm128_aad(ctx, tv->A, tv->A_len);
         if (tv->P_len > 0)
-                CRYPTO_gcm128_encrypt(&ctx, tv->P, out, out_len);
-        if (CRYPTO_gcm128_finish(&ctx, tv->T, 16)) {
+                CRYPTO_gcm128_encrypt(ctx, tv->P, out, out_len);
+        if (CRYPTO_gcm128_finish(ctx, tv->T, 16)) {
                 fprintf(stderr, "TEST %d: CRYPTO_gcm128_finish failed\n",
                     test_no);
                 goto fail;
@@ -891,12 +889,12 @@ do_gcm128_test(int test_no, struct gcm128_test *tv)
 
         if (out_len != 0)
                 memset(out, 0, out_len);
-        CRYPTO_gcm128_setiv(&ctx, tv->IV, tv->IV_len);
+        CRYPTO_gcm128_setiv(ctx, tv->IV, tv->IV_len);
         if (tv->A_len > 0)
-                CRYPTO_gcm128_aad(&ctx, tv->A, tv->A_len);
+                CRYPTO_gcm128_aad(ctx, tv->A, tv->A_len);
         if (tv->C_len > 0)
-                CRYPTO_gcm128_decrypt(&ctx, tv->C, out, out_len);
-        if (CRYPTO_gcm128_finish(&ctx, tv->T, 16)) {
+                CRYPTO_gcm128_decrypt(ctx, tv->C, out, out_len);
+        if (CRYPTO_gcm128_finish(ctx, tv->T, 16)) {
                 fprintf(stderr, "TEST %d: CRYPTO_gcm128_finish failed\n",
                     test_no);
                 goto fail;
@@ -909,6 +907,8 @@ do_gcm128_test(int test_no, struct gcm128_test *tv)
         ret = 0;
 
 fail:
+        CRYPTO_gcm128_release(ctx);
+
         free(out);
         return (ret);
 }
diff --git a/src/regress/lib/libcrypto/man/check_complete.pl b/src/regress/lib/libcrypto/man/check_complete.pl
index 5f2d12ec73..3cbf02f16a 100755
--- a/src/regress/lib/libcrypto/man/check_complete.pl
+++ b/src/regress/lib/libcrypto/man/check_complete.pl
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 #
-# Copyright (c) 2021 Ingo Schwarze <schwarze@openbsd.org>
+# Copyright (c) 2021,2022,2023,2024,2025 Ingo Schwarze <schwarze@openbsd.org>
 #
 # Permission to use, copy, modify, and distribute this software for any
 # purpose with or without fee is hereby granted, provided that the above
@@ -30,6 +30,9 @@ my %internal = (
         BN_MASK2 BN_MASK2h BN_MASK2h1 BN_MASK2l
         BN_TBIT BN_ULLONG
     )],
+    conf => [qw(
+        conf_st conf_method_st
+    )],
     evp => [qw(
         ASN1_PKEY_CTRL_CMS_ENVELOPE ASN1_PKEY_CTRL_CMS_RI_TYPE
         ASN1_PKEY_CTRL_CMS_SIGN
@@ -116,7 +119,7 @@ my %postponed = (
 
 my $MANW = 'man -M /usr/share/man -w';
 my $srcdir = '/usr/src/lib/libcrypto/man';
-my $hfile = '/usr/include/openssl';
+my $hfile = '/usr/include';
 
 my $in_cplusplus = 0;
 my $in_comment = 0;
@@ -133,6 +136,7 @@ if (defined $ARGV[0] && $ARGV[0] eq '-v') {
         shift @ARGV;
 }
 $#ARGV == 0 or die "usage: $0 [-v] headername";
+$hfile .= "/openssl" unless $ARGV[0] eq 'tls';
 $hfile .= "/$ARGV[0].h";
 open my $in_fh, '<', $hfile or die "$hfile: $!";
 
@@ -236,6 +240,7 @@ try_again:
         # Uninteresting lines.
 
         if (/^\s*$/ ||
+            /^DECLARE_LHASH_OF\(\w+\);$/ ||
             /^DECLARE_STACK_OF\(\w+\)$/ ||
             /^DECLARE_PKCS12_STACK_OF\(\w+\)$/ ||
             /^TYPEDEF_D2I2D_OF\(\w+\);$/ ||
@@ -288,7 +293,7 @@ try_again:
                         print "D- $line\n" if $verbose;
                         next;
                 }
-                if ($id =~ /^(?:ASN1|BIO|BN|EVP|X509(?:V3)?)_[FR]_\w+$/) {
+                if ($id =~ /^(?:ASN1|BIO|BN|CONF|EVP|X509(?:V3)?)_[FR]_\w+$/) {
                         print "D- $line\n" if $verbose;
                         next;
                 }
diff --git a/src/regress/lib/libcrypto/md/Makefile b/src/regress/lib/libcrypto/md/Makefile
index 94bec95e05..1df57283b2 100644
--- a/src/regress/lib/libcrypto/md/Makefile
+++ b/src/regress/lib/libcrypto/md/Makefile
@@ -1,9 +1,15 @@
-#       $OpenBSD: Makefile,v 1.1.1.1 2022/09/02 13:34:48 tb Exp $
+#       $OpenBSD: Makefile,v 1.2 2025/05/22 03:24:47 joshua Exp $
 
-PROG=   md_test
-LDADD=  -lcrypto
-DPADD=  ${LIBCRYPTO}
-WARNINGS=       Yes
-CFLAGS+=        -DLIBRESSL_INTERNAL -Werror
+PROG =          md_test
+LDADD =         -lcrypto
+DPADD =         ${LIBCRYPTO}
+WARNINGS =      Yes
+CFLAGS +=       -DLIBRESSL_INTERNAL -Werror
+CFLAGS +=       -I${.CURDIR}/../test
+SRCS +=         md_test.c
+SRCS +=         test.c
+SRCS +=         test_util.c
+
+.PATH: ${.CURDIR}/../test
 
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libcrypto/md/md_test.c b/src/regress/lib/libcrypto/md/md_test.c
index 590bb50ee3..752f2e4958 100644
--- a/src/regress/lib/libcrypto/md/md_test.c
+++ b/src/regress/lib/libcrypto/md/md_test.c
@@ -1,6 +1,6 @@
-/*      $OpenBSD: md_test.c,v 1.3 2025/01/19 10:17:39 tb Exp $ */
+/*      $OpenBSD: md_test.c,v 1.4 2025/05/22 03:24:47 joshua Exp $ */
 /*
- * Copyright (c) 2022 Joshua Sing <joshua@hypera.dev>
+ * Copyright (c) 2022, 2025 Joshua Sing <joshua@joshuasing.dev>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -22,6 +22,8 @@
 #include <stdint.h>
 #include <string.h>
 
+#include "test.h"
+
 struct md_test {
         const int algorithm;
         const uint8_t in[128];
@@ -30,7 +32,7 @@ struct md_test {
 };
 
 static const struct md_test md_tests[] = {
-        /* MD4 (RFC 1320 test vectors)  */
+        /* MD4 (RFC 1320 test vectors) */
         {
                 .algorithm = NID_md4,
                 .in = "",
@@ -99,7 +101,7 @@ static const struct md_test md_tests[] = {
                 }
         },
 
-        /* MD5 (RFC 1321 test vectors)  */
+        /* MD5 (RFC 1321 test vectors) */
         {
                 .algorithm = NID_md5,
                 .in = "",
@@ -175,25 +177,21 @@ typedef unsigned char *(*md_hash_func)(const unsigned char *, size_t,
     unsigned char *);
 
 static int
-md_hash_from_algorithm(int algorithm, const char **out_label,
-    md_hash_func *out_func, const EVP_MD **out_md, size_t *out_len)
+md_hash_from_algorithm(int algorithm, md_hash_func *out_func,
+    const EVP_MD **out_md, size_t *out_len)
 {
         switch (algorithm) {
         case NID_md4:
-                *out_label = SN_md4;
                 *out_func = MD4;
                 *out_md = EVP_md4();
                 *out_len = MD4_DIGEST_LENGTH;
                 break;
         case NID_md5:
-                *out_label = SN_md5;
                 *out_func = MD5;
                 *out_md = EVP_md5();
                 *out_len = MD5_DIGEST_LENGTH;
                 break;
         default:
-                fprintf(stderr, "FAIL: unknown algorithm (%d)\n",
-                        algorithm);
                 return 0;
         }
 
@@ -201,108 +199,100 @@ md_hash_from_algorithm(int algorithm, const char **out_label,
 }
 
 static void
-hexdump(const unsigned char *buf, size_t len)
-{
-        size_t i;
-
-        for (i = 1; i <= len; i++)
-                fprintf(stderr, " 0x%02hhx,%s", buf[i - 1], i % 8 ? "" : "\n");
-
-        fprintf(stderr, "\n");
-}
-
-static int
-md_test(void)
+test_md_tv(struct test *t, const void *arg)
 {
-        unsigned char *(*md_func)(const unsigned char *, size_t, unsigned char *);
-        const struct md_test *st;
-        EVP_MD_CTX *hash = NULL;
+        const struct md_test *st = arg;
+        md_hash_func md_func;
         const EVP_MD *md;
+        EVP_MD_CTX *hash = NULL;
         uint8_t out[EVP_MAX_MD_SIZE];
         size_t in_len, out_len;
-        size_t i;
-        const char *label;
-        int failed = 1;
 
-        if ((hash = EVP_MD_CTX_new()) == NULL) {
-                fprintf(stderr, "FAIL: EVP_MD_CTX_new() failed\n");
-                goto failed;
+        if (!md_hash_from_algorithm(st->algorithm, &md_func, &md, &out_len)) {
+                test_errorf(t, "md_hash_from_algorithm: unknown algorithm: %d",
+                    st->algorithm);
+                goto fail;
         }
 
-        for (i = 0; i < N_MD_TESTS; i++) {
-                st = &md_tests[i];
-                if (!md_hash_from_algorithm(st->algorithm, &label, &md_func,
-                    &md, &out_len))
-                        goto failed;
-
-                /* Digest */
-                memset(out, 0, sizeof(out));
-                md_func(st->in, st->in_len, out);
-                if (memcmp(st->out, out, out_len) != 0) {
-                        fprintf(stderr, "FAIL (%s): mismatch\n", label);
-                        goto failed;
-                }
+        if ((hash = EVP_MD_CTX_new()) == NULL) {
+                test_errorf(t, "EVP_MD_CTX_new()");
+                goto fail;
+        }
 
-                /* EVP single-shot digest */
-                memset(out, 0, sizeof(out));
-                if (!EVP_Digest(st->in, st->in_len, out, NULL, md, NULL)) {
-                        fprintf(stderr, "FAIL (%s): EVP_Digest failed\n",
-                            label);
-                        goto failed;
-                }
+        /* Digest */
+        memset(out, 0, sizeof(out));
+        md_func(st->in, st->in_len, out);
+        if (memcmp(st->out, out, out_len) != 0) {
+                test_errorf(t, "MD: digest output mismatch");
+                test_hexdiff(t, out, out_len, st->out);
+        }
 
-                if (memcmp(st->out, out, out_len) != 0) {
-                        fprintf(stderr, "FAIL (%s): EVP single-shot mismatch\n",
-                            label);
-                        goto failed;
-                }
+        /* EVP single-shot digest */
+        memset(out, 0, sizeof(out));
+        if (!EVP_Digest(st->in, st->in_len, out, NULL, md, NULL)) {
+                test_errorf(t, "EVP_Digest()");
+                goto fail;
+        }
+        if (memcmp(st->out, out, out_len) != 0) {
+                test_errorf(t, "EVP_Digest: digest output mismatch");
+                test_hexdiff(t, out, out_len, st->out);
+        }
 
-                /* EVP digest */
-                memset(out, 0, sizeof(out));
-                if (!EVP_DigestInit_ex(hash, md, NULL)) {
-                        fprintf(stderr, "FAIL (%s): EVP_DigestInit_ex failed\n",
-                            label);
-                        goto failed;
-                }
+        /* EVP digest */
+        memset(out, 0, sizeof(out));
+        if (!EVP_DigestInit_ex(hash, md, NULL)) {
+                test_errorf(t, "EVP_DigestInit_ex()");
+                goto fail;
+        }
 
-                in_len = st->in_len / 2;
-                if (!EVP_DigestUpdate(hash, st->in, in_len)) {
-                        fprintf(stderr,
-                            "FAIL (%s): EVP_DigestUpdate first half failed\n",
-                            label);
-                        goto failed;
-                }
+        in_len = st->in_len / 2;
+        if (!EVP_DigestUpdate(hash, st->in, in_len)) {
+                test_errorf(t, "EVP_DigestUpdate: first half failed");
+                goto fail;
+        }
 
-                if (!EVP_DigestUpdate(hash, st->in + in_len,
-                        st->in_len - in_len)) {
-                        fprintf(stderr,
-                            "FAIL (%s): EVP_DigestUpdate second half failed\n",
-                            label);
-                        goto failed;
-                }
+        if (!EVP_DigestUpdate(hash, st->in + in_len,
+                st->in_len - in_len)) {
+                test_errorf(t, "EVP_DigestUpdate: second half failed");
+                goto fail;
+        }
 
-                if (!EVP_DigestFinal_ex(hash, out, NULL)) {
-                        fprintf(stderr,
-                            "FAIL (%s): EVP_DigestFinal_ex failed\n",
-                            label);
-                        goto failed;
-                }
+        if (!EVP_DigestFinal_ex(hash, out, NULL)) {
+                test_errorf(t, "EVP_DigestFinal_ex()");
+                goto fail;
+        }
 
-                if (memcmp(st->out, out, out_len) != 0) {
-                        fprintf(stderr, "FAIL (%s): EVP mismatch\n", label);
-                        goto failed;
-                }
+        if (memcmp(st->out, out, out_len) != 0) {
+                test_errorf(t, "EVP: digest output mismatch");
+                test_hexdiff(t, out, out_len, st->out);
         }
 
-        failed = 0;
 
- failed:
+ fail:
         EVP_MD_CTX_free(hash);
-        return failed;
 }
 
-static int
-md5_large_test(void)
+static void
+test_md(struct test *t, const void *arg)
+{
+        const struct md_test *st;
+        size_t i;
+        char *name;
+
+        for (i = 0; i < N_MD_TESTS; i++) {
+                st = &md_tests[i];
+                if (asprintf(&name, "%s: '%s'", OBJ_nid2sn(st->algorithm), st->in) == -1) {
+                        test_errorf(t, "create test name");
+                        return;
+                }
+
+                test_run(t, name, test_md_tv, st);
+                free(name);
+        }
+}
+
+static void
+test_md5_large(struct test *t, const void *arg)
 {
         MD5_CTX ctx;
         uint8_t in[1024];
@@ -310,12 +300,10 @@ md5_large_test(void)
         unsigned int out_len;
         size_t in_len;
         size_t i;
-        const char *label;
         uint8_t want[] = {
                 0xd8, 0xbc, 0xae, 0x13, 0xb5, 0x5a, 0xb0, 0xfc,
                 0x7f, 0x8a, 0xe1, 0x78, 0x27, 0x8d, 0x44, 0x1b,
         };
-        int failed = 1;
 
         memset(in, 'A', sizeof(in));
         in_len = sizeof(in);
@@ -323,44 +311,34 @@ md5_large_test(void)
         memset(out, 0, sizeof(out));
         out_len = 16;
 
-        label = "md5";
-
         MD5_Init(&ctx);
 
         for (i = 0; i < (1<<29) + 1; i += in_len) {
                 if (!MD5_Update(&ctx, in, in_len)) {
-                        fprintf(stderr, "FAIL (%s): MD5_Update failed\n", label);
-                        goto failed;
+                        test_errorf(t, "MD5_Update()");
+                        return;
                 }
         }
         if (!MD5_Final(out, &ctx)) {
-                fprintf(stderr, "FAIL (%s): MD5_Final failed\n", label);
-                goto failed;
+                test_errorf(t, "MD5_Final()");
+                return;
         }
 
         if (memcmp(out, want, out_len) != 0) {
-                fprintf(stderr, "FAIL (%s): MD5 mismatch\n", label);
-                hexdump(out, out_len);
-                goto failed;
+                test_errorf(t, "MD5 digest output mismatch");
+                test_hexdump(t, out, out_len);
         }
-        if (ctx.Nh != 0x1 || ctx.Nl != 0x2000) {
-                fprintf(stderr, "FAIL (%s): MD5 incorrect bit length\n", label);
-                goto failed;
-        }
-
-        failed = 0;
-
- failed:
-        return failed;
+        if (ctx.Nh != 0x1 || ctx.Nl != 0x2000)
+                test_errorf(t, "MD5 incorrect bit length");
 }
 
 int
 main(int argc, char **argv)
 {
-        int failed = 0;
+        struct test *t = test_init();
 
-        failed |= md_test();
-        failed |= md5_large_test();
+        test_run(t, "md", test_md, NULL);
+        test_run(t, "md5 large", test_md5_large, NULL);
 
-        return failed;
+        return test_result(t);
 }
diff --git a/src/regress/lib/libcrypto/mlkem/Makefile b/src/regress/lib/libcrypto/mlkem/Makefile
index a08623c90a..3acaf78e63 100644
--- a/src/regress/lib/libcrypto/mlkem/Makefile
+++ b/src/regress/lib/libcrypto/mlkem/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.9 2024/12/29 20:14:15 tb Exp $
+#       $OpenBSD: Makefile,v 1.10 2025/08/15 14:46:37 tb Exp $
 
 REGRESS_SLOW_TARGETS += run-regress-mlkem_iteration_tests
 
@@ -22,7 +22,7 @@ run-regress-mlkem_tests: mlkem_tests
         ./mlkem_tests $f ${.CURDIR}/$f.txt
 .endfor
 
-SRCS_mlkem_tests =      mlkem_tests.c mlkem_tests_util.c parse_test_file.c
+SRCS_mlkem_tests =      mlkem_tests.c parse_test_file.c
 SRCS_mlkem_iteration_tests = mlkem_iteration_tests.c mlkem_tests_util.c
 SRCS_mlkem_unittest =   mlkem_unittest.c mlkem_tests_util.c
 
diff --git a/src/regress/lib/libcrypto/mlkem/mlkem_iteration_tests.c b/src/regress/lib/libcrypto/mlkem/mlkem_iteration_tests.c
index 5a61248090..053f8e1222 100644
--- a/src/regress/lib/libcrypto/mlkem/mlkem_iteration_tests.c
+++ b/src/regress/lib/libcrypto/mlkem/mlkem_iteration_tests.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: mlkem_iteration_tests.c,v 1.2 2024/12/26 07:26:45 tb Exp $ */
+/*      $OpenBSD: mlkem_iteration_tests.c,v 1.8 2025/08/17 19:26:35 tb Exp $ */
 /*
  * Copyright (c) 2024 Google Inc.
  * Copyright (c) 2024 Bob Beck <beck@obtuse.com>
@@ -22,7 +22,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "mlkem.h"
+#include <openssl/mlkem.h>
 
 #include "mlkem_internal.h"
 #include "mlkem_tests_util.h"
@@ -63,46 +63,49 @@ const uint8_t kExpectedAdam1024[32] = {
         0x04, 0xab, 0xdb, 0x94, 0x8b, 0x90, 0x8b, 0x75, 0xba, 0xd5
 };
 
-struct iteration_ctx {
-        uint8_t *encoded_public_key;
-        size_t encoded_public_key_len;
-        uint8_t *ciphertext;
-        size_t ciphertext_len;
-        uint8_t *invalid_ciphertext;
-        size_t invalid_ciphertext_len;
-        void *priv;
-        void *pub;
-
-        mlkem_encode_private_key_fn encode_private_key;
-        mlkem_encap_external_entropy_fn encap_external_entropy;
-        mlkem_generate_key_external_entropy_fn generate_key_external_entropy;
-        mlkem_public_from_private_fn public_from_private;
-        mlkem_decap_fn decap;
-
-        const uint8_t *start;
-        size_t start_len;
-
-        const uint8_t *expected;
-        size_t expected_len;
-};
-
 static int
-MlkemIterativeTest(struct iteration_ctx *ctx)
+MlkemIterativeTest(int rank)
 {
-        uint8_t shared_secret[MLKEM_SHARED_SECRET_BYTES];
+        const uint8_t *start, *expected;
+        size_t start_len;
         uint8_t encap_entropy[MLKEM_ENCAP_ENTROPY];
-        uint8_t seed[MLKEM_SEED_BYTES] = {0};
+        uint8_t seed[MLKEM_SEED_LENGTH] = {0};
+        uint8_t *shared_secret = NULL;
         sha3_ctx drng, results;
         uint8_t out[32];
         int i;
 
+        start = kExpectedSeedStart;
+        start_len = sizeof(kExpectedSeedStart);
+        switch(rank){
+        case RANK768:
+                expected = kExpectedAdam768;
+                break;
+        case RANK1024:
+                expected = kExpectedAdam1024;
+                break;
+        default:
+                errx(1, "invalid rank %d", rank);
+        }
+
         shake128_init(&drng);
         shake128_init(&results);
 
         shake_xof(&drng);
         for (i = 0; i < 10000; i++) {
-                uint8_t *encoded_private_key = NULL;
-                size_t encoded_private_key_len;
+                uint8_t *encoded_public_key = NULL, *ciphertext = NULL,
+                    *encoded_private_key = NULL, *invalid_ciphertext = NULL;
+                size_t encoded_public_key_len, ciphertext_len,
+                    encoded_private_key_len, invalid_ciphertext_len;
+                MLKEM_private_key *priv;
+                MLKEM_public_key *pub;
+                size_t s_len = 0;
+
+                /* allocate keys for this iteration */
+                if ((priv = MLKEM_private_key_new(rank)) == NULL)
+                        errx(1, "malloc");
+                if ((pub = MLKEM_public_key_new(rank)) == NULL)
+                        errx(1, "malloc");
 
                 /*
                  * This should draw both d and z from DRNG concatenating in
@@ -110,118 +113,91 @@ MlkemIterativeTest(struct iteration_ctx *ctx)
                  */
                 shake_out(&drng, seed, sizeof(seed));
                 if (i == 0) {
-                        if (compare_data(seed, ctx->start, ctx->start_len,
+                        if (compare_data(seed, start, start_len,
                             "seed start") != 0)
                                 errx(1, "compare_data");
                 }
 
                 /* generate ek as encoded_public_key */
-                ctx->generate_key_external_entropy(ctx->encoded_public_key,
-                    ctx->priv, seed);
-                ctx->public_from_private(ctx->pub, ctx->priv);
+                if (!MLKEM_generate_key_external_entropy(priv,
+                    &encoded_public_key, &encoded_public_key_len,
+                    seed))
+                        errx(1, "generate_key_external_entropy");
+
+                if (!MLKEM_public_from_private(priv, pub))
+                        errx(1, "public_from_private");
 
                 /* hash in ek */
-                shake_update(&results, ctx->encoded_public_key,
-                    ctx->encoded_public_key_len);
+                shake_update(&results, encoded_public_key,
+                    encoded_public_key_len);
 
                 /* marshal priv to dk as encoded_private_key */
-                if (!ctx->encode_private_key(ctx->priv, &encoded_private_key,
+                if (!MLKEM_marshal_private_key(priv, &encoded_private_key,
                     &encoded_private_key_len))
-                        errx(1, "encode private key");
+                        errx(1, "marshal private key");
 
                 /* hash in dk */
                 shake_update(&results, encoded_private_key,
                     encoded_private_key_len);
 
-                free(encoded_private_key);
+                freezero(encoded_private_key, encoded_private_key_len);
 
                 /* draw m as encap entropy from DRNG */
                 shake_out(&drng, encap_entropy, sizeof(encap_entropy));
 
                 /* generate ct as ciphertext, k as shared_secret */
-                ctx->encap_external_entropy(ctx->ciphertext, shared_secret,
-                    ctx->pub, encap_entropy);
+                if (!MLKEM_encap_external_entropy(pub, encap_entropy,
+                    &ciphertext, &ciphertext_len, &shared_secret, &s_len))
+                        errx(1, "encap_external_entropy");
 
                 /* hash in ct */
-                shake_update(&results, ctx->ciphertext, ctx->ciphertext_len);
+                shake_update(&results, ciphertext, ciphertext_len);
                 /* hash in k */
-                shake_update(&results, shared_secret, sizeof(shared_secret));
+                shake_update(&results, shared_secret, s_len);
+
+                freezero(shared_secret, s_len);
+                shared_secret = NULL;
+
+                invalid_ciphertext_len = ciphertext_len;
+                if ((invalid_ciphertext = calloc(1, invalid_ciphertext_len))
+                    == NULL)
+                        errx(1, "malloc");
 
                 /* draw ct as invalid_ciphertxt from DRNG */
-                shake_out(&drng, ctx->invalid_ciphertext,
-                    ctx->invalid_ciphertext_len);
+                shake_out(&drng, invalid_ciphertext, invalid_ciphertext_len);
 
                 /* generate k as shared secret from invalid ciphertext */
-                if (!ctx->decap(shared_secret, ctx->invalid_ciphertext,
-                    ctx->invalid_ciphertext_len, ctx->priv))
-                        errx(1, "decap failed");
+                if (!MLKEM_decap(priv, invalid_ciphertext,
+                    invalid_ciphertext_len, &shared_secret, &s_len))
+                        errx(1, "decap failed, iteration %d", i);
 
                 /* hash in k */
-                shake_update(&results, shared_secret, sizeof(shared_secret));
+                shake_update(&results, shared_secret, s_len);
+
+                freezero(shared_secret, s_len);
+                shared_secret = NULL;
+                freezero(invalid_ciphertext, invalid_ciphertext_len);
+                invalid_ciphertext = NULL;
+
+                /* free keys and intermediate products for this iteration */
+                MLKEM_private_key_free(priv);
+                MLKEM_public_key_free(pub);
+                freezero(encoded_public_key, encoded_public_key_len);
+                freezero(ciphertext, ciphertext_len);
         }
         shake_xof(&results);
         shake_out(&results, out, sizeof(out));
 
-        return compare_data(ctx->expected, out, sizeof(out), "final result hash");
+        return compare_data(expected, out, sizeof(out), "final result hash");
 }
 
 int
 main(void)
 {
-        uint8_t encoded_public_key768[MLKEM768_PUBLIC_KEY_BYTES];
-        uint8_t ciphertext768[MLKEM768_CIPHERTEXT_BYTES];
-        uint8_t invalid_ciphertext768[MLKEM768_CIPHERTEXT_BYTES];
-        struct MLKEM768_private_key priv768;
-        struct MLKEM768_public_key pub768;
-        struct iteration_ctx iteration768 = {
-                .encoded_public_key = encoded_public_key768,
-                .encoded_public_key_len = sizeof(encoded_public_key768),
-                .ciphertext = ciphertext768,
-                .ciphertext_len = sizeof(ciphertext768),
-                .invalid_ciphertext = invalid_ciphertext768,
-                .invalid_ciphertext_len = sizeof(invalid_ciphertext768),
-                .priv = &priv768,
-                .pub = &pub768,
-                .encap_external_entropy = mlkem768_encap_external_entropy,
-                .encode_private_key = mlkem768_encode_private_key,
-                .generate_key_external_entropy =
-                    mlkem768_generate_key_external_entropy,
-                .public_from_private = mlkem768_public_from_private,
-                .decap = mlkem768_decap,
-                .start = kExpectedSeedStart,
-                .start_len = sizeof(kExpectedSeedStart),
-                .expected = kExpectedAdam768,
-                .expected_len = sizeof(kExpectedAdam768),
-        };
-        uint8_t encoded_public_key1024[MLKEM1024_PUBLIC_KEY_BYTES];
-        uint8_t ciphertext1024[MLKEM1024_CIPHERTEXT_BYTES];
-        uint8_t invalid_ciphertext1024[MLKEM1024_CIPHERTEXT_BYTES];
-        struct MLKEM1024_private_key priv1024;
-        struct MLKEM1024_public_key pub1024;
-        struct iteration_ctx iteration1024 = {
-                .encoded_public_key = encoded_public_key1024,
-                .encoded_public_key_len = sizeof(encoded_public_key1024),
-                .ciphertext = ciphertext1024,
-                .ciphertext_len = sizeof(ciphertext1024),
-                .invalid_ciphertext = invalid_ciphertext1024,
-                .invalid_ciphertext_len = sizeof(invalid_ciphertext1024),
-                .priv = &priv1024,
-                .pub = &pub1024,
-                .encap_external_entropy = mlkem1024_encap_external_entropy,
-                .encode_private_key = mlkem1024_encode_private_key,
-                .generate_key_external_entropy =
-                    mlkem1024_generate_key_external_entropy,
-                .public_from_private = mlkem1024_public_from_private,
-                .decap = mlkem1024_decap,
-                .start = kExpectedSeedStart,
-                .start_len = sizeof(kExpectedSeedStart),
-                .expected = kExpectedAdam1024,
-                .expected_len = sizeof(kExpectedAdam1024),
-        };
         int failed = 0;
 
-        failed |= MlkemIterativeTest(&iteration768);
-        failed |= MlkemIterativeTest(&iteration1024);
+        failed |= MlkemIterativeTest(RANK768);
+        failed |= MlkemIterativeTest(RANK1024);
 
         return failed;
 }
diff --git a/src/regress/lib/libcrypto/mlkem/mlkem_tests.c b/src/regress/lib/libcrypto/mlkem/mlkem_tests.c
index 2801a58890..361467afd0 100644
--- a/src/regress/lib/libcrypto/mlkem/mlkem_tests.c
+++ b/src/regress/lib/libcrypto/mlkem/mlkem_tests.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: mlkem_tests.c,v 1.2 2024/12/26 00:10:19 tb Exp $ */
+/*      $OpenBSD: mlkem_tests.c,v 1.10 2025/08/15 21:47:39 tb Exp $ */
 /*
  * Copyright (c) 2024 Google Inc.
  * Copyright (c) 2024 Theo Buehler <tb@openbsd.org>
@@ -23,12 +23,11 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "bytestring.h"
-#include "mlkem.h"
+#include <openssl/mlkem.h>
 
+#include "bytestring.h"
 #include "mlkem_internal.h"
 
-#include "mlkem_tests_util.h"
 #include "parse_test_file.h"
 
 enum test_type {
@@ -39,11 +38,7 @@ enum test_type {
 struct decap_ctx {
         struct parse *parse_ctx;
 
-        void *private_key;
-        size_t private_key_len;
-
-        mlkem_parse_private_key_fn parse_private_key;
-        mlkem_decap_fn decap;
+        int rank;
 };
 
 enum decap_states {
@@ -102,8 +97,10 @@ static int
 MlkemDecapFileTest(struct decap_ctx *decap)
 {
         struct parse *p = decap->parse_ctx;
-        uint8_t shared_secret_buf[MLKEM_SHARED_SECRET_BYTES];
+        MLKEM_private_key *priv_key = NULL;
         CBS ciphertext, shared_secret, private_key;
+        uint8_t *shared_secret_buf = NULL;
+        size_t shared_secret_buf_len = 0;
         int should_fail;
         int failed = 1;
 
@@ -112,20 +109,31 @@ MlkemDecapFileTest(struct decap_ctx *decap)
         parse_get_cbs(p, DECAP_PRIVATE_KEY, &private_key);
         parse_get_int(p, DECAP_RESULT, &should_fail);
 
-        if (!decap->parse_private_key(decap->private_key, &private_key)) {
+        if ((priv_key = MLKEM_private_key_new(decap->rank)) == NULL)
+                parse_errx(p, "MLKEM_private_key_new");
+
+        if (!MLKEM_parse_private_key(priv_key,
+            CBS_data(&private_key), CBS_len(&private_key))) {
                 if ((failed = !should_fail))
                         parse_info(p, "parse private key");
                 goto err;
         }
-        if (!decap->decap(shared_secret_buf,
-            CBS_data(&ciphertext), CBS_len(&ciphertext), decap->private_key)) {
+        if (!MLKEM_decap(priv_key, CBS_data(&ciphertext), CBS_len(&ciphertext),
+            &shared_secret_buf, &shared_secret_buf_len)) {
                 if ((failed = !should_fail))
                         parse_info(p, "decap");
                 goto err;
         }
 
+        if (shared_secret_buf_len != MLKEM_SHARED_SECRET_LENGTH) {
+                if ((failed = !should_fail))
+                        parse_info(p, "shared secret length %zu != %d",
+                            shared_secret_buf_len, MLKEM_SHARED_SECRET_LENGTH);
+                goto err;
+        }
+
         failed = !parse_data_equal(p, "shared_secret", &shared_secret,
-            shared_secret_buf, sizeof(shared_secret_buf));
+            shared_secret_buf, shared_secret_buf_len);
 
         if (should_fail != failed) {
                 parse_info(p, "FAIL: should_fail %d, failed %d",
@@ -134,6 +142,9 @@ MlkemDecapFileTest(struct decap_ctx *decap)
         }
 
  err:
+        MLKEM_private_key_free(priv_key);
+        freezero(shared_secret_buf, shared_secret_buf_len);
+
         return failed;
 }
 
@@ -192,35 +203,49 @@ static int
 MlkemNistDecapFileTest(struct decap_ctx *decap)
 {
         struct parse *p = decap->parse_ctx;
-        uint8_t shared_secret[MLKEM_SHARED_SECRET_BYTES];
+        MLKEM_private_key *priv_key = NULL;
         CBS dk, c, k;
+        uint8_t *shared_secret = NULL;
+        size_t shared_secret_len = 0;
         int failed = 1;
 
         parse_instruction_get_cbs(p, NIST_DECAP_DK, &dk);
         parse_get_cbs(p, NIST_DECAP_C, &c);
         parse_get_cbs(p, NIST_DECAP_K, &k);
 
+        if ((priv_key = MLKEM_private_key_new(decap->rank)) == NULL)
+                parse_errx(p, "MLKEM_private_key_new");
+
         if (!parse_length_equal(p, "private key",
-            decap->private_key_len, CBS_len(&dk)))
+            MLKEM_private_key_encoded_length(priv_key), CBS_len(&dk)))
                 goto err;
         if (!parse_length_equal(p, "shared secret",
-            MLKEM_SHARED_SECRET_BYTES, CBS_len(&k)))
+            MLKEM_SHARED_SECRET_LENGTH, CBS_len(&k)))
                 goto err;
 
-        if (!decap->parse_private_key(decap->private_key, &dk)) {
+        if (!MLKEM_parse_private_key(priv_key, CBS_data(&dk), CBS_len(&dk))) {
                 parse_info(p, "parse private key");
                 goto err;
         }
-        if (!decap->decap(shared_secret, CBS_data(&c), CBS_len(&c),
-            decap->private_key)) {
+        if (!MLKEM_decap(priv_key, CBS_data(&c), CBS_len(&c),
+            &shared_secret, &shared_secret_len)) {
                 parse_info(p, "decap");
                 goto err;
         }
 
+        if (shared_secret_len != MLKEM_SHARED_SECRET_LENGTH) {
+                parse_info(p, "shared secret length %zu != %d",
+                    shared_secret_len, MLKEM_SHARED_SECRET_LENGTH);
+                goto err;
+        }
+
         failed = !parse_data_equal(p, "shared secret", &k,
-            shared_secret, MLKEM_SHARED_SECRET_BYTES);
+            shared_secret, shared_secret_len);
 
  err:
+        MLKEM_private_key_free(priv_key);
+        freezero(shared_secret, shared_secret_len);
+
         return failed;
 }
 
@@ -244,46 +269,24 @@ static const struct test_parse nist_decap_parse = {
 };
 
 static int
-mlkem_decap_tests(const char *fn, size_t size, enum test_type test_type)
+mlkem_decap_tests(const char *fn, int rank, enum test_type test_type)
 {
-        struct MLKEM768_private_key private_key768;
-        struct decap_ctx decap768 = {
-                .private_key = &private_key768,
-                .private_key_len = MLKEM768_PRIVATE_KEY_BYTES,
-
-                .parse_private_key = mlkem768_parse_private_key,
-                .decap = mlkem768_decap,
+        struct decap_ctx decap = {
+                .rank = rank,
         };
-        struct MLKEM1024_private_key private_key1024;
-        struct decap_ctx decap1024 = {
-                .private_key = &private_key1024,
-                .private_key_len = MLKEM1024_PRIVATE_KEY_BYTES,
 
-                .parse_private_key = mlkem1024_parse_private_key,
-                .decap = mlkem1024_decap,
-        };
-
-        if (size == 768 && test_type == TEST_TYPE_NORMAL)
-                return parse_test_file(fn, &decap_parse, &decap768);
-        if (size == 768 && test_type == TEST_TYPE_NIST)
-                return parse_test_file(fn, &nist_decap_parse, &decap768);
-        if (size == 1024 && test_type == TEST_TYPE_NORMAL)
-                return parse_test_file(fn, &decap_parse, &decap1024);
-        if (size == 1024 && test_type == TEST_TYPE_NIST)
-                return parse_test_file(fn, &nist_decap_parse, &decap1024);
+        if (test_type == TEST_TYPE_NORMAL)
+                return parse_test_file(fn, &decap_parse, &decap);
+        if (test_type == TEST_TYPE_NIST)
+                return parse_test_file(fn, &nist_decap_parse, &decap);
 
-        errx(1, "unknown decap test: size %zu, type %d", size, test_type);
+        errx(1, "unknown decap test: rank %d, type %d", rank, test_type);
 }
 
 struct encap_ctx {
         struct parse *parse_ctx;
 
-        void *public_key;
-        uint8_t *ciphertext;
-        size_t ciphertext_len;
-
-        mlkem_parse_public_key_fn parse_public_key;
-        mlkem_encap_external_entropy_fn encap_external_entropy;
+        int rank;
 };
 
 enum encap_states {
@@ -349,8 +352,12 @@ static int
 MlkemEncapFileTest(struct encap_ctx *encap)
 {
         struct parse *p = encap->parse_ctx;
-        uint8_t shared_secret_buf[MLKEM_SHARED_SECRET_BYTES];
+        MLKEM_public_key *pub_key = NULL;
         CBS entropy, public_key, ciphertext, shared_secret;
+        uint8_t *ciphertext_buf = NULL;
+        size_t ciphertext_buf_len = 0;
+        uint8_t *shared_secret_buf = NULL;
+        size_t shared_secret_buf_len = 0;
         int should_fail;
         int failed = 1;
 
@@ -360,18 +367,34 @@ MlkemEncapFileTest(struct encap_ctx *encap)
         parse_get_cbs(p, ENCAP_SHARED_SECRET, &shared_secret);
         parse_get_int(p, ENCAP_RESULT, &should_fail);
 
-        if (!encap->parse_public_key(encap->public_key, &public_key)) {
+        if ((pub_key = MLKEM_public_key_new(encap->rank)) == NULL)
+                parse_errx(p, "MLKEM_public_key_new");
+
+        if (!MLKEM_parse_public_key(pub_key,
+            CBS_data(&public_key), CBS_len(&public_key))) {
                 if ((failed = !should_fail))
                         parse_info(p, "parse public key");
                 goto err;
         }
-        encap->encap_external_entropy(encap->ciphertext, shared_secret_buf,
-            encap->public_key, CBS_data(&entropy));
+        if (!MLKEM_encap_external_entropy(pub_key, CBS_data(&entropy),
+            &ciphertext_buf, &ciphertext_buf_len,
+            &shared_secret_buf, &shared_secret_buf_len)) {
+                if ((failed = !should_fail))
+                        parse_info(p, "encap_external_entropy");
+                goto err;
+        }
+
+        if (shared_secret_buf_len != MLKEM_SHARED_SECRET_LENGTH) {
+                if ((failed = !should_fail))
+                        parse_info(p, "shared secret length %zu != %d",
+                            shared_secret_buf_len, MLKEM_SHARED_SECRET_LENGTH);
+                goto err;
+        }
 
         failed = !parse_data_equal(p, "shared_secret", &shared_secret,
-            shared_secret_buf, sizeof(shared_secret_buf));
+            shared_secret_buf, shared_secret_buf_len);
         failed |= !parse_data_equal(p, "ciphertext", &ciphertext,
-            encap->ciphertext, encap->ciphertext_len);
+            ciphertext_buf, ciphertext_buf_len);
 
         if (should_fail != failed) {
                 parse_info(p, "FAIL: should_fail %d, failed %d",
@@ -380,6 +403,10 @@ MlkemEncapFileTest(struct encap_ctx *encap)
         }
 
  err:
+        MLKEM_public_key_free(pub_key);
+        freezero(ciphertext_buf, ciphertext_buf_len);
+        freezero(shared_secret_buf, shared_secret_buf_len);
+
         return failed;
 }
 
@@ -400,48 +427,19 @@ static const struct test_parse encap_parse = {
 };
 
 static int
-mlkem_encap_tests(const char *fn, size_t size)
+mlkem_encap_tests(const char *fn, int rank)
 {
-        struct MLKEM768_public_key public_key768;
-        uint8_t ciphertext768[MLKEM768_CIPHERTEXT_BYTES];
-        struct encap_ctx encap768 = {
-                .public_key = &public_key768,
-                .ciphertext = ciphertext768,
-                .ciphertext_len = sizeof(ciphertext768),
-
-                .parse_public_key = mlkem768_parse_public_key,
-                .encap_external_entropy = mlkem768_encap_external_entropy,
-        };
-        struct MLKEM1024_public_key public_key1024;
-        uint8_t ciphertext1024[MLKEM1024_CIPHERTEXT_BYTES];
-        struct encap_ctx encap1024 = {
-                .public_key = &public_key1024,
-                .ciphertext = ciphertext1024,
-                .ciphertext_len = sizeof(ciphertext1024),
-
-                .parse_public_key = mlkem1024_parse_public_key,
-                .encap_external_entropy = mlkem1024_encap_external_entropy,
+        struct encap_ctx encap = {
+                .rank = rank,
         };
 
-        if (size == 768)
-                return parse_test_file(fn, &encap_parse, &encap768);
-        if (size == 1024)
-                return parse_test_file(fn, &encap_parse, &encap1024);
-
-        errx(1, "unknown encap test: size %zu", size);
+        return parse_test_file(fn, &encap_parse, &encap);
 }
 
 struct keygen_ctx {
         struct parse *parse_ctx;
 
-        void *private_key;
-        void *encoded_public_key;
-        size_t encoded_public_key_len;
-        size_t private_key_len;
-        size_t public_key_len;
-
-        mlkem_generate_key_external_entropy_fn generate_key_external_entropy;
-        mlkem_encode_private_key_fn encode_private_key;
+        int rank;
 };
 
 enum keygen_states {
@@ -492,27 +490,38 @@ static int
 MlkemKeygenFileTest(struct keygen_ctx *keygen)
 {
         struct parse *p = keygen->parse_ctx;
+        MLKEM_private_key *priv_key = NULL;
         CBS seed, public_key, private_key;
         uint8_t *encoded_private_key = NULL;
         size_t encoded_private_key_len = 0;
+        uint8_t *encoded_public_key = NULL;
+        size_t encoded_public_key_len = 0;
         int failed = 1;
 
         parse_get_cbs(p, KEYGEN_SEED, &seed);
         parse_get_cbs(p, KEYGEN_PUBLIC_KEY, &public_key);
         parse_get_cbs(p, KEYGEN_PRIVATE_KEY, &private_key);
 
-        if (!parse_length_equal(p, "seed", MLKEM_SEED_BYTES, CBS_len(&seed)))
+        if (!parse_length_equal(p, "seed", MLKEM_SEED_LENGTH, CBS_len(&seed)))
                 goto err;
+
+        if ((priv_key = MLKEM_private_key_new(keygen->rank)) == NULL)
+                parse_errx(p, "MLKEM_public_key_free");
+
+        if (!MLKEM_generate_key_external_entropy(priv_key,
+            &encoded_public_key, &encoded_public_key_len, CBS_data(&seed))) {
+                parse_info(p, "generate_key_external_entropy");
+                goto err;
+        }
+
         if (!parse_length_equal(p, "public key",
-            keygen->public_key_len, CBS_len(&public_key)))
+            encoded_public_key_len, CBS_len(&public_key)))
                 goto err;
         if (!parse_length_equal(p, "private key",
-            keygen->private_key_len, CBS_len(&private_key)))
+            MLKEM_private_key_encoded_length(priv_key), CBS_len(&private_key)))
                 goto err;
 
-        keygen->generate_key_external_entropy(keygen->encoded_public_key,
-            keygen->private_key, CBS_data(&seed));
-        if (!keygen->encode_private_key(keygen->private_key,
+        if (!MLKEM_marshal_private_key(priv_key,
             &encoded_private_key, &encoded_private_key_len)) {
                 parse_info(p, "encode private key");
                 goto err;
@@ -521,10 +530,12 @@ MlkemKeygenFileTest(struct keygen_ctx *keygen)
         failed = !parse_data_equal(p, "private key", &private_key,
             encoded_private_key, encoded_private_key_len);
         failed |= !parse_data_equal(p, "public key", &public_key,
-            keygen->encoded_public_key, keygen->encoded_public_key_len);
+            encoded_public_key, encoded_public_key_len);
 
  err:
+        MLKEM_private_key_free(priv_key);
         freezero(encoded_private_key, encoded_private_key_len);
+        freezero(encoded_public_key, encoded_public_key_len);
 
         return failed;
 }
@@ -584,12 +595,15 @@ static int
 MlkemNistKeygenFileTest(struct keygen_ctx *keygen)
 {
         struct parse *p = keygen->parse_ctx;
+        MLKEM_private_key *priv_key = NULL;
         CBB seed_cbb;
         CBS z, d, ek, dk;
-        uint8_t seed[MLKEM_SEED_BYTES];
+        uint8_t seed[MLKEM_SEED_LENGTH];
         size_t seed_len;
         uint8_t *encoded_private_key = NULL;
         size_t encoded_private_key_len = 0;
+        uint8_t *encoded_public_key = NULL;
+        size_t encoded_public_key_len = 0;
         int failed = 1;
 
         parse_get_cbs(p, NIST_KEYGEN_Z, &z);
@@ -606,24 +620,33 @@ MlkemNistKeygenFileTest(struct keygen_ctx *keygen)
         if (!CBB_finish(&seed_cbb, NULL, &seed_len))
                 parse_errx(p, "CBB_finish");
 
-        if (!parse_length_equal(p, "bogus z or d", MLKEM_SEED_BYTES, seed_len))
+        if (!parse_length_equal(p, "bogus z or d", MLKEM_SEED_LENGTH, seed_len))
                 goto err;
 
-        keygen->generate_key_external_entropy(keygen->encoded_public_key,
-            keygen->private_key, seed);
-        if (!keygen->encode_private_key(keygen->private_key,
+        if ((priv_key = MLKEM_private_key_new(keygen->rank)) == NULL)
+                parse_errx(p, "MLKEM_private_key_new");
+
+        if (!MLKEM_generate_key_external_entropy(priv_key,
+            &encoded_public_key, &encoded_public_key_len, seed)) {
+                parse_info(p, "MLKEM_generate_key_external_entropy");
+                goto err;
+        }
+
+        if (!MLKEM_marshal_private_key(priv_key,
             &encoded_private_key, &encoded_private_key_len)) {
                 parse_info(p, "encode private key");
                 goto err;
         }
 
         failed = !parse_data_equal(p, "public key", &ek,
-            keygen->encoded_public_key, keygen->encoded_public_key_len);
+            encoded_public_key, encoded_public_key_len);
         failed |= !parse_data_equal(p, "private key", &dk,
             encoded_private_key, encoded_private_key_len);
 
  err:
+        MLKEM_private_key_free(priv_key);
         freezero(encoded_private_key, encoded_private_key_len);
+        freezero(encoded_public_key, encoded_public_key_len);
 
         return failed;
 }
@@ -645,73 +668,45 @@ static const struct test_parse nist_keygen_parse = {
 };
 
 static int
-mlkem_keygen_tests(const char *fn, size_t size, enum test_type test_type)
+mlkem_keygen_tests(const char *fn, int rank, enum test_type test_type)
 {
-        struct MLKEM768_private_key private_key768;
-        uint8_t encoded_public_key768[MLKEM768_PUBLIC_KEY_BYTES];
-        struct keygen_ctx keygen768 = {
-                .private_key = &private_key768,
-                .encoded_public_key = encoded_public_key768,
-                .encoded_public_key_len = sizeof(encoded_public_key768),
-                .private_key_len = MLKEM768_PRIVATE_KEY_BYTES,
-                .public_key_len = MLKEM768_PUBLIC_KEY_BYTES,
-                .generate_key_external_entropy =
-                    mlkem768_generate_key_external_entropy,
-                .encode_private_key =
-                    mlkem768_encode_private_key,
-        };
-        struct MLKEM1024_private_key private_key1024;
-        uint8_t encoded_public_key1024[MLKEM1024_PUBLIC_KEY_BYTES];
-        struct keygen_ctx keygen1024 = {
-                .private_key = &private_key1024,
-                .encoded_public_key = encoded_public_key1024,
-                .encoded_public_key_len = sizeof(encoded_public_key1024),
-                .private_key_len = MLKEM1024_PRIVATE_KEY_BYTES,
-                .public_key_len = MLKEM1024_PUBLIC_KEY_BYTES,
-
-                .generate_key_external_entropy =
-                    mlkem1024_generate_key_external_entropy,
-                .encode_private_key =
-                    mlkem1024_encode_private_key,
+        struct keygen_ctx keygen = {
+                .rank = rank,
         };
 
-        if (size == 768 && test_type == TEST_TYPE_NORMAL)
-                return parse_test_file(fn, &keygen_parse, &keygen768);
-        if (size == 768 && test_type == TEST_TYPE_NIST)
-                return parse_test_file(fn, &nist_keygen_parse, &keygen768);
-        if (size == 1024 && test_type == TEST_TYPE_NORMAL)
-                return parse_test_file(fn, &keygen_parse, &keygen1024);
-        if (size == 1024 && test_type == TEST_TYPE_NIST)
-                return parse_test_file(fn, &nist_keygen_parse, &keygen1024);
+        if (test_type == TEST_TYPE_NORMAL)
+                return parse_test_file(fn, &keygen_parse, &keygen);
+        if (test_type == TEST_TYPE_NIST)
+                return parse_test_file(fn, &nist_keygen_parse, &keygen);
 
-        errx(1, "unknown keygen test: size %zu, type %d", size, test_type);
+        errx(1, "unknown keygen test: rank %d, type %d", rank, test_type);
 }
 
 static int
 run_mlkem_test(const char *test, const char *fn)
 {
         if (strcmp(test, "mlkem768_decap_tests") == 0)
-                return mlkem_decap_tests(fn, 768, TEST_TYPE_NORMAL);
+                return mlkem_decap_tests(fn, RANK768, TEST_TYPE_NORMAL);
         if (strcmp(test, "mlkem768_nist_decap_tests") == 0)
-                return mlkem_decap_tests(fn, 768, TEST_TYPE_NIST);
+                return mlkem_decap_tests(fn, RANK768, TEST_TYPE_NIST);
         if (strcmp(test, "mlkem1024_decap_tests") == 0)
-                return mlkem_decap_tests(fn, 1024, TEST_TYPE_NORMAL);
+                return mlkem_decap_tests(fn, RANK1024, TEST_TYPE_NORMAL);
         if (strcmp(test, "mlkem1024_nist_decap_tests") == 0)
-                return mlkem_decap_tests(fn, 1024, TEST_TYPE_NIST);
+                return mlkem_decap_tests(fn, RANK1024, TEST_TYPE_NIST);
 
         if (strcmp(test, "mlkem768_encap_tests") == 0)
-                return mlkem_encap_tests(fn, 768);
+                return mlkem_encap_tests(fn, RANK768);
         if (strcmp(test, "mlkem1024_encap_tests") == 0)
-                return mlkem_encap_tests(fn, 1024);
+                return mlkem_encap_tests(fn, RANK1024);
 
         if (strcmp(test, "mlkem768_keygen_tests") == 0)
-                return mlkem_keygen_tests(fn, 768, TEST_TYPE_NORMAL);
+                return mlkem_keygen_tests(fn, RANK768, TEST_TYPE_NORMAL);
         if (strcmp(test, "mlkem768_nist_keygen_tests") == 0)
-                return mlkem_keygen_tests(fn, 768, TEST_TYPE_NIST);
+                return mlkem_keygen_tests(fn, RANK768, TEST_TYPE_NIST);
         if (strcmp(test, "mlkem1024_keygen_tests") == 0)
-                return mlkem_keygen_tests(fn, 1024, TEST_TYPE_NORMAL);
+                return mlkem_keygen_tests(fn, RANK1024, TEST_TYPE_NORMAL);
         if (strcmp(test, "mlkem1024_nist_keygen_tests") == 0)
-                return mlkem_keygen_tests(fn, 1024, TEST_TYPE_NIST);
+                return mlkem_keygen_tests(fn, RANK1024, TEST_TYPE_NIST);
 
         errx(1, "unknown test %s (test file %s)", test, fn);
 }
diff --git a/src/regress/lib/libcrypto/mlkem/mlkem_tests_util.c b/src/regress/lib/libcrypto/mlkem/mlkem_tests_util.c
index 1bb2ed3a8b..d2e0fbd7c7 100644
--- a/src/regress/lib/libcrypto/mlkem/mlkem_tests_util.c
+++ b/src/regress/lib/libcrypto/mlkem/mlkem_tests_util.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: mlkem_tests_util.c,v 1.5 2024/12/26 00:04:24 tb Exp $ */
+/*      $OpenBSD: mlkem_tests_util.c,v 1.10 2025/08/15 14:47:54 tb Exp $ */
 /*
  * Copyright (c) 2024 Google Inc.
  * Copyright (c) 2024 Bob Beck <beck@obtuse.com>
@@ -22,11 +22,6 @@
 #include <stdio.h>
 #include <string.h>
 
-#include "bytestring.h"
-#include "mlkem.h"
-
-#include "mlkem_internal.h"
-
 #include "mlkem_tests_util.h"
 
 static void
@@ -59,209 +54,3 @@ compare_data(const uint8_t *want, const uint8_t *got, size_t len, const char *ms
 
         return 1;
 }
-
-int
-mlkem768_encode_private_key(const void *private_key, uint8_t **out_buf,
-    size_t *out_len)
-{
-        CBB cbb;
-        int ret = 0;
-
-        if (!CBB_init(&cbb, MLKEM768_PUBLIC_KEY_BYTES))
-                goto err;
-        if (!MLKEM768_marshal_private_key(&cbb, private_key))
-                goto err;
-        if (!CBB_finish(&cbb, out_buf, out_len))
-                goto err;
-
-        ret = 1;
-
- err:
-        CBB_cleanup(&cbb);
-
-        return ret;
-}
-
-int
-mlkem768_encode_public_key(const void *public_key, uint8_t **out_buf,
-    size_t *out_len)
-{
-        CBB cbb;
-        int ret = 0;
-
-        if (!CBB_init(&cbb, MLKEM768_PUBLIC_KEY_BYTES))
-                goto err;
-        if (!MLKEM768_marshal_public_key(&cbb, public_key))
-                goto err;
-        if (!CBB_finish(&cbb, out_buf, out_len))
-                goto err;
-
-        ret = 1;
-
- err:
-        CBB_cleanup(&cbb);
-
-        return ret;
-}
-
-int
-mlkem1024_encode_private_key(const void *private_key, uint8_t **out_buf,
-    size_t *out_len)
-{
-        CBB cbb;
-        int ret = 0;
-
-        if (!CBB_init(&cbb, MLKEM1024_PUBLIC_KEY_BYTES))
-                goto err;
-        if (!MLKEM1024_marshal_private_key(&cbb, private_key))
-                goto err;
-        if (!CBB_finish(&cbb, out_buf, out_len))
-                goto err;
-
-        ret = 1;
-
- err:
-        CBB_cleanup(&cbb);
-
-        return ret;
-}
-
-int
-mlkem1024_encode_public_key(const void *public_key, uint8_t **out_buf,
-    size_t *out_len)
-{
-        CBB cbb;
-        int ret = 0;
-
-        if (!CBB_init(&cbb, MLKEM1024_PUBLIC_KEY_BYTES))
-                goto err;
-        if (!MLKEM1024_marshal_public_key(&cbb, public_key))
-                goto err;
-        if (!CBB_finish(&cbb, out_buf, out_len))
-                goto err;
-
-        ret = 1;
-
- err:
-        CBB_cleanup(&cbb);
-
-        return ret;
-}
-
-int
-mlkem768_decap(uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
-    const uint8_t *ciphertext, size_t ciphertext_len, const void *private_key)
-{
-        return MLKEM768_decap(out_shared_secret, ciphertext, ciphertext_len,
-            private_key);
-}
-
-void
-mlkem768_encap(uint8_t *out_ciphertext,
-    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
-    const void *public_key)
-{
-        MLKEM768_encap(out_ciphertext, out_shared_secret, public_key);
-}
-
-void
-mlkem768_encap_external_entropy(uint8_t *out_ciphertext,
-    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
-    const void *public_key, const uint8_t entropy[MLKEM_ENCAP_ENTROPY])
-{
-        MLKEM768_encap_external_entropy(out_ciphertext, out_shared_secret,
-            public_key, entropy);
-}
-
-void
-mlkem768_generate_key(uint8_t *out_encoded_public_key,
-    uint8_t optional_out_seed[MLKEM_SEED_BYTES], void *out_private_key)
-{
-        MLKEM768_generate_key(out_encoded_public_key, optional_out_seed,
-            out_private_key);
-}
-
-void
-mlkem768_generate_key_external_entropy(uint8_t *out_encoded_public_key,
-    void *out_private_key, const uint8_t entropy[MLKEM_SEED_BYTES])
-{
-        MLKEM768_generate_key_external_entropy(out_encoded_public_key,
-            out_private_key, entropy);
-}
-
-int
-mlkem768_parse_private_key(void *out_private_key, CBS *private_key_cbs)
-{
-        return MLKEM768_parse_private_key(out_private_key, private_key_cbs);
-}
-
-int
-mlkem768_parse_public_key(void *out_public_key, CBS *public_key_cbs)
-{
-        return MLKEM768_parse_public_key(out_public_key, public_key_cbs);
-}
-
-void
-mlkem768_public_from_private(void *out_public_key, const void *private_key)
-{
-        MLKEM768_public_from_private(out_public_key, private_key);
-}
-
-int
-mlkem1024_decap(uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
-    const uint8_t *ciphertext, size_t ciphertext_len, const void *private_key)
-{
-        return MLKEM1024_decap(out_shared_secret, ciphertext, ciphertext_len,
-            private_key);
-}
-
-void
-mlkem1024_encap(uint8_t *out_ciphertext,
-    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
-    const void *public_key)
-{
-        MLKEM1024_encap(out_ciphertext, out_shared_secret, public_key);
-}
-
-void
-mlkem1024_encap_external_entropy(uint8_t *out_ciphertext,
-    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
-    const void *public_key, const uint8_t entropy[MLKEM_ENCAP_ENTROPY])
-{
-        MLKEM1024_encap_external_entropy(out_ciphertext, out_shared_secret,
-            public_key, entropy);
-}
-
-void
-mlkem1024_generate_key(uint8_t *out_encoded_public_key,
-    uint8_t optional_out_seed[MLKEM_SEED_BYTES], void *out_private_key)
-{
-        MLKEM1024_generate_key(out_encoded_public_key, optional_out_seed,
-            out_private_key);
-}
-
-void
-mlkem1024_generate_key_external_entropy(uint8_t *out_encoded_public_key,
-    void *out_private_key, const uint8_t entropy[MLKEM_SEED_BYTES])
-{
-        MLKEM1024_generate_key_external_entropy(out_encoded_public_key,
-            out_private_key, entropy);
-}
-
-int
-mlkem1024_parse_private_key(void *out_private_key, CBS *private_key_cbs)
-{
-        return MLKEM1024_parse_private_key(out_private_key, private_key_cbs);
-}
-
-void
-mlkem1024_public_from_private(void *out_public_key, const void *private_key)
-{
-        MLKEM1024_public_from_private(out_public_key, private_key);
-}
-
-int
-mlkem1024_parse_public_key(void *out_public_key, CBS *public_key_cbs)
-{
-        return MLKEM1024_parse_public_key(out_public_key, public_key_cbs);
-}
diff --git a/src/regress/lib/libcrypto/mlkem/mlkem_tests_util.h b/src/regress/lib/libcrypto/mlkem/mlkem_tests_util.h
index 7fbe6f76a9..514a309112 100644
--- a/src/regress/lib/libcrypto/mlkem/mlkem_tests_util.h
+++ b/src/regress/lib/libcrypto/mlkem/mlkem_tests_util.h
@@ -1,4 +1,4 @@
-/*      $OpenBSD: mlkem_tests_util.h,v 1.4 2024/12/26 00:04:24 tb Exp $ */
+/*      $OpenBSD: mlkem_tests_util.h,v 1.9 2025/08/15 14:47:54 tb Exp $ */
 /*
  * Copyright (c) 2024 Bob Beck <beck@obtuse.com>
  * Copyright (c) 2024 Theo Buehler <tb@openbsd.org>
@@ -22,68 +22,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include "bytestring.h"
-
-#include "mlkem.h"
-#include "mlkem_internal.h"
-
 int compare_data(const uint8_t *want, const uint8_t *got, size_t len,
     const char *msg);
 
-int mlkem768_encode_private_key(const void *priv, uint8_t **out_buf,
-    size_t *out_len);
-int mlkem768_encode_public_key(const void *pub, uint8_t **out_buf,
-    size_t *out_len);
-int mlkem1024_encode_private_key(const void *priv, uint8_t **out_buf,
-    size_t *out_len);
-int mlkem1024_encode_public_key(const void *pub, uint8_t **out_buf,
-    size_t *out_len);
-
-int mlkem768_decap(uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
-    const uint8_t *ciphertext, size_t ciphertext_len, const void *priv);
-void mlkem768_encap(uint8_t *out_ciphertext,
-    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES], const void *pub);
-void mlkem768_encap_external_entropy(uint8_t *out_ciphertext,
-    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES], const void *pub,
-    const uint8_t entropy[MLKEM_ENCAP_ENTROPY]);
-void mlkem768_generate_key(uint8_t *out_encoded_public_key,
-    uint8_t optional_out_seed[MLKEM_SEED_BYTES], void *out_private_key);
-void mlkem768_generate_key_external_entropy(uint8_t *out_encoded_public_key,
-    void *out_private_key, const uint8_t entropy[MLKEM_SEED_BYTES]);
-int mlkem768_parse_private_key(void *priv, CBS *private_key_cbs);
-int mlkem768_parse_public_key(void *pub, CBS *in);
-void mlkem768_public_from_private(void *out_public_key, const void *private_key);
-
-int mlkem1024_decap(uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES],
-    const uint8_t *ciphertext, size_t ciphertext_len, const void *priv);
-void mlkem1024_encap(uint8_t *out_ciphertext,
-    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES], const void *pub);
-void mlkem1024_encap_external_entropy(uint8_t *out_ciphertext,
-    uint8_t out_shared_secret[MLKEM_SHARED_SECRET_BYTES], const void *pub,
-    const uint8_t entropy[MLKEM_ENCAP_ENTROPY]);
-void mlkem1024_generate_key(uint8_t *out_encoded_public_key,
-    uint8_t optional_out_seed[MLKEM_SEED_BYTES], void *out_private_key);
-void mlkem1024_generate_key_external_entropy(uint8_t *out_encoded_public_key,
-    void *out_private_key, const uint8_t entropy[MLKEM_SEED_BYTES]);
-int mlkem1024_parse_private_key(void *priv, CBS *private_key_cbs);
-int mlkem1024_parse_public_key(void *pub, CBS *in);
-void mlkem1024_public_from_private(void *out_public_key, const void *private_key);
-
-typedef int (*mlkem_encode_private_key_fn)(const void *, uint8_t **, size_t *);
-typedef int (*mlkem_encode_public_key_fn)(const void *, uint8_t **, size_t *);
-typedef int (*mlkem_decap_fn)(uint8_t [MLKEM_SHARED_SECRET_BYTES],
-    const uint8_t *, size_t, const void *);
-typedef void (*mlkem_encap_fn)(uint8_t *, uint8_t [MLKEM_SHARED_SECRET_BYTES],
-    const void *);
-typedef void (*mlkem_encap_external_entropy_fn)(uint8_t *,
-    uint8_t [MLKEM_SHARED_SECRET_BYTES], const void *,
-    const uint8_t [MLKEM_ENCAP_ENTROPY]);
-typedef void (*mlkem_generate_key_fn)(uint8_t *, uint8_t *, void *);
-typedef void (*mlkem_generate_key_external_entropy_fn)(uint8_t *, void *,
-    const uint8_t [MLKEM_SEED_BYTES]);
-typedef int (*mlkem_parse_private_key_fn)(void *, CBS *);
-typedef int (*mlkem_parse_public_key_fn)(void *, CBS *);
-typedef void (*mlkem_public_from_private_fn)(void *out_public_key,
-    const void *private_key);
-
 #endif /* MLKEM_TEST_UTIL_H */
diff --git a/src/regress/lib/libcrypto/mlkem/mlkem_unittest.c b/src/regress/lib/libcrypto/mlkem/mlkem_unittest.c
index 23b3d8b261..f802324189 100644
--- a/src/regress/lib/libcrypto/mlkem/mlkem_unittest.c
+++ b/src/regress/lib/libcrypto/mlkem/mlkem_unittest.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: mlkem_unittest.c,v 1.6 2024/12/26 12:35:25 tb Exp $ */
+/*      $OpenBSD: mlkem_unittest.c,v 1.15 2025/08/17 19:26:35 tb Exp $ */
 /*
  * Copyright (c) 2024 Google Inc.
  * Copyright (c) 2024 Bob Beck <beck@obtuse.com>
@@ -22,132 +22,201 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "bytestring.h"
-#include "mlkem.h"
+#include <openssl/mlkem.h>
 
+#include "mlkem_internal.h"
 #include "mlkem_tests_util.h"
 
-struct unittest_ctx {
-        void *priv;
-        void *pub;
-        void *priv2;
-        void *pub2;
-        uint8_t *encoded_public_key;
-        size_t encoded_public_key_len;
-        uint8_t *ciphertext;
-        size_t ciphertext_len;
-        mlkem_decap_fn decap;
-        mlkem_encap_fn encap;
-        mlkem_generate_key_fn generate_key;
-        mlkem_parse_private_key_fn parse_private_key;
-        mlkem_parse_public_key_fn parse_public_key;
-        mlkem_encode_private_key_fn encode_private_key;
-        mlkem_encode_public_key_fn encode_public_key;
-        mlkem_public_from_private_fn public_from_private;
-};
-
 static int
-MlKemUnitTest(struct unittest_ctx *ctx)
+MlKemUnitTest(int rank)
 {
-        uint8_t shared_secret1[MLKEM_SHARED_SECRET_BYTES];
-        uint8_t shared_secret2[MLKEM_SHARED_SECRET_BYTES];
+        MLKEM_private_key *priv = NULL, *priv2 = NULL, *priv3 = NULL;
+        MLKEM_public_key *pub = NULL, *pub2 = NULL, *pub3 = NULL;
+        uint8_t *encoded_public_key = NULL, *ciphertext = NULL,
+            *shared_secret2 = NULL, *shared_secret1 = NULL,
+            *encoded_private_key = NULL, *tmp_buf = NULL, *seed_buf = NULL;
+        size_t encoded_public_key_len, ciphertext_len,
+            encoded_private_key_len, tmp_buf_len;
         uint8_t first_two_bytes[2];
-        uint8_t *encoded_private_key = NULL, *tmp_buf = NULL;
-        size_t encoded_private_key_len, tmp_buf_len;
-        CBS cbs;
+        size_t s_len = 0;
         int failed = 0;
 
-        ctx->generate_key(ctx->encoded_public_key, NULL, ctx->priv);
+        if ((pub = MLKEM_public_key_new(rank)) == NULL) {
+                warnx("public_key_new");
+                failed |= 1;
+        }
+
+        if ((pub2 = MLKEM_public_key_new(rank)) == NULL) {
+                warnx("public_key_new");
+                failed |= 1;
+        }
+
+        if ((priv = MLKEM_private_key_new(rank)) == NULL) {
+                warnx("private_key_new");
+                failed |= 1;
+        }
+
+        if ((priv2 = MLKEM_private_key_new(rank)) == NULL) {
+                warnx("private_key_new");
+                failed |= 1;
+        }
+
+        if (!MLKEM_generate_key(priv, &encoded_public_key,
+            &encoded_public_key_len, &seed_buf, &s_len)) {
+                warnx("generate_key failed");
+                failed |= 1;
+        }
+
+        if (s_len != MLKEM_SEED_LENGTH) {
+                warnx("seed length %zu != %d", s_len, MLKEM_SEED_LENGTH);
+                failed |= 1;
+        }
+
+        if ((priv3 = MLKEM_private_key_new(rank)) == NULL) {
+                warnx("private_key_new");
+                failed |= 1;
+        }
+
+        if ((pub3 = MLKEM_public_key_new(rank)) == NULL) {
+                warnx("public_key_new");
+                failed |= 1;
+        }
 
-        memcpy(first_two_bytes, ctx->encoded_public_key, sizeof(first_two_bytes));
-        memset(ctx->encoded_public_key, 0xff, sizeof(first_two_bytes));
+        if (!MLKEM_private_key_from_seed(priv3, seed_buf, s_len)) {
+                warnx("private_key_from_seed failed");
+                failed |= 1;
+        }
+
+        free(seed_buf);
+        seed_buf = NULL;
 
-        CBS_init(&cbs, ctx->encoded_public_key, ctx->encoded_public_key_len);
+        if (!MLKEM_public_from_private(priv3, pub3)) {
+                warnx("public_from_private");
+                failed |= 1;
+        }
+
+        memcpy(first_two_bytes, encoded_public_key, sizeof(first_two_bytes));
+        memset(encoded_public_key, 0xff, sizeof(first_two_bytes));
 
         /* Parsing should fail because the first coefficient is >= kPrime. */
-        if (ctx->parse_public_key(ctx->pub, &cbs)) {
+        if (MLKEM_parse_public_key(pub, encoded_public_key,
+            encoded_public_key_len)) {
                 warnx("parse_public_key should have failed");
                 failed |= 1;
         }
 
-        memcpy(ctx->encoded_public_key, first_two_bytes, sizeof(first_two_bytes));
-        CBS_init(&cbs, ctx->encoded_public_key, ctx->encoded_public_key_len);
-        if (!ctx->parse_public_key(ctx->pub, &cbs)) {
-                warnx("MLKEM768_parse_public_key");
+        memcpy(encoded_public_key, first_two_bytes, sizeof(first_two_bytes));
+
+        MLKEM_public_key_free(pub);
+        if ((pub = MLKEM_public_key_new(rank)) == NULL) {
+                warnx("public_key_new");
+                failed |= 1;
+        }
+        if (!MLKEM_parse_public_key(pub, encoded_public_key,
+            encoded_public_key_len)) {
+                warnx("MLKEM_parse_public_key");
                 failed |= 1;
         }
 
-        if (CBS_len(&cbs) != 0u) {
-                warnx("CBS_len must be 0");
+        if (!MLKEM_marshal_public_key(pub, &tmp_buf, &tmp_buf_len)) {
+                warnx("marshal_public_key");
+                failed |= 1;
+        }
+        if (encoded_public_key_len != tmp_buf_len) {
+                warnx("encoded public key lengths differ %d != %d",
+                    (int) encoded_public_key_len, (int) tmp_buf_len);
                 failed |= 1;
         }
 
-        if (!ctx->encode_public_key(ctx->pub, &tmp_buf, &tmp_buf_len)) {
-                warnx("encode_public_key");
+        if (compare_data(encoded_public_key, tmp_buf, tmp_buf_len,
+            "encoded public keys") != 0) {
+                warnx("compare_data");
                 failed |= 1;
         }
-        if (ctx->encoded_public_key_len != tmp_buf_len) {
-                warnx("encoded public key lengths differ");
+        free(tmp_buf);
+        tmp_buf = NULL;
+        tmp_buf_len = 0;
+
+        if (!MLKEM_marshal_public_key(pub3, &tmp_buf, &tmp_buf_len)) {
+                warnx("marshal_public_key");
+                failed |= 1;
+        }
+        if (encoded_public_key_len != tmp_buf_len) {
+                warnx("encoded public key lengths differ %d != %d",
+                    (int) encoded_public_key_len, (int) tmp_buf_len);
                 failed |= 1;
         }
 
-        if (compare_data(ctx->encoded_public_key, tmp_buf, tmp_buf_len,
+        if (compare_data(encoded_public_key, tmp_buf, tmp_buf_len,
             "encoded public keys") != 0) {
                 warnx("compare_data");
                 failed |= 1;
         }
         free(tmp_buf);
         tmp_buf = NULL;
+        tmp_buf_len = 0;
 
-        ctx->public_from_private(ctx->pub2, ctx->priv);
-        if (!ctx->encode_public_key(ctx->pub2, &tmp_buf, &tmp_buf_len)) {
-                warnx("encode_public_key");
+        if (!MLKEM_public_from_private(priv, pub2)) {
+                warnx("public_from_private");
+                failed |= 1;
+        }
+        if (!MLKEM_marshal_public_key(pub2, &tmp_buf, &tmp_buf_len)) {
+                warnx("marshal_public_key");
                 failed |= 1;
         }
-        if (ctx->encoded_public_key_len != tmp_buf_len) {
-                warnx("encoded public key lengths differ");
+        if (encoded_public_key_len != tmp_buf_len) {
+                warnx("encoded public key lengths differ %d %d",
+                    (int) encoded_public_key_len, (int) tmp_buf_len);
                 failed |= 1;
         }
 
-        if (compare_data(ctx->encoded_public_key, tmp_buf, tmp_buf_len,
+        if (compare_data(encoded_public_key, tmp_buf, tmp_buf_len,
             "encoded public keys") != 0) {
                 warnx("compare_data");
                 failed |= 1;
         }
         free(tmp_buf);
         tmp_buf = NULL;
+        tmp_buf_len = 0;
 
-        if (!ctx->encode_private_key(ctx->priv, &encoded_private_key,
+        if (!MLKEM_marshal_private_key(priv, &encoded_private_key,
             &encoded_private_key_len)) {
-                warnx("mlkem768_encode_private_key");
+                warnx("marshal_private_key");
                 failed |= 1;
         }
 
         memcpy(first_two_bytes, encoded_private_key, sizeof(first_two_bytes));
         memset(encoded_private_key, 0xff, sizeof(first_two_bytes));
-        CBS_init(&cbs, encoded_private_key, encoded_private_key_len);
 
         /*  Parsing should fail because the first coefficient is >= kPrime. */
-        if (ctx->parse_private_key(ctx->priv2, &cbs)) {
-                warnx("MLKEM768_parse_private_key should have failed");
+        if (MLKEM_parse_private_key(priv2, encoded_private_key,
+            encoded_private_key_len)) {
+                warnx("parse_private_key should have failed");
                 failed |= 1;
         }
 
         memcpy(encoded_private_key, first_two_bytes, sizeof(first_two_bytes));
-        CBS_init(&cbs, encoded_private_key, encoded_private_key_len);
 
-        if (!ctx->parse_private_key(ctx->priv2, &cbs)) {
-                warnx("MLKEM768_parse_private_key");
+        MLKEM_private_key_free(priv2);
+        priv2 = NULL;
+
+        if ((priv2 = MLKEM_private_key_new(rank)) == NULL) {
+                warnx("private_key_new");
+                failed |= 1;
+        }
+        if (!MLKEM_parse_private_key(priv2, encoded_private_key,
+            encoded_private_key_len)) {
+                warnx("parse_private_key");
                 failed |= 1;
         }
 
-        if (!ctx->encode_private_key(ctx->priv2, &tmp_buf, &tmp_buf_len)) {
-                warnx("encode_private_key");
+        if (!MLKEM_marshal_private_key(priv2, &tmp_buf, &tmp_buf_len)) {
+                warnx("marshal_private_key");
                 failed |= 1;
         }
 
         if (encoded_private_key_len != tmp_buf_len) {
-                warnx("encode private key lengths differ");
+                warnx("encoded private key lengths differ");
                 failed |= 1;
         }
 
@@ -160,100 +229,79 @@ MlKemUnitTest(struct unittest_ctx *ctx)
         free(tmp_buf);
         tmp_buf = NULL;
 
-        ctx->encap(ctx->ciphertext, shared_secret1, ctx->pub);
-        ctx->decap(shared_secret2, ctx->ciphertext, ctx->ciphertext_len,
-            ctx->priv);
-        if (compare_data(shared_secret1, shared_secret2, MLKEM_SHARED_SECRET_BYTES,
+        if (!MLKEM_encap(pub, &ciphertext, &ciphertext_len, &shared_secret1,
+            &s_len)) {
+                warnx("encap failed using pub");
+                failed |= 1;
+        }
+
+        if (s_len != MLKEM_SHARED_SECRET_LENGTH) {
+                warnx("seed length %zu != %d", s_len,
+                    MLKEM_SHARED_SECRET_LENGTH);
+                failed |= 1;
+        }
+
+        if (!MLKEM_decap(priv, ciphertext, ciphertext_len,
+            &shared_secret2, &s_len)) {
+                warnx("decap() failed using priv");
+                failed |= 1;
+        }
+
+        if (s_len != MLKEM_SHARED_SECRET_LENGTH) {
+                warnx("seed length %zu != %d", s_len,
+                    MLKEM_SHARED_SECRET_LENGTH);
+                failed |= 1;
+        }
+
+        if (compare_data(shared_secret1, shared_secret2, s_len,
             "shared secrets with priv") != 0) {
                 warnx("compare_data");
                 failed |= 1;
         }
 
-        ctx->decap(shared_secret2, ctx->ciphertext, ctx->ciphertext_len,
-            ctx->priv2);
-        if (compare_data(shared_secret1, shared_secret2, MLKEM_SHARED_SECRET_BYTES,
+        free(shared_secret2);
+        shared_secret2 = NULL;
+
+        if (!MLKEM_decap(priv2, ciphertext, ciphertext_len,
+            &shared_secret2, &s_len)){
+                warnx("decap() failed using priv2");
+                failed |= 1;
+        }
+
+        if (s_len != MLKEM_SHARED_SECRET_LENGTH) {
+                warnx("seed length %zu != %d", s_len,
+                    MLKEM_SHARED_SECRET_LENGTH);
+                failed |= 1;
+        }
+
+        if (compare_data(shared_secret1, shared_secret2, s_len,
             "shared secrets with priv2") != 0) {
                 warnx("compare_data");
                 failed |= 1;
         }
 
+        MLKEM_public_key_free(pub);
+        MLKEM_public_key_free(pub2);
+        MLKEM_public_key_free(pub3);
+        MLKEM_private_key_free(priv);
+        MLKEM_private_key_free(priv2);
+        MLKEM_private_key_free(priv3);
+        free(encoded_public_key);
+        free(ciphertext);
         free(encoded_private_key);
+        free(shared_secret1);
+        free(shared_secret2);
 
         return failed;
 }
 
-static int
-mlkem768_unittest(void)
-{
-        struct MLKEM768_private_key mlkem768_priv, mlkem768_priv2;
-        struct MLKEM768_public_key mlkem768_pub, mlkem768_pub2;
-        uint8_t mlkem768_encoded_public_key[MLKEM768_PUBLIC_KEY_BYTES];
-        uint8_t mlkem768_ciphertext[MLKEM768_CIPHERTEXT_BYTES];
-        struct unittest_ctx mlkem768_test = {
-                .priv = &mlkem768_priv,
-                .pub = &mlkem768_pub,
-                .priv2 = &mlkem768_priv2,
-                .pub2 = &mlkem768_pub2,
-                .encoded_public_key = mlkem768_encoded_public_key,
-                .encoded_public_key_len = sizeof(mlkem768_encoded_public_key),
-                .ciphertext = mlkem768_ciphertext,
-                .ciphertext_len = sizeof(mlkem768_ciphertext),
-                .decap = mlkem768_decap,
-                .encap = mlkem768_encap,
-                .generate_key = mlkem768_generate_key,
-                .parse_private_key = mlkem768_parse_private_key,
-                .parse_public_key = mlkem768_parse_public_key,
-                .encode_private_key = mlkem768_encode_private_key,
-                .encode_public_key = mlkem768_encode_public_key,
-                .public_from_private = mlkem768_public_from_private,
-        };
-
-        return MlKemUnitTest(&mlkem768_test);
-}
-
-static int
-mlkem1024_unittest(void)
-{
-        struct MLKEM1024_private_key mlkem1024_priv, mlkem1024_priv2;
-        struct MLKEM1024_public_key mlkem1024_pub, mlkem1024_pub2;
-        uint8_t mlkem1024_encoded_public_key[MLKEM1024_PUBLIC_KEY_BYTES];
-        uint8_t mlkem1024_ciphertext[MLKEM1024_CIPHERTEXT_BYTES];
-        struct unittest_ctx mlkem1024_test = {
-                .priv = &mlkem1024_priv,
-                .pub = &mlkem1024_pub,
-                .priv2 = &mlkem1024_priv2,
-                .pub2 = &mlkem1024_pub2,
-                .encoded_public_key = mlkem1024_encoded_public_key,
-                .encoded_public_key_len = sizeof(mlkem1024_encoded_public_key),
-                .ciphertext = mlkem1024_ciphertext,
-                .ciphertext_len = sizeof(mlkem1024_ciphertext),
-                .decap = mlkem1024_decap,
-                .encap = mlkem1024_encap,
-                .generate_key = mlkem1024_generate_key,
-                .parse_private_key = mlkem1024_parse_private_key,
-                .parse_public_key = mlkem1024_parse_public_key,
-                .encode_private_key = mlkem1024_encode_private_key,
-                .encode_public_key = mlkem1024_encode_public_key,
-                .public_from_private = mlkem1024_public_from_private,
-        };
-
-        return MlKemUnitTest(&mlkem1024_test);
-}
-
 int
 main(void)
 {
         int failed = 0;
 
-        /*
-         * XXX - this is split into two helper functions since having a few
-         * ML-KEM key blobs on the stack makes Emscripten's stack explode,
-         * leading to inscrutable silent failures unles ASAN is enabled.
-         * Go figure.
-         */
-
-        failed |= mlkem768_unittest();
-        failed |= mlkem1024_unittest();
+        failed |= MlKemUnitTest(RANK768);
+        failed |= MlKemUnitTest(RANK1024);
 
         return failed;
 }
diff --git a/src/regress/lib/libcrypto/mlkem/parse_test_file.c b/src/regress/lib/libcrypto/mlkem/parse_test_file.c
index 19f03439e2..9f3e5f3a1a 100644
--- a/src/regress/lib/libcrypto/mlkem/parse_test_file.c
+++ b/src/regress/lib/libcrypto/mlkem/parse_test_file.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: parse_test_file.c,v 1.3 2024/12/27 11:17:48 tb Exp $ */
+/*      $OpenBSD: parse_test_file.c,v 1.6 2025/06/03 10:29:37 tb Exp $ */
 
 /*
  * Copyright (c) 2024 Theo Buehler <tb@openbsd.org>
@@ -47,6 +47,8 @@ static void
 line_data_clear(struct line_data *ld)
 {
         freezero(ld->data, ld->data_len);
+        /* The dereference isn't enough for silly old gcc 14. */
+        assert(ld != NULL);
         explicit_bzero(ld, sizeof(*ld));
 }
 
@@ -644,7 +646,8 @@ parse_reinit(struct parse *p)
         p->state.running_test_case = 0;
         parse_line_data_clear(p);
         tctx->finish(p->ctx);
-        tctx->init(p->ctx, p);
+        if (!tctx->init(p->ctx, p))
+                parse_errx(p, "init failed");
 }
 
 static int
@@ -706,7 +709,8 @@ parse_init(struct parse *p, const char *fn, const struct test_parse *tctx,
         parse_state_init(&p->state, tctx->num_states, tctx->num_instructions);
         p->tctx = tctx;
         p->ctx = ctx;
-        tctx->init(ctx, p);
+        if (!tctx->init(p->ctx, p))
+                parse_errx(p, "init failed");
 }
 
 static int
@@ -732,7 +736,10 @@ parse_next_line(struct parse *p)
 static void
 parse_finish(struct parse *p)
 {
+        const struct test_parse *tctx = p->tctx;
+
         parse_state_finish(&p->state);
+        tctx->finish(p->ctx);
 
         free(p->buf);
 
diff --git a/src/regress/lib/libcrypto/rsa/rsa_method_test.c b/src/regress/lib/libcrypto/rsa/rsa_method_test.c
index d9c1cc4f9a..9d0a4c3592 100644
--- a/src/regress/lib/libcrypto/rsa/rsa_method_test.c
+++ b/src/regress/lib/libcrypto/rsa/rsa_method_test.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: rsa_method_test.c,v 1.5 2025/01/05 18:21:36 tb Exp $ */
+/*      $OpenBSD: rsa_method_test.c,v 1.6 2025/08/26 05:07:50 tb Exp $ */
 
 /*
  * Copyright (c) 2025 Theo Buehler <tb@openbsd.org>
@@ -221,7 +221,7 @@ sign_and_verify_test(void)
                 errx(1, "%s: RSA_set_ex_data", __func__);
 
         if ((sign_verify_method = RSA_meth_dup(RSA_get_default_method())) == NULL)
-                errx(1, "%s: RSA_get_default_method", __func__);
+                errx(1, "%s: RSA_meth_dup", __func__);
         if (!RSA_meth_set0_app_data(sign_verify_method, rsa_priv))
                 errx(1, "%s: RSA_meth_set0_app_data", __func__);
 
diff --git a/src/regress/lib/libcrypto/sha/Makefile b/src/regress/lib/libcrypto/sha/Makefile
index 6ec223116d..c6ab0398ba 100644
--- a/src/regress/lib/libcrypto/sha/Makefile
+++ b/src/regress/lib/libcrypto/sha/Makefile
@@ -1,9 +1,15 @@
-#       $OpenBSD: Makefile,v 1.5 2022/09/01 14:02:41 tb Exp $
+#       $OpenBSD: Makefile,v 1.6 2025/05/22 03:35:40 joshua Exp $
 
 PROG =          sha_test
 LDADD =         -lcrypto
 DPADD =         ${LIBCRYPTO}
 WARNINGS =      Yes
 CFLAGS +=       -DLIBRESSL_INTERNAL -Werror
+CFLAGS +=       -I${.CURDIR}/../test
+SRCS +=         sha_test.c
+SRCS +=         test.c
+SRCS +=         test_util.c
+
+.PATH: ${.CURDIR}/../test
 
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libcrypto/sha/sha_test.c b/src/regress/lib/libcrypto/sha/sha_test.c
index 82a0c4cceb..904924c890 100644
--- a/src/regress/lib/libcrypto/sha/sha_test.c
+++ b/src/regress/lib/libcrypto/sha/sha_test.c
@@ -1,6 +1,6 @@
-/*      $OpenBSD: sha_test.c,v 1.6 2023/07/19 15:11:42 joshua Exp $ */
+/*      $OpenBSD: sha_test.c,v 1.7 2025/05/22 03:35:40 joshua Exp $ */
 /*
- * Copyright (c) 2022, 2023 Joshua Sing <joshua@hypera.dev>
+ * Copyright (c) 2022, 2023, 2025 Joshua Sing <joshua@joshuasing.dev>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -21,6 +21,8 @@
 #include <stdint.h>
 #include <string.h>
 
+#include "test.h"
+
 struct sha_test {
         const int algorithm;
         const uint8_t in[128];
@@ -677,260 +679,240 @@ typedef unsigned char *(*sha_hash_func)(const unsigned char *, size_t,
     unsigned char *);
 
 static int
-sha_hash_from_algorithm(int algorithm, const char **out_label,
-    sha_hash_func *out_func, const EVP_MD **out_md, size_t *out_len)
+sha_hash_from_algorithm(int algorithm, sha_hash_func *out_func,
+    const EVP_MD **out_md)
 {
-        const char *label;
         sha_hash_func sha_func;
         const EVP_MD *md;
-        size_t len;
 
         switch (algorithm) {
         case NID_sha1:
-                label = SN_sha1;
                 sha_func = SHA1;
                 md = EVP_sha1();
-                len = SHA_DIGEST_LENGTH;
                 break;
         case NID_sha224:
-                label = SN_sha224;
                 sha_func = SHA224;
                 md = EVP_sha224();
-                len = SHA224_DIGEST_LENGTH;
                 break;
         case NID_sha256:
-                label = SN_sha256;
                 sha_func = SHA256;
                 md = EVP_sha256();
-                len = SHA256_DIGEST_LENGTH;
                 break;
         case NID_sha384:
-                label = SN_sha384;
                 sha_func = SHA384;
                 md = EVP_sha384();
-                len = SHA384_DIGEST_LENGTH;
                 break;
         case NID_sha512:
-                label = SN_sha512;
                 sha_func = SHA512;
                 md = EVP_sha512();
-                len = SHA512_DIGEST_LENGTH;
                 break;
         case NID_sha3_224:
-                label = SN_sha3_224;
                 sha_func = NULL;
                 md = EVP_sha3_224();
-                len = 224 / 8;
                 break;
         case NID_sha3_256:
-                label = SN_sha3_256;
                 sha_func = NULL;
                 md = EVP_sha3_256();
-                len = 256 / 8;
                 break;
         case NID_sha3_384:
-                label = SN_sha3_384;
                 sha_func = NULL;
                 md = EVP_sha3_384();
-                len = 384 / 8;
                 break;
         case NID_sha3_512:
-                label = SN_sha3_512;
                 sha_func = NULL;
                 md = EVP_sha3_512();
-                len = 512 / 8;
                 break;
         default:
-                fprintf(stderr, "FAIL: unknown algorithm (%d)\n",
-                    algorithm);
                 return 0;
         }
 
-        if (out_label != NULL)
-                *out_label = label;
         if (out_func != NULL)
                 *out_func = sha_func;
         if (out_md != NULL)
                 *out_md = md;
-        if (out_len != NULL)
-                *out_len = len;
 
         return 1;
 }
 
-static int
-sha_test(void)
+static void
+test_sha_tv(struct test *t, const void *arg)
 {
+        const struct sha_test *st = arg;
         sha_hash_func sha_func;
-        const struct sha_test *st;
         EVP_MD_CTX *hash = NULL;
         const EVP_MD *md;
         uint8_t out[EVP_MAX_MD_SIZE];
         size_t in_len, out_len;
-        size_t i;
-        const char *label;
-        int failed = 1;
 
         if ((hash = EVP_MD_CTX_new()) == NULL) {
-                fprintf(stderr, "FAIL: EVP_MD_CTX_new() failed\n");
-                goto failed;
+                test_errorf(t, "EVP_MD_CTX_new()");
+                goto fail;
         }
 
-        for (i = 0; i < N_SHA_TESTS; i++) {
-                st = &sha_tests[i];
-                if (!sha_hash_from_algorithm(st->algorithm, &label, &sha_func,
-                    &md, &out_len))
-                        goto failed;
-
-                /* Digest */
-                if (sha_func != NULL) {
-                        memset(out, 0, sizeof(out));
-                        sha_func(st->in, st->in_len, out);
-                        if (memcmp(st->out, out, out_len) != 0) {
-                                fprintf(stderr, "FAIL (%s:%zu): mismatch\n",
-                                    label, i);
-                                goto failed;
-                        }
-                }
+        if (!sha_hash_from_algorithm(st->algorithm, &sha_func, &md))
+                goto fail;
 
-                /* EVP single-shot digest */
-                memset(out, 0, sizeof(out));
-                if (!EVP_Digest(st->in, st->in_len, out, NULL, md, NULL)) {
-                        fprintf(stderr, "FAIL (%s:%zu): EVP_Digest failed\n",
-                            label, i);
-                        goto failed;
-                }
+        out_len = EVP_MD_size(md);
 
+        /* Digest */
+        if (sha_func != NULL) {
+                memset(out, 0, sizeof(out));
+                sha_func(st->in, st->in_len, out);
                 if (memcmp(st->out, out, out_len) != 0) {
-                        fprintf(stderr,
-                            "FAIL (%s:%zu): EVP single-shot mismatch\n",
-                            label, i);
-                        goto failed;
+                        test_errorf(t, "SHA: digest output mismatch");
+                        test_hexdiff(t, out, out_len, st->out);
                 }
+        }
 
-                /* EVP digest */
-                memset(out, 0, sizeof(out));
-                if (!EVP_DigestInit_ex(hash, md, NULL)) {
-                        fprintf(stderr,
-                            "FAIL (%s:%zu): EVP_DigestInit_ex failed\n",
-                            label, i);
-                        goto failed;
-                }
+        /* EVP single-shot digest */
+        memset(out, 0, sizeof(out));
+        if (!EVP_Digest(st->in, st->in_len, out, NULL, md, NULL)) {
+                test_errorf(t, "EVP_Digest()");
+                goto fail;
+        }
 
-                in_len = st->in_len / 2;
-                if (!EVP_DigestUpdate(hash, st->in, in_len)) {
-                        fprintf(stderr,
-                            "FAIL (%s:%zu): EVP_DigestUpdate first half "
-                            "failed\n", label, i);
-                        goto failed;
-                }
+        if (memcmp(st->out, out, out_len) != 0) {
+                test_errorf(t, "EVP single-shot: output diget mismatch");
+                test_hexdiff(t, out, out_len, st->out);
+        }
 
-                if (!EVP_DigestUpdate(hash, st->in + in_len,
-                    st->in_len - in_len)) {
-                        fprintf(stderr,
-                            "FAIL (%s:%zu): EVP_DigestUpdate second half "
-                            "failed\n", label, i);
-                        goto failed;
-                }
+        /* EVP digest */
+        memset(out, 0, sizeof(out));
+        if (!EVP_DigestInit_ex(hash, md, NULL)) {
+                test_errorf(t, "EVP_DigestInit_ex() ");
+                goto fail;
+        }
 
-                if (!EVP_DigestFinal_ex(hash, out, NULL)) {
-                        fprintf(stderr,
-                            "FAIL (%s:%zu): EVP_DigestFinal_ex failed\n",
-                            label, i);
-                        goto failed;
-                }
+        in_len = st->in_len / 2;
+        if (!EVP_DigestUpdate(hash, st->in, in_len)) {
+                test_errorf(t, "EVP_DigestUpdate() first half");
+                goto fail;
+        }
 
-                if (memcmp(st->out, out, out_len) != 0) {
-                        fprintf(stderr, "FAIL (%s:%zu): EVP mismatch\n",
-                            label, i);
-                        goto failed;
-                }
+        if (!EVP_DigestUpdate(hash, st->in + in_len,
+            st->in_len - in_len)) {
+                test_errorf(t, "EVP_DigestUpdate() second half");
+                goto fail;
         }
 
-        failed = 0;
+        if (!EVP_DigestFinal_ex(hash, out, NULL)) {
+                test_errorf(t, "EVP_DigestFinal_ex()");
+                goto fail;
+        }
 
- failed:
+        if (memcmp(st->out, out, out_len) != 0) {
+                test_errorf(t, "EVP: digest output mismatch");
+                test_hexdiff(t, out, out_len, st->out);
+        }
+
+
+ fail:
         EVP_MD_CTX_free(hash);
-        return failed;
 }
 
-static int
-sha_repetition_test(void)
+static void
+test_sha(struct test *t, const void *arg)
 {
-        const struct sha_repetition_test *st;
+        const struct sha_test *st;
+        size_t i;
+        char *name;
+
+        for (i = 0; i < N_SHA_TESTS; i++) {
+                st = &sha_tests[i];
+                if (asprintf(&name, "%s: '%s'", OBJ_nid2sn(st->algorithm), st->in) == -1) {
+                        test_errorf(t, "create test name failed");
+                        return;
+                }
+
+                test_run(t, name, test_sha_tv, st);
+                free(name);
+        }
+}
+
+static void
+test_sha_repetition_tv(struct test *t, const void *arg)
+{
+        const struct sha_repetition_test *st = arg;
         EVP_MD_CTX *hash = NULL;
         const EVP_MD *md;
         uint8_t buf[1024];
         uint8_t out[EVP_MAX_MD_SIZE];
         size_t out_len, part_len;
-        size_t i, j;
-        const char *label;
-        int failed = 1;
+        size_t i;
 
         if ((hash = EVP_MD_CTX_new()) == NULL) {
-                fprintf(stderr, "FAIL: EVP_MD_CTX_new() failed\n");
-                goto failed;
+                test_errorf(t, "EVP_MD_CTX_new()");
+                goto fail;
         }
 
-        for (i = 0; i < N_SHA_REPETITION_TESTS; i++) {
-                st = &sha_repetition_tests[i];
-                if (!sha_hash_from_algorithm(st->algorithm, &label, NULL, &md,
-                    &out_len))
-                        goto failed;
-
-                /* EVP digest */
-                if (!EVP_DigestInit_ex(hash, md, NULL)) {
-                        fprintf(stderr,
-                            "FAIL (%s:%zu): EVP_DigestInit_ex failed\n",
-                            label, i);
-                        goto failed;
-                }
+        if (!sha_hash_from_algorithm(st->algorithm, NULL, &md))
+                goto fail;
 
-                memset(buf, st->in, sizeof(buf));
+        out_len = EVP_MD_size(md);
 
-                for (j = 0; j < st->in_repetitions;) {
-                        part_len = arc4random_uniform(sizeof(buf));
-                        if (part_len > st->in_repetitions - j)
-                                part_len = st->in_repetitions - j;
+        /* EVP digest */
+        if (!EVP_DigestInit_ex(hash, md, NULL)) {
+                test_errorf(t, "EVP_DigestInit_ex()");
+                goto fail;
+        }
 
-                        if (!EVP_DigestUpdate(hash, buf, part_len)) {
-                                fprintf(stderr,
-                                    "FAIL (%s:%zu): EVP_DigestUpdate failed\n",
-                                    label, i);
-                                goto failed;
-                        }
+        memset(buf, st->in, sizeof(buf));
 
-                        j += part_len;
-                }
+        for (i = 0; i < st->in_repetitions;) {
+                part_len = arc4random_uniform(sizeof(buf));
+                if (part_len > st->in_repetitions - i)
+                        part_len = st->in_repetitions - i;
 
-                if (!EVP_DigestFinal_ex(hash, out, NULL)) {
-                        fprintf(stderr,
-                            "FAIL (%s:%zu): EVP_DigestFinal_ex failed\n",
-                            label, i);
-                        goto failed;
+                if (!EVP_DigestUpdate(hash, buf, part_len)) {
+                        test_errorf(t, "EVP_DigestUpdate()");
+                        goto fail;
                 }
 
-                if (memcmp(st->out, out, out_len) != 0) {
-                        fprintf(stderr, "FAIL (%s:%zu): EVP mismatch\n",
-                            label, i);
-                        goto failed;
-                }
+                i += part_len;
+        }
+
+        if (!EVP_DigestFinal_ex(hash, out, NULL)) {
+                test_errorf(t, "EVP_DigestFinal_ex()");
+                goto fail;
         }
 
-        failed = 0;
+        if (memcmp(st->out, out, out_len) != 0) {
+                test_errorf(t, "EVP: digest output mismatch");
+                test_hexdiff(t, out, out_len, st->out);
+                goto fail;
+        }
 
- failed:
+ fail:
         EVP_MD_CTX_free(hash);
-        return failed;
+}
+
+static void
+test_sha_repetition(struct test *t, const void *arg)
+{
+        const struct sha_repetition_test *st;
+        size_t i;
+        char *name;
+
+        for (i = 0; i < N_SHA_REPETITION_TESTS; i++) {
+                st = &sha_repetition_tests[i];
+                if (asprintf(&name, "%s: '%hhu' x %zu", OBJ_nid2sn(st->algorithm),
+                    st->in, st->in_repetitions) == -1) {
+                        test_errorf(t, "create test name failed");
+                        return;
+                }
+
+                test_run(t, name, test_sha_repetition_tv, st);
+                free(name);
+        }
 }
 
 int
 main(int argc, char **argv)
 {
-        int failed = 0;
+        struct test *t = test_init();
 
-        failed |= sha_test();
-        failed |= sha_repetition_test();
+        test_run(t, "sha", test_sha, NULL);
+        test_run(t, "sha repetition", test_sha_repetition, NULL);
 
-        return failed;
+        return test_result(t);
 }
diff --git a/src/regress/lib/libcrypto/symbols/symbols.awk b/src/regress/lib/libcrypto/symbols/symbols.awk
index 8ea68b681e..253658e7a0 100644
--- a/src/regress/lib/libcrypto/symbols/symbols.awk
+++ b/src/regress/lib/libcrypto/symbols/symbols.awk
@@ -1,4 +1,4 @@
-# $OpenBSD: symbols.awk,v 1.13 2024/09/01 17:20:37 tb Exp $
+# $OpenBSD: symbols.awk,v 1.15 2025/08/22 15:52:34 tb Exp $
 
 # Copyright (c) 2018,2020 Theo Buehler <tb@openbsd.org>
 #
@@ -26,7 +26,7 @@ BEGIN {
         # Undefine aliases, so we don't accidentally leave them in Symbols.list.
         printf("#ifdef %s\n#undef %s\n#endif\n", $0, $0)
 
-        printf("static typeof(%s) *_libre_%s;\n", $0, $0);
+        printf("extern typeof(%s) *_libre_%s;\n", $0, $0);
 }
 
 END {
@@ -51,8 +51,12 @@ END {
 
         printf("\t\};\n\n")
 
-        printf("\tfor (i = 0; i < sizeof(symbols) / sizeof(symbols[0]); i++)\n")
+        printf("\tfor (i = 0; i < sizeof(symbols) / sizeof(symbols[0]); i++) {\n")
         printf("\t\tfprintf(stderr, \"%%s: %%p\\n\", symbols[i].name, symbols[i].addr);\n")
+        printf("#if defined(USE_LIBRESSL_NAMESPACE)\n")
+        printf("\t\tfprintf(stderr, \"_libre_%%s: %%p\\n\", symbols[i].name, symbols[i].libre_addr);\n")
+        printf("#endif\n")
+        printf("\t}\n")
         printf("\n\tprintf(\"OK\\n\");\n")
         printf("\n\treturn 0;\n}\n")
 }
diff --git a/src/regress/lib/libcrypto/test/test.c b/src/regress/lib/libcrypto/test/test.c
new file mode 100644
index 0000000000..1188ec34ef
--- /dev/null
+++ b/src/regress/lib/libcrypto/test/test.c
@@ -0,0 +1,226 @@
+/*      $OpenBSD: test.c,v 1.4 2025/05/31 11:36:48 tb Exp $ */
+/*
+ * Copyright (c) 2025 Joshua Sing <joshua@joshuasing.dev>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <err.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include "test.h"
+
+struct test {
+        struct test *parent;
+        char *name;
+        FILE *out;
+        int skipped;
+        int failed;
+};
+
+static struct test *
+test_new(struct test *pt, const char *name)
+{
+        struct test *t;
+
+        if ((t = calloc(1, sizeof(*t))) == NULL)
+                err(1, "calloc");
+
+        if (name != NULL) {
+                if ((t->name = strdup(name)) == NULL)
+                        err(1, "strdup");
+        }
+
+        if (pt != NULL)
+                t->out = pt->out;
+        t->parent = pt;
+
+        return t;
+}
+
+struct test *
+test_init(void)
+{
+        struct test *t;
+        char *tmp_file;
+        int out_fd;
+        char *v;
+
+        t = test_new(NULL, NULL);
+        t->out = stderr;
+
+        if (((v = getenv("TEST_VERBOSE")) != NULL) && strcmp(v, "0") != 0)
+                return t;
+
+        /* Create a temporary file for logging in non-verbose mode */
+        if ((tmp_file = strdup("/tmp/libressl-test.XXXXXXXX")) == NULL)
+                err(1, "strdup");
+        if ((out_fd = mkstemp(tmp_file)) == -1)
+                err(1, "mkstemp");
+
+        unlink(tmp_file);
+        free(tmp_file);
+        if ((t->out = fdopen(out_fd, "w+")) == NULL)
+                err(1, "fdopen");
+
+        return t;
+}
+
+static void
+test_cleanup(struct test *t)
+{
+        free(t->name);
+        free(t);
+}
+
+int
+test_result(struct test *t)
+{
+        int failed = t->failed;
+
+        if (t->parent == NULL && t->out != stderr)
+                fclose(t->out);
+
+        test_cleanup(t);
+
+        return failed;
+}
+
+void
+test_fail(struct test *t)
+{
+        t->failed = 1;
+
+        /* Also fail parent. */
+        if (t->parent != NULL)
+                test_fail(t->parent);
+}
+
+static void
+test_vprintf(struct test *t, const char *fmt, va_list ap)
+{
+        if (vfprintf(t->out, fmt, ap) == -1)
+                err(1, "vfprintf");
+}
+
+void
+test_printf(struct test *t, const char *fmt, ...)
+{
+        va_list ap;
+
+        va_start(ap, fmt);
+        test_vprintf(t, fmt, ap);
+        va_end(ap);
+}
+
+static void
+test_vlogf_internal(struct test *t, const char *label, const char *func,
+    const char *file, int line, const char *fmt, va_list ap)
+{
+        char *msg = NULL;
+        char *l = ": ";
+        const char *filename;
+
+        if (label == NULL) {
+                label = "";
+                l = "";
+        }
+
+        if (vasprintf(&msg, fmt, ap) == -1)
+                err(1, "vasprintf");
+
+        if ((filename = strrchr(file, '/')) != NULL)
+                filename++;
+        else
+                filename = file;
+
+        test_printf(t, "%s [%s:%d]%s%s: %s\n",
+            func, filename, line, l, label, msg);
+
+        free(msg);
+}
+
+void
+test_logf_internal(struct test *t, const char *label, const char *func,
+    const char *file, int line, const char *fmt, ...)
+{
+        va_list ap;
+
+        va_start(ap, fmt);
+        test_vlogf_internal(t, label, func, file, line, fmt, ap);
+        va_end(ap);
+}
+
+void
+test_skip(struct test *t, const char *reason)
+{
+        t->skipped = 1;
+        test_printf(t, "%s\n", reason);
+}
+
+void
+test_skipf(struct test *t, const char *fmt, ...)
+{
+        va_list ap;
+
+        t->skipped = 1;
+
+        va_start(ap, fmt);
+        test_vprintf(t, fmt, ap);
+        if (fputc('\n', t->out) == EOF)
+                err(1, "fputc");
+        va_end(ap);
+}
+
+void
+test_run(struct test *pt, const char *name, test_run_func *fn, const void *arg)
+{
+        struct test *t = test_new(pt, name);
+        char *status = "PASS";
+        char buf[1024];
+        size_t buflen;
+        int ferr;
+
+        /* Run test */
+        test_printf(t, "=== RUN   %s\n", t->name);
+        fn(t, arg);
+
+        if (t->skipped)
+                status = "SKIP";
+        if (t->failed)
+                status = "FAIL";
+
+        test_printf(t, "--- %s: %s\n\n", status, t->name);
+
+        /* Print result of test */
+        if (t->failed && t->out != stderr) {
+                /* Copy logs to stderr */
+                rewind(t->out);
+                while ((buflen = fread(buf, 1, sizeof(buf), t->out)) > 0)
+                        fwrite(buf, 1, buflen, stderr);
+                if ((ferr = ferror(t->out)) != 0)
+                        errx(1, "ferror: %d", ferr);
+        }
+
+        if (t->out != NULL && t->out != stderr)  {
+                /* Reset output file */
+                rewind(t->out);
+                ftruncate(fileno(t->out), 0);
+        }
+
+        test_cleanup(t);
+}
diff --git a/src/regress/lib/libcrypto/test/test.h b/src/regress/lib/libcrypto/test/test.h
new file mode 100644
index 0000000000..1c8391d4ec
--- /dev/null
+++ b/src/regress/lib/libcrypto/test/test.h
@@ -0,0 +1,137 @@
+/*      $OpenBSD: test.h,v 1.4 2025/05/31 11:37:18 tb Exp $ */
+/*
+ * Copyright (c) 2025 Joshua Sing <joshua@joshuasing.dev>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef HEADER_TEST_H
+#define HEADER_TEST_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+struct test;
+
+/*
+ * test_init creates a new root test struct.
+ *
+ * Additional tests may be run under the root test struct by calling test_run.
+ *
+ * If the TEST_VERBOSE environment variable is set and not equal to "0", then
+ * verbose mode will be enabled and all test logs will be written to stderr.
+ */
+struct test *test_init(void);
+
+/*
+ * test_result cleans up after all tests have completed and returns an
+ * appropriate exit code indicating the result of the tests.
+ */
+int test_result(struct test *_t);
+
+/*
+ * test_run_func is an individual test function. It is passed the test struct
+ * and an arbitrary argument which may be passed when test_run is called.
+ */
+typedef void (test_run_func)(struct test *_t, const void *_arg);
+
+/*
+ * test_fail marks the test and its parents as failed.
+ */
+void test_fail(struct test *_t);
+
+/*
+ * test_printf prints a test log message. When in verbose mode, the log message
+ * will be written to stderr, otherwise it will be buffered and only written to
+ * stderr if the test fails.
+ *
+ * This printf will write directly, without any additional formatting.
+ */
+void test_printf(struct test *_t, const char *_fmt, ...)
+    __attribute__((__format__ (printf, 2, 3)))
+    __attribute__((__nonnull__ (2)));
+
+/*
+ * test_logf_internal prints a test log message. When in verbose mode, the
+ * log message will be written to stderr, otherwise it will be buffered and
+ * only written to stderr if the test fails.
+ *
+ * label is an optional label indicating the severity of the log.
+ * func, file and line are used to show where the log comes from and are
+ * automatically set in the test log macros.
+ *
+ * This function should never be called directly.
+ */
+void test_logf_internal(struct test *_t, const char *_label, const char *_func,
+    const char *_file, int _line, const char *_fmt, ...)
+    __attribute__((__format__ (printf, 6, 7)))
+    __attribute__((__nonnull__ (6)));
+
+/*
+ * test_logf prints an informational log message. When in verbose mode, the log
+ * will be written to stderr, otherwise it will be buffered and only written to
+ * stderr if the test fails.
+ */
+#define test_logf(t, fmt, ...) \
+    do { \
+        test_logf_internal(t, NULL, __func__, __FILE__, __LINE__, fmt, ##__VA_ARGS__); \
+    } while (0)
+
+/*
+ * test_errorf prints an error message. It will also cause the test to fail.
+ * If the test cannot proceed, it is recommended to return or goto a cleanup
+ * label.
+ *
+ * Tests should not fail-fast if continuing will provide more detailed
+ * information about what is broken.
+ */
+#define test_errorf(t, fmt, ...) \
+    do { \
+        test_logf_internal(t, "ERROR", __func__, __FILE__, __LINE__, fmt, ##__VA_ARGS__); \
+        test_fail(t); \
+    } while (0)
+
+/*
+ * test_skip marks the test as skipped. Once called, the test should return.
+ */
+void test_skip(struct test *_t, const char *_reason);
+
+/*
+ * test_skipf marks the test as skipped with a formatted reason. Once called,
+ * the test should return.
+ */
+void test_skipf(struct test *_t, const char *_fmt, ...)
+    __attribute__((__format__ (printf, 2, 3)))
+    __attribute__((__nonnull__ (2)));
+
+/*
+ * test_run runs a test function. It will create a new test struct with the
+ * given test as the parent. An argument may be provided to pass data to the
+ * test function, otherwise NULL should be passed.
+ *
+ * Each test should have a unique and informational name.
+ */
+void test_run(struct test *_t, const char *_name, test_run_func *_fn, const void *_arg);
+
+/*
+ * test_hexdump prints the given data as hexadecimal.
+ */
+void test_hexdump(struct test *_t, const unsigned char *_buf, size_t _len);
+
+/*
+ * test_hexdiff prints the given data as hexadecimal. If a second comparison
+ * buffer is not NULL, any differing bytes will be marked with an astrix.
+ */
+void test_hexdiff(struct test *_t, const uint8_t *_buf, size_t _len, const uint8_t *_compare);
+
+#endif /* HEADER_TEST_H */
diff --git a/src/regress/lib/libcrypto/test/test_util.c b/src/regress/lib/libcrypto/test/test_util.c
new file mode 100644
index 0000000000..6ecb574788
--- /dev/null
+++ b/src/regress/lib/libcrypto/test/test_util.c
@@ -0,0 +1,51 @@
+/*      $OpenBSD: test_util.c,v 1.1 2025/05/21 08:57:13 joshua Exp $ */
+/*
+ * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
+ * Copyright (c) 2024 Theo Buehler <tb@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+
+#include "test.h"
+
+void
+test_hexdump(struct test *t, const unsigned char *buf, size_t len)
+{
+        size_t i;
+
+        for (i = 1; i <= len; i++)
+                test_printf(t, " 0x%02x,%s", buf[i - 1], i % 8 ? "" : "\n");
+
+        if ((len % 8) != 0)
+                test_printf(t, "\n");
+}
+
+void
+test_hexdiff(struct test *t, const uint8_t *buf, size_t len, const uint8_t *compare)
+{
+        const char *mark = "", *newline;
+        size_t i;
+
+        for (i = 1; i <= len; i++) {
+                if (compare != NULL)
+                        mark = (buf[i - 1] != compare[i - 1]) ? "*" : " ";
+                newline = i % 8 ? "" : "\n";
+                test_printf(t, " %s0x%02x,%s", mark, buf[i - 1], newline);
+        }
+
+        if ((len % 8) != 0)
+                test_printf(t, "\n");
+}
diff --git a/src/regress/lib/libcrypto/wycheproof/Makefile b/src/regress/lib/libcrypto/wycheproof/Makefile
index f2f7910b5b..ec737822b5 100644
--- a/src/regress/lib/libcrypto/wycheproof/Makefile
+++ b/src/regress/lib/libcrypto/wycheproof/Makefile
@@ -1,6 +1,6 @@
-# $OpenBSD: Makefile,v 1.9 2023/07/08 19:41:07 tb Exp $
+# $OpenBSD: Makefile,v 1.11 2025/09/05 14:41:29 tb Exp $
 
-WYCHEPROOF_TESTVECTORS = /usr/local/share/wycheproof/testvectors/
+WYCHEPROOF_TESTVECTORS = /usr/local/share/wycheproof/testvectors_v1/
 
 .if !exists(${WYCHEPROOF_TESTVECTORS})
 regress:
@@ -18,11 +18,17 @@ REGRESS_TARGETS += regress-wycheproof
 CLEANFILES +=   wycheproof
 
 wycheproof: wycheproof.go
-        go build -o wycheproof ${.CURDIR}/wycheproof.go
+        env GOCACHE=${.OBJDIR}/go-build go build -o wycheproof ${.CURDIR}/wycheproof.go
 
 regress-wycheproof: wycheproof
         ./wycheproof
 
+REGRESS_CLEANUP =       clean-go-cache
+
+clean-go-cache:
+        env GOCACHE=${.OBJDIR}/go-build go clean -cache
+        rm -rf ${.OBJDIR}/go-build
+
 . endif
 
 PROGS += wycheproof-primes
diff --git a/src/regress/lib/libcrypto/wycheproof/wycheproof-json.pl b/src/regress/lib/libcrypto/wycheproof/wycheproof-json.pl
index 45c7542b59..0eea14752c 100644
--- a/src/regress/lib/libcrypto/wycheproof/wycheproof-json.pl
+++ b/src/regress/lib/libcrypto/wycheproof/wycheproof-json.pl
@@ -1,4 +1,4 @@
-# $OpenBSD: wycheproof-json.pl,v 1.2 2022/07/08 14:33:56 tb Exp $
+# $OpenBSD: wycheproof-json.pl,v 1.3 2025/09/05 14:36:03 tb Exp $
 
 # Copyright (c) 2022 Joel Sing <jsing@openbsd.org>
 # Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
@@ -17,7 +17,7 @@
 
 use JSON::PP;
 
-$test_vector_path = "/usr/local/share/wycheproof/testvectors";
+$test_vector_path = "/usr/local/share/wycheproof/testvectors_v1";
 
 open JSON, "$test_vector_path/primality_test.json" or die;
 @json = <JSON>;
diff --git a/src/regress/lib/libcrypto/wycheproof/wycheproof-primes.c b/src/regress/lib/libcrypto/wycheproof/wycheproof-primes.c
index 57bd7a53da..e54fd484f9 100644
--- a/src/regress/lib/libcrypto/wycheproof/wycheproof-primes.c
+++ b/src/regress/lib/libcrypto/wycheproof/wycheproof-primes.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: wycheproof-primes.c,v 1.2 2022/12/01 13:49:12 tb Exp $ */
+/*      $OpenBSD: wycheproof-primes.c,v 1.3 2025/09/05 14:36:03 tb Exp $ */
 /*
  * Copyright (c) 2022 Theo Buehler <tb@openbsd.org>
  *
@@ -16,7 +16,9 @@
  */
 
 #include <err.h>
+#include <limits.h>
 #include <stdio.h>
+#include <string.h>
 
 #include <openssl/bn.h>
 
@@ -26,12 +28,31 @@ int
 primality_test(struct wycheproof_testcase *test)
 {
         BIGNUM *value = NULL;
+        size_t len;
         int ret;
         int failed = 1;
 
         if (!BN_hex2bn(&value, test->value))
                 errx(1, "%d: failed to set value \"%s\"", test->id, test->value);
 
+        if ((len = strlen(test->value)) > INT_MAX / 4)
+                errx(1, "%d: overlong test string %zu", test->id, len);
+
+        if (len > 0 && test->value[0] >= '8') {
+                BIGNUM *pow2;
+
+                if ((pow2 = BN_new()) == NULL)
+                        errx(1, "BN_new");
+
+                if (!BN_set_bit(pow2, 4 * len))
+                        errx(1, "BN_set_bit");
+
+                if (!BN_sub(value, value, pow2))
+                        errx(1, "BN_sub");
+
+                BN_free(pow2);
+        }
+
         if ((ret = BN_is_prime_ex(value, BN_prime_checks, NULL, NULL)) < 0)
                 errx(1, "%d: BN_is_prime_ex errored", test->id);
 
diff --git a/src/regress/lib/libcrypto/wycheproof/wycheproof.go b/src/regress/lib/libcrypto/wycheproof/wycheproof.go
index 8f0dfc8b2e..349227fb36 100644
--- a/src/regress/lib/libcrypto/wycheproof/wycheproof.go
+++ b/src/regress/lib/libcrypto/wycheproof/wycheproof.go
@@ -1,7 +1,7 @@
-/* $OpenBSD: wycheproof.go,v 1.161 2024/11/24 10:13:16 tb Exp $ */
+/* $OpenBSD: wycheproof.go,v 1.191 2025/09/14 17:03:28 tb Exp $ */
 /*
  * Copyright (c) 2018,2023 Joel Sing <jsing@openbsd.org>
- * Copyright (c) 2018,2019,2022-2024 Theo Buehler <tb@openbsd.org>
+ * Copyright (c) 2018,2019,2022-2025 Theo Buehler <tb@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -36,6 +36,7 @@ package main
 #include <openssl/evp.h>
 #include <openssl/kdf.h>
 #include <openssl/hmac.h>
+#include <openssl/mlkem.h>
 #include <openssl/objects.h>
 #include <openssl/pem.h>
 #include <openssl/x509.h>
@@ -81,16 +82,16 @@ import (
         "fmt"
         "io/ioutil"
         "log"
+        "math/big"
         "os"
         "path/filepath"
-        "regexp"
         "runtime"
         "strings"
         "sync"
         "unsafe"
 )
 
-const testVectorPath = "/usr/local/share/wycheproof/testvectors"
+const testVectorPath = "/usr/local/share/wycheproof/testvectors_v1"
 
 type testVariant int
 
@@ -125,6 +126,59 @@ func wycheproofFormatTestCase(tcid int, comment string, flags []string, result s
 
 var testc *testCoordinator
 
+type BigInt struct {
+        *big.Int
+}
+
+func mustConvertBigIntToBigNum(bi *BigInt) *C.BIGNUM {
+        value := bi.Bytes()
+        if len(value) == 0 {
+                value = append(value, 0)
+        }
+        bn := C.BN_new()
+        if bn == nil {
+                log.Fatal("BN_new failed")
+        }
+        if C.BN_bin2bn((*C.uchar)(unsafe.Pointer(&value[0])), C.int(len(value)), bn) == nil {
+                log.Fatal("BN_bin2bn failed")
+        }
+        if bi.Sign() == -1 {
+                C.BN_set_negative(bn, C.int(1))
+        }
+        return bn
+}
+
+func (bi *BigInt) UnmarshalJSON(data []byte) error {
+        if len(data) < 2 || data[0] != '"' || data[len(data)-1] != '"' {
+                log.Fatalf("Failed to decode %q: too short or unquoted", data)
+        }
+        data = data[1 : len(data)-1]
+        if len(data)%2 == 1 {
+                pad := make([]byte, 1, len(data)+1)
+                if data[0] >= '0' && data[0] <= '7' {
+                        pad[0] = '0'
+                } else {
+                        pad[0] = 'f'
+                }
+                data = append(pad, data...)
+        }
+
+        src := make([]byte, hex.DecodedLen(len(data)))
+        _, err := hex.Decode(src, data)
+        if err != nil {
+                log.Fatalf("Failed to decode %q: %v", data, err)
+        }
+
+        bi.Int = &big.Int{}
+        bi.Int.SetBytes(src)
+        if data[0] >= '8' {
+                y := &big.Int{}
+                y.SetBit(y, 4*len(data), 1)
+                bi.Int.Sub(bi.Int, y)
+        }
+        return nil
+}
+
 type wycheproofJWKPublic struct {
         Crv string `json:"crv"`
         KID string `json:"kid"`
@@ -236,9 +290,9 @@ func (wt *wycheproofTestDSA) String() string {
 }
 
 type wycheproofTestGroupDSA struct {
-        Key    *wycheproofDSAKey    `json:"key"`
-        KeyDER string               `json:"keyDer"`
-        KeyPEM string               `json:"keyPem"`
+        Key    *wycheproofDSAKey    `json:"publicKey"`
+        KeyDER string               `json:"publicKeyDer"`
+        KeyPEM string               `json:"publicKeyPem"`
         SHA    string               `json:"sha"`
         Type   string               `json:"type"`
         Tests  []*wycheproofTestDSA `json:"tests"`
@@ -309,22 +363,38 @@ func (wt *wycheproofTestECDSA) String() string {
 }
 
 type wycheproofTestGroupECDSA struct {
-        Key    *wycheproofECDSAKey    `json:"key"`
-        KeyDER string                 `json:"keyDer"`
-        KeyPEM string                 `json:"keyPem"`
+        Key    *wycheproofECDSAKey    `json:"publicKey"`
+        KeyDER string                 `json:"publicKeyDer"`
+        KeyPEM string                 `json:"publicKeyPem"`
         SHA    string                 `json:"sha"`
         Type   string                 `json:"type"`
         Tests  []*wycheproofTestECDSA `json:"tests"`
 }
 
-type wycheproofTestGroupECDSAWebCrypto struct {
-        JWK    *wycheproofJWKPublic   `json:"jwk"`
-        Key    *wycheproofECDSAKey    `json:"key"`
-        KeyDER string                 `json:"keyDer"`
-        KeyPEM string                 `json:"keyPem"`
-        SHA    string                 `json:"sha"`
-        Type   string                 `json:"type"`
-        Tests  []*wycheproofTestECDSA `json:"tests"`
+type wycheproofTestEcCurve struct {
+        TCID    int      `json:"tcId"`
+        Comment string   `json:"comment"`
+        Flags   []string `json:"flags"`
+        Name    string   `json:"name"`
+        OID     string   `json:"oid"`
+        Ref     string   `json:"ref"`
+        P       *BigInt  `json:"p"`
+        N       *BigInt  `json:"n"`
+        A       *BigInt  `json:"a"`
+        B       *BigInt  `json:"b"`
+        Gx      *BigInt  `json:"gx"`
+        Gy      *BigInt  `json:"gy"`
+        H       int      `json:"h"`
+        Result  string   `json:"result"`
+}
+
+func (wt *wycheproofTestEcCurve) String() string {
+        return wycheproofFormatTestCase(wt.TCID, wt.Comment, wt.Flags, wt.Result)
+}
+
+type wycheproofTestGroupEcCurve struct {
+        Type  string                   `json:"type"`
+        Tests []*wycheproofTestEcCurve `json:"tests"`
 }
 
 type wycheproofJWKEdDSA struct {
@@ -357,10 +427,10 @@ func (wt *wycheproofTestEdDSA) String() string {
 }
 
 type wycheproofTestGroupEdDSA struct {
-        JWK    *wycheproofJWKEdDSA    `json:"jwk"`
-        Key    *wycheproofEdDSAKey    `json:"key"`
-        KeyDer string                 `json:"keyDer"`
-        KeyPem string                 `json:"keyPem"`
+        JWK    *wycheproofJWKEdDSA    `json:"publicKeyJwk"`
+        Key    *wycheproofEdDSAKey    `json:"publicKey"`
+        KeyDer string                 `json:"publicKeyDer"`
+        KeyPem string                 `json:"publicKeyPem"`
         Type   string                 `json:"type"`
         Tests  []*wycheproofTestEdDSA `json:"tests"`
 }
@@ -428,10 +498,32 @@ type wycheproofTestGroupKW struct {
         Tests   []*wycheproofTestKW `json:"tests"`
 }
 
+type wycheproofTestMLKEM struct {
+        TCID    int      `json:"tcId"`
+        Comment string   `json:"comment"`
+        Seed    string   `json:"seed"`
+        Ek      string   `json:"ek"`
+        M       string   `json:"m"`
+        C       string   `json:"c"`
+        K       string   `json:"K"`
+        Result  string   `json:"result"`
+        Flags   []string `json:"flags"`
+}
+
+func (wt *wycheproofTestMLKEM) String() string {
+        return wycheproofFormatTestCase(wt.TCID, wt.Comment, wt.Flags, wt.Result)
+}
+
+type wycheproofTestGroupMLKEM struct {
+        Type         string                 `json:"type"`
+        ParameterSet string                 `json:"parameterSet"`
+        Tests        []*wycheproofTestMLKEM `json:"tests"`
+}
+
 type wycheproofTestPrimality struct {
         TCID    int      `json:"tcId"`
         Comment string   `json:"comment"`
-        Value   string   `json:"value"`
+        Value   *BigInt  `json:"value"`
         Result  string   `json:"result"`
         Flags   []string `json:"flags"`
 }
@@ -460,15 +552,31 @@ func (wt *wycheproofTestRSA) String() string {
 }
 
 type wycheproofTestGroupRSA struct {
-        E       string               `json:"e"`
-        KeyASN  string               `json:"keyAsn"`
-        KeyDER  string               `json:"keyDer"`
-        KeyPEM  string               `json:"keyPem"`
-        KeySize int                  `json:"keysize"`
-        N       string               `json:"n"`
-        SHA     string               `json:"sha"`
-        Type    string               `json:"type"`
-        Tests   []*wycheproofTestRSA `json:"tests"`
+        PrivateKey *wycheproofRSAPrivateKey `json:"privateKey"`
+        PublicKey  *wycheproofRSAPublicKey  `json:"publicKey"`
+        KeyASN     string                   `json:"keyAsn"`
+        KeyDER     string                   `json:"keyDer"`
+        KeyPEM     string                   `json:"keyPem"`
+        KeySize    int                      `json:"keysize"`
+        SHA        string                   `json:"sha"`
+        Type       string                   `json:"type"`
+        Tests      []*wycheproofTestRSA     `json:"tests"`
+}
+
+type wycheproofRSAPublicKey struct {
+        Modulus        string `json:"modulus"`
+        PublicExponent string `json:"publicExponent"`
+}
+
+type wycheproofRSAPrivateKey struct {
+        Modulus         string `json:"modulus"`
+        PrivateExponent string `json:"privateExponent"`
+        PublicExponent  string `json:"publicExponent"`
+        Prime1          string `json:"prime1"`
+        Prime2          string `json:"prime2"`
+        Exponent1       string `json:"exponent1"`
+        Exponent2       string `json:"exponent2"`
+        Coefficient     string `json:"coefficient"`
 }
 
 type wycheproofPrivateKeyJwk struct {
@@ -500,29 +608,25 @@ func (wt *wycheproofTestRsaes) String() string {
 }
 
 type wycheproofTestGroupRsaesOaep struct {
-        D               string                   `json:"d"`
-        E               string                   `json:"e"`
+        Type            string                   `json:"type"`
         KeySize         int                      `json:"keysize"`
+        SHA             string                   `json:"sha"`
         MGF             string                   `json:"mgf"`
         MGFSHA          string                   `json:"mgfSha"`
-        N               string                   `json:"n"`
+        PrivateKey      *wycheproofRSAPrivateKey `json:"privateKey"`
         PrivateKeyJwk   *wycheproofPrivateKeyJwk `json:"privateKeyJwk"`
         PrivateKeyPem   string                   `json:"privateKeyPem"`
         PrivateKeyPkcs8 string                   `json:"privateKeyPkcs8"`
-        SHA             string                   `json:"sha"`
-        Type            string                   `json:"type"`
         Tests           []*wycheproofTestRsaes   `json:"tests"`
 }
 
 type wycheproofTestGroupRsaesPkcs1 struct {
-        D               string                   `json:"d"`
-        E               string                   `json:"e"`
-        KeySize         int                      `json:"keysize"`
-        N               string                   `json:"n"`
+        Type            string                   `json:"type"`
+        PrivateKey      *wycheproofRSAPrivateKey `json:"privateKey"`
         PrivateKeyJwk   *wycheproofPrivateKeyJwk `json:"privateKeyJwk"`
         PrivateKeyPem   string                   `json:"privateKeyPem"`
         PrivateKeyPkcs8 string                   `json:"privateKeyPkcs8"`
-        Type            string                   `json:"type"`
+        KeySize         int                      `json:"keysize"`
         Tests           []*wycheproofTestRsaes   `json:"tests"`
 }
 
@@ -540,18 +644,18 @@ func (wt *wycheproofTestRsassa) String() string {
 }
 
 type wycheproofTestGroupRsassa struct {
-        E       string                  `json:"e"`
-        KeyASN  string                  `json:"keyAsn"`
-        KeyDER  string                  `json:"keyDer"`
-        KeyPEM  string                  `json:"keyPem"`
-        KeySize int                     `json:"keysize"`
-        MGF     string                  `json:"mgf"`
-        MGFSHA  string                  `json:"mgfSha"`
-        N       string                  `json:"n"`
-        SLen    int                     `json:"sLen"`
-        SHA     string                  `json:"sha"`
-        Type    string                  `json:"type"`
-        Tests   []*wycheproofTestRsassa `json:"tests"`
+        PrivateKey *wycheproofRSAPrivateKey `json:"privateKey"`
+        PublicKey  *wycheproofRSAPublicKey  `json:"publicKey"`
+        KeyASN     string                   `json:"keyAsn"`
+        KeyDER     string                   `json:"keyDer"`
+        KeyPEM     string                   `json:"keyPem"`
+        KeySize    int                      `json:"keysize"`
+        MGF        string                   `json:"mgf"`
+        MGFSHA     string                   `json:"mgfSha"`
+        SLen       int                      `json:"sLen"`
+        SHA        string                   `json:"sha"`
+        Type       string                   `json:"type"`
+        Tests      []*wycheproofTestRsassa  `json:"tests"`
 }
 
 type wycheproofTestX25519 struct {
@@ -578,13 +682,13 @@ type wycheproofTestGroupRunner interface {
         run(string, testVariant) bool
 }
 
-type wycheproofTestVectors struct {
-        Algorithm        string            `json:"algorithm"`
-        GeneratorVersion string            `json:"generatorVersion"`
-        Notes            map[string]string `json:"notes"`
-        NumberOfTests    int               `json:"numberOfTests"`
-        // Header
-        TestGroups []json.RawMessage `json:"testGroups"`
+type wycheproofTestVectorsV1 struct {
+        Algorithm     string            `json:"algorithm"`
+        Schema        string            `json:"schema"`
+        NumberOfTests int               `json:"numberOfTests"`
+        Header        []string          `json:"header"`
+        Notes         json.RawMessage   `json:"notes"`
+        TestGroups    []json.RawMessage `json:"testGroups"`
 }
 
 var nids = map[string]int{
@@ -641,10 +745,16 @@ func nidFromString(ns string) (int, error) {
         return -1, fmt.Errorf("unknown NID %q", ns)
 }
 
-func skipSmallCurve(nid int) bool {
+func skipHash(hash string) bool {
+        return hash == "SHAKE128" || hash == "SHAKE256"
+}
+
+func skipCurve(nid int) bool {
         switch C.int(nid) {
         case C.NID_secp160k1, C.NID_secp160r1, C.NID_secp160r2, C.NID_secp192k1, C.NID_X9_62_prime192v1:
                 return true
+        case C.NID_sect283k1, C.NID_sect283r1, C.NID_sect409k1, C.NID_sect409r1, C.NID_sect571k1, C.NID_sect571r1:
+                return true
         }
         return false
 }
@@ -1266,7 +1376,7 @@ func runEvpChaCha20Poly1305Test(ctx *C.EVP_CIPHER_CTX, algorithm string, wt *wyc
                 log.Fatal("Failed EVP_EncryptUpdate aad")
         }
 
-        sealed := make([]byte, ctLen + tagLen)
+        sealed := make([]byte, ctLen+tagLen)
         copy(sealed, msg)
         if C.EVP_EncryptUpdate(ctx, (*C.uchar)(unsafe.Pointer(&sealed[0])), (*C.int)(unsafe.Pointer(&len)), (*C.uchar)(unsafe.Pointer(&sealed[0])), (C.int)(msgLen)) != 1 {
                 log.Fatal("Failed EVP_EncryptUpdate msg")
@@ -1281,7 +1391,7 @@ func runEvpChaCha20Poly1305Test(ctx *C.EVP_CIPHER_CTX, algorithm string, wt *wyc
         }
         outLen += (C.int)(tagLen)
 
-        if (C.int)(ctLen + tagLen) != outLen {
+        if (C.int)(ctLen+tagLen) != outLen {
                 fmt.Printf("%s\n", wt)
         }
 
@@ -1290,7 +1400,7 @@ func runEvpChaCha20Poly1305Test(ctx *C.EVP_CIPHER_CTX, algorithm string, wt *wyc
         tagMatch := bytes.Equal(tag, sealed[ctLen:])
         if (ctMatch && tagMatch) == (wt.Result != "invalid") {
                 sealSuccess = true
-        } else  {
+        } else {
                 fmt.Printf("%s - ct match: %t tag match: %t\n", wt, ctMatch, tagMatch)
         }
 
@@ -1316,9 +1426,9 @@ func runEvpChaCha20Poly1305Test(ctx *C.EVP_CIPHER_CTX, algorithm string, wt *wyc
                 ct = append(ct, 0)
         }
 
-        opened := make([]byte, msgLen + tagLen)
+        opened := make([]byte, msgLen+tagLen)
         copy(opened, ct)
-        if msgLen + aadLen == 0 {
+        if msgLen+aadLen == 0 {
                 opened = append(opened, 0)
         }
 
@@ -1645,7 +1755,7 @@ func (wtg *wycheproofTestGroupECDH) run(algorithm string, variant testVariant) b
         if err != nil {
                 log.Fatalf("Failed to get nid for curve: %v", err)
         }
-        if skipSmallCurve(nid) {
+        if skipCurve(nid) {
                 return true
         }
 
@@ -1766,7 +1876,16 @@ func runECDSATest(ecKey *C.EC_KEY, md *C.EVP_MD, nid int, variant testVariant, w
         msg, msgLen := mustHashHexMessage(md, wt.Msg)
 
         var ret C.int
-        if variant == Webcrypto || variant == P1363 {
+        if variant == P1363 {
+                order_bytes := int((C.EC_GROUP_order_bits(C.EC_KEY_get0_group(ecKey)) + 7) / 8)
+                if len(wt.Sig)/2 != 2*order_bytes {
+                        if wt.Result == "valid" {
+                                fmt.Printf("FAIL: %s - incorrect signature length, %d, %d\n", wt, len(wt.Sig)/2, 2*order_bytes)
+                                return false
+                        }
+                        return true
+                }
+
                 cDer, derLen := encodeECDSAWebCryptoSig(wt.Sig)
                 if cDer == nil {
                         fmt.Print("FAIL: unable to decode signature")
@@ -1797,7 +1916,10 @@ func (wtg *wycheproofTestGroupECDSA) run(algorithm string, variant testVariant)
         if err != nil {
                 log.Fatalf("Failed to get nid for curve: %v", err)
         }
-        if skipSmallCurve(nid) {
+        if skipCurve(nid) {
+                return true
+        }
+        if skipHash(wtg.SHA) {
                 return true
         }
         ecKey := C.EC_KEY_new_by_curve_name(C.int(nid))
@@ -1892,55 +2014,73 @@ func encodeECDSAWebCryptoSig(wtSig string) (*C.uchar, C.int) {
         return cDer, derLen
 }
 
-func (wtg *wycheproofTestGroupECDSAWebCrypto) run(algorithm string, variant testVariant) bool {
-        fmt.Printf("Running %v test group %v with curve %v, key size %d and %v...\n", algorithm, wtg.Type, wtg.Key.Curve, wtg.Key.KeySize, wtg.SHA)
+func runEcCurveTest(wt *wycheproofTestEcCurve) bool {
+        oid := C.CString(wt.OID)
+        defer C.free(unsafe.Pointer(oid))
 
-        nid, err := nidFromString(wtg.JWK.Crv)
-        if err != nil {
-                log.Fatalf("Failed to get nid for curve: %v", err)
-        }
-        ecKey := C.EC_KEY_new_by_curve_name(C.int(nid))
-        if ecKey == nil {
-                log.Fatal("EC_KEY_new_by_curve_name failed")
+        nid := C.OBJ_txt2nid(oid)
+        if nid == C.NID_undef {
+                fmt.Printf("INFO: %s: %s: unknown OID %s\n", wt, wt.Name, wt.OID)
+                return false
         }
-        defer C.EC_KEY_free(ecKey)
 
-        x, err := base64.RawURLEncoding.DecodeString(wtg.JWK.X)
-        if err != nil {
-                log.Fatalf("Failed to base64 decode X: %v", err)
-        }
-        bnX := C.BN_bin2bn((*C.uchar)(unsafe.Pointer(&x[0])), C.int(len(x)), nil)
-        if bnX == nil {
-                log.Fatal("Failed to decode X")
+        builtinGroup := C.EC_GROUP_new_by_curve_name(nid)
+        defer C.EC_GROUP_free(builtinGroup)
+
+        if builtinGroup == nil {
+                fmt.Printf("INFO: %s: %s: no builtin curve for OID %s\n", wt, wt.Name, wt.OID)
+                return true
         }
-        defer C.BN_free(bnX)
 
-        y, err := base64.RawURLEncoding.DecodeString(wtg.JWK.Y)
-        if err != nil {
-                log.Fatalf("Failed to base64 decode Y: %v", err)
+        p := mustConvertBigIntToBigNum(wt.P)
+        defer C.BN_free(p)
+        a := mustConvertBigIntToBigNum(wt.A)
+        defer C.BN_free(a)
+        b := mustConvertBigIntToBigNum(wt.B)
+        defer C.BN_free(b)
+        n := mustConvertBigIntToBigNum(wt.N)
+        defer C.BN_free(n)
+        x := mustConvertBigIntToBigNum(wt.Gx)
+        defer C.BN_free(x)
+        y := mustConvertBigIntToBigNum(wt.Gy)
+        defer C.BN_free(y)
+
+        group := C.EC_GROUP_new_curve_GFp(p, a, b, (*C.BN_CTX)(nil))
+        defer C.EC_GROUP_free(group)
+
+        if group == nil {
+                log.Fatalf("EC_GROUP_new_curve_GFp failed")
         }
-        bnY := C.BN_bin2bn((*C.uchar)(unsafe.Pointer(&y[0])), C.int(len(y)), nil)
-        if bnY == nil {
-                log.Fatal("Failed to decode Y")
+
+        point := C.EC_POINT_new(group)
+        defer C.EC_POINT_free(point)
+
+        if point == nil {
+                log.Fatalf("EC_POINT_new failed")
         }
-        defer C.BN_free(bnY)
 
-        if C.EC_KEY_set_public_key_affine_coordinates(ecKey, bnX, bnY) != 1 {
-                log.Fatal("Failed to set EC public key")
+        if C.EC_POINT_set_affine_coordinates(group, point, x, y, (*C.BN_CTX)(nil)) == 0 {
+                log.Fatalf("EC_POINT_set_affine_coordinates failed")
         }
 
-        nid, err = nidFromString(wtg.SHA)
-        if err != nil {
-                log.Fatalf("Failed to get MD NID: %v", err)
+        if C.EC_GROUP_set_generator(group, point, n, (*C.BIGNUM)(nil)) == 0 {
+                log.Fatalf("EC_POINT_set_generator failed")
         }
-        md, err := hashEvpMdFromString(wtg.SHA)
-        if err != nil {
-                log.Fatalf("Failed to get hash: %v", err)
+
+        success := true
+        if C.EC_GROUP_cmp(group, builtinGroup, (*C.BN_CTX)(nil)) != 0 {
+                fmt.Printf("FAIL: %s %s builtin curve has wrong parameters\n", wt, wt.Name)
+                success = false
         }
+        return success
+}
+
+func (wtg *wycheproofTestGroupEcCurve) run(algorithm string, variant testVariant) bool {
+        fmt.Printf("Running %v test group %v...\n", algorithm, wtg.Type)
 
         success := true
         for _, wt := range wtg.Tests {
-                if !runECDSATest(ecKey, md, nid, Webcrypto, wt) {
+                if !runEcCurveTest(wt) {
                         success = false
                 }
         }
@@ -1972,11 +2112,11 @@ func runEdDSATest(pkey *C.EVP_PKEY, wt *wycheproofTestEdDSA) bool {
 }
 
 func (wtg *wycheproofTestGroupEdDSA) run(algorithm string, variant testVariant) bool {
-        fmt.Printf("Running %v test group %v...\n", algorithm, wtg.Type)
-
-        if wtg.Key.Curve != "edwards25519" || wtg.Key.KeySize != 255 {
-                fmt.Printf("INFO: Unexpected curve or key size. want (\"edwards25519\", 255), got (%q, %d)\n", wtg.Key.Curve, wtg.Key.KeySize)
-                return false
+        if wtg.Key.Curve == "edwards25519" {
+                fmt.Printf("Running %v test group %v...\n", algorithm, wtg.Type)
+        } else {
+                fmt.Printf("INFO: Skipping %v test group %v for %v...\n", algorithm, wtg.Type, wtg.Key.Curve)
+                return true
         }
 
         pubKey, pubKeyLen := mustDecodeHexString(wtg.Key.Pk, "pubkey")
@@ -2204,13 +2344,122 @@ func (wtg *wycheproofTestGroupKW) run(algorithm string, variant testVariant) boo
         return success
 }
 
-func runPrimalityTest(wt *wycheproofTestPrimality) bool {
-        var bnValue *C.BIGNUM
-        value := C.CString(wt.Value)
-        if C.BN_hex2bn(&bnValue, value) == 0 {
-                log.Fatal("Failed to set bnValue")
+func runMLKEMTestGroup(rank C.int, wt *wycheproofTestMLKEM) bool {
+        privKey := C.MLKEM_private_key_new(rank)
+        defer C.MLKEM_private_key_free(privKey)
+        if privKey == nil {
+                log.Fatal("MLKEM_private_key_new failed")
+        }
+        pubKey := C.MLKEM_public_key_new(rank)
+        defer C.MLKEM_public_key_free(pubKey)
+        if pubKey == nil {
+                log.Fatal("MLKEM_public_key_new failed")
+        }
+
+        seed, seedLen := mustDecodeHexString(wt.Seed, "seed")
+        ek, _ := mustDecodeHexString(wt.Ek, "ek")
+
+        if C.MLKEM_private_key_from_seed(privKey, (*C.uchar)(unsafe.Pointer(&seed[0])), C.size_t(seedLen)) != 1 {
+                fmt.Printf("%s - MLKEM_private_key_from_seed failed\n", wt)
+                return false
+        }
+
+        if C.MLKEM_public_from_private(privKey, pubKey) != 1 {
+                fmt.Printf("%s - MLKEM_public_from_private failed\n", wt)
+                return false
+        }
+
+        var marshalledPubKey *C.uchar
+        var marshalledPubKeyLen C.size_t
+        defer C.free(unsafe.Pointer(marshalledPubKey))
+        if C.MLKEM_marshal_public_key(pubKey, (**C.uchar)(unsafe.Pointer(&marshalledPubKey)), (*C.size_t)(unsafe.Pointer(&marshalledPubKeyLen))) != 1 {
+                fmt.Printf("%s - MLKEM_marshal_private_key failed\n", wt)
+                return false
+        }
+        gotEk := unsafe.Slice((*byte)(unsafe.Pointer(marshalledPubKey)), marshalledPubKeyLen)
+
+        if !bytes.Equal(ek, gotEk) {
+                fmt.Printf("FAIL: %s marshalledPubKey mismatch\n", wt)
+                return false
+        }
+
+        c, cLen := mustDecodeHexString(wt.C, "c")
+
+        var sharedSecret *C.uchar
+        var sharedSecretLen C.size_t
+        defer C.free(unsafe.Pointer(sharedSecret))
+        if C.MLKEM_decap(privKey, (*C.uchar)(unsafe.Pointer(&c[0])), C.size_t(cLen), (**C.uchar)(unsafe.Pointer(&sharedSecret)), (*C.size_t)(unsafe.Pointer(&sharedSecretLen))) != 1 {
+                fmt.Printf("%s - MLKEM_decap failed\n", wt)
+                return false
+        }
+        gotK := unsafe.Slice((*byte)(unsafe.Pointer(sharedSecret)), sharedSecretLen)
+
+        k, _ := mustDecodeHexString(wt.K, "K")
+
+        if !bytes.Equal(k, gotK) {
+                fmt.Printf("FAIL: %s sharedSecret mismatch\n", wt)
+                return false
+        }
+
+        return true
+}
+
+func runMLKEMEncapsTestGroup(rank C.int, wt *wycheproofTestMLKEM) bool {
+        pubKey := C.MLKEM_public_key_new(rank)
+        defer C.MLKEM_public_key_free(pubKey)
+        if pubKey == nil {
+                log.Fatal("MLKEM_public_key_new failed")
+        }
+
+        ek, ekLen := mustDecodeHexString(wt.C, "eK")
+
+        if C.MLKEM_parse_public_key(pubKey, (*C.uchar)(unsafe.Pointer(&ek[0])), (C.size_t)(ekLen)) != 0 || wt.Result != "invalid" {
+                fmt.Printf("FAIL: %s MLKEM_parse_public_key succeeded\n", wt)
+                return false
+        }
+
+        return true
+}
+
+func (wtg *wycheproofTestGroupMLKEM) run(algorithm string, variant testVariant) bool {
+        var rank C.int
+
+        switch wtg.ParameterSet {
+        case "ML-KEM-512":
+                fmt.Printf("INFO: skipping %v test group of type %v for %s\n", algorithm, wtg.Type, wtg.ParameterSet)
+                return true
+        case "ML-KEM-768":
+                rank = C.RANK768
+        case "ML-KEM-1024":
+                rank = C.RANK1024
+        default:
+                log.Fatalf("Unknown ML-KEM parameterSet %v", wtg.ParameterSet)
+        }
+        fmt.Printf("Running %v test group of type %v\n", algorithm, wtg.Type)
+
+        type MLKEMTestFunc func(C.int, *wycheproofTestMLKEM) bool
+        var runTest MLKEMTestFunc
+
+        switch wtg.Type {
+        case "MLKEMTest":
+                runTest = runMLKEMTestGroup
+        case "MLKEMEncapsTest":
+                runTest = runMLKEMEncapsTestGroup
+        default:
+                log.Fatalf("Unknown ML-KEM test type %v", wtg.Type)
         }
-        C.free(unsafe.Pointer(value))
+
+        success := true
+        for _, wt := range wtg.Tests {
+                if !runTest(rank, wt) {
+                        success = false
+                }
+        }
+        return success
+}
+
+func runPrimalityTest(wt *wycheproofTestPrimality) bool {
+        bnValue := mustConvertBigIntToBigNum(wt.Value)
         defer C.BN_free(bnValue)
 
         ret := C.BN_is_prime_ex(bnValue, C.BN_prime_checks, (*C.BN_CTX)(unsafe.Pointer(nil)), (*C.BN_GENCB)(unsafe.Pointer(nil)))
@@ -2280,13 +2529,17 @@ func runRsaesOaepTest(rsa *C.RSA, sha *C.EVP_MD, mgfSha *C.EVP_MD, wt *wycheproo
 func (wtg *wycheproofTestGroupRsaesOaep) run(algorithm string, variant testVariant) bool {
         fmt.Printf("Running %v test group %v with key size %d MGF %v and %v...\n", algorithm, wtg.Type, wtg.KeySize, wtg.MGFSHA, wtg.SHA)
 
+        if skipHash(wtg.SHA) {
+                return true
+        }
+
         rsa := C.RSA_new()
         if rsa == nil {
                 log.Fatal("RSA_new failed")
         }
         defer C.RSA_free(rsa)
 
-        d := C.CString(wtg.D)
+        d := C.CString(wtg.PrivateKey.PrivateExponent)
         var rsaD *C.BIGNUM
         defer C.BN_free(rsaD)
         if C.BN_hex2bn(&rsaD, d) == 0 {
@@ -2294,7 +2547,7 @@ func (wtg *wycheproofTestGroupRsaesOaep) run(algorithm string, variant testVaria
         }
         C.free(unsafe.Pointer(d))
 
-        e := C.CString(wtg.E)
+        e := C.CString(wtg.PrivateKey.PublicExponent)
         var rsaE *C.BIGNUM
         defer C.BN_free(rsaE)
         if C.BN_hex2bn(&rsaE, e) == 0 {
@@ -2302,7 +2555,7 @@ func (wtg *wycheproofTestGroupRsaesOaep) run(algorithm string, variant testVaria
         }
         C.free(unsafe.Pointer(e))
 
-        n := C.CString(wtg.N)
+        n := C.CString(wtg.PrivateKey.Modulus)
         var rsaN *C.BIGNUM
         defer C.BN_free(rsaN)
         if C.BN_hex2bn(&rsaN, n) == 0 {
@@ -2376,7 +2629,7 @@ func (wtg *wycheproofTestGroupRsaesPkcs1) run(algorithm string, variant testVari
         }
         defer C.RSA_free(rsa)
 
-        d := C.CString(wtg.D)
+        d := C.CString(wtg.PrivateKey.PrivateExponent)
         var rsaD *C.BIGNUM
         defer C.BN_free(rsaD)
         if C.BN_hex2bn(&rsaD, d) == 0 {
@@ -2384,7 +2637,7 @@ func (wtg *wycheproofTestGroupRsaesPkcs1) run(algorithm string, variant testVari
         }
         C.free(unsafe.Pointer(d))
 
-        e := C.CString(wtg.E)
+        e := C.CString(wtg.PrivateKey.PublicExponent)
         var rsaE *C.BIGNUM
         defer C.BN_free(rsaE)
         if C.BN_hex2bn(&rsaE, e) == 0 {
@@ -2392,7 +2645,7 @@ func (wtg *wycheproofTestGroupRsaesPkcs1) run(algorithm string, variant testVari
         }
         C.free(unsafe.Pointer(e))
 
-        n := C.CString(wtg.N)
+        n := C.CString(wtg.PrivateKey.Modulus)
         var rsaN *C.BIGNUM
         defer C.BN_free(rsaN)
         if C.BN_hex2bn(&rsaN, n) == 0 {
@@ -2451,13 +2704,30 @@ func runRsassaTest(rsa *C.RSA, sha *C.EVP_MD, mgfSha *C.EVP_MD, sLen int, wt *wy
 
 func (wtg *wycheproofTestGroupRsassa) run(algorithm string, variant testVariant) bool {
         fmt.Printf("Running %v test group %v with key size %d and %v...\n", algorithm, wtg.Type, wtg.KeySize, wtg.SHA)
+
+        if skipHash(wtg.SHA) {
+                return true
+        }
+
         rsa := C.RSA_new()
         if rsa == nil {
                 log.Fatal("RSA_new failed")
         }
         defer C.RSA_free(rsa)
 
-        e := C.CString(wtg.E)
+        var publicExponent, modulus string
+        if wtg.PublicKey != nil {
+                publicExponent = wtg.PublicKey.PublicExponent
+                modulus = wtg.PublicKey.Modulus
+        } else if wtg.PrivateKey != nil {
+                publicExponent = wtg.PrivateKey.PublicExponent
+                modulus = wtg.PrivateKey.Modulus
+        }
+        if publicExponent == "" || modulus == "" {
+                return true
+        }
+
+        e := C.CString(publicExponent)
         var rsaE *C.BIGNUM
         defer C.BN_free(rsaE)
         if C.BN_hex2bn(&rsaE, e) == 0 {
@@ -2465,7 +2735,7 @@ func (wtg *wycheproofTestGroupRsassa) run(algorithm string, variant testVariant)
         }
         C.free(unsafe.Pointer(e))
 
-        n := C.CString(wtg.N)
+        n := C.CString(modulus)
         var rsaN *C.BIGNUM
         defer C.BN_free(rsaN)
         if C.BN_hex2bn(&rsaN, n) == 0 {
@@ -2522,7 +2792,19 @@ func (wtg *wycheproofTestGroupRSA) run(algorithm string, variant testVariant) bo
         }
         defer C.RSA_free(rsa)
 
-        e := C.CString(wtg.E)
+        var publicExponent, modulus string
+        if wtg.PublicKey != nil {
+                publicExponent = wtg.PublicKey.PublicExponent
+                modulus = wtg.PublicKey.Modulus
+        } else if wtg.PrivateKey != nil {
+                publicExponent = wtg.PrivateKey.PublicExponent
+                modulus = wtg.PrivateKey.Modulus
+        }
+        if publicExponent == "" || modulus == "" {
+                return true
+        }
+
+        e := C.CString(publicExponent)
         var rsaE *C.BIGNUM
         defer C.BN_free(rsaE)
         if C.BN_hex2bn(&rsaE, e) == 0 {
@@ -2530,7 +2812,7 @@ func (wtg *wycheproofTestGroupRSA) run(algorithm string, variant testVariant) bo
         }
         C.free(unsafe.Pointer(e))
 
-        n := C.CString(wtg.N)
+        n := C.CString(modulus)
         var rsaN *C.BIGNUM
         defer C.BN_free(rsaN)
         if C.BN_hex2bn(&rsaN, n) == 0 {
@@ -2586,7 +2868,12 @@ func runX25519Test(wt *wycheproofTestX25519) bool {
 }
 
 func (wtg *wycheproofTestGroupX25519) run(algorithm string, variant testVariant) bool {
-        fmt.Printf("Running %v test group with curve %v...\n", algorithm, wtg.Curve)
+        if wtg.Curve == "curve25519" {
+                fmt.Printf("Running %v test group with curve %v...\n", algorithm, wtg.Curve)
+        } else {
+                fmt.Printf("INFO: Skipping %v test group with curve %v...\n", algorithm, wtg.Curve)
+                return true
+        }
 
         success := true
         for _, wt := range wtg.Tests {
@@ -2597,59 +2884,121 @@ func (wtg *wycheproofTestGroupX25519) run(algorithm string, variant testVariant)
         return success
 }
 
-func testGroupFromAlgorithm(algorithm string, variant testVariant) wycheproofTestGroupRunner {
-        if algorithm == "ECDH" && variant == Webcrypto {
-                return &wycheproofTestGroupECDHWebCrypto{}
-        }
-        if algorithm == "ECDSA" && variant == Webcrypto {
-                return &wycheproofTestGroupECDSAWebCrypto{}
-        }
-        switch algorithm {
+func testGroupFromTestVector(wtv *wycheproofTestVectorsV1) (wycheproofTestGroupRunner, testVariant) {
+        variant := Normal
+
+        switch wtv.Algorithm {
+        case "A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512":
+                return nil, Skip
+        case "AEGIS128", "AEGIS128L", "AEGIS256":
+                return nil, Skip
+        case "AEAD-AES-SIV-CMAC":
+                return nil, Skip
         case "AES-CBC-PKCS5":
-                return &wycheproofTestGroupAesCbcPkcs5{}
+                return &wycheproofTestGroupAesCbcPkcs5{}, variant
         case "AES-CCM", "AES-GCM":
-                return &wycheproofTestGroupAesAead{}
+                return &wycheproofTestGroupAesAead{}, variant
         case "AES-CMAC":
-                return &wycheproofTestGroupAesCmac{}
+                return &wycheproofTestGroupAesCmac{}, variant
+        case "AES-EAX", "AES-FF1", "AES-GCM-SIV", "AES-GMAC", "AES-KWP", "AES-SIV-CMAC", "AES-XTS":
+                return nil, Skip
+        case "AES-WRAP":
+                return &wycheproofTestGroupKW{}, variant
+        case "ARIA-CBC-PKCS5", "ARIA-CCM", "ARIA-CMAC", "ARIA-GCM", "ARIA-KWP", "ARIA-WRAP":
+                return nil, Skip
+        case "ASCON128", "ASCON128A", "ASCON80PQ":
+                return nil, Skip
+        case "CAMELLIA-CBC-PKCS5", "CAMELLIA-CCM", "CAMELLIA-CMAC", "CAMELLIA-WRAP":
+                return nil, Skip
         case "CHACHA20-POLY1305", "XCHACHA20-POLY1305":
-                return &wycheproofTestGroupChaCha{}
+                return &wycheproofTestGroupChaCha{}, variant
         case "DSA":
-                return &wycheproofTestGroupDSA{}
+                if wtv.Schema == "dsa_p1363_verify_schema_v1.json" {
+                        variant = P1363
+                }
+                return &wycheproofTestGroupDSA{}, variant
+        case "EcCurveTest":
+                return &wycheproofTestGroupEcCurve{}, variant
         case "ECDH":
-                return &wycheproofTestGroupECDH{}
+                if wtv.Schema == "ecdh_webcrypto_test_schema_v1.json" {
+                        return &wycheproofTestGroupECDHWebCrypto{}, Webcrypto
+                }
+                if wtv.Schema == "ecdh_ecpoint_test_schema_v1.json" {
+                        variant = EcPoint
+                }
+                if wtv.Schema == "ecdh_pem_test_schema_v1.json" {
+                        variant = Skip
+                }
+                return &wycheproofTestGroupECDH{}, variant
         case "ECDSA":
-                return &wycheproofTestGroupECDSA{}
+                if wtv.Schema == "ecdsa_bitcoin_verify_schema.json" {
+                        variant = Skip
+                }
+                if wtv.Schema == "ecdsa_p1363_verify_schema_v1.json" {
+                        variant = P1363
+                }
+                return &wycheproofTestGroupECDSA{}, variant
         case "EDDSA":
-                return &wycheproofTestGroupEdDSA{}
+                return &wycheproofTestGroupEdDSA{}, variant
         case "HKDF-SHA-1", "HKDF-SHA-256", "HKDF-SHA-384", "HKDF-SHA-512":
-                return &wycheproofTestGroupHkdf{}
-        case "HMACSHA1", "HMACSHA224", "HMACSHA256", "HMACSHA384", "HMACSHA512", "HMACSHA3-224", "HMACSHA3-256", "HMACSHA3-384", "HMACSHA3-512":
-                return &wycheproofTestGroupHmac{}
-        case "KW":
-                return &wycheproofTestGroupKW{}
+                return &wycheproofTestGroupHkdf{}, variant
+        case "HMACSHA1", "HMACSHA224", "HMACSHA256", "HMACSHA384", "HMACSHA512", "HMACSHA512/224", "HMACSHA512/256", "HMACSHA3-224", "HMACSHA3-256", "HMACSHA3-384", "HMACSHA3-512":
+                return &wycheproofTestGroupHmac{}, variant
+        case "HMACSM3":
+                return nil, Skip
+        case "KMAC128", "KMAC256":
+                return nil, Skip
+        case "ML-DSA-44", "ML-DSA-65", "ML-DSA-87":
+                return nil, Skip
+        case "ML-KEM":
+                return &wycheproofTestGroupMLKEM{}, Normal
+        case "MORUS640", "MORUS1280":
+                return nil, Skip
+        case "PbeWithHmacSha1AndAes_128", "PbeWithHmacSha1AndAes_192", "PbeWithHmacSha1AndAes_256", "PbeWithHmacSha224AndAes_128", "PbeWithHmacSha224AndAes_192", "PbeWithHmacSha224AndAes_256", "PbeWithHmacSha256AndAes_128", "PbeWithHmacSha256AndAes_192", "PbeWithHmacSha256AndAes_256", "PbeWithHmacSha384AndAes_128", "PbeWithHmacSha384AndAes_192", "PbeWithHmacSha384AndAes_256", "PbeWithHmacSha512AndAes_128", "PbeWithHmacSha512AndAes_192", "PbeWithHmacSha512AndAes_256":
+                return nil, Skip
+        case "PBKDF2-HMACSHA1", "PBKDF2-HMACSHA224", "PBKDF2-HMACSHA256", "PBKDF2-HMACSHA384", "PBKDF2-HMACSHA512":
+                return nil, Skip
         case "PrimalityTest":
-                return &wycheproofTestGroupPrimality{}
+                return &wycheproofTestGroupPrimality{}, variant
         case "RSAES-OAEP":
-                return &wycheproofTestGroupRsaesOaep{}
+                return &wycheproofTestGroupRsaesOaep{}, variant
         case "RSAES-PKCS1-v1_5":
-                return &wycheproofTestGroupRsaesPkcs1{}
+                return &wycheproofTestGroupRsaesPkcs1{}, variant
         case "RSASSA-PSS":
-                return &wycheproofTestGroupRsassa{}
+                return &wycheproofTestGroupRsassa{}, variant
         case "RSASSA-PKCS1-v1_5", "RSASig":
-                return &wycheproofTestGroupRSA{}
-        case "XDH", "X25519":
-                return &wycheproofTestGroupX25519{}
+                return &wycheproofTestGroupRSA{}, variant
+        case "SEED-CCM", "SEED-GCM", "SEED-WRAP":
+                return nil, Skip
+        case "SipHash-1-3", "SipHash-2-4", "SipHash-4-8", "SipHashX-2-4", "SipHashX-4-8":
+                return nil, Skip
+        case "SM4-CCM", "SM4-GCM":
+                return nil, Skip
+        case "VMAC-AES":
+                return nil, Skip
+        case "XDH":
+                switch wtv.Schema {
+                case "xdh_asn_comp_schema_v1.json", "xdh_jwk_comp_schema_v1.json", "xdh_pem_comp_schema_v1.json":
+                        variant = Skip
+                case "xdh_comp_schema_v1.json":
+                        variant = Normal
+                }
+                return &wycheproofTestGroupX25519{}, variant
         default:
-                return nil
+                // XXX - JOSE tests don't set an Algorithm...
+                if strings.HasPrefix(wtv.Schema, "json_web_") {
+                        return nil, Skip
+                }
+                return nil, Normal
         }
 }
 
-func runTestVectors(path string, variant testVariant) bool {
+func runTestVectors(path string) bool {
         b, err := ioutil.ReadFile(path)
         if err != nil {
                 log.Fatalf("Failed to read test vectors: %v", err)
         }
-        wtv := &wycheproofTestVectors{}
+        wtv := &wycheproofTestVectorsV1{}
         if err := json.Unmarshal(b, wtv); err != nil {
                 log.Fatalf("Failed to unmarshal JSON: %v", err)
         }
@@ -2657,10 +3006,13 @@ func runTestVectors(path string, variant testVariant) bool {
 
         success := true
         for _, tg := range wtv.TestGroups {
-                wtg := testGroupFromAlgorithm(wtv.Algorithm, variant)
+                wtg, variant := testGroupFromTestVector(wtv)
+                if variant == Skip {
+                        fmt.Printf("INFO: Skipping tests from \"%s\"\n", filepath.Base(path))
+                        return true
+                }
                 if wtg == nil {
-                        log.Printf("INFO: Unknown test vector algorithm %q", wtv.Algorithm)
-                        return false
+                        log.Fatalf("INFO: Unknown test vector algorithm %qin \"%s\"", wtv.Algorithm, filepath.Base(path))
                 }
                 if err := json.Unmarshal(tg, wtg); err != nil {
                         log.Fatalf("Failed to unmarshal test groups JSON: %v", err)
@@ -2714,44 +3066,13 @@ func (tc *testCoordinator) shutdown() {
 }
 
 func main() {
-        if _, err := os.Stat(testVectorPath); os.IsNotExist(err) {
+        path := testVectorPath
+        if _, err := os.Stat(path); os.IsNotExist(err) {
                 fmt.Printf("package wycheproof-testvectors is required for this regress\n")
                 fmt.Printf("SKIPPED\n")
                 os.Exit(0)
         }
 
-        tests := []struct {
-                name    string
-                pattern string
-                variant testVariant
-        }{
-                {"AES", "aes_[cg]*[^xv]_test.json", Normal}, // Skip AES-EAX, AES-GCM-SIV and AES-SIV-CMAC.
-                {"ChaCha20-Poly1305", "chacha20_poly1305_test.json", Normal},
-                {"DSA", "dsa_*test.json", Normal},
-                {"DSA", "dsa_*_p1363_test.json", P1363},
-                {"ECDH", "ecdh_test.json", Normal},
-                {"ECDH", "ecdh_[^w_]*_test.json", Normal},
-                {"ECDH EcPoint", "ecdh_*_ecpoint_test.json", EcPoint},
-                {"ECDH webcrypto", "ecdh_webcrypto_test.json", Webcrypto},
-                {"ECDSA", "ecdsa_test.json", Normal},
-                {"ECDSA", "ecdsa_[^w]*test.json", Normal},
-                {"ECDSA P1363", "ecdsa_*_p1363_test.json", P1363},
-                {"ECDSA webcrypto", "ecdsa_webcrypto_test.json", Webcrypto},
-                {"EDDSA", "eddsa_test.json", Normal},
-                {"ED448", "ed448_test.json", Skip},
-                {"HKDF", "hkdf_sha*_test.json", Normal},
-                {"HMAC", "hmac_sha*_test.json", Normal},
-                {"JSON webcrypto", "json_web_*_test.json", Skip},
-                {"KW", "kw_test.json", Normal},
-                {"Primality test", "primality_test.json", Normal},
-                {"RSA", "rsa_*test.json", Normal},
-                {"X25519", "x25519_test.json", Normal},
-                {"X25519 ASN", "x25519_asn_test.json", Skip},
-                {"X25519 JWK", "x25519_jwk_test.json", Skip},
-                {"X25519 PEM", "x25519_pem_test.json", Skip},
-                {"XCHACHA20-POLY1305", "xchacha20_poly1305_test.json", Normal},
-        }
-
         success := true
 
         var wg sync.WaitGroup
@@ -2764,33 +3085,25 @@ func main() {
 
         testc = newTestCoordinator()
 
-        skipNormal := regexp.MustCompile(`_(ecpoint|p1363|sect\d{3}[rk]1|secp(160|192))_`)
-
-        for _, test := range tests {
-                tvs, err := filepath.Glob(filepath.Join(testVectorPath, test.pattern))
-                if err != nil {
-                        log.Fatalf("Failed to glob %v test vectors: %v", test.name, err)
-                }
-                if len(tvs) == 0 {
-                        log.Fatalf("Failed to find %v test vectors at %q\n", test.name, testVectorPath)
-                }
-                for _, tv := range tvs {
-                        if test.variant == Skip || (test.variant == Normal && skipNormal.Match([]byte(tv))) {
-                                fmt.Printf("INFO: Skipping tests from \"%s\"\n", strings.TrimPrefix(tv, testVectorPath+"/"))
-                                continue
+        tvs, err := filepath.Glob(filepath.Join(path, "*.json"))
+        if err != nil {
+                log.Fatalf("Failed to glob test vectors: %v", err)
+        }
+        if len(tvs) == 0 {
+                log.Fatalf("Failed to find test vectors at %q\n", path)
+        }
+        for _, tv := range tvs {
+                wg.Add(1)
+                <-vectorsRateLimitCh
+                go func(tv string) {
+                        select {
+                        case resultCh <- runTestVectors(tv):
+                        default:
+                                log.Fatal("result channel is full")
                         }
-                        wg.Add(1)
-                        <-vectorsRateLimitCh
-                        go func(tv string, variant testVariant) {
-                                select {
-                                case resultCh <- runTestVectors(tv, variant):
-                                default:
-                                        log.Fatal("result channel is full")
-                                }
-                                vectorsRateLimitCh <- true
-                                wg.Done()
-                        }(tv, test.variant)
-                }
+                        vectorsRateLimitCh <- true
+                        wg.Done()
+                }(tv)
         }
 
         wg.Wait()
diff --git a/src/regress/lib/libcrypto/x509/Makefile b/src/regress/lib/libcrypto/x509/Makefile
index 19e65efddd..94e9e476a0 100644
--- a/src/regress/lib/libcrypto/x509/Makefile
+++ b/src/regress/lib/libcrypto/x509/Makefile
@@ -1,6 +1,6 @@
-#       $OpenBSD: Makefile,v 1.24 2025/03/15 06:37:49 tb Exp $
+#       $OpenBSD: Makefile,v 1.25 2025/05/05 06:33:34 tb Exp $
 
-PROGS = constraints verify x509attribute x509name x509req_ext callback
+PROGS = constraints verify x509attribute x509req_ext callback
 PROGS += expirecallback callbackfailures x509_asn1 x509_extensions_test
 PROGS += x509_name_test
 LDADD = -lcrypto
@@ -16,7 +16,7 @@ CFLAGS +=	-I${.CURDIR}/../../../../lib/libcrypto/bytestring
 
 SUBDIR += bettertls policy rfc3779
 
-CLEANFILES +=   x509name.result callback.out
+CLEANFILES +=   callback.out
 
 .if make(clean) || make(cleandir)
 . if ${.OBJDIR} != ${.CURDIR}
@@ -29,10 +29,6 @@ run-regress-verify: verify
         perl ${.CURDIR}/make-dir-roots.pl ${.CURDIR}/../certs .
         ./verify ${.CURDIR}/../certs
 
-run-regress-x509name: x509name
-        ./x509name > x509name.result
-        diff -u ${.CURDIR}/x509name.expected x509name.result
-
 run-regress-callback: callback
         ./callback ${.CURDIR}/../certs
         perl ${.CURDIR}/callback.pl callback.out
diff --git a/src/regress/lib/libcrypto/x509/bettertls/Makefile b/src/regress/lib/libcrypto/x509/bettertls/Makefile
index 2724140635..2a06239fc5 100644
--- a/src/regress/lib/libcrypto/x509/bettertls/Makefile
+++ b/src/regress/lib/libcrypto/x509/bettertls/Makefile
@@ -1,10 +1,10 @@
-#       $OpenBSD: Makefile,v 1.6 2024/12/27 08:02:27 tb Exp $
+#       $OpenBSD: Makefile,v 1.7 2025/07/23 07:46:12 tb Exp $
 
 PROGS =         verify
 
-.ifdef EOPENSSL33
-LDADD +=        -Wl,-rpath,/usr/local/lib/eopenssl33 -L/usr/local/lib/eopenssl33
-CFLAGS +=       -I/usr/local/include/eopenssl33/
+.ifdef EOPENSSL35
+LDADD +=        -Wl,-rpath,/usr/local/lib/eopenssl35 -L/usr/local/lib/eopenssl35
+CFLAGS +=       -I/usr/local/include/eopenssl35/
 .endif
 
 LDADD +=        -lcrypto
diff --git a/src/regress/lib/libcrypto/x509/x509_name_test.c b/src/regress/lib/libcrypto/x509/x509_name_test.c
index eaf7076d74..24e62cc766 100644
--- a/src/regress/lib/libcrypto/x509/x509_name_test.c
+++ b/src/regress/lib/libcrypto/x509/x509_name_test.c
@@ -1,7 +1,9 @@
-/*      $OpenBSD: x509_name_test.c,v 1.2 2025/03/19 11:19:17 tb Exp $ */
+/*      $OpenBSD: x509_name_test.c,v 1.3 2025/05/05 06:33:34 tb Exp $ */
 
 /*
  * Copyright (c) 2025 Theo Buehler <tb@openbsd.org>
+ * Copyright (c) 2025 Kenjiro Nakayama <nakayamakenjiro@gmail.com>
+ * Copyright (c) 2018 Ingo Schwarze <schwarze@openbsd.org>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -288,12 +290,131 @@ x509_name_compat_test(void)
         return failed;
 }
 
+static const struct x509_name_entry_test {
+        const char *field;
+        const char *value;
+        int loc;
+        int set;
+        const char *expected_str;
+        const int expected_set[4];
+        const int expected_count;
+} entry_tests[] = {
+        {
+                .field = "ST",
+                .value = "BaWue",
+                .loc = -1,
+                .set = 0,
+                .expected_str = "ST=BaWue",
+                .expected_set = { 0 },
+                .expected_count = 1,
+        },
+        {
+                .field = "O",
+                .value = "KIT",
+                .loc = -1,
+                .set = 0,
+                .expected_str = "ST=BaWue, O=KIT",
+                .expected_set = { 0, 1 },
+                .expected_count = 2,
+        },
+        {
+                .field = "L",
+                .value = "Karlsruhe",
+                .loc = 1,
+                .set = 0,
+                .expected_str = "ST=BaWue, L=Karlsruhe, O=KIT",
+                .expected_set = { 0, 1, 2 },
+                .expected_count = 3,
+        },
+        {
+                .field = "C",
+                .value = "DE",
+                .loc = 0,
+                .set = 1,
+                .expected_str = "C=DE + ST=BaWue, L=Karlsruhe, O=KIT",
+                .expected_set = { 0, 0, 1, 2 },
+                .expected_count = 4,
+        },
+};
+
+#define N_ENTRY_TESTS (sizeof(entry_tests) / sizeof(entry_tests[0]))
+
+static int
+verify_x509_name_output(X509_NAME *name, const struct x509_name_entry_test *tc)
+{
+        BIO *bio;
+        char *got;
+        long got_len;
+        int loc, ret;
+        int failed = 1;
+
+        if ((bio = BIO_new(BIO_s_mem())) == NULL)
+                goto fail;
+
+        if ((ret = X509_NAME_print_ex(bio, name, 0, XN_FLAG_SEP_CPLUS_SPC)) == -1)
+                goto fail;
+
+        if ((got_len = BIO_get_mem_data(bio, &got)) < 0)
+                goto fail;
+
+        if (ret != got_len || strlen(tc->expected_str) != (size_t)ret)
+                goto fail;
+
+        if (strncmp(tc->expected_str, got, got_len) != 0)
+                goto fail;
+
+        if (X509_NAME_entry_count(name) != tc->expected_count)
+                goto fail;
+
+        for (loc = 0; loc < X509_NAME_entry_count(name); loc++) {
+                X509_NAME_ENTRY *e = X509_NAME_get_entry(name, loc);
+                if (e == NULL || X509_NAME_ENTRY_set(e) != tc->expected_set[loc])
+                        goto fail;
+        }
+
+        failed = 0;
+
+ fail:
+        BIO_free(bio);
+
+        return failed;
+}
+
+static int
+x509_name_add_entry_test(void)
+{
+        X509_NAME *name;
+        int failed = 1;
+
+        if ((name = X509_NAME_new()) == NULL)
+                goto done;
+
+        for (size_t i = 0; i < N_ENTRY_TESTS; i++) {
+                const struct x509_name_entry_test *t = &entry_tests[i];
+
+                if (!X509_NAME_add_entry_by_txt(name, t->field, MBSTRING_ASC,
+                    (const unsigned char *)t->value, -1, t->loc, t->set))
+                        goto done;
+
+                if (verify_x509_name_output(name, t))
+                        goto done;
+        }
+
+        failed = 0;
+
+ done:
+        X509_NAME_free(name);
+
+        return failed;
+}
+
 int
 main(void)
 {
         int failed = 0;
 
         failed |= x509_name_compat_test();
+        failed |= x509_name_add_entry_test();
 
         return failed;
 }
diff --git a/src/regress/lib/libcrypto/x509/x509name.c b/src/regress/lib/libcrypto/x509/x509name.c
deleted file mode 100644
index 9deeeb2986..0000000000
--- a/src/regress/lib/libcrypto/x509/x509name.c
+++ /dev/null
@@ -1,62 +0,0 @@
-/* $OpenBSD: x509name.c,v 1.3 2021/10/31 08:27:15 tb Exp $ */
-/*
- * Copyright (c) 2018 Ingo Schwarze <schwarze@openbsd.org>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <err.h>
-#include <stdio.h>
-
-#include <openssl/x509.h>
-
-static void      debug_print(X509_NAME *);
-
-static void
-debug_print(X509_NAME *name)
-{
-        int loc;
-
-        for (loc = 0; loc < X509_NAME_entry_count(name); loc++)
-                printf("%d:",
-                    X509_NAME_ENTRY_set(X509_NAME_get_entry(name, loc)));
-        putchar(' ');
-        X509_NAME_print_ex_fp(stdout, name, 0, XN_FLAG_SEP_CPLUS_SPC);
-        putchar('\n');
-}
-
-int
-main(void)
-{
-        X509_NAME *name;
-
-        if ((name = X509_NAME_new()) == NULL)
-                err(1, NULL);
-        X509_NAME_add_entry_by_txt(name, "ST", MBSTRING_ASC,
-            "BaWue", -1, -1, 0);
-        X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC,
-            "KIT", -1, -1, 0);
-        debug_print(name);
-
-        X509_NAME_add_entry_by_txt(name, "L", MBSTRING_ASC,
-            "Karlsruhe", -1, 1, 0);
-        debug_print(name);
-
-        X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC,
-            "DE", -1, 0, 1);
-        debug_print(name);
-
-        X509_NAME_free(name);
-
-        return 0;
-}
diff --git a/src/regress/lib/libcrypto/x509/x509name.expected b/src/regress/lib/libcrypto/x509/x509name.expected
deleted file mode 100644
index 6cee7cc435..0000000000
--- a/src/regress/lib/libcrypto/x509/x509name.expected
+++ /dev/null
@@ -1,3 +0,0 @@
-0:1: ST=BaWue, O=KIT
-0:1:2: ST=BaWue, L=Karlsruhe, O=KIT
-0:0:1:2: C=DE + ST=BaWue, L=Karlsruhe, O=KIT
diff --git a/src/regress/lib/libssl/interop/Makefile b/src/regress/lib/libssl/interop/Makefile
index bdc67f627a..e1e9633d37 100644
--- a/src/regress/lib/libssl/interop/Makefile
+++ b/src/regress/lib/libssl/interop/Makefile
@@ -1,6 +1,6 @@
-# $OpenBSD: Makefile,v 1.21 2025/01/15 10:54:17 tb Exp $
+# $OpenBSD: Makefile,v 1.23 2025/07/25 16:33:15 tb Exp $
 
-SUBDIR =        libressl openssl33 openssl34
+SUBDIR =        libressl openssl35
 
 # the above binaries must have been built before we can continue
 SUBDIR +=       netcat
diff --git a/src/regress/lib/libssl/interop/botan/Makefile b/src/regress/lib/libssl/interop/botan/Makefile
index 85877d4290..56bcdaf4bd 100644
--- a/src/regress/lib/libssl/interop/botan/Makefile
+++ b/src/regress/lib/libssl/interop/botan/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.10 2025/01/15 10:54:17 tb Exp $
+# $OpenBSD: Makefile,v 1.12 2025/07/25 16:33:15 tb Exp $
 
 .include <bsd.own.mk>
 
@@ -20,11 +20,8 @@ CXX = /usr/local/bin/eg++
 .endif
 
 LIBRARIES =             libressl
-.if exists(/usr/local/bin/eopenssl33)
-LIBRARIES +=            openssl33
-.endif
-.if exists(/usr/local/bin/eopenssl34)
-LIBRARIES +=            openssl34
+.if exists(/usr/local/bin/eopenssl35)
+LIBRARIES +=            openssl35
 .endif
 
 PROGS =         client
diff --git a/src/regress/lib/libssl/interop/cert/Makefile b/src/regress/lib/libssl/interop/cert/Makefile
index 74c63c86a8..9698c56acd 100644
--- a/src/regress/lib/libssl/interop/cert/Makefile
+++ b/src/regress/lib/libssl/interop/cert/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.14 2025/01/15 10:54:17 tb Exp $
+# $OpenBSD: Makefile,v 1.16 2025/07/25 16:33:15 tb Exp $
 
 # Connect a client to a server.  Both can be current libressl, or
 # openssl 3.x.  Create client and server certificates
@@ -7,11 +7,8 @@
 # and check the result of certificate verification.
 
 LIBRARIES =             libressl
-.if exists(/usr/local/bin/eopenssl33)
-LIBRARIES +=            openssl33
-.endif
-.if exists(/usr/local/bin/eopenssl34)
-LIBRARIES +=            openssl34
+.if exists(/usr/local/bin/eopenssl35)
+LIBRARIES +=            openssl35
 .endif
 
 .for cca in noca ca fakeca
diff --git a/src/regress/lib/libssl/interop/cipher/Makefile b/src/regress/lib/libssl/interop/cipher/Makefile
index fa7e25f9ee..5bdc9089fe 100644
--- a/src/regress/lib/libssl/interop/cipher/Makefile
+++ b/src/regress/lib/libssl/interop/cipher/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.17 2025/01/15 10:54:17 tb Exp $
+# $OpenBSD: Makefile,v 1.19 2025/07/25 16:33:15 tb Exp $
 
 # Connect a client to a server.  Both can be current libressl, or
 # openssl 1.1 or 3.0.  Create lists of supported ciphers
@@ -7,11 +7,8 @@
 # have used correct cipher by grepping in their session print out.
 
 LIBRARIES =             libressl
-.if exists(/usr/local/bin/eopenssl33)
-LIBRARIES +=            openssl33
-.endif
-.if exists(/usr/local/bin/eopenssl34)
-LIBRARIES +=            openssl34
+.if exists(/usr/local/bin/eopenssl35)
+LIBRARIES +=            openssl35
 .endif
 
 CLEANFILES =    *.tmp *.ciphers ciphers.mk
@@ -41,8 +38,7 @@ client-${clib}-server-${slib}.ciphers: \
         uniq -d <$@.tmp >$@
         # we are only interested in ciphers supported by libressl
         sort $@ client-libressl.ciphers >$@.tmp
-. if "${clib}" == "openssl33" || "${slib}" == "openssl33" || \
-        "${clib}" == "openssl34" || "${slib}" == "openssl34"
+. if "${clib}" == "openssl35" || "${slib}" == "openssl35"
         # OpenSSL's SSL_CTX_set_cipher_list doesn't accept TLSv1.3 ciphers
         sed -i '/^TLS_/d' $@.tmp
 . endif
@@ -70,8 +66,7 @@ regress: ciphers.mk
 .endif
 
 LEVEL_libressl =
-LEVEL_openssl33 = ,@SECLEVEL=0
-LEVEL_openssl34 = ,@SECLEVEL=0
+LEVEL_openssl35 = ,@SECLEVEL=0
 
 .for clib in ${LIBRARIES}
 .for slib in ${LIBRARIES}
@@ -132,7 +127,7 @@ check-cipher-${cipher}-client-${clib}-server-${slib}: \
 . endif
 . if "${clib}" == "libressl"
         # libressl client may prefer chacha-poly if aes-ni is not supported
-.  if "${slib}" == "openssl33" || "${slib}" == "openssl34"
+.  if "${slib}" == "openssl35"
         egrep -q ' Cipher *: TLS_(AES_256_GCM_SHA384|CHACHA20_POLY1305_SHA256)$$' ${@:S/^check/server/}.out
 .  else
         egrep -q ' Cipher *: TLS_(AES_256_GCM_SHA384|CHACHA20_POLY1305_SHA256)$$' ${@:S/^check/server/}.out
diff --git a/src/regress/lib/libssl/interop/netcat/Makefile b/src/regress/lib/libssl/interop/netcat/Makefile
index 3b8e3f95be..cff6b7ea76 100644
--- a/src/regress/lib/libssl/interop/netcat/Makefile
+++ b/src/regress/lib/libssl/interop/netcat/Makefile
@@ -1,11 +1,8 @@
-# $OpenBSD: Makefile,v 1.10 2025/01/15 10:54:17 tb Exp $
+# $OpenBSD: Makefile,v 1.12 2025/07/25 16:33:15 tb Exp $
 
 LIBRARIES =             libressl
-.if exists(/usr/local/bin/eopenssl33)
-LIBRARIES +=            openssl33
-.endif
-.if exists(/usr/local/bin/eopenssl34)
-LIBRARIES +=            openssl34
+.if exists(/usr/local/bin/eopenssl35)
+LIBRARIES +=            openssl35
 .endif
 
 # run netcat server and connect with test client
diff --git a/src/regress/lib/libssl/interop/openssl33/Makefile b/src/regress/lib/libssl/interop/openssl33/Makefile
deleted file mode 100644
index eff61704d0..0000000000
--- a/src/regress/lib/libssl/interop/openssl33/Makefile
+++ /dev/null
@@ -1,44 +0,0 @@
-# $OpenBSD: Makefile,v 1.1 2025/01/15 10:54:17 tb Exp $
-
-.if ! exists(/usr/local/bin/eopenssl33)
-regress:
-        # install openssl-3.3 from ports for interop tests
-        @echo 'Run "pkg_add openssl--%3.3" to run tests against OpenSSL 3.3'
-        @echo SKIPPED
-.else
-
-PROGS =                 client server
-CFLAGS +=               -DOPENSSL_SUPPRESS_DEPRECATED
-CPPFLAGS =              -I /usr/local/include/eopenssl33
-LDFLAGS =               -L /usr/local/lib/eopenssl33
-LDADD =                 -lssl -lcrypto
-DPADD =                 /usr/local/lib/eopenssl33/libssl.a \
-                        /usr/local/lib/eopenssl33/libcrypto.a
-LD_LIBRARY_PATH =       /usr/local/lib/eopenssl33
-REGRESS_TARGETS =       run-self-client-server
-.for p in ${PROGS}
-REGRESS_TARGETS +=      run-ldd-$p run-version-$p run-protocol-$p
-.endfor
-
-.for p in ${PROGS}
-
-run-ldd-$p: ldd-$p.out
-        # check that $p is linked with OpenSSL 3.3
-        grep -q /usr/local/lib/eopenssl33/libcrypto.so ldd-$p.out
-        grep -q /usr/local/lib/eopenssl33/libssl.so ldd-$p.out
-        # check that $p is not linked with LibreSSL
-        ! grep -v libc.so ldd-$p.out | grep /usr/lib/
-
-run-version-$p: $p-self.out
-        # check that runtime version is OpenSSL 3.3
-        grep 'SSLEAY_VERSION: OpenSSL 3.3' $p-self.out
-
-run-protocol-$p: $p-self.out
-        # check that OpenSSL 3.3 protocol version is TLS 1.3
-        grep 'Protocol *: TLSv1.3' $p-self.out
-
-.endfor
-
-.endif # exists(/usr/local/bin/eopenssl33)
-
-.include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/interop/openssl34/Makefile b/src/regress/lib/libssl/interop/openssl34/Makefile
deleted file mode 100644
index 72246bb621..0000000000
--- a/src/regress/lib/libssl/interop/openssl34/Makefile
+++ /dev/null
@@ -1,44 +0,0 @@
-# $OpenBSD: Makefile,v 1.1 2025/01/15 10:54:17 tb Exp $
-
-.if ! exists(/usr/local/bin/eopenssl34)
-regress:
-        # install openssl-3.4 from ports for interop tests
-        @echo 'Run "pkg_add openssl--%3.4" to run tests against OpenSSL 3.4'
-        @echo SKIPPED
-.else
-
-PROGS =                 client server
-CFLAGS +=               -DOPENSSL_SUPPRESS_DEPRECATED
-CPPFLAGS =              -I /usr/local/include/eopenssl34
-LDFLAGS =               -L /usr/local/lib/eopenssl34
-LDADD =                 -lssl -lcrypto
-DPADD =                 /usr/local/lib/eopenssl34/libssl.a \
-                        /usr/local/lib/eopenssl34/libcrypto.a
-LD_LIBRARY_PATH =       /usr/local/lib/eopenssl34
-REGRESS_TARGETS =       run-self-client-server
-.for p in ${PROGS}
-REGRESS_TARGETS +=      run-ldd-$p run-version-$p run-protocol-$p
-.endfor
-
-.for p in ${PROGS}
-
-run-ldd-$p: ldd-$p.out
-        # check that $p is linked with OpenSSL 3.4
-        grep -q /usr/local/lib/eopenssl34/libcrypto.so ldd-$p.out
-        grep -q /usr/local/lib/eopenssl34/libssl.so ldd-$p.out
-        # check that $p is not linked with LibreSSL
-        ! grep -v libc.so ldd-$p.out | grep /usr/lib/
-
-run-version-$p: $p-self.out
-        # check that runtime version is OpenSSL 3.4
-        grep 'SSLEAY_VERSION: OpenSSL 3.4' $p-self.out
-
-run-protocol-$p: $p-self.out
-        # check that OpenSSL 3.4 protocol version is TLS 1.3
-        grep 'Protocol *: TLSv1.3' $p-self.out
-
-.endfor
-
-.endif # exists(/usr/local/bin/eopenssl34)
-
-.include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/interop/openssl35/Makefile b/src/regress/lib/libssl/interop/openssl35/Makefile
new file mode 100644
index 0000000000..e11ad5dd20
--- /dev/null
+++ b/src/regress/lib/libssl/interop/openssl35/Makefile
@@ -0,0 +1,44 @@
+# $OpenBSD: Makefile,v 1.1 2025/07/09 17:48:02 tb Exp $
+
+.if ! exists(/usr/local/bin/eopenssl35)
+regress:
+        # install openssl-3.5 from ports for interop tests
+        @echo 'Run "pkg_add openssl--%3.5" to run tests against OpenSSL 3.5'
+        @echo SKIPPED
+.else
+
+PROGS =                 client server
+CFLAGS +=               -DOPENSSL_SUPPRESS_DEPRECATED
+CPPFLAGS =              -I /usr/local/include/eopenssl35
+LDFLAGS =               -L /usr/local/lib/eopenssl35
+LDADD =                 -lssl -lcrypto
+DPADD =                 /usr/local/lib/eopenssl35/libssl.a \
+                        /usr/local/lib/eopenssl35/libcrypto.a
+LD_LIBRARY_PATH =       /usr/local/lib/eopenssl35
+REGRESS_TARGETS =       run-self-client-server
+.for p in ${PROGS}
+REGRESS_TARGETS +=      run-ldd-$p run-version-$p run-protocol-$p
+.endfor
+
+.for p in ${PROGS}
+
+run-ldd-$p: ldd-$p.out
+        # check that $p is linked with OpenSSL 3.5
+        grep -q /usr/local/lib/eopenssl35/libcrypto.so ldd-$p.out
+        grep -q /usr/local/lib/eopenssl35/libssl.so ldd-$p.out
+        # check that $p is not linked with LibreSSL
+        ! grep -v -e libc.so -e libpthread.so ldd-$p.out | grep /usr/lib/
+
+run-version-$p: $p-self.out
+        # check that runtime version is OpenSSL 3.5
+        grep 'SSLEAY_VERSION: OpenSSL 3.5' $p-self.out
+
+run-protocol-$p: $p-self.out
+        # check that OpenSSL 3.5 protocol version is TLS 1.3
+        grep 'Protocol *: TLSv1.3' $p-self.out
+
+.endfor
+
+.endif # exists(/usr/local/bin/eopenssl35)
+
+.include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/interop/session/Makefile b/src/regress/lib/libssl/interop/session/Makefile
index e9a353f99e..fff66b169b 100644
--- a/src/regress/lib/libssl/interop/session/Makefile
+++ b/src/regress/lib/libssl/interop/session/Makefile
@@ -1,11 +1,8 @@
-# $OpenBSD: Makefile,v 1.12 2025/01/15 10:54:17 tb Exp $
+# $OpenBSD: Makefile,v 1.14 2025/07/25 16:33:15 tb Exp $
 
 LIBRARIES =             libressl
-.if exists(/usr/local/bin/eopenssl33)
-#LIBRARIES +=           openssl33
-.endif
-.if exists(/usr/local/bin/eopenssl34)
-#LIBRARIES +=           openssl34
+.if exists(/usr/local/bin/eopenssl35)
+#LIBRARIES +=           openssl35
 .endif
 
 run-session-client-libressl-server-libressl:
diff --git a/src/regress/lib/libssl/interop/version/Makefile b/src/regress/lib/libssl/interop/version/Makefile
index 605fba252f..5ee7d4c4f3 100644
--- a/src/regress/lib/libssl/interop/version/Makefile
+++ b/src/regress/lib/libssl/interop/version/Makefile
@@ -1,4 +1,4 @@
-# $OpenBSD: Makefile,v 1.10 2025/01/15 10:54:17 tb Exp $
+# $OpenBSD: Makefile,v 1.12 2025/07/25 16:33:15 tb Exp $
 
 # Connect a client to a server.  Both can be current libressl, or
 # openssl 1.1 or openssl 3.0.  Pin client or server to a fixed TLS
@@ -7,11 +7,8 @@
 # print out.
 
 LIBRARIES =             libressl
-.if exists(/usr/local/bin/eopenssl33)
-LIBRARIES +=            openssl33
-.endif
-.if exists(/usr/local/bin/eopenssl34)
-LIBRARIES +=            openssl34
+.if exists(/usr/local/bin/eopenssl35)
+LIBRARIES +=            openssl35
 .endif
 
 VERSIONS =      any TLS1_2 TLS1_3
@@ -29,8 +26,7 @@ FAIL_${cver}_${sver} = !
 .for slib in ${LIBRARIES}
 
 .if ("${cver}" != TLS1_3 && "${sver}" != TLS1_3) && \
-    ((("${clib}" != openssl33 && "${slib}" != openssl33)) || \
-    (("${clib}" != openssl34 && "${slib}" != openssl34)) || \
+    ((("${clib}" != openssl35 && "${slib}" != openssl35)) || \
     (("${cver}" != any && "${sver}" != any) && \
     ("${cver}" != TLS1 && "${sver}" != TLS1) && \
     ("${cver}" != TLS1_1 && "${sver}" != TLS1_1)))
diff --git a/src/regress/lib/libssl/openssl-ruby/Makefile b/src/regress/lib/libssl/openssl-ruby/Makefile
index af8083f662..19d2f2fc40 100644
--- a/src/regress/lib/libssl/openssl-ruby/Makefile
+++ b/src/regress/lib/libssl/openssl-ruby/Makefile
@@ -1,10 +1,10 @@
-#       $OpenBSD: Makefile,v 1.14 2024/08/31 11:14:58 tb Exp $
+#       $OpenBSD: Makefile,v 1.17 2025/06/27 03:32:08 tb Exp $
 
 OPENSSL_RUBY_TESTS =    /usr/local/share/openssl-ruby-tests
-.if exists(/usr/local/bin/ruby32)
-RUBY_BINREV =           32
-.else
+.if exists(/usr/local/bin/ruby33)
 RUBY_BINREV =           33
+.else
+RUBY_BINREV =           34
 .endif
 RUBY =                  ruby${RUBY_BINREV}
 
@@ -71,6 +71,21 @@ ${_t}: ${_BUILD_COOKIE}
                 -n ${_t}
 .endfor
 
+# These tests can be a pain to run. To run a small set of individual
+# ssl tests, set the test names separated by spaces in the environment
+# variable RUBY_SSL_TEST_TARGETS - then you can type "make <test_name>"
+# to run a single ruby ssl test.
+.for _t in ${RUBY_SSL_TEST_TARGETS}
+REGRESS_TARGETS += ${_t}
+REGRESS_EXPECTED_FAILURES += ${_t}
+${_t}: ${_BUILD_COOKIE}
+        cd ${BUILDDIR} && \
+            ${RUBY} -I. -I${OPENSSL_RUBY_TESTS}/test/openssl \
+                -I${OPENSSL_RUBY_TESTS}/lib \
+                ${OPENSSL_RUBY_TESTS}/test/openssl/test_ssl.rb \
+                -n ${_t}
+.endfor
+
 CLEANFILES +=           ${_BUILD_COOKIE} ${_TEST_COOKIE} ${_BUILDDIR_COOKIE}
 
 . if make(clean) || make(cleandir)
diff --git a/src/regress/lib/libssl/pqueue/Makefile b/src/regress/lib/libssl/pqueue/Makefile
index 48c2cb7e61..05fe9a268d 100644
--- a/src/regress/lib/libssl/pqueue/Makefile
+++ b/src/regress/lib/libssl/pqueue/Makefile
@@ -1,4 +1,4 @@
-#       $OpenBSD: Makefile,v 1.1 2016/11/04 19:45:12 jsing Exp $
+#       $OpenBSD: Makefile,v 1.2 2025/05/04 11:04:02 tb Exp $
 
 PROG=   pq_test
 SRC=    ${.CURDIR}/../../../../lib/libssl
@@ -9,9 +9,4 @@ DPADD=	${LIBSSL} ${LIBCRYPTO}
 WARNINGS=       Yes
 CFLAGS+=        -DLIBRESSL_INTERNAL -Werror
 
-REGRESS_TARGETS= regress-pq_test
-
-regress-pq_test: ${PROG}
-        ${.OBJDIR}/pq_test | cmp -s ${.CURDIR}/expected.txt /dev/stdin
-
 .include <bsd.regress.mk>
diff --git a/src/regress/lib/libssl/pqueue/expected.txt b/src/regress/lib/libssl/pqueue/expected.txt
deleted file mode 100644
index c59d6cd838..0000000000
--- a/src/regress/lib/libssl/pqueue/expected.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-item    6966726167696c69
-item    7374696365787069
-item    737570657263616c
diff --git a/src/regress/lib/libssl/pqueue/pq_test.c b/src/regress/lib/libssl/pqueue/pq_test.c
index a078ba5366..822fdea961 100644
--- a/src/regress/lib/libssl/pqueue/pq_test.c
+++ b/src/regress/lib/libssl/pqueue/pq_test.c
@@ -59,60 +59,77 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+
 #include "pqueue.h"
 
-/* remember to change expected.txt if you change these values */
-unsigned char prio1[8] = "supercal";
-unsigned char prio2[8] = "ifragili";
-unsigned char prio3[8] = "sticexpi";
+static const unsigned char *pq_expected[3] = {
+        "ifragili",
+        "sticexpi",
+        "supercal"
+};
 
-static void
-pqueue_print(pqueue pq)
+static int
+test_pqueue(void)
 {
-        pitem *iter, *item;
-
-        iter = pqueue_iterator(pq);
-        for (item = pqueue_next(&iter); item != NULL;
-            item = pqueue_next(&iter)) {
-                printf("item\t%02x%02x%02x%02x%02x%02x%02x%02x\n",
-                    item->priority[0], item->priority[1],
-                    item->priority[2], item->priority[3],
-                    item->priority[4], item->priority[5],
-                    item->priority[6], item->priority[7]);
-        }
-}
+        const unsigned char *prio1 = pq_expected[2];
+        const unsigned char *prio2 = pq_expected[0];
+        const unsigned char *prio3 = pq_expected[1];
+        pqueue pq = NULL;
+        pitem *item = NULL;
+        pitem *iter = NULL;
+        int i = 0;
+        int failed = 1;
 
-int
-main(void)
-{
-        pitem *item;
-        pqueue pq;
+        if ((pq = pqueue_new()) == NULL)
+                goto failure;
 
-        pq = pqueue_new();
+        if (!pqueue_insert(pq, pitem_new(prio3, NULL)))
+                goto failure;
+        if (!pqueue_insert(pq, pitem_new(prio1, NULL)))
+                goto failure;
+        if (!pqueue_insert(pq, pitem_new(prio2, NULL)))
+                goto failure;
 
-        item = pitem_new(prio3, NULL);
-        pqueue_insert(pq, item);
+        if (pqueue_size(pq) != 3)
+                goto failure;
 
-        item = pitem_new(prio1, NULL);
-        pqueue_insert(pq, item);
+        if ((item = pqueue_find(pq, prio1)) == NULL)
+                goto failure;
+        if ((item = pqueue_find(pq, prio2)) == NULL)
+                goto failure;
+        if ((item = pqueue_find(pq, prio3)) == NULL)
+                goto failure;
 
-        item = pitem_new(prio2, NULL);
-        pqueue_insert(pq, item);
+        if ((item = pqueue_peek(pq)) == NULL)
+                goto failure;
 
-        item = pqueue_find(pq, prio1);
-        fprintf(stderr, "found %p\n", item->priority);
+        if (memcmp(item->priority, pq_expected[0], 8))
+                goto failure;
 
-        item = pqueue_find(pq, prio2);
-        fprintf(stderr, "found %p\n", item->priority);
+        iter = pqueue_iterator(pq);
+        for (item = pqueue_next(&iter); item != NULL; item = pqueue_next(&iter)) {
+                if (memcmp(item->priority, pq_expected[i], 8) != 0)
+                        goto failure;
+                i++;
+        }
 
-        item = pqueue_find(pq, prio3);
-        fprintf(stderr, "found %p\n", item ? item->priority: 0);
+        failed = (i != 3);
 
-        pqueue_print(pq);
+ failure:
 
         for (item = pqueue_pop(pq); item != NULL; item = pqueue_pop(pq))
                 pitem_free(item);
-
         pqueue_free(pq);
-        return 0;
+
+        return failed;
+}
+
+int
+main(void)
+{
+        int failed = 0;
+
+        failed |= test_pqueue();
+
+        return failed;
 }
diff --git a/src/regress/lib/libssl/tlsext/tlsexttest.c b/src/regress/lib/libssl/tlsext/tlsexttest.c
index 4adf27421d..68584998ce 100644
--- a/src/regress/lib/libssl/tlsext/tlsexttest.c
+++ b/src/regress/lib/libssl/tlsext/tlsexttest.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tlsexttest.c,v 1.92 2024/09/11 15:04:16 tb Exp $ */
+/* $OpenBSD: tlsexttest.c,v 1.94 2025/05/03 08:37:28 tb Exp $ */
 /*
  * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -3740,6 +3740,11 @@ test_tlsext_keyshare_client(void)
                 FAIL("Did not select a key share");
                 goto done;
         }
+        if (tls_key_share_group(ssl->s3->hs.key_share) != 29) {
+                FAIL("wrong key share group: got %d, expected 29\n",
+                     tls_key_share_group(ssl->s3->hs.key_share));
+                goto done;
+        }
 
         /*
          * Pretend the client did not send the supported groups extension. We
@@ -4542,12 +4547,10 @@ test_tlsext_valid_hostnames(void)
 #define N_TLSEXT_RANDOMIZATION_TESTS 1000
 
 static int
-test_tlsext_check_extension_order(SSL *ssl)
+test_tlsext_check_psk_is_last_extension(SSL *ssl)
 {
         const struct tls_extension *ext;
         uint16_t type;
-        size_t alpn_idx, sni_idx;
-        size_t i;
 
         if (ssl->tlsext_build_order_len == 0) {
                 FAIL("Unexpected zero build order length");
@@ -4560,34 +4563,6 @@ test_tlsext_check_extension_order(SSL *ssl)
                 return 1;
         }
 
-        if (ssl->server)
-                return 0;
-
-        alpn_idx = sni_idx = ssl->tlsext_build_order_len;
-        for (i = 0; i < ssl->tlsext_build_order_len; i++) {
-                ext = ssl->tlsext_build_order[i];
-                if (tls_extension_type(ext) == TLSEXT_TYPE_alpn)
-                        alpn_idx = i;
-                if (tls_extension_type(ext) == TLSEXT_TYPE_server_name)
-                        sni_idx = i;
-        }
-
-        if (alpn_idx == ssl->tlsext_build_order_len) {
-                FAIL("could not find alpn extension\n");
-                return 1;
-        }
-
-        if (sni_idx == ssl->tlsext_build_order_len) {
-                FAIL("could not find alpn extension\n");
-                return 1;
-        }
-
-        if (sni_idx >= alpn_idx) {
-                FAIL("sni does not precede alpn: %zu >= %zu\n",
-                    sni_idx, alpn_idx);
-                return 1;
-        }
-
         return 0;
 }
 
@@ -4600,7 +4575,7 @@ test_tlsext_randomized_extensions(SSL *ssl)
         for (i = 0; i < N_TLSEXT_RANDOMIZATION_TESTS; i++) {
                 if (!tlsext_randomize_build_order(ssl))
                         errx(1, "failed to randomize extensions");
-                failed |= test_tlsext_check_extension_order(ssl);
+                failed |= test_tlsext_check_psk_is_last_extension(ssl);
         }
 
         return failed;
diff --git a/src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py b/src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
index 91aedad165..ff678ec9a8 100644
--- a/src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
+++ b/src/regress/lib/libssl/tlsfuzzer/tlsfuzzer.py
@@ -1,4 +1,4 @@
-#   $OpenBSD: tlsfuzzer.py,v 1.56 2024/09/18 19:12:37 tb Exp $
+#   $OpenBSD: tlsfuzzer.py,v 1.57 2025/06/15 09:44:57 tb Exp $
 #
 # Copyright (c) 2020 Theo Buehler <tb@openbsd.org>
 #
@@ -72,7 +72,7 @@ def substitute_alert(want, got):
     return f"Expected alert description \"{want}\" " \
         + f"does not match received \"{got}\""
 
-# test-tls13-finished.py has 70 failing tests that expect a "decode_error"
+# test_tls13_finished.py has 70 failing tests that expect a "decode_error"
 # instead of the "decrypt_error" sent by tls13_server_finished_recv().
 # Both alerts appear to be reasonable in this context, so work around this
 # in the test instead of the library.
@@ -164,46 +164,46 @@ def generate_test_tls13_finished_args():
     return args
 
 tls13_tests = TestGroup("TLSv1.3 tests", [
-    Test("test-tls13-ccs.py"),
-    Test("test-tls13-conversation.py"),
-    Test("test-tls13-count-tickets.py"),
-    Test("test-tls13-empty-alert.py"),
-    Test("test-tls13-finished.py", generate_test_tls13_finished_args()),
-    Test("test-tls13-finished-plaintext.py"),
-    Test("test-tls13-hrr.py"),
-    Test("test-tls13-keyshare-omitted.py"),
-    Test("test-tls13-legacy-version.py"),
-    Test("test-tls13-nociphers.py"),
-    Test("test-tls13-record-padding.py"),
+    Test("test_tls13_ccs.py"),
+    Test("test_tls13_conversation.py"),
+    Test("test_tls13_count_tickets.py"),
+    Test("test_tls13_empty_alert.py"),
+    Test("test_tls13_finished.py", generate_test_tls13_finished_args()),
+    Test("test_tls13_finished_plaintext.py"),
+    Test("test_tls13_hrr.py"),
+    Test("test_tls13_keyshare_omitted.py"),
+    Test("test_tls13_legacy_version.py"),
+    Test("test_tls13_nociphers.py"),
+    Test("test_tls13_record_padding.py"),
     # Exclude QUIC transport parameters
-    Test("test-tls13-shuffled-extentions.py", [ "--exc", "57" ]),
-    Test("test-tls13-zero-content-type.py"),
+    Test("test_tls13_shuffled_extentions.py", [ "--exc", "57" ]),
+    Test("test_tls13_zero_content_type.py"),
 
     # The skipped tests fail due to a bug in BIO_gets() which masks the retry
     # signalled from an SSL_read() failure. Testing with httpd(8) shows we're
     # handling these corner cases correctly since tls13_record_layer.c -r1.47.
-    Test("test-tls13-zero-length-data.py", [
+    Test("test_tls13_zero_length_data.py", [
         "-e", "zero-length app data",
         "-e", "zero-length app data with large padding",
         "-e", "zero-length app data with padding",
     ]),
 
     # We don't currently handle NSTs
-    Test("test-tls13-connection-abort.py", ["-e", "After NewSessionTicket"]),
+    Test("test_tls13_connection_abort.py", ["-e", "After NewSessionTicket"]),
 ])
 
 # Tests that take a lot of time (> ~30s on an x280)
 tls13_slow_tests = TestGroup("slow TLSv1.3 tests", [
     # XXX: Investigate the occasional message
     # "Got shared secret with 1 most significant bytes equal to zero."
-    Test("test-tls13-dhe-shared-secret-padding.py", tls13_unsupported_ciphers),
+    Test("test_tls13_dhe_shared_secret_padding.py", tls13_unsupported_ciphers),
 
-    Test("test-tls13-invalid-ciphers.py"),
-    Test("test-tls13-serverhello-random.py", tls13_unsupported_ciphers),
+    Test("test_tls13_invalid_ciphers.py"),
+    Test("test_tls13_serverhello_random.py", tls13_unsupported_ciphers),
 
     # Mark two tests cases as xfail for now. The tests expect an arguably
     # correct decode_error while we send a decrypt_error (like fizz/boring).
-    Test("test-tls13-record-layer-limits.py", [
+    Test("test_tls13_record_layer_limits.py", [
         "-x", "max size payload (2**14) of Finished msg, with 16348 bytes of left padding, cipher TLS_AES_128_GCM_SHA256",
         "-X", substitute_alert("decode_error", "decrypt_error"),
         "-x", "max size payload (2**14) of Finished msg, with 16348 bytes of left padding, cipher TLS_CHACHA20_POLY1305_SHA256",
@@ -212,22 +212,22 @@ tls13_slow_tests = TestGroup("slow TLSv1.3 tests", [
     # We don't accept an empty ECPF extension since it must advertise the
     # uncompressed point format. Exclude this extension type from the test.
     Test(
-        "test-tls13-large-number-of-extensions.py",
+        "test_tls13_large_number_of_extensions.py",
         tls13_args = ["--exc", "11"],
     ),
 ])
 
 tls13_extra_cert_tests = TestGroup("TLSv1.3 certificate tests", [
     # need to set up client certs to run these
-    Test("test-tls13-certificate-request.py"),
-    Test("test-tls13-certificate-verify.py"),
-    Test("test-tls13-ecdsa-in-certificate-verify.py"),
-    Test("test-tls13-eddsa-in-certificate-verify.py"),
+    Test("test_tls13_certificate_request.py"),
+    Test("test_tls13_certificate_verify.py"),
+    Test("test_tls13_ecdsa_in_certificate_verify.py"),
+    Test("test_tls13_eddsa_in_certificate_verify.py"),
 
     # Test expects the server to have installed three certificates:
     # with P-256, P-384 and P-521 curve. Also SHA1+ECDSA is verified
     # to not work.
-    Test("test-tls13-ecdsa-support.py"),
+    Test("test_tls13_ecdsa_support.py"),
 ])
 
 tls13_failing_tests = TestGroup("failing TLSv1.3 tests", [
@@ -235,7 +235,7 @@ tls13_failing_tests = TestGroup("failing TLSv1.3 tests", [
     # With X25519, we accept weak peer public keys and fail when we actually
     # compute the keyshare.  Other tests seem to indicate that we could be
     # stricter about what keyshares we accept.
-    Test("test-tls13-crfg-curves.py", [
+    Test("test_tls13_crfg_curves.py", [
         '-e', 'all zero x448 key share',
         '-e', 'empty x448 key share',
         '-e', 'sanity x448 with compression ansiX962_compressed_char2',
@@ -245,7 +245,7 @@ tls13_failing_tests = TestGroup("failing TLSv1.3 tests", [
         '-e', 'too small x448 key share',
         '-e', 'x448 key share of "1"',
     ]),
-    Test("test-tls13-ecdhe-curves.py", [
+    Test("test_tls13_ecdhe_curves.py", [
         '-e', 'sanity - x448',
         '-e', 'x448 - key share from other curve',
         '-e', 'x448 - point at infinity',
@@ -258,21 +258,21 @@ tls13_failing_tests = TestGroup("failing TLSv1.3 tests", [
     # We have the logic corresponding to NSS's fix for CVE-2020-25648
     # https://hg.mozilla.org/projects/nss/rev/57bbefa793232586d27cee83e74411171e128361
     # so should not be affected by this issue.
-    Test("test-tls13-multiple-ccs-messages.py"),
+    Test("test_tls13_multiple_ccs_messages.py"),
 
     # https://github.com/openssl/openssl/issues/8369
-    Test("test-tls13-obsolete-curves.py"),
+    Test("test_tls13_obsolete_curves.py"),
 
     # 3 failing rsa_pss_pss tests
-    Test("test-tls13-rsa-signatures.py"),
+    Test("test_tls13_rsa_signatures.py"),
 
     # The failing tests all expect an ri extension.  What's up with that?
-    Test("test-tls13-version-negotiation.py"),
+    Test("test_tls13_version_negotiation.py"),
 ])
 
 tls13_slow_failing_tests = TestGroup("slow, failing TLSv1.3 tests", [
     # Other test failures bugs in keyshare/tlsext negotiation?
-    Test("test-tls13-unrecognised-groups.py"),    # unexpected closure
+    Test("test_tls13_unrecognised_groups.py"),    # unexpected closure
 
     # 5 occasional failures:
     #   'app data split, conversation with KeyUpdate msg'
@@ -280,43 +280,43 @@ tls13_slow_failing_tests = TestGroup("slow, failing TLSv1.3 tests", [
     #   'multiple KeyUpdate messages'
     #   'post-handshake KeyUpdate msg with update_not_request'
     #   'post-handshake KeyUpdate msg with update_request'
-    Test("test-tls13-keyupdate.py"),
+    Test("test_tls13_keyupdate.py"),
 
-    Test("test-tls13-symetric-ciphers.py"),       # unexpected message from peer
+    Test("test_tls13_symetric_ciphers.py"),       # unexpected message from peer
 
     # 6 tests fail: 'rsa_pkcs1_{md5,sha{1,224,256,384,512}} signature'
     # We send server hello, but the test expects handshake_failure
-    Test("test-tls13-pkcs-signature.py"),
+    Test("test_tls13_pkcs_signature.py"),
     # 8 tests fail: 'tls13 signature rsa_pss_{pss,rsae}_sha{256,384,512}
-    Test("test-tls13-rsapss-signatures.py"),
+    Test("test_tls13_rsapss_signatures.py"),
 ])
 
 tls13_unsupported_tests = TestGroup("TLSv1.3 tests for unsupported features", [
     # Tests for features we don't support
-    Test("test-tls13-0rtt-garbage.py"),
-    Test("test-tls13-ffdhe-groups.py"),
-    Test("test-tls13-ffdhe-sanity.py"),
-    Test("test-tls13-psk_dhe_ke.py"),
-    Test("test-tls13-psk_ke.py"),
+    Test("test_tls13_0rtt_garbage.py"),
+    Test("test_tls13_ffdhe_groups.py"),
+    Test("test_tls13_ffdhe_sanity.py"),
+    Test("test_tls13_psk_dhe_ke.py"),
+    Test("test_tls13_psk_ke.py"),
 
     # need server to react to HTTP GET for /keyupdate
-    Test("test-tls13-keyupdate-from-server.py"),
+    Test("test_tls13_keyupdate_from_server.py"),
 
     # needs an echo server
-    Test("test-tls13-lengths.py"),
+    Test("test_tls13_lengths.py"),
 
     # Weird test: tests servers that don't support 1.3
-    Test("test-tls13-non-support.py"),
+    Test("test_tls13_non_support.py"),
 
     # broken test script
     # UnboundLocalError: local variable 'cert' referenced before assignment
-    Test("test-tls13-post-handshake-auth.py"),
+    Test("test_tls13_post_handshake_auth.py"),
 
     # ExpectNewSessionTicket
-    Test("test-tls13-session-resumption.py"),
+    Test("test_tls13_session_resumption.py"),
 
     # Server must be configured to support only rsa_pss_rsae_sha512
-    Test("test-tls13-signature-algorithms.py"),
+    Test("test_tls13_signature_algorithms.py"),
 ])
 
 tls12_exclude_legacy_protocols = [
@@ -345,52 +345,52 @@ tls12_exclude_legacy_protocols = [
 
 tls12_tests = TestGroup("TLSv1.2 tests", [
     # Tests that pass as they are.
-    Test("test-aes-gcm-nonces.py"),
-    Test("test-connection-abort.py"),
-    Test("test-conversation.py"),
-    Test("test-cve-2016-2107.py"),
-    Test("test-cve-2016-6309.py"),
-    Test("test-dhe-rsa-key-exchange.py"),
-    Test("test-early-application-data.py"),
-    Test("test-empty-extensions.py"),
-    Test("test-extensions.py"),
-    Test("test-fuzzed-MAC.py"),
-    Test("test-fuzzed-ciphertext.py"),
-    Test("test-fuzzed-finished.py"),
-    Test("test-fuzzed-padding.py"),
-    Test("test-fuzzed-plaintext.py"), # fails once in a while
-    Test("test-hello-request-by-client.py"),
-    Test("test-invalid-cipher-suites.py"),
-    Test("test-invalid-content-type.py"),
-    Test("test-invalid-session-id.py"),
-    Test("test-invalid-version.py"),
-    Test("test-large-number-of-extensions.py"),
-    Test("test-lucky13.py"),
-    Test("test-message-skipping.py"),
-    Test("test-no-heartbeat.py"),
-    Test("test-record-layer-fragmentation.py"),
-    Test("test-sslv2-connection.py"),
-    Test("test-truncating-of-finished.py"),
-    Test("test-truncating-of-kRSA-client-key-exchange.py"),
-    Test("test-unsupported-curve-fallback.py"),
-    Test("test-version-numbers.py"),
-    Test("test-zero-length-data.py"),
+    Test("test_aes_gcm_nonces.py"),
+    Test("test_connection_abort.py"),
+    Test("test_conversation.py"),
+    Test("test_cve_2016_2107.py"),
+    Test("test_cve_2016_6309.py"),
+    Test("test_dhe_rsa_key_exchange.py"),
+    Test("test_early_application_data.py"),
+    Test("test_empty_extensions.py"),
+    Test("test_extensions.py"),
+    Test("test_fuzzed_MAC.py"),
+    Test("test_fuzzed_ciphertext.py"),
+    Test("test_fuzzed_finished.py"),
+    Test("test_fuzzed_padding.py"),
+    Test("test_fuzzed_plaintext.py"), # fails once in a while
+    Test("test_hello_request_by_client.py"),
+    Test("test_invalid_cipher_suites.py"),
+    Test("test_invalid_content_type.py"),
+    Test("test_invalid_session_id.py"),
+    Test("test_invalid_version.py"),
+    Test("test_large_number_of_extensions.py"),
+    Test("test_lucky13.py"),
+    Test("test_message_skipping.py"),
+    Test("test_no_heartbeat.py"),
+    Test("test_record_layer_fragmentation.py"),
+    Test("test_sslv2_connection.py"),
+    Test("test_truncating_of_finished.py"),
+    Test("test_truncating_of_kRSA_client_key_exchange.py"),
+    Test("test_unsupported_curve_fallback.py"),
+    Test("test_version_numbers.py"),
+    Test("test_zero_length_data.py"),
 
     # Tests that need tweaking for unsupported features and ciphers.
     Test(
-        "test-atypical-padding.py", [
+        "test_atypical_padding.py", [
             "-e", "sanity - encrypt then MAC",
             "-e", "2^14 bytes of AppData with 256 bytes of padding (SHA1 + Encrypt then MAC)",
         ]
     ),
     Test(
-        "test-ccs.py", [
+        "test_ccs.py", [
             "-x", "two bytes long CCS",
             "-X", substitute_alert("unexpected_message", "decode_error"),
         ]
     ),
     Test(
-        "test-dhe-rsa-key-exchange-signatures.py", [
+        "test_dhe_rsa_key_exchange_signatures.py", [
             "-e", "TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA sha224 signature",
             "-e", "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 sha224 signature",
             "-e", "TLS_DHE_RSA_WITH_AES_128_CBC_SHA sha224 signature",
@@ -398,14 +398,14 @@ tls12_tests = TestGroup("TLSv1.2 tests", [
             "-e", "TLS_DHE_RSA_WITH_AES_256_CBC_SHA sha224 signature",
         ]
     ),
-    Test("test-dhe-rsa-key-exchange-with-bad-messages.py", [
+    Test("test_dhe_rsa_key_exchange_with_bad_messages.py", [
         "-x", "invalid dh_Yc value - missing",
         "-X", substitute_alert("decode_error", "illegal_parameter"),
     ]),
-    Test("test-dhe-key-share-random.py", tls12_exclude_legacy_protocols),
-    Test("test-export-ciphers-rejected.py", ["--min-ver", "TLSv1.2"]),
+    Test("test_dhe_key_share_random.py", tls12_exclude_legacy_protocols),
+    Test("test_export_ciphers_rejected.py", ["--min-ver", "TLSv1.2"]),
     Test(
-        "test-downgrade-protection.py",
+        "test_downgrade_protection.py",
         tls12_args = ["--server-max-protocol", "TLSv1.2"],
         tls13_args = [
             "--server-max-protocol", "TLSv1.3",
@@ -414,7 +414,7 @@ tls12_tests = TestGroup("TLSv1.2 tests", [
         ]
     ),
     Test(
-        "test-fallback-scsv.py",
+        "test_fallback_scsv.py",
         tls13_args = [
             "--tls-1.3",
             "-e", "FALLBACK - hello TLSv1.1 - pos 0",
@@ -428,7 +428,7 @@ tls12_tests = TestGroup("TLSv1.2 tests", [
         ]
     ),
 
-    Test("test-invalid-compression-methods.py", [
+    Test("test_invalid_compression_methods.py", [
         "-x", "invalid compression methods",
         "-X", substitute_alert("illegal_parameter", "decode_error"),
         "-x", "only deflate compression method",
@@ -437,134 +437,134 @@ tls12_tests = TestGroup("TLSv1.2 tests", [
 
     # Skip extended_master_secret test. Since we don't support this
     # extension, we don't notice that it was dropped.
-    Test("test-renegotiation-changed-clienthello.py", [
+    Test("test_renegotiation_changed_clienthello.py", [
         "-e", "drop extended_master_secret in renegotiation",
     ]),
 
-    Test("test-sessionID-resumption.py", [
+    Test("test_sessionID_resumption.py", [
         "-x", "Client Hello too long session ID",
         "-X", substitute_alert("decode_error", "illegal_parameter"),
     ]),
 
     # Without --sig-algs-drop-ok, two tests fail since we do not currently
     # implement the signature_algorithms_cert extension (although we MUST).
-    Test("test-sig-algs-renegotiation-resumption.py", ["--sig-algs-drop-ok"]),
+    Test("test_sig_algs_renegotiation_resumption.py", ["--sig-algs-drop-ok"]),
 
-    Test("test-serverhello-random.py", args = tls12_exclude_legacy_protocols),
+    Test("test_serverhello_random.py", args = tls12_exclude_legacy_protocols),
 
-    Test("test-chacha20.py", [ "-e", "Chacha20 in TLS1.1" ]),
+    Test("test_chacha20.py", [ "-e", "Chacha20 in TLS1.1" ]),
 ])
 
 tls12_slow_tests = TestGroup("slow TLSv1.2 tests", [
-    Test("test-cve-2016-7054.py"),
-    Test("test-dhe-no-shared-secret-padding.py", tls12_exclude_legacy_protocols),
-    Test("test-ecdhe-padded-shared-secret.py", tls12_exclude_legacy_protocols),
-    Test("test-ecdhe-rsa-key-share-random.py", tls12_exclude_legacy_protocols),
+    Test("test_cve_2016_7054.py"),
+    Test("test_dhe_no_shared_secret_padding.py", tls12_exclude_legacy_protocols),
+    Test("test_ecdhe_padded_shared_secret.py", tls12_exclude_legacy_protocols),
+    Test("test_ecdhe_rsa_key_share_random.py", tls12_exclude_legacy_protocols),
     # Start at extension number 58 to avoid QUIC transport parameters (57)
-    Test("test-large-hello.py", [ "-m", "58" ]),
+    Test("test_large_hello.py", [ "-m", "58" ]),
 ])
 
 tls12_failing_tests = TestGroup("failing TLSv1.2 tests", [
     # no shared cipher
-    Test("test-aesccm.py"),
+    Test("test_aesccm.py"),
     # need server to set up alpn
-    Test("test-alpn-negotiation.py"),
+    Test("test_alpn_negotiation.py"),
     # Failing on TLS_RSA_WITH_AES_128_CBC_SHA because server does not support it.
-    Test("test-bleichenbacher-timing-pregenerate.py"),
+    Test("test_bleichenbacher_timing_pregenerate.py"),
     # many tests fail due to unexpected server_name extension
-    Test("test-bleichenbacher-workaround.py"),
+    Test("test_bleichenbacher_workaround.py"),
 
     # need client key and cert plus extra server setup
-    Test("test-certificate-malformed.py"),
-    Test("test-certificate-request.py"),
-    Test("test-certificate-verify-malformed-sig.py"),
-    Test("test-certificate-verify-malformed.py"),
-    Test("test-certificate-verify.py"),
-    Test("test-ecdsa-in-certificate-verify.py"),
-    Test("test-eddsa-in-certificate-verify.py"),
-    Test("test-renegotiation-disabled-client-cert.py"),
-    Test("test-rsa-pss-sigs-on-certificate-verify.py"),
-    Test("test-rsa-sigs-on-certificate-verify.py"),
+    Test("test_certificate_malformed.py"),
+    Test("test_certificate_request.py"),
+    Test("test_certificate_verify_malformed_sig.py"),
+    Test("test_certificate_verify_malformed.py"),
+    Test("test_certificate_verify.py"),
+    Test("test_ecdsa_in_certificate_verify.py"),
+    Test("test_eddsa_in_certificate_verify.py"),
+    Test("test_renegotiation_disabled_client_cert.py"),
+    Test("test_rsa_pss_sigs_on_certificate_verify.py"),
+    Test("test_rsa_sigs_on_certificate_verify.py"),
 
     # test doesn't expect session ticket
-    Test("test-client-compatibility.py"),
+    Test("test_client_compatibility.py"),
     # abrupt closure
-    Test("test-client-hello-max-size.py"),
+    Test("test_client_hello_max_size.py"),
     # unknown signature algorithms
-    Test("test-clienthello-md5.py"),
+    Test("test_clienthello_md5.py"),
 
     # Tests expect an illegal_parameter or a decode_error alert.  Should be
     # added to ssl3_get_client_key_exchange on kex function failure.
-    Test("test-ecdhe-rsa-key-exchange-with-bad-messages.py"),
+    Test("test_ecdhe_rsa_key_exchange_with_bad_messages.py"),
 
     # We send a handshake_failure due to no shared ciphers while the
     # test expects to succeed.
-    Test("test-ecdhe-rsa-key-exchange.py"),
+    Test("test_ecdhe_rsa_key_exchange.py"),
 
     # no shared cipher
-    Test("test-ecdsa-sig-flexibility.py"),
+    Test("test_ecdsa_sig_flexibility.py"),
 
     # Tests expect SH but we send unexpected_message or handshake_failure
     #   'Application data inside Client Hello'
     #   'Application data inside Client Key Exchange'
     #   'Application data inside Finished'
-    Test("test-interleaved-application-data-and-fragmented-handshakes-in-renegotiation.py"),
+    Test("test_interleaved_application_data_and_fragmented_handshakes_in_renegotiation.py"),
     # Tests expect SH but we send handshake_failure
     #   'Application data before Change Cipher Spec'
     #   'Application data before Client Key Exchange'
     #   'Application data before Finished'
-    Test("test-interleaved-application-data-in-renegotiation.py"),
+    Test("test_interleaved_application_data_in_renegotiation.py"),
 
     # broken test script
     # TypeError: '<' not supported between instances of 'int' and 'NoneType'
-    Test("test-invalid-client-hello-w-record-overflow.py"),
+    Test("test_invalid_client_hello_w_record_overflow.py"),
 
     # Lots of failures. abrupt closure
-    Test("test-invalid-client-hello.py"),
+    Test("test_invalid_client_hello.py"),
 
     # abrupt closure
     # 'encrypted premaster set to all zero (n)' n in 256 384 512
-    Test("test-invalid-rsa-key-exchange-messages.py"),
+    Test("test_invalid_rsa_key_exchange_messages.py"),
 
     # test expects illegal_parameter, we send unrecognized_name (which seems
     # correct according to rfc 6066?)
-    Test("test-invalid-server-name-extension-resumption.py"),
+    Test("test_invalid_server_name_extension_resumption.py"),
     # let through some server names without sending an alert
     # again illegal_parameter vs unrecognized_name
-    Test("test-invalid-server-name-extension.py"),
+    Test("test_invalid_server_name_extension.py"),
 
     # 4 failures:
     #   'insecure (legacy) renegotiation with GET after 2nd handshake'
     #   'insecure (legacy) renegotiation with incomplete GET'
     #   'secure renegotiation with GET after 2nd handshake'
     #   'secure renegotiation with incomplete GET'
-    Test("test-legacy-renegotiation.py"),
+    Test("test_legacy_renegotiation.py"),
 
     # 1 failure (timeout): we don't send the unexpected_message alert
     # 'duplicate change cipher spec after Finished'
-    Test("test-message-duplication.py"),
+    Test("test_message_duplication.py"),
 
     # server should send status_request
-    Test("test-ocsp-stapling.py"),
+    Test("test_ocsp_stapling.py"),
 
     # unexpected closure
-    Test("test-openssl-3712.py"),
+    Test("test_openssl_3712.py"),
 
     # failed: 3 (expect an alert, we send AD)
     # 'try insecure (legacy) renegotiation with incomplete GET'
     # 'try secure renegotiation with GET after 2nd CH'
     # 'try secure renegotiation with incomplete GET'
-    Test("test-renegotiation-disabled.py"),
+    Test("test_renegotiation_disabled.py"),
 
     # 'resumption of safe session with NULL cipher'
     # 'resumption with cipher from old CH but not selected by server'
-    Test("test-resumption-with-wrong-ciphers.py"),
+    Test("test_resumption_with_wrong_ciphers.py"),
 
     # 'session resumption with empty session_id'
     # 'session resumption with random session_id'
     # 'session resumption with renegotiation'
     # AssertionError: Server did not send extension(s): session_ticket
-    Test("test-session-ticket-resumption.py"),
+    Test("test_session_ticket_resumption.py"),
 
     # 5 failures:
     #   'empty sigalgs'
@@ -572,7 +572,7 @@ tls12_failing_tests = TestGroup("failing TLSv1.2 tests", [
     #   'rsa_pss_pss_sha256 only'
     #   'rsa_pss_pss_sha384 only'
     #   'rsa_pss_pss_sha512 only'
-    Test("test-sig-algs.py"),
+    Test("test_sig_algs.py"),
 
     # 13 failures:
     #   'duplicated n non-rsa schemes' for n in 202 2342 8119 23741 32744
@@ -581,51 +581,51 @@ tls12_failing_tests = TestGroup("failing TLSv1.2 tests", [
     #   'tolerance 32758 methods with sig_alg_cert'
     #   'tolerance max 32744 number of methods with sig_alg_cert'
     #   'tolerance max (32760) number of methods'
-    Test("test-signature-algorithms.py"),
+    Test("test_signature_algorithms.py"),
 
     # times out
-    Test("test-ssl-death-alert.py"),
+    Test("test_ssl_death_alert.py"),
 
     # 17 pass, 13 fail. padding and truncation
-    Test("test-truncating-of-client-hello.py"),
+    Test("test_truncating_of_client_hello.py"),
 
     # x448 tests need disabling plus x25519 corner cases need sorting out
-    Test("test-x25519.py"),
+    Test("test_x25519.py"),
 
     # Needs TLS 1.0 or 1.1
-    Test("test-TLSv1_2-rejected-without-TLSv1_2.py"),
+    Test("test_TLSv1_2_rejected_without_TLSv1_2.py"),
 ])
 
 tls12_unsupported_tests = TestGroup("TLSv1.2 for unsupported features", [
     # protocol_version
-    Test("test-SSLv3-padding.py"),
+    Test("test_SSLv3_padding.py"),
     # we don't do RSA key exchanges
-    Test("test-bleichenbacher-timing.py"),
+    Test("test_bleichenbacher_timing.py"),
     # no encrypt-then-mac
-    Test("test-encrypt-then-mac-renegotiation.py"),
-    Test("test-encrypt-then-mac.py"),
+    Test("test_encrypt_then_mac_renegotiation.py"),
+    Test("test_encrypt_then_mac.py"),
     # no EME support
-    Test("test-extended-master-secret-extension-with-client-cert.py"),
-    Test("test-extended-master-secret-extension.py"),
+    Test("test_extended_master_secret_extension_with_client_cert.py"),
+    Test("test_extended_master_secret_extension.py"),
     # no ffdhe
-    Test("test-ffdhe-expected-params.py"),
-    Test("test-ffdhe-negotiation.py"),
+    Test("test_ffdhe_expected_params.py"),
+    Test("test_ffdhe_negotiation.py"),
     # record_size_limit/max_fragment_length extension (RFC 8449)
-    Test("test-record-size-limit.py"),
+    Test("test_record_size_limit.py"),
     # expects the server to send the heartbeat extension
-    Test("test-heartbeat.py"),
+    Test("test_heartbeat.py"),
     # needs an echo server
-    Test("test-lengths.py"),
+    Test("test_lengths.py"),
 ])
 
 # These tests take a ton of time to fail against an 1.3 server,
 # so don't run them against 1.3 pending further investigation.
 legacy_tests = TestGroup("Legacy protocol tests", [
-    Test("test-sslv2-force-cipher-3des.py"),
-    Test("test-sslv2-force-cipher-non3des.py"),
-    Test("test-sslv2-force-cipher.py"),
-    Test("test-sslv2-force-export-cipher.py"),
-    Test("test-sslv2hello-protocol.py"),
+    Test("test_sslv2_force_cipher_3des.py"),
+    Test("test_sslv2_force_cipher_non3des.py"),
+    Test("test_sslv2_force_cipher.py"),
+    Test("test_sslv2_force_export_cipher.py"),
+    Test("test_sslv2hello_protocol.py"),
 ])
 
 all_groups = [
diff --git a/src/regress/lib/libtls/tls/tlstest.c b/src/regress/lib/libtls/tls/tlstest.c
index b675c798b4..d52156128d 100644
--- a/src/regress/lib/libtls/tls/tlstest.c
+++ b/src/regress/lib/libtls/tls/tlstest.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tlstest.c,v 1.16 2024/08/02 15:02:22 tb Exp $ */
+/* $OpenBSD: tlstest.c,v 1.17 2025/06/04 10:28:00 tb Exp $ */
 /*
  * Copyright (c) 2017 Joel Sing <jsing@openbsd.org>
  *
@@ -531,6 +531,142 @@ do_tls_version_tests(void)
         return failure;
 }
 
+static int
+test_tls_alpn(const char *client_alpn, const char *server_alpn,
+    const char *selected)
+{
+        struct tls_config *client_cfg, *server_cfg;
+        struct tls *client, *server, *server_cctx;
+        const char *got_server, *got_client;
+        int failed = 1;
+
+        if ((client = tls_client()) == NULL)
+                errx(1, "failed to create tls client");
+        if ((client_cfg = tls_config_new()) == NULL)
+                errx(1, "failed to create tls client config");
+        tls_config_insecure_noverifyname(client_cfg);
+        if (tls_config_set_alpn(client_cfg, client_alpn) == -1)
+                errx(1, "failed to set alpn: %s", tls_config_error(client_cfg));
+        if (tls_config_set_ca_file(client_cfg, cafile) == -1)
+                errx(1, "failed to set ca: %s", tls_config_error(client_cfg));
+
+        if ((server = tls_server()) == NULL)
+                errx(1, "failed to create tls server");
+        if ((server_cfg = tls_config_new()) == NULL)
+                errx(1, "failed to create tls server config");
+        if (tls_config_set_alpn(server_cfg, server_alpn) == -1)
+                errx(1, "failed to set alpn: %s", tls_config_error(server_cfg));
+        if (tls_config_set_keypair_file(server_cfg, certfile, keyfile) == -1)
+                errx(1, "failed to set keypair: %s",
+                    tls_config_error(server_cfg));
+
+        if (tls_configure(client, client_cfg) == -1)
+                errx(1, "failed to configure client: %s", tls_error(client));
+        tls_reset(server);
+        if (tls_configure(server, server_cfg) == -1)
+                errx(1, "failed to configure server: %s", tls_error(server));
+
+        tls_config_free(client_cfg);
+        tls_config_free(server_cfg);
+
+        circular_init();
+
+        if (tls_accept_cbs(server, &server_cctx, server_read, server_write,
+            NULL) == -1)
+                errx(1, "failed to accept: %s", tls_error(server));
+
+        if (tls_connect_cbs(client, client_read, client_write, NULL,
+            "test") == -1)
+                errx(1, "failed to connect: %s", tls_error(client));
+
+        if (do_client_server_test("alpn", client, server_cctx) != 0)
+                goto fail;
+
+        got_server = tls_conn_alpn_selected(server_cctx);
+        got_client = tls_conn_alpn_selected(client);
+
+        if (got_server == NULL || got_client == NULL) {
+                printf("FAIL: expected ALPN for server and client, got "
+                    "server: %p, client %p\n", got_server, got_client);
+                goto fail;
+        }
+
+        if (strcmp(got_server, got_client) != 0) {
+                printf("FAIL: ALPN mismatch: server %s, client %s\n",
+                    got_server, got_client);
+                goto fail;
+        }
+
+        if (strcmp(selected, got_server) != 0) {
+                printf("FAIL: ALPN mismatch: want %s, got %s\n",
+                    selected, got_server);
+                goto fail;
+        }
+
+        failed = 0;
+
+ fail:
+        tls_free(client);
+        tls_free(server);
+        tls_free(server_cctx);
+
+        return (failed);
+}
+
+static const struct test_alpn {
+        const char *client;
+        const char *server;
+        const char *selected;
+} tls_test_alpn[] = {
+        {
+                .client = "http/2,http/1.1",
+                .server = "http/1.1",
+                .selected = "http/1.1",
+        },
+        {
+                .client = "http/2,http/1.1",
+                .server = "http/2,http/1.1",
+                .selected = "http/2",
+        },
+        {
+                .client = "http/1.1,http/2",
+                .server = "http/2,http/1.1",
+                .selected = "http/2",
+        },
+        {
+                .client = "http/2,http/1.1",
+                .server = "http/1.1,http/2",
+                .selected = "http/1.1",
+        },
+        {
+                .client = "http/1.1",
+                .server = "http/2,http/1.1",
+                .selected = "http/1.1",
+        },
+};
+
+#define N_TLS_ALPN_TESTS (sizeof(tls_test_alpn) / sizeof(tls_test_alpn[0]))
+
+static int
+do_tls_alpn_tests(void)
+{
+        const struct test_alpn *ta;
+        int failure = 0;
+        size_t i;
+
+        printf("== TLS alpn tests ==\n");
+
+        for (i = 0; i < N_TLS_ALPN_TESTS; i++) {
+                ta = &tls_test_alpn[i];
+                printf("INFO: alpn test %zu - client alpn '%s' "
+                    "and server alpn '%s'\n", i, ta->client, ta->server);
+                failure |= test_tls_alpn(ta->client, ta->server, ta->selected);
+                printf("\n");
+        }
+
+        return failure;
+}
+
 int
 main(int argc, char **argv)
 {
@@ -549,6 +685,7 @@ main(int argc, char **argv)
         failure |= do_tls_tests();
         failure |= do_tls_ordering_tests();
         failure |= do_tls_version_tests();
+        failure |= do_tls_alpn_tests();
 
         return (failure);
 }