untrusted comment: verify with openbsd-80-base.pub
RWSMSt0erHTctTM4sBaK5qtYJbMMvlG8lO4CZBXLLE1ZV000HD6FZwYaxInn11qqKyQ0MXhMMXk1w9p1H2tCNOE4ouzf4zGslQA=

OpenBSD 8.0 errata 010, November 14, 2026:

Multiple vulnerabilities in the X server Resources, Test, Xv
extensions and EDID Display range parsing.
CVE-2026-109091 CVE-2026-109092 CVE-2026-109093 CVE-2026-109904
CVE-2026-109094 CVE-2026-109095 CVE-2026-109096 CVE-2026-109903

Apply by doing:
    signify -Vep /etc/signify/openbsd-80-base.pub -x 010_xserver.patch.sig \
        -m - | (cd /usr/xenocara && patch -p0)

And then rebuild and install the X server:
    cd /usr/xenocara/xserver
    make -f Makefile.bsd-wrapper obj
    make -f Makefile.bsd-wrapper build

Index: xserver/Xext/xres.c
===================================================================
RCS file: /cvs/xenocara/xserver/Xext/xres.c,v
diff -u -p -r1.15 xres.c
--- xserver/Xext/xres.c	3 Nov 2025 09:57:22 -0000	1.15
+++ xserver/Xext/xres.c	5 Nov 2026 11:47:10 -0000
@@ -581,6 +581,8 @@ ProcXResQueryClientIds (ClientPtr client
     InitConstructClientIdCtx(&ctx);
 
     REQUEST_AT_LEAST_SIZE(xXResQueryClientIdsReq);
+    if (stuff->numSpecs > UINT32_MAX / sizeof(specs[0]))
+        return BadLength;
     REQUEST_FIXED_SIZE(xXResQueryClientIdsReq,
                        stuff->numSpecs * sizeof(specs[0]));
 
@@ -1051,6 +1053,8 @@ SProcXResQueryClientIds (ClientPtr clien
 
     REQUEST_AT_LEAST_SIZE (xXResQueryClientIdsReq);
     swapl(&stuff->numSpecs);
+    if (stuff->numSpecs > UINT32_MAX / sizeof(xXResClientIdSpec))
+        return BadLength;
     return ProcXResQueryClientIds(client);
 }
 
@@ -1066,6 +1070,8 @@ SProcXResQueryResourceBytes (ClientPtr c
 
     REQUEST_AT_LEAST_SIZE(xXResQueryResourceBytesReq);
     swapl(&stuff->numSpecs);
+    if (stuff->numSpecs > UINT32_MAX / sizeof(specs[0]))
+        return BadLength;
     REQUEST_FIXED_SIZE(xXResQueryResourceBytesReq,
                        stuff->numSpecs * sizeof(specs[0]));
 
Index: xserver/Xext/xtest.c
===================================================================
RCS file: /cvs/xenocara/xserver/Xext/xtest.c,v
diff -u -p -r1.16 xtest.c
--- xserver/Xext/xtest.c	3 Nov 2025 09:57:22 -0000	1.16
+++ xserver/Xext/xtest.c	5 Nov 2026 11:47:10 -0000
@@ -257,6 +257,12 @@ ProcXTestFakeInput(ClientPtr client)
                 client->errorValue = dv->first_valuator;
                 return BadValue;
             }
+            if (!dv->num_valuators || dv->num_valuators > 6 ||
+                base + dv->num_valuators > dev->valuator->numAxes ||
+                base + dv->num_valuators > MAX_VALUATORS) {
+                client->errorValue = dv->num_valuators;
+                return BadValue;
+            }
             switch (dv->num_valuators) {
             case 6:
                 valuators[base + 5] = dv->valuator5;
@@ -278,11 +284,6 @@ ProcXTestFakeInput(ClientPtr client)
 
             base += dv->num_valuators;
             numValuators += dv->num_valuators;
-
-            if (firstValuator + numValuators > dev->valuator->numAxes) {
-                client->errorValue = dv->num_valuators;
-                return BadValue;
-            }
         }
         type = type - XI_DeviceKeyPress + KeyPress;
 
Index: xserver/Xext/xvdisp.c
===================================================================
RCS file: /cvs/xenocara/xserver/Xext/xvdisp.c,v
diff -u -p -r1.16 xvdisp.c
--- xserver/Xext/xvdisp.c	27 Jul 2019 07:57:07 -0000	1.16
+++ xserver/Xext/xvdisp.c	5 Nov 2026 11:47:11 -0000
@@ -853,6 +853,9 @@ ProcXvPutImage(ClientPtr client)
     height = stuff->height;
     size = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage, &width,
                                                        &height, NULL, NULL);
+    if (size < 0)
+        return BadValue;
+
     size += sizeof(xvPutImageReq);
     size = bytes_to_int32(size);
 
@@ -919,7 +922,8 @@ ProcXvShmPutImage(ClientPtr client)
     size_needed = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage,
                                                               &width, &height,
                                                               NULL, NULL);
-    if ((size_needed + stuff->offset) > shmdesc->size)
+    if (size_needed < 0 || stuff->offset > shmdesc->size ||
+        (unsigned long) size_needed > shmdesc->size - stuff->offset)
         return BadAccess;
 
     if ((width < stuff->width) || (height < stuff->height))
@@ -1002,6 +1006,10 @@ ProcXvQueryImageAttributes(ClientPtr cli
     size = (*pPort->pAdaptor->ddQueryImageAttributes) (pPort, pImage,
                                                        &width, &height, offsets,
                                                        pitches);
+    if (size < 0) {
+        free(offsets);
+        return BadValue;
+    }
 
     rep = (xvQueryImageAttributesReply) {
         .type = X_Reply,
Index: xserver/glamor/glamor_xv.c
===================================================================
RCS file: /cvs/xenocara/xserver/glamor/glamor_xv.c,v
diff -u -p -r1.9 glamor_xv.c
--- xserver/glamor/glamor_xv.c	3 Nov 2025 09:57:23 -0000	1.9
+++ xserver/glamor/glamor_xv.c	5 Nov 2026 11:47:11 -0000
@@ -330,7 +330,7 @@ glamor_xv_query_image_attributes(int id,
                                  unsigned short *w, unsigned short *h,
                                  int *pitches, int *offsets)
 {
-    int size = 0, tmp;
+    int64_t size = 0, tmp;
 
     if (offsets)
         offsets[0] = 0;
@@ -343,6 +343,8 @@ glamor_xv_query_image_attributes(int id,
         if (pitches)
             pitches[0] = size;
         size *= *h;
+        if (size > INT_MAX)
+            return -1;
         if (offsets)
             offsets[1] = size;
         tmp = ALIGN(*w >> 1, 4);
@@ -350,6 +352,8 @@ glamor_xv_query_image_attributes(int id,
             pitches[1] = pitches[2] = tmp;
         tmp *= (*h >> 1);
         size += tmp;
+        if (size > INT_MAX)
+            return -1;
         if (offsets)
             offsets[2] = size;
         size += tmp;
@@ -361,6 +365,8 @@ glamor_xv_query_image_attributes(int id,
         if (pitches)
             pitches[0] = size;
         size *= *h;
+        if (size > INT_MAX)
+            return -1;
         if (offsets)
             offsets[1] = size;
         tmp = ALIGN(*w, 4);
@@ -395,6 +401,8 @@ glamor_xv_query_image_attributes(int id,
         size *= *h;
         break;
     }
+    if (size > INT_MAX)
+        return -1;
     return size;
 }
 
Index: xserver/hw/xfree86/modes/xf86EdidModes.c
===================================================================
RCS file: /cvs/xenocara/xserver/hw/xfree86/modes/xf86EdidModes.c,v
diff -u -p -r1.21 xf86EdidModes.c
--- xserver/hw/xfree86/modes/xf86EdidModes.c	31 Oct 2024 11:54:14 -0000	1.21
+++ xserver/hw/xfree86/modes/xf86EdidModes.c	5 Nov 2026 11:47:12 -0000
@@ -1125,14 +1125,16 @@ handle_detailed_monset(struct detailed_m
     switch (det_mon->type) {
     case DS_RANGES:
         if (!p->have_hsync) {
-            if (!p->Monitor->nHsync)
-                xf86DrvMsg(scrnIndex, X_INFO,
-                           "Using EDID range info for horizontal sync\n");
-            p->Monitor->hsync[p->Monitor->nHsync].lo =
-                det_mon->section.ranges.min_h;
-            p->Monitor->hsync[p->Monitor->nHsync].hi =
-                det_mon->section.ranges.max_h;
-            p->Monitor->nHsync++;
+            if (p->Monitor->nHsync < MAX_HSYNC) {
+                if (!p->Monitor->nHsync)
+                    xf86DrvMsg(scrnIndex, X_INFO,
+                               "Using EDID range info for horizontal sync\n");
+                p->Monitor->hsync[p->Monitor->nHsync].lo =
+                    det_mon->section.ranges.min_h;
+                p->Monitor->hsync[p->Monitor->nHsync].hi =
+                    det_mon->section.ranges.max_h;
+                p->Monitor->nHsync++;
+            }
         }
         else {
 #ifdef SPAM_XORG_LOG
@@ -1142,14 +1144,16 @@ handle_detailed_monset(struct detailed_m
         }
 
         if (!p->have_vrefresh) {
-            if (!p->Monitor->nVrefresh)
-                xf86DrvMsg(scrnIndex, X_INFO,
-                           "Using EDID range info for vertical refresh\n");
-            p->Monitor->vrefresh[p->Monitor->nVrefresh].lo =
-                det_mon->section.ranges.min_v;
-            p->Monitor->vrefresh[p->Monitor->nVrefresh].hi =
-                det_mon->section.ranges.max_v;
-            p->Monitor->nVrefresh++;
+            if (p->Monitor->nVrefresh < MAX_VREFRESH) {
+                if (!p->Monitor->nVrefresh)
+                    xf86DrvMsg(scrnIndex, X_INFO,
+                               "Using EDID range info for vertical refresh\n");
+                p->Monitor->vrefresh[p->Monitor->nVrefresh].lo =
+                    det_mon->section.ranges.min_v;
+                p->Monitor->vrefresh[p->Monitor->nVrefresh].hi =
+                    det_mon->section.ranges.max_v;
+                p->Monitor->nVrefresh++;
+            }
         }
         else {
 #ifdef SPAM_XORG_LOG