diff --git a/datamove6.sh b/datamove6.sh
new file mode 100755
index 000000000000..88bfea425bdc
--- /dev/null
+++ b/datamove6.sh
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# Variation of the datamove.sh, using MSDOSFS
+
+# No problems seen
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+
+here=`pwd`
+prog=$(basename "$0" .sh)
+cd /tmp
+sed '1,/^EOF/d' < $here/datamove.sh > $prog.c
+mycc -o $prog -Wall -Wextra -O2 -g $prog.c
+rm -f $prog.c
+
+set -eu
+mount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint
+[ -c /dev/md$mdstart ] &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 2g -u $mdstart
+newfs_msdos -F 32 -b 8192 /dev/md$mdstart 2> /dev/null
+#mount -t msdosfs /dev/md$mdstart $mntpoint
+mount_msdosfs -m 777 /dev/md$mdstart $mntpoint
+set +e
+
+$here/../testcases/swap/swap -t 5m -i 100 -h &
+for i in `jot 5`; do
+	su $testuser -c "cd $mntpoint; /tmp/$prog"
+done
+mv /tmp/$prog $mntpoint
+for i in `jot 5`; do
+	mkdir -p $mntpoint/datamove.dir.$i
+	cd $mntpoint/datamove.dir.$i
+	$mntpoint/$prog &
+done
+pkill swap
+wait
+while mount | grep -q $mntpoint; do
+	umount -f $mntpoint > /dev/null 2>&1
+done
+mdconfig -d -u $mdstart
+
+exit 0
diff --git a/ftruncate3.sh b/ftruncate3.sh
new file mode 100755
index 000000000000..7373ae8d22a8
--- /dev/null
+++ b/ftruncate3.sh
@@ -0,0 +1,96 @@
+#!/bin/sh
+
+# Test scenario from Bug 64816: [nfs] [patch] mmap and/or ftruncate does not work correctly on nfs mounted file systems
+
+. ../default.cfg
+
+set -u
+grep -q $mntpoint /etc/exports ||
+    { echo "$mntpoint missing from /etc/exports"; exit 0; }
+rpcinfo 2>/dev/null | grep -q mountd || exit 0
+
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+#include <sys/types.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+void error(char *msg)
+{
+	fprintf(stderr, "Error: %s\nSystem error %d: %s\n", msg, errno, strerror(errno));
+	exit(-1);
+}
+
+#define SZ 1024 // Less than page size
+
+int main(int argn, char *argv[])
+{
+	int fd, s;
+	char buffer[SZ];
+	char *map;
+
+	if (argn!=2)
+	{
+		fprintf(stderr, "Usage:\n %s [filename]\n", argv[0]);
+		_exit(-1);
+	}
+
+	memset(buffer, 0, SZ);
+	s = 0;
+
+	fd=open(argv[1], O_RDWR|O_CREAT|O_TRUNC, S_IRUSR|S_IWUSR);
+	if (fd==-1)
+		error("Could not create file");
+
+	if (write(fd, buffer, SZ)!=SZ)
+		error("Could not write buffer");
+
+	map=mmap(NULL, SZ, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
+	if (map==MAP_FAILED)
+		error("Map failed");
+	map[SZ-1]=1;
+
+	if (ftruncate(fd, SZ+1)!=0)
+		error("Could not truncate file");
+
+	if (map[SZ-1]==1)
+		printf("Test passed\n");
+	else {
+		printf("Test failed\n");
+		s = 1;
+	}
+
+	exit(s);
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 -g /tmp/$prog.c || exit 1
+
+mount | grep -q "on $mntpoint " && umount -f $mntpoint
+mdconfig -l | grep -q md$mdstart && mdconfig -d -u $mdstart
+mdconfig -s 1g -u $mdstart
+newfs -n $newfs_flags /dev/md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+
+mp2=${mntpoint}2
+mkdir -p $mp2
+mount | grep -q "on $mp2 " && umount -f $mp2
+mount -t nfs -o retrycnt=3 127.0.0.1:$mntpoint $mp2 || exit 1
+sleep .2
+mount | grep  $mntpoint
+
+cd $mp2
+/tmp/$prog $prog.data; s=$?
+ls -ls $mp2/$prog.data
+cd -
+
+umount $mp2
+umount $mntpoint
+mdconfig -d -u $mdstart
+rm -f /tmp/$prog /tmp/$prog.c
+exit $s
diff --git a/growfs3.sh b/growfs3.sh
new file mode 100755
index 000000000000..33e8327cdbbc
--- /dev/null
+++ b/growfs3.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+. ../default.cfg
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+set -eu
+prog=$(basename "$0" .sh)
+log=/tmp/$prog.log
+mount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint
+[ -c /dev/md$mdstart ] &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 32g -u $mdstart
+/sbin/gpart create -s GPT md$mdstart > /dev/null
+/sbin/gpart add -t freebsd-ufs -s 2g -a 4k md$mdstart > /dev/null
+set +e
+
+newfs_flags=$(echo "-O1" "-O2" "-U" "-j" | awk -v N=`jot -r 1 1 4` '{print $N}')
+echo "newfs $newfs_flags md${mdstart}p1"
+newfs $newfs_flags md${mdstart}p1 > /dev/null
+[ "$newfs_flags" = "-O2" ] &&
+    tunefs -n disable md${mdstart}p1 > /dev/null 2>&1
+mount /dev/md${mdstart}p1 $mntpoint
+cp -r /usr/include $mntpoint/inc1
+umount $mntpoint
+
+gpart resize -i 1 -s 31g -a 4k md$mdstart
+growfs -y md${mdstart}p1 > /dev/null
+
+mount /dev/md${mdstart}p1 $mntpoint
+cp -r /usr/include $mntpoint/inc2
+umount $mntpoint
+fsck -fy /dev/md${mdstart}p1 > $log 2>&1; s=$?
+grep -q "WAS MODIFIED" $log && { cat $log; s=1; }
+rm -f $log
+mdconfig -d -u $mdstart
+exit $s
diff --git a/kcmp.sh b/kcmp.sh
new file mode 100755
index 000000000000..7c571dd8e8a1
--- /dev/null
+++ b/kcmp.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# Seen:
+# UID  PID PPID  C PRI NI   VSZ  RSS MWCHAN   STAT TT     TIME COMMAND
+#   0 3730 3668 11  20  0 13596 2904 exithold DE+   0  1:59.68 ./kcmp
+
+# Fixed by: 5b3e5c6ce3e5
+
+. ../default.cfg
+
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+#include <sys/types.h>
+
+#include <err.h>
+#include <fcntl.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+static void *
+t1(void *data __unused)
+{
+	for (;;)
+		pause();
+
+	return (NULL);
+}
+
+int
+main(void)
+{
+	pid_t p1, p2;
+	pthread_t tid[2];
+	time_t start;
+	uintptr_t idx1, idx2;
+	int r;
+
+	if ((r = pthread_create(&tid[0], NULL, t1, NULL)) != 0)
+		errc(1, r, "pthread_create");
+	if ((r = pthread_create(&tid[1], NULL, t1, NULL)) != 0)
+		errc(1, r, "pthread_create");
+
+	start = time(NULL);
+	while (time(NULL) - start < 60) {
+		idx1 = idx2 = 0;
+		p1 = arc4random() % 1000000;
+		p2 = arc4random() % 1000000;
+		kcmp(p1, p2, KCMP_VM, idx1, idx2);
+	}
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+/tmp/$prog
+
+rm /tmp/$prog.c /tmp/$prog
+exit 0
diff --git a/marcus8.sh b/marcus8.sh
new file mode 100755
index 000000000000..0c6110c8ec4c
--- /dev/null
+++ b/marcus8.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+# Run with marcus.cfg on a 5g swap backed MD with UFS non SU fs.
+# Check for non empty file system after test.
+
+. ../default.cfg
+
+set -u
+mount | grep $mntpoint | grep -q /dev/md && umount -f $mntpoint
+mdconfig -l | grep -q md$mdstart &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 4g -u $mdstart
+newfs_flags=""	# With SU this test runs out of disk space
+newfs $newfs_flags md$mdstart > /dev/null
+tunefs -n disable md$mdstart	# Remove the default SU flag
+mount /dev/md$mdstart $mntpoint
+chmod 777 $mntpoint
+
+export runRUNTIME=5m
+export CTRLDIR=$mntpoint/stressX.control
+export RUNDIR=$mntpoint/stressX
+
+su $testuser -c 'cd ..; ./run.sh marcus.cfg'
+
+nb=`find $RUNDIR | wc -l`
+[ $nb -gt 1 ] && { find $RUNDIR -ls | head -12; s=1; } || s=0
+n=0
+while mount | grep $mntpoint | grep -q /dev/md; do
+	umount $mntpoint || sleep 1
+	[ $((n += 1)) -gt 300 ] && { echo FAIL; exit 1; }
+done
+checkfs /dev/md$mdstart; s2=$?
+mdconfig -d -u $mdstart
+exit $((s + s2))
diff --git a/mprotect3.sh b/mprotect3.sh
new file mode 100755
index 000000000000..9bd4a6f9be79
--- /dev/null
+++ b/mprotect3.sh
@@ -0,0 +1,70 @@
+#!/bin/sh
+
+# Test scenario from:
+# Bug 272585 - calling mprotect in an mmap-ed stack can affect non-target pages 
+# Test scenario by: John F. Carr <jfc mit edu>
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+/* Test program from:
+   Bug 272585 - calling mprotect in an mmap-ed stack can affect non-target pages
+ */
+#include <err.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <sysexits.h>
+#include <unistd.h>
+
+#ifndef MAP_GROWSDOWN
+#define MAP_GROWSDOWN 0
+#endif
+#ifndef MAP_STACK
+#define MAP_STACK 0
+#endif
+
+int main(void)
+{
+  long pagesize;
+  char *addr, *guard;
+  size_t alloc_size;
+
+  pagesize = sysconf(_SC_PAGESIZE);
+  if (pagesize < 0)
+    err(EX_OSERR, "getPAGESIZE");
+
+  alloc_size = 0x200000 + pagesize;
+
+  addr = mmap(0, alloc_size, PROT_READ|PROT_WRITE,
+              MAP_GROWSDOWN|MAP_STACK|MAP_PRIVATE|MAP_ANONYMOUS,
+              -1, 0);
+  if (addr == MAP_FAILED) {
+    err(EX_OSERR, "mmap");
+  }
+
+  /* Only 0x20 causes a failure. */
+  guard = addr + alloc_size - 0x20 * pagesize;
+
+  if (mprotect(guard, pagesize, PROT_NONE)) {
+    err(EX_OSERR, "mprotect");
+  }
+
+  printf("mapped %p..%p, guard at %p\n", addr, addr + alloc_size, guard);
+  fflush(stdout);
+
+  ((volatile char *)guard)[-1];
+
+  return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c || exit 0
+
+cd /tmp
+./$prog; s=$?
+cd -
+
+rm -f /tmp/$prog /tmp/$prog.c /tmp/$prog.core
+exit $s
diff --git a/mprotect4.sh b/mprotect4.sh
new file mode 100755
index 000000000000..c233d20852a2
--- /dev/null
+++ b/mprotect4.sh
@@ -0,0 +1,109 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+/* N readers and 1 writer threaded test scenario */
+
+#include <sys/types.h>
+#include <sys/mman.h>
+
+#include <assert.h>
+#include <err.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+static int go, n, ps;
+static char *cp;
+static volatile char v;
+
+void *
+rd(void *arg __unused)
+{
+	int i;
+
+	while (go == 0)
+		usleep(100);
+	while (go == 1) {
+		for (i = 0; i < n; i += ps) {
+			v = cp[i];
+		}
+		pthread_yield();
+	}
+	return(NULL);
+}
+
+void
+usage(char *prog) {
+	fprintf(stderr, "Usage: %s <number of threads>\n", prog);
+	_exit(1);
+}
+
+int
+main(int argc, char *argv[])
+{
+	pthread_t *tid;
+	time_t start;
+	int e, i, nb;
+
+	if (argc != 2)
+		usage(argv[0]);
+	if (sscanf(argv[1], "%d", &n) != 1)
+		usage(argv[0]);
+	if (n > 1)
+		n--;
+	if ((tid = calloc(n, sizeof(pthread_t *))) == NULL)
+		err(1, "calloc()");
+
+	ps = getpagesize();
+	cp = mmap(NULL, n * ps, PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
+	go = 0;
+	for (i = 0; i < n; i++) {
+		if ((e = pthread_create(&tid[i], NULL, rd, NULL)) != 0)
+			errc(1, e, "pthread_create()");
+	}
+	go = 1;
+
+	nb = 0;
+	start = time(NULL);
+	while (time(NULL) - start < 120) {
+		for (i = 0; i < n; i += ps) {
+			if (mprotect(&cp[i], ps, PROT_READ|PROT_WRITE) == -1)
+				err(1, "mprotect(PROT_READ)");
+			cp[i] = 1;
+			if (mprotect(&cp[i], ps, PROT_READ) == -1)
+				err(1, "mprotect(PROT_READ)");
+			nb++;
+		}
+	}
+	go = 0;
+	for (i = 0; i < n; i++) {
+		if ((e = pthread_join(tid[i], NULL)) != 0)
+			errc(1, e, "pthread_join() in loop %d", i);
+	}
+	if (nb >= 0) {
+#if defined(DEBUG)
+		fprintf(stderr, "%d loops\n", nb);
+#endif
+		;
+	}
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+/tmp/$prog `sysctl -n hw.ncpu`; s=$?
+
+rm -d /tmp/$prog /tmp/$prog.c
+exit $s
diff --git a/mprotect5.sh b/mprotect5.sh
new file mode 100755
index 000000000000..ab4d2eeee118
--- /dev/null
+++ b/mprotect5.sh
@@ -0,0 +1,118 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+/* N writers threaded test scenario */
+
+#include <sys/types.h>
+#include <sys/mman.h>
+
+#include <assert.h>
+#include <err.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+static pthread_mutex_t write_mutex;
+static int go, n, ps;
+static char *cp, *wp;
+
+void *
+wr(void *arg __unused)
+{
+	while (go == 0)
+		usleep(100);
+	while (go == 1) {
+		pthread_mutex_lock(&write_mutex);
+		if (wp != NULL)
+			*wp += 1;
+		pthread_mutex_unlock(&write_mutex);
+	}
+	return(NULL);
+}
+
+void
+usage(char *prog) {
+	fprintf(stderr, "Usage: %s <number of threads>\n", prog);
+	_exit(1);
+}
+
+int
+main(int argc, char *argv[])
+{
+	pthread_t *tid;
+	time_t start;
+	int e, i, nb;
+
+	if (argc != 2)
+		usage(argv[0]);
+	if (sscanf(argv[1], "%d", &n) != 1)
+		usage(argv[0]);
+	if (n > 1)
+		n--;
+	if ((tid = calloc(n, sizeof(pthread_t *))) == NULL)
+		err(1, "calloc()");
+
+	ps = getpagesize();
+	cp = mmap(NULL, n * ps, PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
+	pthread_mutex_init(&write_mutex, NULL);
+	pthread_mutex_lock(&write_mutex);
+	go = 0;
+	for (i = 0; i < n; i++) {
+		if ((e = pthread_create(&tid[i], NULL, wr, NULL)) != 0)
+			errc(1, e, "pthread_create()");
+	}
+	go = 1;
+
+	nb = 0;
+	start = time(NULL);
+	while (time(NULL) - start < 120) {
+		for (i = 0; i < n; i += ps) {
+			pthread_mutex_lock(&write_mutex);
+			if (mprotect(&cp[i], ps, PROT_READ|PROT_WRITE) == -1)
+				err(1, "mprotect(PROT_READ)");
+			cp[i] = 0;
+			wp = &cp[i];
+			pthread_mutex_unlock(&write_mutex);
+
+			usleep(100);
+
+			pthread_mutex_lock(&write_mutex);
+			if (mprotect(&cp[i], ps, PROT_READ) == -1)
+				err(1, "mprotect(PROT_READ)");
+			wp = NULL;
+			pthread_mutex_unlock(&write_mutex);
+			nb++;
+		}
+	}
+	go = 0;
+	for (i = 0; i < n; i++) {
+		if ((e = pthread_join(tid[i], NULL)) != 0)
+			errc(1, e, "pthread_join() in loop %d", i);
+	}
+	if (nb >= 0) {
+#if defined(DEBUG)
+		fprintf(stderr, "%d loops\n", nb);
+#endif
+		;
+	}
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+/tmp/$prog `sysctl -n hw.ncpu`; s=$?
+
+rm -d /tmp/$prog /tmp/$prog.c
+exit $s
diff --git a/mprotect6.sh b/mprotect6.sh
new file mode 100755
index 000000000000..ef1443c216d3
--- /dev/null
+++ b/mprotect6.sh
@@ -0,0 +1,146 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+#include <sys/types.h>
+#include <sys/mman.h>
+
+#include <assert.h>
+#include <err.h>
+#include <pthread.h>
+#include <signal.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+static pthread_mutex_t write_mutex;
+static volatile int done;
+static int go, n, *once, *p, ps;
+
+static void *
+wr(void *arg)
+{
+	int idx;
+
+	alarm(180);
+	idx = *(int *)arg;
+	while (go == 0)
+		usleep(100);
+	while (go == 1) {
+		while (go == 1 && once[idx] == 0)
+			usleep(100);
+		if (go == 0)
+			break;
+		p[idx]++;
+		once[idx] = 0;
+		pthread_mutex_lock(&write_mutex);
+		done++;
+		pthread_mutex_unlock(&write_mutex);
+	}
+	return(NULL);
+}
+
+static void
+setonce(int val)
+{
+	int i;
+
+	for (i = 0; i < n; i++)
+		once[i] = val;
+}
+
+static void
+usage(char *prog) {
+	fprintf(stderr, "Usage: %s <number of threads>\n", prog);
+	_exit(1);
+}
+
+int
+main(int argc, char *argv[])
+{
+	pthread_t *tid;
+	time_t start;
+	int *arg;
+	int e, i, nb, r;
+
+	if (argc != 2)
+		usage(argv[0]);
+	if (sscanf(argv[1], "%d", &n) != 1)
+		usage(argv[0]);
+	if (n > 1)
+		n--;
+	if ((tid = calloc(n, sizeof(pthread_t *))) == NULL)
+		err(1, "calloc()");
+	if ((once = calloc(n, sizeof(int *))) == NULL)
+		err(1, "calloc()");
+	setonce(0);
+
+	ps = getpagesize();
+	p = mmap(NULL, n * ps, PROT_READ, MAP_PRIVATE | MAP_ANON, -1, 0);
+	go = 0;
+	pthread_mutex_init(&write_mutex, NULL);
+	for (i = 0; i < n; i++) {
+		arg = malloc(sizeof(int));
+		*arg = i;
+		if ((e = pthread_create(&tid[i], NULL, wr, (void *)arg)) != 0)
+			errc(1, e, "pthread_create()");
+	}
+	go = 1;
+
+	nb = 0;
+	start = time(NULL);
+	while (time(NULL) - start < 120) {
+		if (mprotect(p, n * ps, PROT_READ|PROT_WRITE) == -1)
+			err(1, "mprotect(PROT_READ)");
+		done = 0;
+		setonce(1);
+		while (done != n)
+			usleep(100);
+		if (mprotect(p, n * ps, PROT_READ) == -1)
+			err(1, "mprotect(PROT_READ)");
+		nb++;
+		usleep(100);
+	}
+	go = 0;
+	for (i = 0; i < n; i++) {
+		if ((e = pthread_join(tid[i], NULL)) != 0)
+			errc(1, e, "pthread_join() in loop %d", i);
+	}
+	r = 0;
+	for (i = 1; i < n; i++) {
+		if (p[0] != p[i])
+			r++;
+	}
+	if (r != 0) {
+		fprintf(stderr, "%d loops.\n", nb);
+		for (i = 0; i < n; i++)
+			fprintf(stderr, "p[%3d] = %d\n", i, p[i]);
+	}
+
+	return (r);
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 -g /tmp/$prog.c -lpthread || exit 1
+
+n=`sysctl -n hw.ncpu`
+if [ $# -eq 1 ]; then
+	echo $1 | grep -Eq '^[0-9]+$' && n=$1
+fi
+../testcases/swap/swap -t 2m > /dev/null &
+sleep 10
+/tmp/$prog $n; s=$?
+pkill -9 swap
+wait
+
+rm -d /tmp/$prog /tmp/$prog.c
+exit $s
diff --git a/msdos17.sh b/msdos17.sh
new file mode 100755
index 000000000000..392a9a622b9a
--- /dev/null
+++ b/msdos17.sh
@@ -0,0 +1,144 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# No problems observed
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+
+set -u
+prog=$(basename "$0" .sh)
+mount | grep -q "on $mntpoint " && umount $mntpoint
+[ -c /dev/md$mdstart ] && mdconfig -d -u $mdstart
+
+mdconfig -a -t swap -s 1g -u $mdstart
+gpart create -s bsd md$mdstart > /dev/null
+gpart add -t freebsd-ufs md$mdstart > /dev/null
+part=a
+newfs_msdos -F 32 -b 8192 /dev/md${mdstart}$part > /dev/null || exit 1
+mount -t msdosfs /dev/md${mdstart}$part $mntpoint
+
+here=`pwd`
+cd /tmp
+cat > $prog.c <<EOF
+#include <sys/param.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#include <machine/atomic.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+static volatile u_int *share;
+static char file1[80], file2[80];
+
+#define SYNC 0
+#define STOP 1
+
+static void
+test0(void)
+{
+	struct stat sb;
+
+	while (share[STOP] == 0) {
+		while (share[SYNC] != 0)
+			usleep(100);
+		if (rename(file1, file2) == -1)
+			err(1, "rename(%s, %s)", file1, file2);
+		if (stat(file1, &sb) == 0)
+			err(1, "stat(%s)", file1);
+		atomic_add_int(&share[SYNC], 1);
+	}
+
+	_exit(0);
+}
+
+static void
+test1(void)
+{
+	struct stat sb;
+
+	while (share[STOP] == 0) {
+		while (share[SYNC] != 1)
+			usleep(100);
+		if (rename(file2, file1) == -1)
+			err(1, "rename(%s, %s)", file2, file1);
+		if (stat(file2, &sb) == 0)
+			err(1, "stat(%s)", file2);
+		atomic_add_int(&share[SYNC], -1);
+	}
+
+	_exit(0);
+}
+
+int
+main(void)
+{
+	pid_t pids[2];
+	size_t len;
+	int fd;
+	char cwd[80];
+
+	len = PAGE_SIZE;
+	if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
+	    MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
+		err(1, "mmap");
+
+	if (getcwd(cwd, sizeof(cwd)) == NULL)
+		err(1, "getcwd()");
+	snprintf(file1, sizeof(file1), "%s/a.%06d", cwd, getpid());
+	snprintf(file2, sizeof(file2), "%s/b.%06d", cwd, getpid());
+	if ((fd = open(file1, O_CREAT, 0640)) == -1)
+		err(1, "open(%s)", file1);
+	close(fd);
+
+	if ((pids[0] = fork()) == 0)
+		test0();
+	if ((pids[1] = fork()) == 0)
+		test1();
+
+	sleep(120);
+	share[STOP] = 1;
+
+	if (waitpid(pids[0], NULL, 0) == -1)
+		err(1, "waitpid(%d)", pids[0]);
+	if (waitpid(pids[1], NULL, 0) == -1)
+		err(1, "waitpid(%d)", pids[1]);
+	unlink(file1);
+	unlink(file2);
+}
+EOF
+mycc -o $prog -Wall $prog.c || exit 1
+rm -f $prog.c
+cd $here
+
+(cd ../testcases/swap; ./swap -t 5m -i 20 -l 100) &
+cd $mntpoint
+pids=""
+for i in `jot 30`; do
+	/tmp/$prog &
+	pids="$pids $!"
+done
+for pid in $pids; do
+	wait $pid
+done
+cd $here
+while pkill swap; do :; done
+wait
+
+umount $mntpoint
+mdconfig -d -u $mdstart
+rm -f /tmp/$prog
+exit 0
diff --git a/msdos20.sh b/msdos20.sh
new file mode 100755
index 000000000000..96c224a629f3
--- /dev/null
+++ b/msdos20.sh
@@ -0,0 +1,87 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# msdosfs disk image fuzz test.
+# No problems seen
+
+. ../default.cfg
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+cc -o /tmp/flip -Wall -Wextra -O2 ../tools/flip.c || exit 1
+
+set -eu
+u1=$mdstart
+u2=$((mdstart + 1))
+mp1=${mntpoint}$u1
+mp2=${mntpoint}$u2
+mkdir -p $mp1 $mp2
+prog=$(basename "$0" .sh)
+backup=/tmp/$prog.sh.diskimage.`date +%Y%m%dT%H%M%S`
+cap=$((32 * 1024))	# Only fuzz the first 32k
+log=$mp1/$prog.sh.log
+diskimage=$mp1/msdos20.sh.diskimage
+
+set +e
+mount | grep "on $mp2 " | grep -q /dev/md && umount -f $mp2
+mount | grep "on $mp1 " | grep -q /dev/md && umount -f $mp1
+[ -c /dev/md$u2 ] && mdconfig -d -u $u2
+[ -c /dev/md$u1 ] && mdconfig -d -u $u1
+mdconfig -a -t swap -s 2g -u $u1
+newfs -U /dev/md$u1 > /dev/null
+mount /dev/md$u1 $mp1
+
+size=32m
+type=`jot -r 1 1 3`
+[ $type -eq 3 ] && size=260m
+[ -c /dev/md$u2 ] && mdconfig -d -u $u2
+dd if=/dev/zero of=$diskimage bs=$size count=1 status=none
+mdconfig -a -t vnode -f $diskimage -u $u2
+[ $type -eq 1 ] && newfs_msdos -F 12         /dev/md$u2 > /dev/null 2>&1
+[ $type -eq 2 ] && newfs_msdos -F 16         /dev/md$u2 > /dev/null 2>&1
+[ $type -eq 3 ] && newfs_msdos -F 32 -b 4096 /dev/md$u2 > /dev/null 2>&1
+
+mount -t msdosfs /dev/md$u2 $mp2 || { echo "Initial mount of type $type failed"; exit 1; }
+if [ -d /usr/include/sys ]; then
+	mkdir $mp2/sys
+	cp /usr/include/sys/elf_common.h $mp2/sys
+	cp /usr/include/sys/soundcard.h  $mp2/sys
+	cp /usr/include/sys/sysproto.h   $mp2/sys
+fi
+umount $mp2
+
+cd $mp1
+start=`date +%s`
+nn=0
+s=0
+while [ $((`date +%s` - start)) -lt 240 ]; do
+	mount -t msdosfs /dev/md$u2 $mp2 2>/dev/null || { s=1; break; }
+	ls -lR $mp2 > /dev/null 2>&1 ||  { s=2; break; }
+	rm -rf $mp2/* > /dev/null 2>&1 || { s=3; break; }
+	touch $mp2/`jot -rc 8 a z | tr -d '\n'` || { s=4; break; }
+	while mount | grep -q "on $mp2 "; do umount $mp2; done
+	echo * | grep -q core && { s=5; break; }
+	sync
+	mdconfig -d -u $u2
+	/tmp/flip -n 10 -s $cap $diskimage
+	cp $diskimage $backup
+	fsync $backup
+	sync
+	mdconfig -a -t vnode -f $diskimage -u $u2
+	nn=$((nn + 1))
+done
+#echo "Exit after $nn loops on a type $type MSDOS FS with code $s"
+mount | grep -q "on $mp2 " && umount $mp2
+mdconfig -d -u $u2 || exit 1
+
+echo * | grep -q core && { ls -l *.core; cp $log /tmp; exit 106; } ||
+cd /tmp
+umount $mp1
+mdconfig -d -u $u1
+rm -f /tmp/flip $backup
+exit 0
diff --git a/msdos21.sh b/msdos21.sh
new file mode 100755
index 000000000000..68ea94eab105
--- /dev/null
+++ b/msdos21.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+# Test scenario from https://reviews.freebsd.org/D43951 "Fix MSDOSFS rename (in case target exists)"
+# Test scenario by se@
+
+# Triggered a panic with a WiP kernel patch.
+
+set -u
+[ -f "`which rsync`" ] || exit 0
+[ -d /usr/src/lib ]    || exit 0
+
+MDUNIT=10
+FS=/mnt/test
+mdconfig -u $MDUNIT -t malloc -s 512m
+newfs_msdos -c 8 -F 32 /dev/md$MDUNIT > /dev/null 2>&1
+mkdir -p $FS
+mount -t msdos /dev/md$MDUNIT $FS
+rsync -r /usr/src/lib/libsysdecode $FS
+rsync -r /usr/src/lib/libsysdecode $FS
+rsync -r /usr/src/lib/libsysdecode $FS
+umount $FS
+fsck_msdosfs -y /dev/md$MDUNIT; s=$?
+mdconfig -d -u $MDUNIT
+
+exit $s
diff --git a/newfs8.sh b/newfs8.sh
new file mode 100755
index 000000000000..56ee07cba9b1
--- /dev/null
+++ b/newfs8.sh
@@ -0,0 +1,69 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# Variation of newfs.sh with VM pressure added
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+
+set -u
+mount | grep "$mntpoint" | grep md$mdstart > /dev/null &&
+    umount $mntpoint
+mdconfig -l | grep md$mdstart > /dev/null &&  mdconfig -d -u $mdstart
+
+mdconfig -a -t swap -s 20g -u $mdstart
+
+log=/tmp/newfs.sh.log
+s=0
+export RUNDIR=$mntpoint/stressX
+export runRUNTIME=2m
+export RUNTIME=$runRUNTIME
+export CTRLDIR=$mntpoint/stressX.control
+start=`date '+%s'`
+for opt in -O2 -U -j; do
+	blocksize=4096
+	while [ $blocksize -le 65536 ]; do
+		for i in 8 4 2 1; do
+			fragsize=$((blocksize / i))
+			echo "`date +%T` newfs $opt -b $blocksize -f $fragsize"\
+			    "md$mdstart"
+			newfs $opt -b $blocksize -f $fragsize \
+			    md$mdstart > /dev/null || { s=1; continue; }
+			[ "$opt" = "-O2" ] && tunefs -n disable md$mdstart > /dev/null 2>&1
+			mount /dev/md$mdstart $mntpoint || { s=2; continue; }
+			chmod 777 $mntpoint
+			su $testuser -c \
+				"(cd ..; ./run.sh io.cfg > /dev/null 2>&1)" &
+			sleep 30
+			while pkill swap; do :; done
+			while pkill -U $testuser; do :; done
+			../tools/killall.sh || { echo "Failed at $opt -b $blocksize -f $fragsize$"; \
+				exit 3; }
+			wait
+			while mount | grep "$mntpoint" | \
+			    grep -q md$mdstart; do
+				umount $mntpoint > /dev/null 2>&1 || sleep 1
+			done
+			fsck -fy /dev/md$mdstart > $log 2>&1
+			grep -q "WAS MODIFIED" $log && {
+				s=4
+				cat $log
+			}
+		done
+		blocksize=$((blocksize * 2))
+	done
+	if [ $((`date '+%s'` - start)) -gt 3600 ]; then
+		echo "Timed out in $opt -b $blocksize -f $fragsize$"
+		s=5
+		break
+	fi
+done
+mdconfig -d -u $mdstart
+rm -f $log
+exit $s
diff --git a/nullfs31.sh b/nullfs31.sh
new file mode 100755
index 000000000000..381ec6bf041c
--- /dev/null
+++ b/nullfs31.sh
@@ -0,0 +1,75 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# Variation of nullfs25.sh, using cp(1) (copy_file_range())
+
+# Page fault in vn_copy_file_range() seen:
+# https://people.freebsd.org/~pho/stress/log/log0497.txt
+# Fixed by: 23210f538a00
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+. ../default.cfg
+
+set -u
+mounts=4	# Number of parallel scripts
+: ${nullfs_srcdir:=$mntpoint}
+: ${nullfs_dstdir:=$mntpoint}
+prog=$(basename "$0" .sh)
+CONT=/tmp/$prog.continue
+
+mount | grep $mntpoint | grep -q /dev/md && umount -f $mntpoint
+mdconfig -l | grep -q md$mdstart &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 1g -u $mdstart
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+chmod 777 $mntpoint
+(cd $mntpoint; jot 500 | xargs touch)
+(cd ../testcases/swap; ./swap -t 5m -i 20 > /dev/null) &
+
+for i in `jot $mounts $mdstart`; do
+	[ ! -d ${nullfs_dstdir}$i ] && mkdir ${nullfs_dstdir}$i
+	mount | grep -q " ${nullfs_dstdir}$i " &&
+	    umount ${nullfs_dstdir}$i
+done
+
+# Start the parallel tests
+touch $CONT
+for i in `jot $mounts $mdstart`; do
+	while [ -f $CONT ]; do
+		cp /etc/group ${nullfs_dstdir}$i > \
+		    /dev/null 2>&1
+	done &
+	# The test: Parallel mount and unmount
+	start=`date +%s`
+	(
+		while [ $((`date +%s` - start))  -lt 300 ]; do
+			mount_nullfs $nullfs_srcdir ${nullfs_dstdir}$i > \
+			    /dev/null 2>&1
+			opt=$([ `jot -r 1 0 1` -eq 0 ] && echo "-f")
+			while mount | grep -q ${nullfs_dstdir}$i; do
+				umount $opt ${nullfs_dstdir}$i > \
+				    /dev/null 2>&1
+			done
+		done
+		rm -f $CONT
+	) &
+done
+while [ -f $CONT ] ; do sleep 1; done
+while pgrep -q swap; do pkill swap; done
+wait
+
+for i in `jot $mounts`; do
+	umount ${nullfs_dstdir}$i > /dev/null 2>&1
+done
+n=0
+while mount | grep $mntpoint | grep -q /dev/md; do
+	umount $mntpoint || sleep 1
+	[ $((n += 1)) -gt 300 ] && { echo FAIL; exit 1; }
+done
+mdconfig -d -u $mdstart
+exit 0
diff --git a/nullfs32.sh b/nullfs32.sh
new file mode 100755
index 000000000000..567a40d4d373
--- /dev/null
+++ b/nullfs32.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Test scenario from:
+# Bug 254210 - jail: nullfs: deleted files does not free up space
+# Fixed by: 1a0cb938f7b4
+
+# Test scenario idea by: ronald@FreeBSD.org
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+. ../default.cfg
+
+set -u
+prog=$(basename "$0" .sh)
+log=/tmp/$prog.log
+df -h | grep "$mntpoint"
+mount | grep $mntpoint | grep -q /dev/md && umount -f $mntpoint
+mdconfig -l | grep -q md$mdstart && mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 2g -u $mdstart
+newfs $newfs_flags -n md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+
+cd $mntpoint
+mkdir storage test1 test2
+mount_nullfs -o rw,noatime ./storage ./test1
+mount_nullfs -o rw,noatime ./storage ./test2
+
+dd if=/dev/random of=./test1/random.dd bs=1M count=1024 status=none
+
+rm ./test2/random.dd
+df -h | grep "$mntpoint" > $log
+grep -E "${mntpoint}$" $log | grep -q '16K    1.8G     0%' && s=0 || s=1
+if [ $s -eq 1 ]; then
+	echo "Leaking:"
+	cat $log
+	find $mntpoint -type f -ls
+fi
+cd -
+umount $mntpoint/test1
+umount $mntpoint/test2
+umount $mntpoint
+mdconfig -d -u $mdstart
+rm -f rm -f $log
+exit $s
diff --git a/pthread10.sh b/pthread10.sh
new file mode 100755
index 000000000000..ddeab0f9bb57
--- /dev/null
+++ b/pthread10.sh
@@ -0,0 +1,106 @@
+#!/bin/sh
+
+# Original test scenario by nabijaczleweli@nabijaczleweli.xyz:
+# Bug 283101 - pthread_cancel() doesn't cancel a thread that's currently in pause()
+# Fixed by: 9f78c837d94f check_cancel: when in_sigsuspend, send SIGCANCEL unconditionally
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+static void *
+thread(void *arg __unused)
+{
+	for(;;) {
+		pause();
+		printf("woke up from pause\n");
+	}
+}
+
+static void
+thread_cancel_and_join(pthread_t ptid)
+{
+	void *status = NULL;
+
+	if (pthread_cancel(ptid)) {
+		printf("pthread_cancel() failed\n");
+		exit(1);
+	}
+
+	(void) pthread_join(ptid, &status);
+	int error = (int)(uintptr_t)status;
+
+	if (error) {
+		if (status == PTHREAD_CANCELED) {
+			printf("pthread_cancel() succeeded\n");
+		} else {
+			printf("pthread_join() error (not PTHREAD_CANCELED)\n");
+			exit(1);
+		}
+	}
+}
+
+int
+main(void)
+{
+	// Empirically, I've noticed that either the hang occurs somewhere between
+	// 10 and 500 iterations, or it runs infinitely without ever hanging.
+	// Therefore, stopping at 500th iteration, and looping from a shell script.
+
+	// For quick results (usually under 10 minutes), invoke "./run" from a dozen
+	// consoles or GNU screen windows in parallel.
+
+	pid_t pid = getpid();
+
+	for (uint64_t iteration = 1; iteration <= 500; ++iteration) {
+		printf("PID %d, iteration %lu...", pid, iteration);
+
+		pthread_t ptid;
+		int err;
+
+		err = pthread_create(&ptid, NULL, thread, NULL);
+
+		if (err) {
+			printf("pthread_create() failed with error: %d\n", err);
+			return 1;
+		}
+
+		thread_cancel_and_join(ptid);
+
+		printf("OK\n");
+
+		// Tiny sleep
+		usleep(20000);
+	}
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O2 /tmp/$prog.c -lpthread || exit 1
+(cd ../testcases/swap; ./swap -t 3m -i 20 > /dev/null) &
+sleep 5
+start=`date +%s`
+while [ $((`date +%s` - start)) -lt 180 ]; do
+	/tmp/$prog > /dev/null & pid=$!
+	t1=`date +%s`
+	while kill -0 $pid 2> /dev/null; do
+		if [ $((`date +%s` - t1)) -gt 180 ]; then
+			ps -lH $pid
+#			exit 1 # For DEBUG
+			kill -9 $pid; s=1
+			echo fail
+			break 2
+		else
+			sleep 1
+		fi
+	done
+	wait $pid; s=$?
+	[ $s -ne 0 ] && break
+done
+while pkill swap; do :; done
+wait
+rm -f /tmp/$prog /tmp/$prog.c
+exit $s
diff --git a/rangelocks.sh b/rangelocks.sh
new file mode 100755
index 000000000000..fa855359d72b
--- /dev/null
+++ b/rangelocks.sh
@@ -0,0 +1,194 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# Range lock test scenario suggestion by kib@
+
+. ../default.cfg
+
+set -u
+prog=$(basename "$0" .sh)
+dir=/tmp
+odir=`pwd`
+cd $dir
+sed '1,/^EOF/d' < $odir/$0 > $dir/$prog.c
+mycc -o $prog -Wall -Wextra -O2 -g $prog.c || exit 1
+rm -f $prog.c
+cd $odir
+
+mdconfig -l | grep -q md$mdstart && mdconfig -d -u $mdstart
+set -e
+mdconfig -a -t swap -s 6g -u $mdstart
+newfs $newfs_flags -n /dev/md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+set +e
+wd="$mntpoint/$prog.dir"
+mkdir -p $wd
+dd if=/dev/zero of=$wd/file bs=1m count=5k status=none
+
+[ `jot -r 1 1 100` -le 25 ] &&
+    ../testcases/swap/swap -t 10m -i 20 > /dev/null 2>&1 &
+cd $wd
+/tmp/$prog $wd/file; s=$?
+cd $odir
+while pkill swap; do :; done
+wait
+
+umount $mntpoint
+mdconfig -d -u $mdstart
+rm -rf /tmp/$prog $wd
+exit $s
+
+EOF
+#include <sys/param.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#include <machine/atomic.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+#define DONE 1
+#define MAXBLK 10240
+//#define MAXPROC 32
+#define MAXPROC 1024
+#define MAXSIZ (5LL * 1024 * 1024 *1024)
+#define RUNTIME (5 * 60)
+#define SYNC 0
+
+static volatile u_int *share;
+static int parallel;
+
+static char *file;
+
+static off_t
+newpos(int lng)
+{
+	off_t p;
+
+	do {
+		arc4random_buf(&p, sizeof(p));
+		p = p & 0xfffffff;
+	} while (p + lng > MAXSIZ);
+	return (p);
+}
+
+static void
+test(int indx, int num)
+{
+	off_t pos;
+	ssize_t i, l, r;
+	time_t start;
+	int fd, n;
+	char *buf;
+
+	atomic_add_int(&share[SYNC], 1);
+	while (share[SYNC] != (unsigned int)parallel)
+		sched_yield();
+
+	if ((buf = malloc(MAXBLK)) == NULL)
+		err(1, "malloc");
+	n = 0;
+	start = time(NULL);
+	while (share[DONE] != (unsigned int)parallel) {
+		setproctitle("test(%d) num %d, n %d", indx, num, n);
+		if ((fd = open(file, O_RDWR)) == -1)
+			err(1, "open(%s)", file);
+
+		for (i = 0; i < arc4random() % 512; i++) {
+			if (arc4random() % 100 < 50) {
+				l = arc4random() % MAXBLK + 1;
+				pos = newpos(l);
+				if (lseek(fd, pos, SEEK_SET) == -1)
+					err(1, "lseek");
+				if ((r = read(fd, buf, l)) != l) {
+					warn("read %jd @ %jd returned %zd\n", (intmax_t)l, (intmax_t)pos, r);
+					goto done;
+				}
+			}
+
+			l = arc4random() % MAXBLK + 1;
+			pos = newpos(l);
+			if (lseek(fd, pos, SEEK_SET) == -1)
+				err(1, "lseek");
+			if ((r = write(fd, buf, l)) != l) {
+				warn("write returned %zd\n", r);
+				goto done;
+			}
+		}
+
+		close(fd);
+		if (n++ == 0)
+			atomic_add_int(&share[DONE], 1);
+		if (time(NULL) - start >= RUNTIME * 4) {
+			fprintf(stderr, "test(%d), %d Timed out\n", indx, num);
+			break;
+		}
+	}
+done:
+	if (n++ == 0)
+		atomic_add_int(&share[DONE], 1);
+
+	_exit(0);
+}
+
+void
+setup(void)
+{
+
+	parallel = arc4random() % MAXPROC + 1;
+}
+
+int
+main(int argc, char *argv[])
+{
+	size_t len;
+	time_t start;
+	int e, i, n, *pids, status;
+
+	if (argc != 2) {
+		fprintf(stderr, "Usage: %s <file>\n", argv[0]);
+		_exit(1);
+	}
+	e = 0;
+	file = argv[1];
+	len = PAGE_SIZE;
+	if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
+	    MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
+		err(1, "mmap");
+
+	n = 0;
+	start = time(NULL);
+	while ((time(NULL) - start) < RUNTIME && e == 0) {
+		setup();
+
+		pids = malloc(sizeof(pid_t) * parallel);
+		share[SYNC] = share[DONE] = 0;
+		for (i = 0; i < parallel; i++) {
+			if ((pids[i] = fork()) == 0)
+				test(i, n);
+		}
+		for (i = 0; i < parallel; i++) {
+			if (waitpid(pids[i], &status, 0) != pids[i])
+				err(1, "waitpid %d", pids[i]);
+			e += status == 0 ? 0 : 1;
+		}
+		n++;
+		n = n % 10;
+		free(pids);
+	}
+
+	return (e);
+}
diff --git a/rangelocks2.sh b/rangelocks2.sh
new file mode 100755
index 000000000000..2df4cf346bc8
--- /dev/null
+++ b/rangelocks2.sh
@@ -0,0 +1,178 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+. ../default.cfg
+
+set -u
+prog=$(basename "$0" .sh)
+dir=/tmp
+odir=`pwd`
+cd $dir
+sed '1,/^EOF/d' < $odir/$0 > $dir/$prog.c
+mycc -o $prog -Wall -Wextra -O2 -g $prog.c || exit 1
+rm -f $prog.c
+cd $odir
+
+mdconfig -l | grep -q md$mdstart && mdconfig -d -u $mdstart
+set -e
+mdconfig -a -t swap -s 6g -u $mdstart
+newfs $newfs_flags -n /dev/md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+set +e
+wd="$mntpoint/$prog.dir"
+mkdir -p $wd
+dd if=/dev/zero of=$wd/file bs=1m count=5k status=none
+
+[ `jot -r 1 1 100` -le 25 ] &&
+    ../testcases/swap/swap -t 10m -i 20 > /dev/null 2>&1 &
+cd $wd
+touch $wd/out
+/tmp/$prog $wd/file $wd/out; s=$?
+cd $odir
+while pkill swap; do :; done
+wait
+
+umount $mntpoint
+mdconfig -d -u $mdstart
+rm -rf /tmp/$prog $wd
+exit $s
+
+EOF
+#include <sys/param.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#include <machine/atomic.h>
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+#define DONE 1
+#define MAXBLK (100 * 1024 * 1024)
+#define MAXPROC 32
+#define MAXSIZ (5LL * 1024 * 1024 *1024)
+#define RUNTIME (5 * 60)
+#define SYNC 0
+
+static volatile u_int *share;
+static int parallel;
+
+static char *file, *file2;
+
+static off_t
+newpos(int lng)
+{
+	off_t p;
+
+	do {
+		arc4random_buf(&p, sizeof(p));
+		p = p & 0xfffffff;
+	} while (p + lng > MAXSIZ);
+	return (p);
+}
+
+static void
+test(int indx, int num)
+{
+	off_t pos, pos2;
+	ssize_t i, l;
+	time_t start;
+	int fd, fd2, n;
+
+	atomic_add_int(&share[SYNC], 1);
+	while (share[SYNC] != (unsigned int)parallel)
+		sched_yield();
+
+	n = 0;
+	start = time(NULL);
+	while (share[DONE] != (unsigned int)parallel) {
+		setproctitle("test(%d) num %d, n %d", indx, num, n);
+		if ((fd = open(file, O_RDWR)) == -1)
+			err(1, "open(%s)", file);
+		if ((fd2 = open(file2, O_RDWR)) == -1)
+			err(1, "open(%s)", file2);
+
+		for (i = 0; i < arc4random() % 512; i++) {
+			l = arc4random() % MAXBLK + 1;
+			pos = newpos(l);
+			pos2 = newpos(l);
+			if (copy_file_range(fd, &pos, fd2, &pos2, l, 0) == -1)
+				err(1, "copy_file_range()");
+		}
+
+		close(fd2);
+		close(fd);
+		if (n++ == 0)
+			atomic_add_int(&share[DONE], 1);
+		if (time(NULL) - start >= RUNTIME * 4) {
+			fprintf(stderr, "test(%d), %d Timed out\n", indx, num);
+			break;
+		}
+	}
+	if (n++ == 0)
+		atomic_add_int(&share[DONE], 1);
+
+	_exit(0);
+}
+
+void
+setup(void)
+{
+
+	parallel = arc4random() % MAXPROC + 1;
+}
+
+int
+main(int argc, char *argv[])
+{
+	size_t len;
+	time_t start;
+	int e, i, n, *pids, status;
+
+	if (argc != 3) {
+		fprintf(stderr, "Usage: %s <in file> <out file>\n", argv[0]);
+		_exit(1);
+	}
+	e = 0;
+	file = argv[1];
+	file2 = argv[2];
+	len = PAGE_SIZE;
+	if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
+	    MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
+		err(1, "mmap");
+
+	n = 0;
+	start = time(NULL);
+	while ((time(NULL) - start) < RUNTIME && e == 0) {
+		setup();
+
+		pids = malloc(sizeof(pid_t) * parallel);
+		share[SYNC] = share[DONE] = 0;
+		for (i = 0; i < parallel; i++) {
+			if ((pids[i] = fork()) == 0)
+				test(i, n);
+		}
+		for (i = 0; i < parallel; i++) {
+			if (waitpid(pids[i], &status, 0) != pids[i])
+				err(1, "waitpid %d", pids[i]);
+			e += status == 0 ? 0 : 1;
+		}
+		n++;
+		n = n % 10;
+		free(pids);
+	}
+
+	return (e);
+}
diff --git a/rename16.sh b/rename16.sh
new file mode 100755
index 000000000000..09e796299794
--- /dev/null
+++ b/rename16.sh
@@ -0,0 +1,261 @@
+#!/bin/sh
+
+# Copy of suj30.sh but with SU instead of SUJ
+
+# Rename test scenario by Andrey Zonov <zont@FreeBSD.org>
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+
+set -u
+prog=$(basename "$0" .sh)
+here=`pwd`
+log=/tmp/$prog.sh.log
+cd /tmp
+sed '1,/^EOF/d' < $here/$0 > $prog.c
+mycc -o $prog -Wall -Wextra -O2 $prog.c -lpthread
+rm -f $prog.c
+
+mount | grep "on $mntpoint " | grep -q md$mdstart && umount $mntpoint
+mdconfig -l | grep -q md$mdstart &&  mdconfig -d -u $mdstart
+
+mdconfig -a -t swap -s 8g -u $mdstart
+newfs -U md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+chmod 777 $mntpoint
+
+t=`date +%s`
+/tmp/$prog $mntpoint/test-0 100000
+t=$((`date +%s` - t))
+[ $t -gt 60 ] && n=20000 || n=100000
+
+for i in `jot 10`; do
+	/tmp/$prog $mntpoint/test-$i $n &
+done
+wait
+
+while mount | grep -q $mntpoint; do
+	umount $mntpoint || sleep 1
+done
+fsck -fy /dev/md$mdstart > $log
+grep -q "WAS MODIFIED" $log && s=1 || s=0
+mdconfig -d -u $mdstart
+rm -f /tmp/$prog $log
+exit $s
+EOF
+/*
+ * Andrey Zonov (c) 2012
+ *
+ * compile as `cc -o rename rename.c -lpthread'
+ */
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/queue.h>
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <pthread.h>
+#ifdef __FreeBSD__
+#include <pthread_np.h>
+#define	__NP__
+#endif
+#include <sched.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <unistd.h>
+
+#define	LOCK(x)		pthread_mutex_lock(&x.mtx)
+#define	UNLOCK(x)	pthread_mutex_unlock(&x.mtx)
+#define	SIGNAL(x)	pthread_cond_signal(&x.wait)
+#define	WAIT(x)		pthread_cond_wait(&x.wait, &x.mtx)
+
+int max;
+int exited;
+char *dirname1;
+char *dirname2;
+
+struct file {
+	char *name;
+	STAILQ_ENTRY(file) next;
+};
+
+struct files {
+	pthread_mutex_t mtx;
+	pthread_cond_t wait;
+	STAILQ_HEAD(, file) list;
+};
+
+static struct files newfiles;
+static struct files renamedfiles;
+
+void *loop_create(void *arg __unused);
+void *loop_rename(void *arg __unused);
+void *loop_unlink(void *arg __unused);
+
+int
+main(int argc, char **argv)
+{
+	int i;
+	int rc;
+	pthread_t tid[3];
+
+	if (argc != 3)
+		errx(1, "usage: pthread_count <dirname> <max>");
+
+	asprintf(&dirname1, "%s.1", argv[1]);
+	asprintf(&dirname2, "%s.2", argv[1]);
+	if (mkdir(dirname1, 0755) == -1)
+		err(1, "mkdir(%s)", dirname1);
+	if (mkdir(dirname2, 0755) == -1)
+		err(1, "mkdir(%s)", dirname2);
+	max = atoi(argv[2]);
+
+	STAILQ_INIT(&newfiles.list);
+	STAILQ_INIT(&renamedfiles.list);
+
+	rc = pthread_mutex_init(&newfiles.mtx, NULL);
+	if (rc != 0)
+		errc(1, rc, "pthread_mutex_init()");
+	rc = pthread_cond_init(&newfiles.wait, NULL);
+	if (rc != 0)
+		errc(1, rc, "pthread_cond_init()");
+	rc = pthread_mutex_init(&renamedfiles.mtx, NULL);
+	if (rc != 0)
+		errc(1, rc, "pthread_mutex_init()");
+	rc = pthread_cond_init(&renamedfiles.wait, NULL);
+	if (rc != 0)
+		errc(1, rc, "pthread_cond_init()");
+
+	rc = pthread_create(&tid[0], NULL, loop_create, NULL);
+	if (rc != 0)
+		errc(1, rc, "pthread_create()");
+	rc = pthread_create(&tid[1], NULL, loop_rename, NULL);
+	if (rc != 0)
+		errc(1, rc, "pthread_create()");
+	rc = pthread_create(&tid[2], NULL, loop_unlink, NULL);
+	if (rc != 0)
+		errc(1, rc, "pthread_create()");
+
+	for (i = 0; i < 3; i++) {
+		rc = pthread_join(tid[i], NULL);
+		if (rc != 0)
+			errc(1, rc, "pthread_join(%d)", i);
+	}
+
+	rc = pthread_mutex_destroy(&newfiles.mtx);
+	if (rc != 0)
+		errc(1, rc, "pthread_mutex_destroy(newfiles)");
+	rc = pthread_cond_destroy(&newfiles.wait);
+	if (rc != 0)
+		errc(1, rc, "pthread_cond_destroy(newfiles)");
+	rc = pthread_mutex_destroy(&renamedfiles.mtx);
+	if (rc != 0)
+		errc(1, rc, "pthread_mutex_destroy(renamedfiles)");
+	rc = pthread_cond_destroy(&renamedfiles.wait);
+	if (rc != 0)
+		errc(1, rc, "pthread_cond_destroy(renamedfiles)");
+	rmdir(dirname1);
+	rmdir(dirname2);
+	free(dirname1);
+	free(dirname2);
+
+	exit(0);
+}
+
+void *
+loop_create(void *arg __unused)
+{
+	int i;
+	struct file *file;
+
+#ifdef __NP__
+	pthread_set_name_np(pthread_self(), __func__);
+#endif
+
+	for (i = 0; i < max; i++) {
+		file = malloc(sizeof(*file));
+		asprintf(&file->name, "%s/filename_too-long:%d", dirname1, i);
+		if (mkdir(file->name, 0666) == -1) {
+			warn("mkdir(%s)", file->name);
+			free(file->name);
+			free(file);
+			break;
+		}
+		LOCK(newfiles);
+		STAILQ_INSERT_TAIL(&newfiles.list, file, next);
+		UNLOCK(newfiles);
+		SIGNAL(newfiles);
+	}
+	exited = 1;
+	SIGNAL(newfiles);
+	pthread_exit(NULL);
+}
+
+void *
+loop_rename(void *arg __unused)
+{
+	char *filename, *newname;
+	struct file *file;
+
+#ifdef	__NP__
+	pthread_set_name_np(pthread_self(), __func__);
+#endif
+
+	for ( ;; ) {
+		LOCK(newfiles);
+		while (STAILQ_EMPTY(&newfiles.list) && exited < 1)
+			WAIT(newfiles);
+		if (STAILQ_EMPTY(&newfiles.list) && exited == 1) {
+			UNLOCK(newfiles);
+			break;
+		}
+		file = STAILQ_FIRST(&newfiles.list);
+		STAILQ_REMOVE_HEAD(&newfiles.list, next);
+		UNLOCK(newfiles);
+		filename = strrchr(file->name, '/');
+		asprintf(&newname, "%s/%s", dirname2, filename);
+		if (rename(file->name, newname) == -1)
+			err(1, "rename(%s, %s)", file->name, newname);
+		free(file->name);
+		file->name = newname;
+		LOCK(renamedfiles);
+		STAILQ_INSERT_TAIL(&renamedfiles.list, file, next);
+		UNLOCK(renamedfiles);
+		SIGNAL(renamedfiles);
+	}
+	exited = 2;
+	SIGNAL(renamedfiles);
+	pthread_exit(NULL);
+}
+
+void *
+loop_unlink(void *arg __unused)
+{
+	struct file *file;
+
+#ifdef	__NP__
+	pthread_set_name_np(pthread_self(), __func__);
+#endif
+
+	for ( ;; ) {
+		LOCK(renamedfiles);
+		while (STAILQ_EMPTY(&renamedfiles.list) && exited < 2)
+			WAIT(renamedfiles);
+		if (STAILQ_EMPTY(&renamedfiles.list) && exited == 2) {
+			UNLOCK(renamedfiles);
+			break;
+		}
+		file = STAILQ_FIRST(&renamedfiles.list);
+		STAILQ_REMOVE_HEAD(&renamedfiles.list, next);
+		UNLOCK(renamedfiles);
+		rmdir(file->name);
+		free(file->name);
+		free(file);
+	}
+	pthread_exit(NULL);
+}
diff --git a/rmdir.sh b/rmdir.sh
new file mode 100755
index 000000000000..2df62a5576a8
--- /dev/null
+++ b/rmdir.sh
@@ -0,0 +1,119 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# Based on msdos11.sh
+
+. ../default.cfg
+
+set -u
+prog=$(basename "$0" .sh)
+log=/tmp/$prog.log
+
+cat > /tmp/$prog.c <<EOF
+#include <sys/param.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+
+#include <err.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdatomic.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <unistd.h>
+
+static _Atomic(int) *share;
+
+#define PARALLEL 3
+#define RUNTIME (2 * 60)
+#define SYNC 0
+
+static void
+test(void)
+{
+	time_t start;
+
+	atomic_fetch_add(&share[SYNC], 1);
+	while (share[SYNC] != PARALLEL)
+		;
+	start = time(NULL);
+	while ((time(NULL) - start) < 30) {
+		mkdir("a", 0755);
+		rename("a", "b");
+		rmdir("b");
+	}
+
+	_exit(0);
+}
+
+int
+main(void)
+{
+	pid_t pids[PARALLEL];
+	size_t len;
+	time_t start;
+	int e, i, status;
+
+	e = 0;
+	len = PAGE_SIZE;
+	if ((share = mmap(NULL, len, PROT_READ | PROT_WRITE,
+	    MAP_ANON | MAP_SHARED, -1, 0)) == MAP_FAILED)
+		err(1, "mmap");
+
+	start = time(NULL);
+	while ((time(NULL) - start) < RUNTIME && e == 0) {
+		share[SYNC] = 0;
+		for (i = 0; i < PARALLEL; i++) {
+			if ((pids[i] = fork()) == 0)
+				test();
+			if (pids[i] == -1)
+				err(1, "fork()");
+		}
+		for (i = 0; i < PARALLEL; i++) {
+			if (waitpid(pids[i], &status, 0) == -1)
+				err(1, "waitpid(%d)", pids[i]);
+			if (status != 0) {
+				if (WIFSIGNALED(status))
+					fprintf(stderr,
+					    "pid %d exit signal %d\n",
+					    pids[i], WTERMSIG(status));
+			}
+			e += status == 0 ? 0 : 1;
+		}
+	}
+
+	return (e);
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c || exit 1
+
+set -e
+mount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint
+[ -c /dev/md$mdstart ] &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 512m -u $mdstart
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+set +e
+
+here=`pwd`
+(cd $here/../testcases/swap; ./swap -t 2m -i 20 -l 100 > /dev/null) &
+sleep .5
+
+cd $mntpoint
+/tmp/$prog; s=$?
+cd -
+wait
+umount $mntpoint
+fsck_ffs /dev/md$mdstart > $log 2>&1
+grep -Eq "WAS MODIFIED" $log && { cat $log; s=32; }
+mdconfig -d -u $mdstart
+rm -f /tmp/$prog /tmp/$prog.c $log
+exit $s
diff --git a/rsync.sh b/rsync.sh
new file mode 100755
index 000000000000..fa52f98c6f02
--- /dev/null
+++ b/rsync.sh
@@ -0,0 +1,49 @@
+#/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+[ `id -u` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+
+[ -f "`which rsync`" ] || exit 0
+[ -d /usr/src/sys ]    || exit 0
+
+set -eu
+prog=$(basename "$0" .sh)
+log=/tmp/$prog.log
+mount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint
+[ -c /dev/md$mdstart ] &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 15g -u $mdstart
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+set +e
+
+mkdir -p $mntpoint/usr/src
+rsync -avrq /usr/src/sys $mntpoint/usr/src; s=$?
+if [ $s -eq 0 ]; then
+	(cd $mntpoint; umount $mntpoint > /dev/null 2>&1)	# sync
+	rsync -avrq  /usr/src/sys $mntpoint/usr/src; s=$?
+fi
+
+if [ $s -eq 0 ]; then
+	diff -rq /usr/src/sys $mntpoint/usr/src/sys > $log; s=$?
+	[ $s -ne 0 ] &&
+	    { echo "/usr/src $mntpoint/usr/src differ!"; head -10 $log; }
+fi
+
+while mount | grep -q "on $mntpoint "; do
+	umount $mntpoint || break
+	sleep 1
+done
+if [ $s -eq 0 ]; then
+	fsck_ffs -fy /dev/md$mdstart > $log 2>&1; s=$?
+	grep -Eq "WAS MODIFIED" $log && { cat $log; s=1; }
+fi
+mdconfig -d -u $mdstart
+rm -f $log
+exit $s
diff --git a/rsync2.sh b/rsync2.sh
new file mode 100755
index 000000000000..882753fe596f
--- /dev/null
+++ b/rsync2.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# Test scenario by se@ from https://reviews.freebsd.org/D43951
+
+set -u
+MDUNIT=10
+FS=/mnt/test
+mdconfig -u $MDUNIT -t malloc -s 512m
+newfs_msdos -c 8 -F 32 /dev/md$MDUNIT
+mkdir -p $FS
+mount -t msdos /dev/md$MDUNIT $FS
+rsync -r /usr/src/lib/libsysdecode $FS
+rsync -r /usr/src/lib/libsysdecode $FS
+rsync -r /usr/src/lib/libsysdecode $FS
+umount $FS
+fsck_msdosfs -y /dev/md$MDUNIT; s=$?
+exit $s
diff --git a/rsync3.sh b/rsync3.sh
new file mode 100755
index 000000000000..1d77bdfbcaa5
--- /dev/null
+++ b/rsync3.sh
@@ -0,0 +1,43 @@
+#/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# tmpfs version of rsync.sh
+
+[ `id -u` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+
+[ -f "`which rsync`" ] || exit 0
+[ -d /usr/src/sys ]    || exit 0
+
+set -eu
+prog=$(basename "$0" .sh)
+log=/tmp/$prog.log
+mount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint
+[ -c /dev/md$mdstart ] &&  mdconfig -d -u $mdstart
+mount -t tmpfs dummy $mntpoint
+set +e
+
+mkdir -p $mntpoint/usr/src
+rsync -avrq /usr/src/sys $mntpoint/usr/src; s=$?
+if [ $s -eq 0 ]; then
+	rsync -avrq  /usr/src/sys $mntpoint/usr/src; s=$?
+fi
+
+if [ $s -eq 0 ]; then
+	diff -rq /usr/src/sys $mntpoint/usr/src/sys > $log; s=$?
+	[ $s -ne 0 ] &&
+	    { echo "/usr/src $mntpoint/usr/src differ!"; head -10 $log; }
+fi
+
+while mount | grep -q "on $mntpoint "; do
+	umount $mntpoint || break
+	sleep 1
+done
+rm -f $log
+exit $s
diff --git a/seekhole2.sh b/seekhole2.sh
new file mode 100755
index 000000000000..e3f08779061d
--- /dev/null
+++ b/seekhole2.sh
@@ -0,0 +1,65 @@
+#!/bin/sh
+
+#
+# Copyright (c) 2025 Peter Holm <pho@FreeBSD.org>
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+
+# A SEEK_HOLE / SEEK_DATA test scenario, FFS version
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+
+prog=$(basename "$0" .sh)
+exp=/tmp/$prog.exp
+here=`pwd`
+log=/tmp/$prog.log
+
+cc -o /tmp/lsholes -Wall -Wextra -O2 $here/../tools/lsholes.c | exit 1
+cat > $exp <<EXP
+Min hole size is 32768, file size is 524288000.
+data #1 @ 0, size=32768)
+hole #2 @ 32768, size=32768
+data #3 @ 65536, size=32768)
+hole #4 @ 98304, size=32768
+data #5 @ 131072, size=32768)
+hole #6 @ 163840, size=524091392
+data #7 @ 524255232, size=32768)
+hole #8 @ 524288000, size=0
+EXP
+
+set -eu
+mount | grep "on $mntpoint " | grep -q /dev/md && umount -f $mntpoint
+[ -c /dev/md$mdstart ] &&  mdconfig -d -u $mdstart
+mdconfig -a -t swap -s 2g -u $mdstart
+newfs $newfs_flags md$mdstart > /dev/null
+mount /dev/md$mdstart $mntpoint
+set +e
+
+file=$mntpoint/file
+copy=$mntpoint/copy
+truncate -s 500m $file
+bs=`getconf MIN_HOLE_SIZE $file`
+printf "\001" | dd of=$file seek=$((0*bs)) bs=1 count=1 conv=notrunc status=none
+printf "\002" | dd of=$file seek=$((2*bs)) bs=1 count=1 conv=notrunc status=none
+printf "\003" | dd of=$file seek=$((4*bs)) bs=1 count=1 conv=notrunc status=none
+s1=0
+s2=0
+s3=0
+/tmp/lsholes $file > $log 2>&1; s1=$?
+
+sdiff -s $exp $log || s2=1
+
+$here/../testcases/swap/swap -t 2m -i 20 -h > /dev/null &
+sleep 10
+cp $file $copy
+while pkill swap; do :; done
+wait
+cmp $file $copy || { echo "copy error"; s3=1; }
+
+umount $mntpoint
+mdconfig -d -u $mdstart
+rm -f /tmp/lsholes $exp $log
+exit $((s1 + s2 + s3))
diff --git a/syzkaller71.sh b/syzkaller71.sh
new file mode 100755
index 000000000000..58cf7eeb5825
--- /dev/null
+++ b/syzkaller71.sh
@@ -0,0 +1,171 @@
+#!/bin/sh
+
+# panic: Counter goes negative
+# cpuid = 4
+# time = 1694583637
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe01bac2a960
+# vpanic() at vpanic+0x132/frame 0xfffffe01bac2aa90
+# panic() at panic+0x43/frame 0xfffffe01bac2aaf0
+# sctp_inpcb_free() at sctp_inpcb_free+0xf28/frame 0xfffffe01bac2ab60
+# sctp_close() at sctp_close+0xc0/frame 0xfffffe01bac2abb0
+# soclose() at soclose+0x154/frame 0xfffffe01bac2ac10
+# _fdrop() at _fdrop+0x1b/frame 0xfffffe01bac2ac30
+# closef() at closef+0x1e3/frame 0xfffffe01bac2acc0
+# fdescfree() at fdescfree+0x41a/frame 0xfffffe01bac2ad80
+# exit1() at exit1+0x4a1/frame 0xfffffe01bac2adf0
+# sys_exit() at sys_exit+0xd/frame 0xfffffe01bac2ae00
+# amd64_syscall() at amd64_syscall+0x14f/frame 0xfffffe01bac2af30
+# fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe01bac2af30
+# --- syscall (1, FreeBSD ELF64, exit), rip = 0x824db2f4a, rsp = 0x8211862b8, rbp = 0x8211862d0 ---
+# KDB: enter: pani[ thread pid 9676 tid 346853 ]
+# Stopped at      kdb_enter+0x32: movq    $0,0xe27583(%rip)
+# db> x/s version
+# version: FreeBSD 15.0-CURRENT #0 main-n265298-10db91ecec98b1: Tue Sep 12 12:16:45 CEST 2023
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db> 
+
+uname -p | grep -Eq "amd64" || exit 0
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=d8a54d453b8e643b807a5c3c56728561f01c0fde
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// Reported-by: syzbot+d4e1d30d578891245f59@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+static unsigned long long procid;
+
+static void kill_and_wait(int pid, int* status)
+{
+  kill(pid, SIGKILL);
+  while (waitpid(-1, status, 0) != pid) {
+  }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+  usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+  struct timespec ts;
+  if (clock_gettime(CLOCK_MONOTONIC, &ts))
+    exit(1);
+  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+  int iter __unused = 0;
+  for (;; iter++) {
+    int pid = fork();
+    if (pid < 0)
+      exit(1);
+    if (pid == 0) {
+      execute_one();
+      exit(0);
+    }
+    int status = 0;
+    uint64_t start = current_time_ms();
+    for (;;) {
+      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+        break;
+      sleep_ms(1);
+      if (current_time_ms() - start < 5000)
+        continue;
+      kill_and_wait(pid, &status);
+      break;
+    }
+  }
+}
+
+uint64_t r[1] = {0xffffffffffffffff};
+
+void execute_one(void)
+{
+  intptr_t res = 0;
+  res = syscall(SYS_socket, 0x1cul, 1ul, 0x84);
+  if (res != -1)
+    r[0] = res;
+  *(uint8_t*)0x20000040 = 0x1c;
+  *(uint8_t*)0x20000041 = 0x1c;
+  *(uint16_t*)0x20000042 = htobe16(0x4e22 + procid * 4);
+  *(uint32_t*)0x20000044 = 0;
+  *(uint64_t*)0x20000048 = htobe64(0);
+  *(uint64_t*)0x20000050 = htobe64(1);
+  *(uint32_t*)0x20000058 = 0;
+  syscall(SYS_bind, r[0], 0x20000040ul, 0x1cul);
+  *(uint8_t*)0x20000180 = 0x1c;
+  *(uint8_t*)0x20000181 = 0x1c;
+  *(uint16_t*)0x20000182 = htobe16(0x4e22 + procid * 4);
+  *(uint32_t*)0x20000184 = 0;
+  *(uint64_t*)0x20000188 = htobe64(0);
+  *(uint64_t*)0x20000190 = htobe64(1);
+  *(uint32_t*)0x20000198 = 0;
+  syscall(SYS_connect, r[0], 0x20000180ul, 0x1cul);
+  *(uint32_t*)0x20000300 = 0x80000021;
+  syscall(SYS_setsockopt, r[0], 0x84, 0x1b, 0x20000300ul, 4ul);
+  memset((void*)0x20000480, 163, 1);
+  syscall(SYS_sendto, r[0], 0x20000480ul, 0xfffffe5cul, 0x188ul, 0ul, 0ul);
+  *(uint16_t*)0x200000c0 = 0;
+  *(uint16_t*)0x200000c2 = 0x200;
+  *(uint32_t*)0x200000c4 = 0;
+  *(uint32_t*)0x200000c8 = 0;
+  *(uint32_t*)0x200000cc = 0;
+  syscall(SYS_setsockopt, r[0], 0x84, 0x21, 0x200000c0ul, 0x10ul);
+  syscall(SYS_shutdown, r[0], 0ul);
+  syscall(SYS_writev, r[0], 0ul, 0ul);
+}
+int main(void)
+{
+  syscall(SYS_mmap, 0x20000000ul, 0x1000000ul, 7ul, 0x1012ul, -1, 0ul);
+  for (procid = 0; procid < 4; procid++) {
+    if (fork() == 0) {
+      loop();
+    }
+  }
+  sleep(1000000);
+  return 0;
+}
+EOF
+mycc -o /tmp/$prog -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+mount | grep -q "on $mntpoint " && umount $mntpoint
+mount -o size=10m -t tmpfs dummy $mntpoint
+
+cd $mntpoint
+for i in `jot 20`; do
+	timeout 3m /tmp/$prog &
+done
+wait
+cd -
+
+umount $mntpoint
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core
+exit 0
diff --git a/syzkaller72.sh b/syzkaller72.sh
new file mode 100755
index 000000000000..6dd69987a913
--- /dev/null
+++ b/syzkaller72.sh
@@ -0,0 +1,70 @@
+#!/bin/sh
+
+# panic: sbflush_internal: ccc 0 mb 0xfffff8004eee95f0 mbcnt 0
+# cpuid = 9
+# time = 1704448830
+# KDB: stack backtrace:
+# db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe016a2ccb70
+# vpanic() at vpanic+0x131/frame 0xfffffe016a2ccca0
+# panic() at panic+0x43/frame 0xfffffe016a2ccd00
+# sbrelease_internal() at sbrelease_internal+0x7c/frame 0xfffffe016a2ccd20
+# sbrelease() at sbrelease+0x5e/frame 0xfffffe016a2ccd50
+# sorflush() at sorflush+0x66/frame 0xfffffe016a2ccd70
+# soshutdown() at soshutdown+0x105/frame 0xfffffe016a2ccdb0
+# kern_shutdown() at kern_shutdown+0x60/frame 0xfffffe016a2ccdf0
+# ia32_syscall() at ia32_syscall+0x154/frame 0xfffffe016a2ccf30
+# int0x80_syscall_common() at int0x80_syscall_common+0x9c/frame 0xffffdb44
+# KDB: enter: panic
+# [ thread pid 4927 tid 100275 ]
+# Stopped at      : movq    $0,0xe37212(%rip)
+# db> x/s version
+# FreeBSD 15.0-CURRENT #0 main-n267418-24cd5c26fe3e: Fri Jan  5 08:21:43 CET 2024
+# pho@mercat1.netperf.freebsd.org:/usr/src/sys/amd64/compile/PHO
+# db> 
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=a9e90e96743f3e20b4a66d9d0d4c08c57ea8cc7f
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+// Reported-by: syzbot+a58e1615881c01a51653@syzkaller.appspotmail.com
+
+#define _GNU_SOURCE
+
+#include <pwd.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+uint64_t r[1] = {0xffffffffffffffff};
+
+int main(void)
+{
+  syscall(SYS_mmap, /*addr=*/0x10000000, /*len=*/0x1000000, /*prot=*/7,
+          /*flags=*/0x1012, /*fd=*/-1, /*offset=*/0);
+  intptr_t res = 0;
+  res = syscall(SYS_socket, /*domain=*/0x26, /*type=*/2, /*proto=*/0);
+  if (res != -1)
+    r[0] = res;
+  syscall(SYS_shutdown, /*fd=*/(intptr_t)r[0], /*how=*/0);
+  return 0;
+}
+EOF
+mycc -o /tmp/$prog -m32 -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+start=`date +%s`
+while [ $((`date +%s` - start)) -lt 120 ]; do
+	timeout 3m /tmp/$prog
+done
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core
+exit 0
diff --git a/syzkaller73.sh b/syzkaller73.sh
new file mode 100755
index 000000000000..776ace385f21
--- /dev/null
+++ b/syzkaller73.sh
@@ -0,0 +1,537 @@
+#!/bin/sh
+
+# No issues seen (Looks a bit like syzkaller43.sh)
+
+[ `id -u ` -ne 0 ] && echo "Must be root!" && exit 1
+
+. ../default.cfg
+set -u
+prog=$(basename "$0" .sh)
+cat > /tmp/$prog.c <<EOF
+// https://syzkaller.appspot.com/bug?id=cf4c0a08d26692dc8f22b0fcc50db08fd17dd709
+// autogenerated by syzkaller (https://github.com/google/syzkaller)
+
+#define _GNU_SOURCE
+
+#include <sys/types.h>
+
+#include <dirent.h>
+#include <errno.h>
+#include <pthread.h>
+#include <pwd.h>
+#include <setjmp.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/endian.h>
+#include <sys/resource.h>
+#include <sys/stat.h>
+#include <sys/syscall.h>
+#include <sys/wait.h>
+#include <time.h>
+#include <unistd.h>
+
+#ifndef SYS_aio_writev
+#define SYS_aio_writev 578
+#endif
+
+static __thread int clone_ongoing;
+static __thread int skip_segv;
+static __thread jmp_buf segv_env;
+
+static void segv_handler(int sig, siginfo_t* info, void* ctx __unused)
+{
+  if (__atomic_load_n(&clone_ongoing, __ATOMIC_RELAXED) != 0) {
+    exit(sig);
+  }
+  uintptr_t addr = (uintptr_t)info->si_addr;
+  const uintptr_t prog_start = 1 << 20;
+  const uintptr_t prog_end = 100 << 20;
+  int skip = __atomic_load_n(&skip_segv, __ATOMIC_RELAXED) != 0;
+  int valid = addr < prog_start || addr > prog_end;
+  if (sig == SIGBUS)
+    valid = 1;
+  if (skip && valid) {
+    _longjmp(segv_env, 1);
+  }
+  exit(sig);
+}
+
+static void install_segv_handler(void)
+{
+  struct sigaction sa;
+  memset(&sa, 0, sizeof(sa));
+  sa.sa_sigaction = segv_handler;
+  sa.sa_flags = SA_NODEFER | SA_SIGINFO;
+  sigaction(SIGSEGV, &sa, NULL);
+  sigaction(SIGBUS, &sa, NULL);
+}
+
+#define NONFAILING(...)                                                        \
+  ({                                                                           \
+    int ok = 1;                                                                \
+    __atomic_fetch_add(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
+    if (_setjmp(segv_env) == 0) {                                              \
+      __VA_ARGS__;                                                             \
+    } else                                                                     \
+      ok = 0;                                                                  \
+    __atomic_fetch_sub(&skip_segv, 1, __ATOMIC_SEQ_CST);                       \
+    ok;                                                                        \
+  })
+
+static void kill_and_wait(int pid, int* status)
+{
+  kill(pid, SIGKILL);
+  while (waitpid(-1, status, 0) != pid) {
+  }
+}
+
+static void sleep_ms(uint64_t ms)
+{
+  usleep(ms * 1000);
+}
+
+static uint64_t current_time_ms(void)
+{
+  struct timespec ts;
+  if (clock_gettime(CLOCK_MONOTONIC, &ts))
+    exit(1);
+  return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
+}
+
+static void use_temporary_dir(void)
+{
+  char tmpdir_template[] = "./syzkaller.XXXXXX";
+  char* tmpdir = mkdtemp(tmpdir_template);
+  if (!tmpdir)
+    exit(1);
+  if (chmod(tmpdir, 0777))
+    exit(1);
+  if (chdir(tmpdir))
+    exit(1);
+}
+
+static void reset_flags(const char* filename)
+{
+  struct stat st;
+  if (lstat(filename, &st))
+    exit(1);
+  st.st_flags &= ~(SF_NOUNLINK | UF_NOUNLINK | SF_IMMUTABLE | UF_IMMUTABLE |
+                   SF_APPEND | UF_APPEND);
+  if (lchflags(filename, st.st_flags))
+    exit(1);
+}
+static void __attribute__((noinline)) remove_dir(const char* dir)
+{
+  DIR* dp = opendir(dir);
+  if (dp == NULL) {
+    if (errno == EACCES) {
+      if (rmdir(dir))
+        exit(1);
+      return;
+    }
+    exit(1);
+  }
+  struct dirent* ep = 0;
+  while ((ep = readdir(dp))) {
+    if (strcmp(ep->d_name, ".") == 0 || strcmp(ep->d_name, "..") == 0)
+      continue;
+    char filename[FILENAME_MAX];
+    snprintf(filename, sizeof(filename), "%s/%s", dir, ep->d_name);
+    struct stat st;
+    if (lstat(filename, &st))
+      exit(1);
+    if (S_ISDIR(st.st_mode)) {
+      remove_dir(filename);
+      continue;
+    }
+    if (unlink(filename)) {
+      if (errno == EPERM) {
+        reset_flags(filename);
+        reset_flags(dir);
+        if (unlink(filename) == 0)
+          continue;
+      }
+      exit(1);
+    }
+  }
+  closedir(dp);
+  while (rmdir(dir)) {
+    if (errno == EPERM) {
+      reset_flags(dir);
+      if (rmdir(dir) == 0)
+        break;
+    }
+    exit(1);
+  }
+}
+
+static void thread_start(void* (*fn)(void*), void* arg)
+{
+  pthread_t th;
+  pthread_attr_t attr;
+  pthread_attr_init(&attr);
+  pthread_attr_setstacksize(&attr, 128 << 10);
+  int i = 0;
+  for (; i < 100; i++) {
+    if (pthread_create(&th, &attr, fn, arg) == 0) {
+      pthread_attr_destroy(&attr);
+      return;
+    }
+    if (errno == EAGAIN) {
+      usleep(50);
+      continue;
+    }
+    break;
+  }
+  exit(1);
+}
+
+typedef struct {
+  pthread_mutex_t mu;
+  pthread_cond_t cv;
+  int state;
+} event_t;
+
+static void event_init(event_t* ev)
+{
+  if (pthread_mutex_init(&ev->mu, 0))
+    exit(1);
+  if (pthread_cond_init(&ev->cv, 0))
+    exit(1);
+  ev->state = 0;
+}
+
+static void event_reset(event_t* ev)
+{
+  ev->state = 0;
+}
+
+static void event_set(event_t* ev)
+{
+  pthread_mutex_lock(&ev->mu);
+  if (ev->state)
+    exit(1);
+  ev->state = 1;
+  pthread_mutex_unlock(&ev->mu);
+  pthread_cond_broadcast(&ev->cv);
+}
+
+static void event_wait(event_t* ev)
+{
+  pthread_mutex_lock(&ev->mu);
+  while (!ev->state)
+    pthread_cond_wait(&ev->cv, &ev->mu);
+  pthread_mutex_unlock(&ev->mu);
+}
+
+static int event_isset(event_t* ev)
+{
+  pthread_mutex_lock(&ev->mu);
+  int res = ev->state;
+  pthread_mutex_unlock(&ev->mu);
+  return res;
+}
+
+static int event_timedwait(event_t* ev, uint64_t timeout)
+{
+  uint64_t start = current_time_ms();
+  uint64_t now = start;
+  pthread_mutex_lock(&ev->mu);
+  for (;;) {
+    if (ev->state)
+      break;
+    uint64_t remain = timeout - (now - start);
+    struct timespec ts;
+    ts.tv_sec = remain / 1000;
+    ts.tv_nsec = (remain % 1000) * 1000 * 1000;
+    pthread_cond_timedwait(&ev->cv, &ev->mu, &ts);
+    now = current_time_ms();
+    if (now - start > timeout)
+      break;
+  }
+  int res = ev->state;
+  pthread_mutex_unlock(&ev->mu);
+  return res;
+}
+
+static void sandbox_common()
+{
+  struct rlimit rlim;
+  rlim.rlim_cur = rlim.rlim_max = 128 << 20;
+  setrlimit(RLIMIT_AS, &rlim);
+  rlim.rlim_cur = rlim.rlim_max = 8 << 20;
+  setrlimit(RLIMIT_MEMLOCK, &rlim);
+  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+  setrlimit(RLIMIT_FSIZE, &rlim);
+  rlim.rlim_cur = rlim.rlim_max = 1 << 20;
+  setrlimit(RLIMIT_STACK, &rlim);
+  rlim.rlim_cur = rlim.rlim_max = 0;
+  setrlimit(RLIMIT_CORE, &rlim);
+  rlim.rlim_cur = rlim.rlim_max = 256;
+  setrlimit(RLIMIT_NOFILE, &rlim);
+}
+
+static void loop();
+
+static int do_sandbox_none(void)
+{
+  sandbox_common();
+  loop();
+  return 0;
+}
+
+struct thread_t {
+  int created, call;
+  event_t ready, done;
+};
+
+static struct thread_t threads[16];
+static void execute_call(int call);
+static int running;
+
+static void* thr(void* arg)
+{
+  struct thread_t* th = (struct thread_t*)arg;
+  for (;;) {
+    event_wait(&th->ready);
+    event_reset(&th->ready);
+    execute_call(th->call);
+    __atomic_fetch_sub(&running, 1, __ATOMIC_RELAXED);
+    event_set(&th->done);
+  }
+  return 0;
+}
+
+static void execute_one(void)
+{
+  if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
+  }
+  int i, call, thread;
+  for (call = 0; call < 24; call++) {
+    for (thread = 0; thread < (int)(sizeof(threads) / sizeof(threads[0]));
+         thread++) {
+      struct thread_t* th = &threads[thread];
+      if (!th->created) {
+        th->created = 1;
+        event_init(&th->ready);
+        event_init(&th->done);
+        event_set(&th->done);
+        thread_start(thr, th);
+      }
+      if (!event_isset(&th->done))
+        continue;
+      event_reset(&th->done);
+      th->call = call;
+      __atomic_fetch_add(&running, 1, __ATOMIC_RELAXED);
+      event_set(&th->ready);
+      event_timedwait(&th->done, 50);
+      break;
+    }
+  }
+  for (i = 0; i < 100 && __atomic_load_n(&running, __ATOMIC_RELAXED); i++)
+    sleep_ms(1);
+}
+
+static void execute_one(void);
+
+#define WAIT_FLAGS 0
+
+static void loop(void)
+{
+  int iter = 0;
+  for (;; iter++) {
+    char cwdbuf[32];
+    sprintf(cwdbuf, "./%d", iter);
+    if (mkdir(cwdbuf, 0777))
+      exit(1);
+    int pid = fork();
+    if (pid < 0)
+      exit(1);
+    if (pid == 0) {
+      if (chdir(cwdbuf))
+        exit(1);
+      execute_one();
+      exit(0);
+    }
+    int status = 0;
+    uint64_t start = current_time_ms();
+    for (;;) {
+      sleep_ms(10);
+      if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
+        break;
+      if (current_time_ms() - start < 5000)
+        continue;
+      kill_and_wait(pid, &status);
+      break;
+    }
+    remove_dir(cwdbuf);
+  }
+}
+
+uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
+
+void execute_call(int call)
+{
+  intptr_t res = 0;
+  switch (call) {
+  case 0:
+    res = syscall(SYS_socket, /*domain=AF_INET6*/ 0x1cul,
+                  /*type=SOCK_STREAM*/ 1ul, /*proto=*/0);
+    if (res != -1)
+      r[0] = res;
+    break;
+  case 1:
+    NONFAILING(*(uint32_t*)0x200000c0 = 0x101);
+    syscall(SYS_setsockopt, /*fd=*/r[0], /*level=*/0xffff,
+            /*optname=SO_SNDBUF*/ 0x1001, /*optval=*/0x200000c0ul,
+            /*optlen=*/4ul);
+    break;
+  case 2:
+    NONFAILING(*(uint8_t*)0x20000140 = 0x1c);
+    NONFAILING(*(uint8_t*)0x20000141 = 0x1c);
+    NONFAILING(*(uint16_t*)0x20000142 = htobe16(0x4e23));
+    NONFAILING(*(uint32_t*)0x20000144 = 0);
+    NONFAILING(memset((void*)0x20000148, 0, 16));
+    NONFAILING(*(uint32_t*)0x20000158 = 0);
+    syscall(SYS_bind, /*fd=*/r[0], /*addr=*/0x20000140ul, /*addrlen=*/0x1cul);
+    break;
+  case 3:
+    NONFAILING(*(uint32_t*)0x20000500 = r[0]);
+    NONFAILING(*(uint64_t*)0x20000508 = 0);
+    NONFAILING(*(uint64_t*)0x20000510 = 0);
+    NONFAILING(*(uint64_t*)0x20000518 = 0);
+    NONFAILING(*(uint32_t*)0x20000520 = 4);
+    NONFAILING(*(uint32_t*)0x20000524 = 0);
+    NONFAILING(*(uint64_t*)0x20000528 = 0);
+    NONFAILING(*(uint32_t*)0x20000530 = 0);
+    NONFAILING(*(uint32_t*)0x20000534 = 4);
+    NONFAILING(*(uint64_t*)0x20000538 = 0x822e);
+    NONFAILING(*(uint64_t*)0x20000540 = 0);
+    NONFAILING(*(uint64_t*)0x20000548 = 0x20000340);
+    NONFAILING(*(uint32_t*)0x20000550 = 0);
+    NONFAILING(*(uint32_t*)0x20000554 = 0);
+    NONFAILING(*(uint64_t*)0x20000558 = 0xfffffffffffffffe);
+    NONFAILING(*(uint64_t*)0x20000560 = 0);
+    NONFAILING(*(uint64_t*)0x20000568 = 0x20000380);
+    NONFAILING(memcpy((void*)0x20000380, "\x3c\x88\x80", 3));
+    syscall(SYS_aio_writev, /*iocb=*/0x20000500ul);
+    break;
+  case 4:
+    NONFAILING(*(uint8_t*)0x20000180 = 0x1c);
+    NONFAILING(*(uint8_t*)0x20000181 = 0x1c);
+    NONFAILING(*(uint16_t*)0x20000182 = htobe16(0x4e23));
+    NONFAILING(*(uint32_t*)0x20000184 = 0);
+    NONFAILING(memset((void*)0x20000188, 0, 16));
+    NONFAILING(*(uint32_t*)0x20000198 = 0);
+    syscall(SYS_connect, /*fd=*/r[0], /*addr=*/0x20000180ul,
+            /*addrlen=*/0x1cul);
+    break;
+  case 5:
+    NONFAILING(memset((void*)0x20000200, 14, 1));
+    syscall(SYS_sendto, /*fd=*/r[0], /*buf=*/0x20000200ul, /*len=*/0xff66ul,
+            /*f=*/0ul, /*addr=*/0ul, /*addrlen=*/0ul);
+    break;
+  case 6:
+    syscall(SYS_sendmsg, /*fd=*/r[0], /*msg=*/0ul, /*f=*/0ul);
+    break;
+  case 7:
+    syscall(SYS_socket, /*domain=AF_INET*/ 2ul, /*type=SOCK_STREAM*/ 1ul,
+            /*proto=*/0);
+    break;
+  case 8:
+    res = syscall(SYS_socket, /*domain=*/2ul, /*type=SOCK_SEQPACKET*/ 5ul,
+                  /*proto=*/0x84);
+    if (res != -1)
+      r[1] = res;
+    break;
+  case 9:
+    syscall(SYS_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0ul,
+            /*flags=O_RDWR*/ 2ul, /*mode=*/0ul);
+    break;
+  case 10:
+    syscall(SYS_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0ul,
+            /*flags=O_RDWR*/ 2ul, /*mode=*/0ul);
+    break;
+  case 11:
+    syscall(SYS_socket, /*domain=*/2ul, /*type=SOCK_SEQPACKET*/ 5ul,
+            /*proto=*/0x84);
+    break;
+  case 12:
+    syscall(SYS_socket, /*domain=*/0x1cul, /*type=*/1ul, /*proto=*/0);
+    break;
+  case 13:
+    syscall(SYS_shutdown, /*fd=*/-1, /*how=*/0ul);
+    break;
+  case 14:
+    syscall(SYS_shutdown, /*fd=*/-1, /*how=*/0ul);
+    break;
+  case 15:
+    syscall(SYS_sendto, /*fd=*/-1, /*buf=*/0ul, /*len=*/0ul, /*f=*/0ul,
+            /*addr=*/0ul, /*addrlen=*/0ul);
+    break;
+  case 16:
+    syscall(SYS_sendmsg, /*fd=*/-1, /*msg=*/0ul, /*f=*/0ul);
+    break;
+  case 17:
+    syscall(SYS_rfork, /*flags=RFMEM|RFTHREAD|RFCFDG|RFNOWAIT*/ 0x3060ul);
+    break;
+  case 18:
+    syscall(SYS_rfork, /*flags=RFMEM|RFTHREAD|RFCFDG|RFNOWAIT*/ 0x3060ul);
+    break;
+  case 19:
+    syscall(SYS_openat, /*fd=*/0xffffff9cul, /*file=*/0ul,
+            /*flags=O_APPEND*/ 8ul, /*mode=*/0ul);
+    break;
+  case 20:
+    syscall(SYS_openat, /*fd=*/0xffffff9cul, /*file=*/0ul,
+            /*flags=O_APPEND*/ 8ul, /*mode=*/0ul);
+    break;
+  case 21:
+    syscall(SYS_connect, /*fd=*/r[1], /*addr=*/0ul, /*addrlen=*/0ul);
+    break;
+  case 22:
+    res = syscall(SYS_socket, /*domain=*/2ul, /*type=SOCK_STREAM*/ 1ul,
+                  /*proto=*/0x84);
+    if (res != -1)
+      r[2] = res;
+    break;
+  case 23:
+    NONFAILING(*(uint32_t*)0x200001c0 = 0);
+    syscall(SYS_getsockopt, /*fd=*/r[2], /*level=*/0x84, /*opt=*/0xc,
+            /*val=*/0ul, /*len=*/0x200001c0ul);
+    break;
+  }
+}
+int main(void)
+{
+  syscall(SYS_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul,
+          /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
+          /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x1012ul, /*fd=*/-1,
+          /*offset=*/0ul);
+  const char* reason;
+  (void)reason;
+  install_segv_handler();
+  use_temporary_dir();
+  do_sandbox_none();
+  return 0;
+}
+EOF
+mycc -o /tmp/$prog -m32 -Wall -Wextra -O0 /tmp/$prog.c -lpthread || exit 1
+
+(cd ../testcases/swap; ./swap -t 2m -i 10 -l 100 > /dev/null 2>&1) &
+sleep 1
+cd /tmp
+start=`date +%s`
+while [ $((`date +%s` - start)) -lt 120 ]; do
+	timeout 3m /tmp/$prog > /dev/null 2>&1
+done
+while pkill swap; do :; done
+wait
+
+rm -rf /tmp/$prog /tmp/$prog.c /tmp/$prog.core
+exit 0