OK, I'll cut it into smaller batches.

Oops! Include proper diff.

Mark few more nodes.

Don't mark sysctl's that are already MPSAFE as NEEDGIANT.

Create macro to add MPSAFE flag for SYSCTL_NODEs that are not marked as NEEDGIANT instead of correcting every single entry.

Because the write path in sysctl_handle_string() and sysctl_handle_opaque() isn't locked yet?

Mark everything that was left since the last revision.

In D23110#508108, @lutz_donnerhacke.de wrote:

If it is only annotating something for a group of deverlopers, I'd suggest an inline comment in all the files.

Mark all SYSCTL_NODEs using custom handler and not already marked as MPSAFE as CTLFLAG_NEEDGIANT.
Mark all SYSCTL_NODEs with NULL handler as MPSAFE.

In D23110#506834, @alfix86_gmail.com wrote:

A question because I should update my tools.
If a node has not the CLT_MFSAFE flags then it has to have the CTL_NEEDGIANT, is it right?

Yes, many of the sysctls can be trivially be made / already are but aren't marked as MPSAFE but this was mostly sed + vim macros + a bit of manual fixes to add the flag where MPSAFE isn't set (yet).
The question is: should fixing this be done in this (already huge) diff or as a separate work later.

I'm not going to die for a name, but! we still have D_NEEDGIANT and the name still describe what is being done in this case.

Fix few typos and be more consistent on style(9).

lgtm, at least from the vmstat -m perspective

Update diff to use CTLFLAG_SKIP instead of completely removing KERN_DUMMY.

No problems, no. I understand that it was introduced as a combat for 3rd party binaries that hardcoded 1.31 as the oid, but the value 0 isn't helpful either.
How about CTLFLAG_SKIP so it wouldn't show up in sysctl(8) list?

update diff

Make the comment style(9) friendly.

Check if the flags provided are supported, otherwise return EINVAL.

There are no flags defined for now and kern_copy_file_range explicitly checks for flags != 0.
But if it's a problem, I can add a local flag variable and set it to 0 because this is what we support for now anyway.

Remove the now unneeded include of libc_private.h too.

But there is also dma, sendmail and parts of kerberos… :-)

Wouldn't /usr/libexec be a better place for it, like for many other such daemons (like fingerd etc…)?

sort it alphabetically, actually

rewrite the return path

don't return too early

Style and s/Int/Sizet/ where appropriate.

Address @kib comments.

Add space after comma.

Use constants defined in D21693.

add a missing file

Address @kib's comments.

Update to r351542 and bump __FreeBSD_version again.

Add a lightweight compat layer in libc.

Check for ENOSYS.

Split the function for one that do the actual work and teach sys___sysctlbyname and freebsd32___sysctlbyname to call it properly.

Update diff to r351302 and address some comments.

I confirm that it works.

This breaks ifconfig_DEFAULT="DHCP" somehow. It works with either SYNCDHCP or this commit reverted.

Update diff with minor fixes.

Man: start a sentence from new line.

Add CAVEATS section to the man page to point out the rounding issue with too short buffers.

In D13578#284349, @kib wrote:

In one branch of the snprintf() use, we add divisor / 2 and remainder * 10, not remainder. Does this case need to be handled differently ?

In D13578#283989, @cem wrote:

I don't understand the actual algorithmic change, but given the strong test coverage, I think I'm ok with this. Some style nits below.