diff --git a/stand/defs.mk b/stand/defs.mk
index e8480a8c2b1e..3624b9311161 100644
--- a/stand/defs.mk
+++ b/stand/defs.mk
@@ -1,254 +1,255 @@
 
 .if !defined(__BOOT_DEFS_MK__)
 __BOOT_DEFS_MK__=${MFILE}
 
 # We need to define all the MK_ options before including src.opts.mk
 # because it includes bsd.own.mk which needs the right MK_ values,
 # espeically MK_CTF.
 
 MK_CTF=		no
 MK_SSP=		no
 MK_PROFILE=	no
 MK_PIE=		no
 MAN=
 .if !defined(PIC)
 NO_PIC=
 INTERNALLIB=
 .endif
 # Should be NO_CPU_FLAGS, but bsd.cpu.mk is included too early in bsd.init.mk
 # via the early include of bsd.opts.mk. Moving Makefile.inc include earlier in
 # that file causes weirdness, so this is the next best thing. We need to do this
 # because the loader needs very specific flags to work right, and things like
 # CPUTYPE?=native prevent that, and introduce an endless game of whack-a-mole
 # to disable more and more features. Boot loader performance is never improved
 # enough to make that hassle worth chasing.
 _CPUCFLAGS=
 
 .if ${LDFLAGS:M-nostdlib}
 # Sanitizers won't work unless we link against libc (e.g. in userboot/test).
 MK_ASAN:=	no
 MK_UBSAN:=	no
 .endif
 
 .include <src.opts.mk>
 .include <bsd.linker.mk>
 
 WARNS?=		1
 
 BOOTSRC=	${SRCTOP}/stand
 EFISRC=		${BOOTSRC}/efi
 EFIINC=		${EFISRC}/include
 EFIINCMD=	${EFIINC}/${MACHINE}
 FDTSRC=		${BOOTSRC}/fdt
 FICLSRC=	${BOOTSRC}/ficl
 LDRSRC=		${BOOTSRC}/common
 LIBLUASRC=	${BOOTSRC}/liblua
 LIBOFWSRC=	${BOOTSRC}/libofw
 LUASRC=		${SRCTOP}/contrib/lua/src
 SASRC=		${BOOTSRC}/libsa
 SYSDIR=		${SRCTOP}/sys
 UBOOTSRC=	${BOOTSRC}/uboot
 ZFSSRC=		${SASRC}/zfs
 OZFS=		${SRCTOP}/sys/contrib/openzfs
 ZFSOSSRC=	${OZFS}/module/os/freebsd/
 ZFSOSINC=	${OZFS}/include/os/freebsd
 LIBCSRC=	${SRCTOP}/lib/libc
 
 BOOTOBJ=	${OBJTOP}/stand
 
 # BINDIR is where we install
 BINDIR?=	/boot
 
 # LUAPATH is where we search for and install lua scripts.
 LUAPATH?=	/boot/lua
 FLUASRC?=	${SRCTOP}/libexec/flua
+FLUALIB?=	${SRCTOP}/lib/flua
 
 LIBSA=		${BOOTOBJ}/libsa/libsa.a
 .if ${MACHINE} == "i386"
 LIBSA32=	${LIBSA}
 .else
 LIBSA32=	${BOOTOBJ}/libsa32/libsa32.a
 .endif
 
 # Standard options:
 CFLAGS+=	-nostdinc
 # Allow CFLAGS_EARLY.file/target so that code that needs specific stack
 # of include paths can set them up before our include paths. Normally
 # the only thing that should be there are -I directives, and as few of
 # those as possible.
 CFLAGS+=	${CFLAGS_EARLY} ${CFLAGS_EARLY.${.IMPSRC:T}} ${CFLAGS_EARLY.${.TARGET:T}}
 .if ${MACHINE_ARCH} == "amd64" && ${DO32:U0} == 1
 CFLAGS+=	-I${BOOTOBJ}/libsa32
 .else
 CFLAGS+=	-I${BOOTOBJ}/libsa
 .endif
 CFLAGS+=	-I${SASRC} -D_STANDALONE
 CFLAGS+=	-I${SYSDIR}
 # Spike the floating point interfaces
 CFLAGS+=	-Ddouble=jagged-little-pill -Dfloat=floaty-mcfloatface
 .if ${MACHINE_ARCH} == "i386" || ${MACHINE_ARCH} == "amd64"
 # Slim down the image. This saves about 15% in size with clang 6 on x86
 # Our most constrained /boot/loader env is BIOS booting on x86, where
 # our text + data + BTX have to fit into 640k below the ISA hole.
 # Experience has shown that problems arise between ~520k to ~530k.
 CFLAGS.clang+=	-Oz
 CFLAGS.gcc+=	-Os
 CFLAGS+=	-ffunction-sections -fdata-sections
 .endif
 
 # GELI Support, with backward compat hooks (mostly)
 .if defined(LOADER_NO_GELI_SUPPORT)
 MK_LOADER_GELI=no
 .warning "Please move from LOADER_NO_GELI_SUPPORT to WITHOUT_LOADER_GELI"
 .endif
 .if defined(LOADER_GELI_SUPPORT)
 MK_LOADER_GELI=yes
 .warning "Please move from LOADER_GELI_SUPPORT to WITH_LOADER_GELI"
 .endif
 .if ${MK_LOADER_GELI} == "yes"
 CFLAGS+=	-DLOADER_GELI_SUPPORT
 CFLAGS+=	-I${SASRC}/geli
 .endif # MK_LOADER_GELI
 
 # These should be confined to loader.mk, but can't because uboot/lib
 # also uses it. It's part of loader, but isn't a loader so we can't
 # just include loader.mk
 .if ${LOADER_DISK_SUPPORT:Uyes} == "yes"
 CFLAGS+= -DLOADER_DISK_SUPPORT
 .endif
 
 # Machine specific flags for all builds here
 
 # Ensure PowerPC64 and PowerPC64LE boot loaders are compiled as 32 bit.
 # PowerPC64LE boot loaders are 32-bit little-endian.
 .if ${MACHINE_ARCH} == "powerpc64"
 CFLAGS+=	-m32 -mcpu=powerpc -mbig-endian
 .elif ${MACHINE_ARCH} == "powerpc64le"
 CFLAGS+=	-m32 -mcpu=powerpc -mlittle-endian
 .endif
 
 # For amd64, there's a bit of mixed bag. Some of the tree (i386, lib*32) is
 # build 32-bit and some 64-bit (lib*, efi). Centralize all the 32-bit magic here
 # and activate it when DO32 is explicitly defined to be 1.
 .if ${MACHINE_ARCH} == "amd64" && ${DO32:U0} == 1
 CFLAGS+=	-m32
 # LD_FLAGS is passed directly to ${LD}, not via ${CC}:
 LD_FLAGS+=	-m elf_i386_fbsd
 AFLAGS+=	--32
 .endif
 
 # Add in the no float / no SIMD stuff and announce we're freestanding
 # aarch64 and riscv don't have -msoft-float, but all others do.
 CFLAGS+=	-ffreestanding ${CFLAGS_NO_SIMD}
 .if ${MACHINE_CPUARCH} == "aarch64"
 CFLAGS+=	-mgeneral-regs-only -ffixed-x18 -fPIC
 .elif ${MACHINE_CPUARCH} == "riscv"
 CFLAGS+=	-march=rv64imac -mabi=lp64 -fPIC
 CFLAGS.clang+=	-mcmodel=medium
 CFLAGS.gcc+=	-mcmodel=medany
 .else
 CFLAGS+=	-msoft-float
 .endif
 
 # -msoft-float seems to be insufficient for powerpcspe
 .if ${MACHINE_ARCH} == "powerpcspe"
 CFLAGS+=	-mno-spe
 .endif
 
 .if ${MACHINE_CPUARCH} == "i386" || (${MACHINE_CPUARCH} == "amd64" && ${DO32:U0} == 1)
 CFLAGS+=	-march=i386
 CFLAGS.gcc+=	-mpreferred-stack-boundary=2
 .endif
 .if ${MACHINE_CPUARCH} == "amd64" && ${DO32:U0} == 0
 CFLAGS+=	-fPIC -mno-red-zone
 .endif
 
 .if ${MACHINE_CPUARCH} == "arm"
 # Do not generate movt/movw, because the relocation fixup for them does not
 # translate to the -Bsymbolic -pie format required by self_reloc() in loader(8).
 # Also, the fpu is not available in a standalone environment.
 CFLAGS.clang+=	-mno-movt
 CFLAGS.clang+=  -mfpu=none
 CFLAGS+=	-fPIC
 .endif
 
 # Some RISC-V linkers have support for relaxations, while some (lld) do not
 # yet. If this is the case we inhibit the compiler from emitting relaxations.
 .if ${LINKER_FEATURES:Mriscv-relaxations} == ""
 CFLAGS+=	-mno-relax
 .endif
 
 # The boot loader build uses dd status=none, where possible, for reproducible
 # build output (since performance varies from run to run). Trouble is that
 # option was recently (10.3) added to FreeBSD and is non-standard. Only use it
 # when this test succeeds rather than require dd to be a bootstrap tool.
 DD_NOSTATUS!=(dd status=none count=0 2> /dev/null && echo status=none) || true
 DD=dd ${DD_NOSTATUS}
 
 #
 # Have a sensible default
 #
 .if ${MK_LOADER_LUA} == "yes"
 LOADER_DEFAULT_INTERP?=lua
 .elif ${MK_FORTH} == "yes"
 LOADER_DEFAULT_INTERP?=4th
 .else
 LOADER_DEFAULT_INTERP?=simp
 .endif
 LOADER_INTERP?=${LOADER_DEFAULT_INTERP}
 
 # Make sure we use the machine link we're about to create
 CFLAGS+=-I.
 
 all: ${PROG}
 
 CLEANFILES+= teken_state.h
 teken.c: teken_state.h
 
 teken_state.h: ${SYSDIR}/teken/sequences
 	awk -f ${SYSDIR}/teken/gensequences \
 		${SYSDIR}/teken/sequences > teken_state.h
 
 .if !defined(NO_OBJ)
 _ILINKS=include/machine
 .if ${MACHINE} != ${MACHINE_CPUARCH} && ${MACHINE} != "arm64"
 _ILINKS+=include/${MACHINE_CPUARCH}
 .endif
 .if ${MACHINE_CPUARCH} == "i386" || ${MACHINE_CPUARCH} == "amd64"
 _ILINKS+=include/x86
 .endif
 CFLAGS+= -Iinclude
 CLEANDIRS+= include
 
 beforedepend: ${_ILINKS}
 beforebuild: ${_ILINKS}
 
 # Ensure that the links exist without depending on it when it exists which
 # causes all the modules to be rebuilt when the directory pointed to changes.
 .for _link in ${_ILINKS}
 .if !exists(${.OBJDIR}/${_link})
 ${OBJS}:       ${_link}
 .endif # _link exists
 .endfor
 
 .NOPATH: ${_ILINKS}
 
 ${_ILINKS}: .NOMETA
 	@case ${.TARGET:T} in \
 	machine) \
 		if [ ${DO32:U0} -eq 0 ]; then \
 			path=${SYSDIR}/${MACHINE}/include ; \
 		else \
 			path=${SYSDIR}/${MACHINE:C/amd64/i386/}/include ; \
 		fi ;; \
 	*) \
 		path=${SYSDIR}/${.TARGET:T}/include ;; \
 	esac ; \
 	case ${.TARGET} in \
 	*/*) mkdir -p ${.TARGET:H};; \
 	esac ; \
 	path=`(cd $$path && /bin/pwd)` ; \
 	${ECHO} ${.TARGET} "->" $$path ; \
 	ln -fns $$path ${.TARGET}
 .endif # !NO_OBJ
 .endif # __BOOT_DEFS_MK__
diff --git a/stand/i386/loader/Makefile b/stand/i386/loader/Makefile
index de96e1329b2f..57191b3c8f78 100644
--- a/stand/i386/loader/Makefile
+++ b/stand/i386/loader/Makefile
@@ -1,132 +1,132 @@
 
 HAVE_ZFS=		${MK_LOADER_ZFS}
 
 LOADER_NET_SUPPORT?=	yes
 LOADER_NFS_SUPPORT?=	yes
 LOADER_TFTP_SUPPORT?=	yes
 LOADER_CD9660_SUPPORT?=	yes
 LOADER_EXT2FS_SUPPORT?=	yes
 LOADER_MSDOS_SUPPORT?=	yes
 LOADER_UFS_SUPPORT?=	yes
 LOADER_GZIP_SUPPORT?=	yes
 LOADER_BZIP2_SUPPORT?=	yes
 
 .include <bsd.init.mk>
 
 LOADER?=	loader_${LOADER_INTERP}
 PROG=		${LOADER}.sym
 INTERNALPROG=
 NEWVERSWHAT?=	"bootstrap loader" x86
 VERSION_FILE=	${.CURDIR}/../loader/version
 #
 # There's 640k - 40k maximum space, less however much memory the BIOS uses.  A
 # non-random survey suggests that 20k-25k is a good value for 'most' machines.
 # We also need to subtract maximum stack usage (20-25k).
 #
 # So 640k - 40k - 25k - 25k = 550k = 563,200 bytes, but use 550,000 below for
 # some extra buffer for more complex setups and/or wider BIOS lomem variation.
 #
 # Some systems use more stack or have BIOS reserve more RAM (or both), and will
 # need to set this lower in /etc/src.conf if the above buffer is too small.
 #
 # sudo dd if=/dev/mem bs=1 iseek=0x413 count=2 | hd -d
 #
 # will tell you how many kiB of lomem are available.
 #
-LOADERSIZE?=	550000		# Largest known safe size for loader.bin
+LOADERSIZE?=	570000		# Largest known safe size for loader.bin
 
 .PATH:		${BOOTSRC}/i386/loader
 
 # architecture-specific loader code
 SRCS=		main.c conf.c vers.c chain.c gfx_fb.c 8x16.c
 
 CFLAGS.gfx_fb.c += -I${.CURDIR}/../libi386
 CFLAGS.gfx_fb.c += -I$(SRCTOP)/sys/teken
 CFLAGS.gfx_fb.c += -I${SRCTOP}/sys/cddl/contrib/opensolaris/common/lz4
 CFLAGS.gfx_fb.c += -I${SRCTOP}/contrib/pnglite
 CFLAGS.gfx_fb.c += -DHAVE_MEMCPY -I${SRCTOP}/sys/contrib/zlib
 
 # Include bcache code.
 HAVE_BCACHE=	yes
 
 # Enable PnP and ISA-PnP code.
 HAVE_PNP=	yes
 HAVE_ISABUS=	yes
 
 .if ${MK_LOADER_ZFS} == "yes"
 CFLAGS.main.c+=	-I${SYSDIR}/contrib/openzfs/include
 CFLAGS.main.c+=	-I${SYSDIR}/contrib/openzfs/include/os/freebsd/zfs
 .endif
 
 .if exists(${.CURDIR}/help.i386)
 HELP_FILES=	${.CURDIR}/help.i386
 .endif
 HELP_FILENAME=	loader.help.bios
 
 # Always add MI sources
 .include	"${BOOTSRC}/loader.mk"
 
 CLEANFILES+=	${LOADER} ${LOADER}.bin 8x16.c
 
 ORG=		0x0
 
 CFLAGS+=	-Wall
 LDFLAGS+=	-static ${LDFLAGS_ORG} -Wl,--gc-sections
 .if ${LINKER_TYPE} == "lld" && ${LINKER_VERSION} >= 130000
 # lld 13 and higher default to garbage collecting start/stop symbols,
 # completely ruining our linker sets. For now, work around it by
 # disabling this un-feature.
 LDFLAGS+=	-Wl,-z,nostart-stop-gc
 .endif
 
 # i386 standalone support library
 LIBI386=	${BOOTOBJ}/i386/libi386/libi386.a
 CFLAGS+=	-I${BOOTSRC}/i386
 
 # Debug me!
 #CFLAGS+=	-g
 #LDFLAGS+=	-g
 
 8x16.c: ${SRCTOP}/contrib/terminus/ter-u16b.bdf
 	vtfontcvt -f compressed-source -o ${.TARGET} ${.ALLSRC}
 
 
 ${LOADER}: ${LOADER}.bin ${BTXLDR} ${BTXKERN}
 	btxld -v -f aout -e ${LOADER_ADDRESS} -o ${.TARGET} -l ${BTXLDR} \
 		-b ${BTXKERN} ${LOADER}.bin
 
 ${LOADER}.bin: ${LOADER}.sym
 	${STRIPBIN} -R .comment -R .note -o ${.TARGET} ${.ALLSRC}
 	@set -- `ls -l ${.TARGET}` ; x=$$((${LOADERSIZE}-$$5)); \
 	    echo "$$x bytes available"; test $$x -ge 0
 
 .if ${MK_LOADER_ZFS} == "yes" && ${LOADER_INTERP} == ${LOADER_DEFAULT_INTERP}
 LINKS+=		${BINDIR}/${LOADER} ${BINDIR}/zfsloader
 .endif
 .if ${LOADER_INTERP} == ${LOADER_DEFAULT_INTERP}
 LINKS+=		${BINDIR}/${LOADER} ${BINDIR}/loader
 .endif
 FILES+=	${LOADER}
 FILESMODE_${LOADER}= ${BINMODE} -b
 
 # Note: crt0.o needs to be first for pxeboot(8) to work. It assumes that the
 # startup code is located at the start of the loader and will jump
 # there. Although btx is more flexible than this, the emulated boot2 environment
 # that pxeldr provides has none of that flexibility assumes an entry point of
 # 0. In addition, pxeldr and cdboot assume that it is loading an a.out file.
 #
 # We must add it to the LDFLAGS instead of the OBJS because the former won't try
 # to clean it. When it is in OBJS, this cleaning can lead to races where
 # btxcrt.o is rebuilt, but boot2 isn't, leading to errors at installation time.
 # LDFLAGS does not have this baggage and will be included first in the list of
 # files.
 LDFLAGS+=	${BTXCRT}
 
 DPADD=	${LDR_INTERP32} ${LIBI386} ${LIBSA32}
 LDADD=	${LDR_INTERP32} ${LIBI386} ${LIBSA32}
 
 .if ${MACHINE_CPUARCH} == "amd64"
 CFLAGS+=	-DLOADER_PREFER_AMD64
 .endif
 
 .include <bsd.prog.mk>
diff --git a/stand/kboot/kboot/Makefile b/stand/kboot/kboot/Makefile
index 2e68a9ba9214..b571c3acada1 100644
--- a/stand/kboot/kboot/Makefile
+++ b/stand/kboot/kboot/Makefile
@@ -1,63 +1,70 @@
 
 LOADER_DISK_SUPPORT?=	yes
 LOADER_CD9660_SUPPORT?=	yes
 LOADER_MSDOS_SUPPORT?=	no
 LOADER_EXT2FS_SUPPORT?=	yes
 LOADER_UFS_SUPPORT?=	yes
 LOADER_ZFS_SUPPORT?=	yes
 LOADER_NET_SUPPORT?=	no
 LOADER_NFS_SUPPORT?=	no
 LOADER_TFTP_SUPPORT?=	no
 LOADER_GZIP_SUPPORT?=	no
 LOADER_BZIP2_SUPPORT?=	no
 
 .include <bsd.init.mk>
 
 PROG=		loader.kboot
 NEWVERSWHAT=	"kboot loader" ${MACHINE_ARCH}
 INSTALLFLAGS=	-b
 
 # Architecture-specific loader code
 SRCS=	\
 		bootinfo.c \
 		conf.c \
 		hostcons.c \
 		hostdisk.c \
 		hostfs.c \
 		init.c \
 		kbootfdt.c \
 		main.c \
 		seg.c \
 		util.c \
 		vers.c
 
 .if ${MK_LOADER_ZFS} != "no"
 CFLAGS+=	-I${ZFSSRC}
 CFLAGS+=        -I${SYSDIR}/contrib/openzfs/include
 CFLAGS+=        -I${SYSDIR}/contrib/openzfs/include/os/freebsd/zfs
 HAVE_ZFS=yes
 .endif
 
 HELP_FILENAME=	loader.help.kboot
 
 .include	"${BOOTSRC}/fdt.mk"
 
 # We share bootinfo.c with efi
 .PATH:		${BOOTSRC}/efi/loader
 
 # Note: Since we're producing a userland binary, we key off of MACHINE_ARCH
 # instead of the more normal MACHINE since the changes between different flavors
 # of MACHINE_ARCH are large enough in Linux that it's easier that way.
 .PATH:	${.CURDIR}/arch/${MACHINE_ARCH}
 .include "${.CURDIR}/arch/${MACHINE_ARCH}/Makefile.inc"
 
 # Always add MI sources
 .include	"${BOOTSRC}/loader.mk"
 CFLAGS+=	-I${.CURDIR} -I${.CURDIR}/arch/${MACHINE_ARCH}
 
 CFLAGS+=	-Wall
 
 DPADD=		${LDR_INTERP} ${LIBOFW} ${LIBSAFDT} ${LIBSA} ${LIBKBOOT}
 LDADD=		${LDR_INTERP} ${LIBOFW} ${LIBSAFDT} ${LIBSA} ${LIBKBOOT}
 
+# Add our own lua bindings until they are universal
+.if ${LOADER_INTERP} == "lua"
+SRCS+=		\
+		lua_bindings.c
+CFLAGS.lua_bindings.c+=  -I${FLUALIB}/libhash
+.endif
+
 .include <bsd.prog.mk>
diff --git a/stand/kboot/kboot/lua_bindings.c b/stand/kboot/kboot/lua_bindings.c
new file mode 100644
index 000000000000..ca5d0253c21f
--- /dev/null
+++ b/stand/kboot/kboot/lua_bindings.c
@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2024 Netflix, Inc.
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include "lua.h"
+#include "lauxlib.h"
+#include "lutils.h"
+#include "lhash.h"
+
+static void
+lua_hash_bindings(lua_State *L)
+{
+	luaL_requiref(L, "hash", luaopen_hash, 1);
+	lua_pop(L, 1);	/* Remove lib */
+}
+
+LUA_COMPILE_SET(lua_hash_bindings);
diff --git a/stand/liblua/Makefile b/stand/liblua/Makefile
index bbfa21e07f53..b0d89bec4f02 100644
--- a/stand/liblua/Makefile
+++ b/stand/liblua/Makefile
@@ -1,46 +1,49 @@
 
 .include <bsd.init.mk>
 
 .PATH:		${LUASRC}
 .PATH:		${LIBLUASRC}
 
 .include	"${BOOTSRC}/lua.mk"
 
 LIB=		lua
 INTERNALLIB=
 
 # Core Lua.
 SRCS=	lapi.c lcode.c lctype.c ldebug.c ldo.c ldump.c lfunc.c lgc.c llex.c \
 	lmem.c lobject.c lopcodes.c lparser.c lstate.c lstring.c ltable.c \
         ltm.c lundump.c lvm.c lzio.c
 SRCS+=	lauxlib.c lbaselib.c lstrlib.c loadlib.c
 
 # These aren't yet included, but link now, omitting them saves 15k
 #SRCS+=	lcorolib.c ldblib.c lutf8lib.c
 
 # These aren't yet compatible with the boot environment, and some may never be
 #SRCS+=	lbitlib.c liolib.c lmathlib.c loslib.c ltablib.c
 
 # Our utilities.
 SRCS+=	lerrno.c lpager.c lstd.c lutils.c
 SRCS+=	gfx_utils.c
 
 .PATH:	${FLUASRC}/modules
 SRCS+=	lfs.c
+.PATH:	${FLUALIB}/libhash
+SRCS+=	lhash.c
 
 WARNS?=	3
 
 CFLAGS+= -DLUA_PATH=\"${LUAPATH}\" -DLUA_PATH_DEFAULT=\"${LUAPATH}/\?.lua\"
 CFLAGS+= -ffreestanding -nostdlib -DLUA_USE_POSIX
 CFLAGS+= -fno-stack-protector -D__BSD_VISIBLE
 CFLAGS+= -I${BOOTSRC}/include -I${LIBLUASRC} -I${LUASRC} -I${LDRSRC}
 
 CFLAGS.gfx_utils.c+= -I${SRCTOP}/sys/teken -I${SRCTOP}/contrib/pnglite
+CFLAGS.lhash.c+= -I${FLUALIB}/libhash -I${SRCTOP}/sys/crypto/sha2
 
 .if ${MACHINE_CPUARCH} == "amd64" && ${DO32:U0} == 0
 CFLAGS+=	-fPIC
 .endif
 
 .include "${BOOTSRC}/veriexec.mk"
 
 .include <bsd.lib.mk>