Index: sys/kern/kern_sysctl.c
===================================================================
--- sys/kern/kern_sysctl.c
+++ sys/kern/kern_sysctl.c
@@ -112,6 +112,7 @@
 #define	SYSCTL_SLEEP(ch, wmesg, timo)					\
 				rm_sleep(ch, &sysctllock, 0, wmesg, timo)
 
+static void sysctl_fetch_fqname(struct sysctl_oid *, struct sbuf *);
 static int sysctl_root(SYSCTL_HANDLER_ARGS);
 
 /* Root list */
@@ -169,6 +170,18 @@
 	else
 		SYSCTL_WUNLOCK();
 
+	if ((oid->oid_kind & CTLFLAG_DEPRECATED) != 0) {
+		struct sbuf *sb;
+
+		sb = sbuf_new_auto();
+		sysctl_fetch_fqname(oid, sb);
+		sbuf_finish(sb);
+
+		printf("Deprecated sysctl (to be removed in a future version): %s\n",
+		    sbuf_data(sb));
+
+		sbuf_delete(sb);
+	}
 	if (!(oid->oid_kind & CTLFLAG_MPSAFE))
 		mtx_lock(&Giant);
 	error = oid->oid_handler(oid, arg1, arg2, req);
@@ -366,6 +379,19 @@
 	return (-1);
 }
 
+static void
+sysctl_fetch_fqname(struct sysctl_oid *oid, struct sbuf *sb)
+{
+	struct sysctl_oid *parent;
+
+	if ((parent = SYSCTL_PARENT(oid)) != NULL) {
+		sysctl_fetch_fqname(parent, sb);
+		sbuf_printf(sb, ".%s", oid->oid_name);
+	} else {
+		sbuf_printf(sb, "%s", oid->oid_name);
+	}
+}
+
 static void
 sysctl_warn_reuse(const char *func, struct sysctl_oid *leaf)
 {
Index: sys/net/if_tuntap.c
===================================================================
--- sys/net/if_tuntap.c
+++ sys/net/if_tuntap.c
@@ -174,7 +174,8 @@
 /* tap */
 static SYSCTL_NODE(_net_link, OID_AUTO, tap, CTLFLAG_RW, 0,
     "Ethernet tunnel software network interface");
-SYSCTL_INT(_net_link_tap, OID_AUTO, user_open, CTLFLAG_RW, &tap_allow_uopen, 0,
+SYSCTL_INT(_net_link_tap, OID_AUTO, user_open, CTLFLAG_RW | CTLFLAG_DEPRECATED,
+    &tap_allow_uopen, 0,
     "Allow user to open /dev/tap (based on node permissions)");
 SYSCTL_INT(_net_link_tap, OID_AUTO, up_on_open, CTLFLAG_RW, &tapuponopen, 0,
     "Bring interface up when /dev/tap is opened");
Index: sys/sys/sysctl.h
===================================================================
--- sys/sys/sysctl.h
+++ sys/sys/sysctl.h
@@ -105,6 +105,7 @@
 #define	CTLFLAG_STATS	0x00002000	/* Statistics, not a tuneable */
 #define	CTLFLAG_NOFETCH	0x00001000	/* Don't fetch tunable from getenv() */
 #define	CTLFLAG_CAPRW	(CTLFLAG_CAPRD|CTLFLAG_CAPWR)
+#define	CTLFLAG_DEPRECATED	0x00000800
 
 /*
  * Secure level.   Note that CTLFLAG_SECURE == CTLFLAG_SECURE1.