Never mind, I was thinking of resolv.conf...

I would have rejected this change if I had noticed it in time. It is a huge POLA violation, especially on laptops that aren't running their own resolver. There's an intermediate solution, which is to stat the file every M requests and / or N seconds. The caveat is that the latter is very fast on i386, amd64, arm, and arm64, which us a vDSO, but slow on other platforms.

Fix date in MOVED and add www/nginx PORTREVISION bump that fell out when I generated the diff.

This version has a couple of regressions from the previous one. Remember that CMSG_SPACE and CMSG_LEN already include space for the header, plus alignment and padding. See CMSG_DATA(3) and sys/sys/socket.h.

I believe this is correct (with or without the suggested changes), but send_credentials() in usr.sbin/nscd/nscdcli.c also needs to be fixed. It was not touched by rS158257, which introduced the bug you are fixing here while trying to fix another, so the bug is slightly different. It is supposed to be (almost) identical to lib/libc/net/nscachedcli.c; the latter is actually the former ported into libc.

The answer to “how it worked before” is that it didn't. It has never worked properly.

I would strongly recommend submitting the sshbuf_{get,put,free}_passwd() part of this patch upstream.

IMO mergemaster(8) should be deprecated, if not outright removed. We have had etcupdate(8) for years now. It does everything that mergemaster(8) does, except better.

You should add the same disclaimer to opieinfo(1), opiekey(1), opiepasswd(1), pam_opie(8), pam_opieaccess(8), opieaccess(5), and opiekeys(5). Note that some of those (the PAM ones, at least) are in mdoc format rather than man.