Index: tools/tools/git/candidatematch.lua
===================================================================
--- /dev/null
+++ tools/tools/git/candidatematch.lua
@@ -0,0 +1,65 @@
+#!/usr/libexec/flua
+
+-- MFC candidate script utility - $0 from-file to-file
+--
+-- from-file specifies hashes that exist only in the "MFC from" branch and
+-- to-file specifies the original hashes of commits already merged to the
+-- "MFC to" branch.
+
+-- SPDX-License-Identifier: BSD-2-Clause
+-- Copyright 2024 The FreeBSD Foundation
+
+-- Read a file and return its content as a table
+local function read_file(filename)
+	local file = assert(io.open(filename, "r"))
+	local content = {}
+	for line in file:lines() do
+		table.insert(content, line)
+	end
+	file:close()
+	return content
+end
+
+-- Remove hashes from 'from' list that are present in 'to' list
+local function set_difference(set1, set2)
+	local set2_values = {}
+	for _, value in ipairs(set2) do
+		set2_values[value] = true
+	end
+
+	local result = {}
+	for _, value in ipairs(set1) do
+		if not set2_values[value] then
+			table.insert(result, value)
+		end
+	end
+	return result
+end
+
+-- Main function
+local function main()
+	local from_file = arg[1]
+	local to_file = arg[2]
+	local exclude_file = arg[3]
+
+	if not from_file or not to_file then
+		print("Usage: flua $0 from-file to-file")
+		return
+	end
+
+	local from_hashes = read_file(from_file)
+	local to_hashes = read_file(to_file)
+
+	local result_hashes = set_difference(from_hashes, to_hashes)
+	if exclude_file then
+		exclude_hashes = read_file(exclude_file)
+		result_hashes = set_difference(result_hashes, exclude_hashes)
+	end
+
+	-- Print the result
+	for _, hash in ipairs(result_hashes) do
+		print(hash)
+	end
+end
+
+main()
Index: tools/tools/git/mfc-candidates.sh
===================================================================
--- tools/tools/git/mfc-candidates.sh
+++ tools/tools/git/mfc-candidates.sh
@@ -124,16 +124,14 @@
 # Commits in from_branch after branch point
 commits_from()
 {
-	git rev-list --first-parent $authorarg $to_branch..$from_branch "$@" |\
-	    sort
+	git rev-list --first-parent $authorarg $to_branch..$from_branch "$@"
 }
 
 # "cherry picked from" hashes from commits in to_branch after branch point
 commits_to()
 {
 	git log $from_branch..$to_branch --grep 'cherry picked from' "$@" |\
-	    sed -E -n 's/^[[:space:]]*\(cherry picked from commit ([0-9a-f]+)\)[[:space:]]*$/\1/p' |\
-	    sort
+	    sed -E -n 's/^[[:space:]]*\(cherry picked from commit ([0-9a-f]+)\)[[:space:]]*$/\1/p'
 }
 
 # Turn a list of short hashes (and optional descriptions) into a list of full
@@ -164,16 +162,11 @@
 commits_from "$@" > $from_list
 commits_to "$@" > $to_list
 
-comm -23 $from_list $to_list > $candidate_list
+/usr/libexec/flua $(dirname $0)/candidatematch.lua \
+    $from_list $to_list $exclude_list > $candidate_list
 
-if [ -n "$exclude_file" ]; then
-	mv $candidate_list $candidate_list.bak
-	comm -23 $candidate_list.bak $exclude_list > $candidate_list
-fi
-
-# Sort by (but do not print) commit time
 while read hash; do
-	git show --pretty='%ct %h %s' --no-patch $hash
-done < $candidate_list | sort -n | cut -d ' ' -f 2-
+	git show --pretty='%h %s' --no-patch $hash
+done < $candidate_list
 
 rm -rf "$workdir"