diff --git a/sys/altq/altq_afmap.c b/sys/altq/altq_afmap.c
index e9fbb469730b..a4dd8db5ac55 100644
--- a/sys/altq/altq_afmap.c
+++ b/sys/altq/altq_afmap.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: altq_afmap.c,v 1.6 2003/11/09 22:11:12 christos Exp $	*/
+/*	$NetBSD: altq_afmap.c,v 1.7 2004/04/21 18:40:37 itojun Exp $	*/
 /*	$KAME: altq_afmap.c,v 1.7 2000/12/14 08:12:45 thorpej Exp $	*/
 
 /*
@@ -36,18 +36,12 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: altq_afmap.c,v 1.6 2003/11/09 22:11:12 christos Exp $");
+__KERNEL_RCSID(0, "$NetBSD: altq_afmap.c,v 1.7 2004/04/21 18:40:37 itojun Exp $");
 
-#if defined(__FreeBSD__) || defined(__NetBSD__)
+#ifdef _KERNEL_OPT
 #include "opt_altq.h"
-#if (__FreeBSD__ != 2)
 #include "opt_inet.h"
-#ifdef __FreeBSD__
-#include "opt_inet6.h"
 #endif
-#endif
-#endif /* __FreeBSD__ || __NetBSD__ */
-#ifdef ALTQ_AFMAP
 
 #include <sys/param.h>
 #include <sys/malloc.h>
@@ -411,5 +405,3 @@ afmioctl(dev, cmd, addr, flag, p)
 
 	return error;
 }
-
-#endif /* ALTQ_AFMAP */
diff --git a/sys/ddb/db_sym.c b/sys/ddb/db_sym.c
index 207c7e346543..d1953fb56609 100644
--- a/sys/ddb/db_sym.c
+++ b/sys/ddb/db_sym.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: db_sym.c,v 1.45 2003/11/17 10:16:18 cube Exp $	*/
+/*	$NetBSD: db_sym.c,v 1.46 2004/04/21 18:40:37 itojun Exp $	*/
 
 /*
  * Mach Operating System
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: db_sym.c,v 1.45 2003/11/17 10:16:18 cube Exp $");
+__KERNEL_RCSID(0, "$NetBSD: db_sym.c,v 1.46 2004/04/21 18:40:37 itojun Exp $");
 
 #include "opt_ddbparam.h"
 
@@ -324,7 +324,8 @@ db_symstr(char *buf, size_t buflen, db_expr_t off, db_strategy_t strategy)
 					if ((*db_symformat->sym_line_at_pc)
 					    (NULL, cursym, &filename,
 					    &linenum, off))
-						sprintf(buf+strlen(buf),
+						snprintf(buf + strlen(buf),
+						    buflen - strlen(buf),
 						    " [%s:%d]",
 						    filename, linenum);
 				}
@@ -339,7 +340,7 @@ db_symstr(char *buf, size_t buflen, db_expr_t off, db_strategy_t strategy)
 	    strategy|KSYMS_CLOSEST) == 0) {
 		(void)ksyms_getval_from_kernel(mod, name, &val, KSYMS_ANY);
 		if (((off - val) < db_maxoff) && val) {
-			sprintf(buf, "%s:%s", mod, name);
+			snprintf(buf, buflen, "%s:%s", mod, name);
 			if (off - val) {
 				strlcat(buf, "+", buflen);
 				db_format_radix(buf+strlen(buf),
@@ -347,7 +348,9 @@ db_symstr(char *buf, size_t buflen, db_expr_t off, db_strategy_t strategy)
 			}
 #ifdef notyet
 			if (strategy & KSYMS_PROC) {
-				if (ksyms_fmaddr(off, &filename, &linenum) == 0)					sprintf(buf+strlen(buf),
+				if (ksyms_fmaddr(off, &filename, &linenum) == 0)
+					snprintf(buf + strlen(buf),
+					    buflen - strlen(buf),
 					    " [%s:%d]", filename, linenum);
 			}
 #endif
diff --git a/sys/dev/ccd.c b/sys/dev/ccd.c
index abbf9a2a4045..68fee9fc8d92 100644
--- a/sys/dev/ccd.c
+++ b/sys/dev/ccd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ccd.c,v 1.95 2004/01/25 18:06:48 hannken Exp $	*/
+/*	$NetBSD: ccd.c,v 1.96 2004/04/21 18:40:37 itojun Exp $	*/
 
 /*-
  * Copyright (c) 1996, 1997, 1998, 1999 The NetBSD Foundation, Inc.
@@ -125,7 +125,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ccd.c,v 1.95 2004/01/25 18:06:48 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ccd.c,v 1.96 2004/04/21 18:40:37 itojun Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -258,7 +258,7 @@ ccdattach(num)
 	/* Initialize per-softc structures. */
 	for (i = 0; i < num; i++) {
 		cs = &ccd_softc[i];
-		sprintf(cs->sc_xname, "ccd%d", i);	/* XXX */
+		snprintf(cs->sc_xname, sizeof(cs->sc_xname), "ccd%d", i);
 		cs->sc_dkdev.dk_name = cs->sc_xname;	/* XXX */
 		lockinit(&cs->sc_lock, PRIBIO, "ccdlk", 0, 0);
 	}
diff --git a/sys/dev/md.c b/sys/dev/md.c
index 93df0f2ced81..fdd74518820e 100644
--- a/sys/dev/md.c
+++ b/sys/dev/md.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: md.c,v 1.36 2003/06/29 22:30:00 fvdl Exp $	*/
+/*	$NetBSD: md.c,v 1.37 2004/04/21 18:40:37 itojun Exp $	*/
 
 /*
  * Copyright (c) 1995 Gordon W. Ross, Leo Weppelman.
@@ -46,7 +46,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: md.c,v 1.36 2003/06/29 22:30:00 fvdl Exp $");
+__KERNEL_RCSID(0, "$NetBSD: md.c,v 1.37 2004/04/21 18:40:37 itojun Exp $");
 
 #include "opt_md.h"
 
@@ -151,7 +151,8 @@ mdattach(n)
 		}
 		ramdisk_devs[i] = sc;
 		sc->sc_dev.dv_unit = i;
-		sprintf(sc->sc_dev.dv_xname, "md%d", i);
+		snprintf(sc->sc_dev.dv_xname, sizeof(sc->sc_dev.dv_xname),
+		    "md%d", i);
 		md_attach(NULL, &sc->sc_dev, NULL);
 	}
 }
diff --git a/sys/dev/vnd.c b/sys/dev/vnd.c
index 11790f681863..25e5cadadf0e 100644
--- a/sys/dev/vnd.c
+++ b/sys/dev/vnd.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: vnd.c,v 1.106 2004/01/25 18:06:48 hannken Exp $	*/
+/*	$NetBSD: vnd.c,v 1.107 2004/04/21 18:40:37 itojun Exp $	*/
 
 /*-
  * Copyright (c) 1996, 1997, 1998 The NetBSD Foundation, Inc.
@@ -133,7 +133,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.106 2004/01/25 18:06:48 hannken Exp $");
+__KERNEL_RCSID(0, "$NetBSD: vnd.c,v 1.107 2004/04/21 18:40:37 itojun Exp $");
 
 #if defined(_KERNEL_OPT)
 #include "fs_nfs.h"
@@ -944,7 +944,7 @@ vndioctl(dev, cmd, data, flag, p)
 
 		/* Attach the disk. */
 		memset(vnd->sc_xname, 0, sizeof(vnd->sc_xname)); /* XXX */
-		sprintf(vnd->sc_xname, "vnd%d", unit);		/* XXX */
+		snprintf(vnd->sc_xname, sizeof(vnd->sc_xname), "vnd%d", unit);
 		vnd->sc_dkdev.dk_name = vnd->sc_xname;
 		disk_attach(&vnd->sc_dkdev);
 
diff --git a/sys/kern/core_elf32.c b/sys/kern/core_elf32.c
index c95328766bcd..3f91d1ae5330 100644
--- a/sys/kern/core_elf32.c
+++ b/sys/kern/core_elf32.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: core_elf32.c,v 1.12 2003/09/14 06:59:13 christos Exp $	*/
+/*	$NetBSD: core_elf32.c,v 1.13 2004/04/21 18:40:38 itojun Exp $	*/
 
 /*
  * Copyright (c) 2001 Wasabi Systems, Inc.
@@ -40,7 +40,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(1, "$NetBSD: core_elf32.c,v 1.12 2003/09/14 06:59:13 christos Exp $");
+__KERNEL_RCSID(1, "$NetBSD: core_elf32.c,v 1.13 2004/04/21 18:40:38 itojun Exp $");
 
 /* If not included by core_elf64.c, ELFSIZE won't be defined. */
 #ifndef ELFSIZE
@@ -394,7 +394,8 @@ ELFNAMEEND(coredump_note)(struct proc *p, struct lwp *l, struct vnode *vp,
 
 	size = 0;
 
-	sprintf(name, "%s@%d", ELF_NOTE_NETBSD_CORE_NAME, l->l_lid);
+	snprintf(name, sizeof(name), "%s@%d", ELF_NOTE_NETBSD_CORE_NAME,
+	    l->l_lid);
 	namesize = strlen(name) + 1;
 
 	notesize = sizeof(nhdr) + elfround(namesize) + elfround(sizeof(intreg));
diff --git a/sys/kern/exec_script.c b/sys/kern/exec_script.c
index 0e47729c0e46..3974872ddef8 100644
--- a/sys/kern/exec_script.c
+++ b/sys/kern/exec_script.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: exec_script.c,v 1.36 2003/06/29 22:31:16 fvdl Exp $	*/
+/*	$NetBSD: exec_script.c,v 1.37 2004/04/21 18:40:38 itojun Exp $	*/
 
 /*
  * Copyright (c) 1993, 1994, 1996 Christopher G. Demetriou
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: exec_script.c,v 1.36 2003/06/29 22:31:16 fvdl Exp $");
+__KERNEL_RCSID(0, "$NetBSD: exec_script.c,v 1.37 2004/04/21 18:40:38 itojun Exp $");
 
 #if defined(SETUIDSCRIPTS) && !defined(FDSCRIPTS)
 #define FDSCRIPTS		/* Need this for safe set-id scripts. */
@@ -223,7 +223,7 @@ check_shell:
 #endif
 #ifdef FDSCRIPTS
 	} else
-		sprintf(*tmpsap++, "/dev/fd/%d", epp->ep_fd);
+		snprintf(*tmpsap++, MAXPATHLEN, "/dev/fd/%d", epp->ep_fd);
 #endif
 	*tmpsap = NULL;
 
diff --git a/sys/kern/kern_subr.c b/sys/kern/kern_subr.c
index 8cada03c256c..1af80bf22ff7 100644
--- a/sys/kern/kern_subr.c
+++ b/sys/kern/kern_subr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kern_subr.c,v 1.109 2004/03/23 13:22:33 junyoung Exp $	*/
+/*	$NetBSD: kern_subr.c,v 1.110 2004/04/21 18:40:38 itojun Exp $	*/
 
 /*-
  * Copyright (c) 1997, 1998, 1999, 2002 The NetBSD Foundation, Inc.
@@ -86,7 +86,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kern_subr.c,v 1.109 2004/03/23 13:22:33 junyoung Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kern_subr.c,v 1.110 2004/04/21 18:40:38 itojun Exp $");
 
 #include "opt_ddb.h"
 #include "opt_md.h"
@@ -205,6 +205,28 @@ uiomove(buf, n, uio)
 	return (error);
 }
 
+/*
+ * Wrapper for uiomove() that validates the arguments against a known-good
+ * kernel buffer.  Currently, uiomove accepts a signed (n) argument, which
+ * is almost definitely a bad thing, so we catch that here as well.  We
+ * return a runtime failure, but it might be desirable to generate a runtime
+ * assertion failure instead.
+ */
+int
+uiomove_frombuf(void *buf, int buflen, struct uio *uio)
+{
+	unsigned int offset, n;
+
+	if (uio->uio_offset < 0 || uio->uio_resid < 0 ||
+	    (offset = uio->uio_offset) != uio->uio_offset)
+		return (EINVAL);
+	if (buflen <= 0 || offset >= buflen)
+		return (0);
+	if ((n = buflen - offset) > INT_MAX)
+		return (EINVAL);
+	return (uiomove((char *)buf + offset, n, uio));
+}
+
 /*
  * Give next character to user as result of read.
  */
@@ -756,7 +778,8 @@ setroot(bootdv, bootpartition)
 		fakemdrootdev[i].dv_cfdata = NULL;
 		fakemdrootdev[i].dv_unit   = i;
 		fakemdrootdev[i].dv_parent = NULL;
-		sprintf(fakemdrootdev[i].dv_xname, "md%d", i);
+		snprintf(fakemdrootdev[i].dv_xname,
+		    sizeof(fakemdrootdev[i].dv_xname), "md%d", i);
 	}
 #endif /* MEMORY_DISK_HOOKS */
 
@@ -966,7 +989,8 @@ setroot(bootdv, bootpartition)
 			goto top;
 		}
 		memset(buf, 0, sizeof(buf));
-		sprintf(buf, "%s%d", rootdevname, DISKUNIT(rootdev));
+		snprintf(buf, sizeof(buf), "%s%d", rootdevname,
+		    DISKUNIT(rootdev));
 
 		rootdv = finddevice(buf);
 		if (rootdv == NULL) {
@@ -1031,7 +1055,8 @@ setroot(bootdv, bootpartition)
 		if (dumpdevname == NULL)
 			goto nodumpdev;
 		memset(buf, 0, sizeof(buf));
-		sprintf(buf, "%s%d", dumpdevname, DISKUNIT(dumpdev));
+		snprintf(buf, sizeof(buf), "%s%d", dumpdevname,
+		    DISKUNIT(dumpdev));
 
 		dumpdv = finddevice(buf);
 		if (dumpdv == NULL) {
diff --git a/sys/kern/kgdb_stub.c b/sys/kern/kgdb_stub.c
index 665874e43a5c..3d957ea15e7a 100644
--- a/sys/kern/kgdb_stub.c
+++ b/sys/kern/kgdb_stub.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kgdb_stub.c,v 1.17 2004/03/23 13:22:03 junyoung Exp $	*/
+/*	$NetBSD: kgdb_stub.c,v 1.18 2004/04/21 18:40:38 itojun Exp $	*/
 
 /*
  * Copyright (c) 1990, 1993
@@ -45,7 +45,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: kgdb_stub.c,v 1.17 2004/03/23 13:22:03 junyoung Exp $");
+__KERNEL_RCSID(0, "$NetBSD: kgdb_stub.c,v 1.18 2004/04/21 18:40:38 itojun Exp $");
 
 #include "opt_kgdb.h"
 
@@ -407,7 +407,7 @@ kgdb_trap(type, regs)
 		kgdb_active = 1;
 	} else {
 		/* Tell remote host that an exception has occurred. */
-		sprintf(buffer, "S%02x", kgdb_signal(type));
+		snprintf(buffer, sizeof(buffer), "S%02x", kgdb_signal(type));
 		kgdb_send(buffer);
 	}
 
@@ -435,7 +435,8 @@ kgdb_trap(type, regs)
 			 * knowing if we're in or out of this loop
 			 * when he issues a "remote-signal".
 			 */
-			sprintf(buffer, "S%02x", kgdb_signal(type));
+			snprintf(buffer, sizeof(buffer), "S%02x",
+			    kgdb_signal(type));
 			kgdb_send(buffer);
 			continue;
 
diff --git a/sys/kern/subr_userconf.c b/sys/kern/subr_userconf.c
index e2ec8e5dc6cf..e4e8063e9c2f 100644
--- a/sys/kern/subr_userconf.c
+++ b/sys/kern/subr_userconf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: subr_userconf.c,v 1.11 2004/03/23 13:22:04 junyoung Exp $	*/
+/*	$NetBSD: subr_userconf.c,v 1.12 2004/04/21 18:40:38 itojun Exp $	*/
 
 /*
  * Copyright (c) 1996 Mats O Jansson <moj@stacken.kth.se>
@@ -35,7 +35,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: subr_userconf.c,v 1.11 2004/03/23 13:22:04 junyoung Exp $");
+__KERNEL_RCSID(0, "$NetBSD: subr_userconf.c,v 1.12 2004/04/21 18:40:38 itojun Exp $");
 
 #include "opt_userconf.h"
 
@@ -155,7 +155,7 @@ void
 userconf_hist_int(val)
 	int val;
 {
-	sprintf(userconf_histbuf," %d",val);
+	snprintf(userconf_histbuf, sizeof(userconf_histbuf), " %d", val);
 	if ((userconf_histcur + strlen(userconf_histbuf)) < userconf_histsz) {
 		memcpy(&userconf_history[userconf_histcur],
 		      userconf_histbuf,
diff --git a/sys/net/if_atmsubr.c b/sys/net/if_atmsubr.c
index 6b57c1aaa147..951d182f6434 100644
--- a/sys/net/if_atmsubr.c
+++ b/sys/net/if_atmsubr.c
@@ -1,4 +1,4 @@
-/*      $NetBSD: if_atmsubr.c,v 1.32 2003/01/19 23:14:42 simonb Exp $       */
+/*      $NetBSD: if_atmsubr.c,v 1.33 2004/04/21 18:40:38 itojun Exp $       */
 
 /*
  *
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_atmsubr.c,v 1.32 2003/01/19 23:14:42 simonb Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_atmsubr.c,v 1.33 2004/04/21 18:40:38 itojun Exp $");
 
 #include "opt_inet.h"
 #include "opt_gateway.h"
@@ -383,7 +383,8 @@ pvcsif_alloc()
 	memset(pvcsif, 0, sizeof(struct pvcsif));
 
 #ifdef __NetBSD__
-	sprintf(pvcsif->sif_if.if_xname, "pvc%d", pvc_number++);
+	snprintf(pvcsif->sif_if.if_xname, sizeof(pvcsif->sif_if.if_xname),
+	    "pvc%d", pvc_number++);
 #else
 	pvcsif->sif_if.if_name = "pvc";
 	pvcsif->sif_if.if_unit = pvc_number++;
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index df5f8322c32c..198c644f43a0 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_bridge.c,v 1.22 2004/01/31 20:11:13 jdc Exp $	*/
+/*	$NetBSD: if_bridge.c,v 1.23 2004/04/21 18:40:38 itojun Exp $	*/
 
 /*
  * Copyright 2001 Wasabi Systems, Inc.
@@ -80,7 +80,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_bridge.c,v 1.22 2004/01/31 20:11:13 jdc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_bridge.c,v 1.23 2004/04/21 18:40:38 itojun Exp $");
 
 #include "opt_bridge_ipf.h"
 #include "opt_inet.h"
@@ -370,7 +370,8 @@ bridge_clone_create(struct if_clone *ifc, int unit)
 
 	LIST_INIT(&sc->sc_iflist);
 
-	sprintf(ifp->if_xname, "%s%d", ifc->ifc_name, unit);
+	snprintf(ifp->if_xname, sizeof(ifp->if_xname), "%s%d", ifc->ifc_name,
+	    unit);
 	ifp->if_softc = sc;
 	ifp->if_mtu = ETHERMTU;
 	ifp->if_ioctl = bridge_ioctl;
diff --git a/sys/net/if_ecosubr.c b/sys/net/if_ecosubr.c
index 8b3f65edc038..4b1e6a8f8b4a 100644
--- a/sys/net/if_ecosubr.c
+++ b/sys/net/if_ecosubr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_ecosubr.c,v 1.13 2003/08/07 16:32:51 agc Exp $	*/
+/*	$NetBSD: if_ecosubr.c,v 1.14 2004/04/21 18:40:38 itojun Exp $	*/
 
 /*-
  * Copyright (c) 2001 Ben Harris
@@ -58,7 +58,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ecosubr.c,v 1.13 2003/08/07 16:32:51 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ecosubr.c,v 1.14 2004/04/21 18:40:38 itojun Exp $");
 
 #include "bpfilter.h"
 #include "opt_inet.h"
@@ -66,7 +66,7 @@ __KERNEL_RCSID(0, "$NetBSD: if_ecosubr.c,v 1.13 2003/08/07 16:32:51 agc Exp $");
 
 #include <sys/param.h>
 
-__KERNEL_RCSID(0, "$NetBSD: if_ecosubr.c,v 1.13 2003/08/07 16:32:51 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ecosubr.c,v 1.14 2004/04/21 18:40:38 itojun Exp $");
 
 #include <sys/errno.h>
 #include <sys/kernel.h>
@@ -833,9 +833,9 @@ eco_sprintf(const u_int8_t *ea)
 	static char buf[8];
 
 	if (ea[1] == 0)
-		sprintf(buf, "%d", ea[0]);
+		snprintf(buf, sizeof(buf), "%d", ea[0]);
 	else
-		sprintf(buf, "%d.%d", ea[1], ea[0]);
+		snprintf(buf, sizeof(buf), "%d.%d", ea[1], ea[0]);
 	return buf;
 }
 		    
diff --git a/sys/net/if_faith.c b/sys/net/if_faith.c
index 019f0346a581..df04aecfed5b 100644
--- a/sys/net/if_faith.c
+++ b/sys/net/if_faith.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_faith.c,v 1.26 2003/08/07 16:32:52 agc Exp $	*/
+/*	$NetBSD: if_faith.c,v 1.27 2004/04/21 18:40:38 itojun Exp $	*/
 /*	$KAME: if_faith.c,v 1.21 2001/02/20 07:59:26 itojun Exp $	*/
 
 /*
@@ -40,7 +40,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_faith.c,v 1.26 2003/08/07 16:32:52 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_faith.c,v 1.27 2004/04/21 18:40:38 itojun Exp $");
 
 #include "opt_inet.h"
 
@@ -125,7 +125,8 @@ faith_clone_create(ifc, unit)
 	sc = malloc(sizeof(struct faith_softc), M_DEVBUF, M_WAITOK);
 	memset(sc, 0, sizeof(struct faith_softc));
 
-	sprintf(sc->sc_if.if_xname, "%s%d", ifc->ifc_name, unit);
+	snprintf(sc->sc_if.if_xname, sizeof(sc->sc_if.if_xname), "%s%d",
+	    ifc->ifc_name, unit);
 
 	sc->sc_if.if_mtu = FAITHMTU;
 	/* Change to BROADCAST experimentaly to announce its prefix. */
diff --git a/sys/net/if_gif.c b/sys/net/if_gif.c
index 0a7be5ecdeda..993ed33a5436 100644
--- a/sys/net/if_gif.c
+++ b/sys/net/if_gif.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_gif.c,v 1.44 2003/10/28 20:13:23 mycroft Exp $	*/
+/*	$NetBSD: if_gif.c,v 1.45 2004/04/21 18:40:38 itojun Exp $	*/
 /*	$KAME: if_gif.c,v 1.76 2001/08/20 02:01:02 kjc Exp $	*/
 
 /*
@@ -31,7 +31,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_gif.c,v 1.44 2003/10/28 20:13:23 mycroft Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_gif.c,v 1.45 2004/04/21 18:40:38 itojun Exp $");
 
 #include "opt_inet.h"
 #include "opt_iso.h"
@@ -142,7 +142,8 @@ gif_clone_create(ifc, unit)
 	sc = malloc(sizeof(struct gif_softc), M_DEVBUF, M_WAIT);
 	memset(sc, 0, sizeof(struct gif_softc));
 
-	sprintf(sc->gif_if.if_xname, "%s%d", ifc->ifc_name, unit);
+	snprintf(sc->gif_if.if_xname, sizeof(sc->gif_if.if_xname), "%s%d",
+	    ifc->ifc_name, unit);
 
 	gifattach0(sc);
 
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
index 05e42d7fb3c2..da226b3c61c3 100644
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_gre.c,v 1.49 2003/12/11 00:22:29 itojun Exp $ */
+/*	$NetBSD: if_gre.c,v 1.50 2004/04/21 18:40:38 itojun Exp $ */
 
 /*
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -46,7 +46,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_gre.c,v 1.49 2003/12/11 00:22:29 itojun Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_gre.c,v 1.50 2004/04/21 18:40:38 itojun Exp $");
 
 #include "opt_inet.h"
 #include "opt_ns.h"
@@ -140,7 +140,8 @@ gre_clone_create(ifc, unit)
 	sc = malloc(sizeof(struct gre_softc), M_DEVBUF, M_WAITOK);
 	memset(sc, 0, sizeof(struct gre_softc));
 
-	sprintf(sc->sc_if.if_xname, "%s%d", ifc->ifc_name, unit);
+	snprintf(sc->sc_if.if_xname, sizeof(sc->sc_if.if_xname), "%s%d",
+	    ifc->ifc_name, unit);
 	sc->sc_if.if_softc = sc;
 	sc->sc_if.if_type = IFT_OTHER;
 	sc->sc_if.if_addrlen = 0;
diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c
index 9f44ac87fe75..3ca67936a77b 100644
--- a/sys/net/if_loop.c
+++ b/sys/net/if_loop.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_loop.c,v 1.49 2003/11/13 01:48:13 jonathan Exp $	*/
+/*	$NetBSD: if_loop.c,v 1.50 2004/04/21 18:40:39 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -65,7 +65,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_loop.c,v 1.49 2003/11/13 01:48:13 jonathan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_loop.c,v 1.50 2004/04/21 18:40:39 itojun Exp $");
 
 #include "opt_inet.h"
 #include "opt_atalk.h"
@@ -158,7 +158,7 @@ loopattach(n)
 
 	for (i = 0; i < NLOOP; i++) {
 		ifp = &loif[i];
-		sprintf(ifp->if_xname, "lo%d", i);
+		snprintf(ifp->if_xname, sizeof(ifp->if_xname), "lo%d", i);
 		ifp->if_softc = NULL;
 		ifp->if_mtu = LOMTU;
 		ifp->if_flags = IFF_LOOPBACK | IFF_MULTICAST;
diff --git a/sys/net/if_ppp.c b/sys/net/if_ppp.c
index 6e6c8e62c235..18b65f643ec5 100644
--- a/sys/net/if_ppp.c
+++ b/sys/net/if_ppp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_ppp.c,v 1.88 2003/10/28 20:16:28 mycroft Exp $	*/
+/*	$NetBSD: if_ppp.c,v 1.89 2004/04/21 18:40:39 itojun Exp $	*/
 /*	Id: if_ppp.c,v 1.6 1997/03/04 03:33:00 paulus Exp 	*/
 
 /*
@@ -102,7 +102,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_ppp.c,v 1.88 2003/10/28 20:16:28 mycroft Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_ppp.c,v 1.89 2004/04/21 18:40:39 itojun Exp $");
 
 #include "ppp.h"
 
@@ -237,7 +237,7 @@ pppattach()
 
     for (sc = ppp_softc; i < NPPP; sc++) {
 	sc->sc_unit = i;	/* XXX */
-	sprintf(sc->sc_if.if_xname, "ppp%d", i++);
+	snprintf(sc->sc_if.if_xname, sizeof(sc->sc_if.if_xname), "ppp%d", i++);
 	callout_init(&sc->sc_timo_ch);
 	sc->sc_if.if_softc = sc;
 	sc->sc_if.if_mtu = PPP_MTU;
diff --git a/sys/net/if_pppoe.c b/sys/net/if_pppoe.c
index f62fbe67585d..9799e1831feb 100644
--- a/sys/net/if_pppoe.c
+++ b/sys/net/if_pppoe.c
@@ -1,4 +1,4 @@
-/* $NetBSD: if_pppoe.c,v 1.52 2004/03/30 06:00:13 oki Exp $ */
+/* $NetBSD: if_pppoe.c,v 1.53 2004/04/21 18:40:40 itojun Exp $ */
 
 /*-
  * Copyright (c) 2002 The NetBSD Foundation, Inc.
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.52 2004/03/30 06:00:13 oki Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.53 2004/04/21 18:40:40 itojun Exp $");
 
 #include "pppoe.h"
 #include "bpfilter.h"
@@ -230,7 +230,8 @@ pppoe_clone_create(ifc, unit)
 	sc = malloc(sizeof(struct pppoe_softc), M_DEVBUF, M_WAITOK);
 	memset(sc, 0, sizeof(struct pppoe_softc));
 
-	sprintf(sc->sc_sppp.pp_if.if_xname, "pppoe%d", unit);
+	snprintf(sc->sc_sppp.pp_if.if_xname, sizeof(sc->sc_sppp.pp_if.if_xname),
+	    "pppoe%d", unit);
 	sc->sc_sppp.pp_if.if_softc = sc;
 	sc->sc_sppp.pp_if.if_mtu = PPPOE_MAXMTU;
 	sc->sc_sppp.pp_if.if_flags = IFF_SIMPLEX|IFF_POINTOPOINT|IFF_MULTICAST;
diff --git a/sys/net/if_sl.c b/sys/net/if_sl.c
index 6e479d18aee7..68060ea55cef 100644
--- a/sys/net/if_sl.c
+++ b/sys/net/if_sl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_sl.c,v 1.84 2003/08/07 16:32:53 agc Exp $	*/
+/*	$NetBSD: if_sl.c,v 1.85 2004/04/21 18:40:40 itojun Exp $	*/
 
 /*
  * Copyright (c) 1987, 1989, 1992, 1993
@@ -60,7 +60,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_sl.c,v 1.84 2003/08/07 16:32:53 agc Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_sl.c,v 1.85 2004/04/21 18:40:40 itojun Exp $");
 
 #include "sl.h"
 #if NSL > 0
@@ -202,7 +202,8 @@ slattach()
 
 	for (sc = sl_softc; i < NSL; sc++) {
 		sc->sc_unit = i;		/* XXX */
-		sprintf(sc->sc_if.if_xname, "sl%d", i++);
+		snprintf(sc->sc_if.if_xname, sizeof(sc->sc_if.if_xname),
+		    "sl%d", i++);
 		sc->sc_if.if_softc = sc;
 		sc->sc_if.if_mtu = SLMTU;
 		sc->sc_if.if_flags =
diff --git a/sys/net/if_stf.c b/sys/net/if_stf.c
index 376b30ac5db0..3498ffebf33c 100644
--- a/sys/net/if_stf.c
+++ b/sys/net/if_stf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_stf.c,v 1.36 2003/11/12 13:40:16 cl Exp $	*/
+/*	$NetBSD: if_stf.c,v 1.37 2004/04/21 18:40:41 itojun Exp $	*/
 /*	$KAME: if_stf.c,v 1.62 2001/06/07 22:32:16 itojun Exp $	*/
 
 /*
@@ -75,7 +75,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_stf.c,v 1.36 2003/11/12 13:40:16 cl Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_stf.c,v 1.37 2004/04/21 18:40:41 itojun Exp $");
 
 #include "opt_inet.h"
 
@@ -201,7 +201,8 @@ stf_clone_create(ifc, unit)
 	sc = malloc(sizeof(struct stf_softc), M_DEVBUF, M_WAIT);
 	memset(sc, 0, sizeof(struct stf_softc));
 
-	sprintf(sc->sc_if.if_xname, "%s%d", ifc->ifc_name, unit);
+	snprintf(sc->sc_if.if_xname, sizeof(sc->sc_if.if_xname), "%s%d",
+	    ifc->ifc_name, unit);
 
 	sc->encap_cookie = encap_attach_func(AF_INET, IPPROTO_IPV6,
 	    stf_encapcheck, &in_stf_protosw, sc);
diff --git a/sys/net/if_strip.c b/sys/net/if_strip.c
index 9c2d3fbf3073..79160ba76d48 100644
--- a/sys/net/if_strip.c
+++ b/sys/net/if_strip.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_strip.c,v 1.51 2004/01/19 16:12:51 atatat Exp $	*/
+/*	$NetBSD: if_strip.c,v 1.52 2004/04/21 18:40:41 itojun Exp $	*/
 /*	from: NetBSD: if_sl.c,v 1.38 1996/02/13 22:00:23 christos Exp $	*/
 
 /*
@@ -87,7 +87,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_strip.c,v 1.51 2004/01/19 16:12:51 atatat Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_strip.c,v 1.52 2004/04/21 18:40:41 itojun Exp $");
 
 #include "strip.h"
 
@@ -342,7 +342,8 @@ stripattach(n)
 
 	for (sc = strip_softc; i < NSTRIP; sc++) {
 		sc->sc_unit = i;		/* XXX */
-		sprintf(sc->sc_if.if_xname, "strip%d", i++);
+		snprintf(sc->sc_if.if_xname, sizeof(sc->sc_if.if_xname),
+		    "strip%d", i++);
 		callout_init(&sc->sc_timo_ch);
 		sc->sc_if.if_softc = sc;
 		sc->sc_if.if_mtu = SLMTU;
@@ -1965,8 +1966,9 @@ RecvErr(msg, sc)
 		} else if (*ptr >= 32 && *ptr <= 126)
 			*p++ = *ptr;
 		else {
-			sprintf(p, "\\%02x", *ptr);
-			p+= 3;
+			snprintf(p, sizeof(pkt_text) - (p - pkt_text),
+			    "\\%02x", *ptr);
+			p += 3;
 		}
 		ptr++;
 	}
diff --git a/sys/net/if_vlan.c b/sys/net/if_vlan.c
index 687da8721249..99dfc5a9f4cb 100644
--- a/sys/net/if_vlan.c
+++ b/sys/net/if_vlan.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_vlan.c,v 1.38 2003/12/05 19:35:43 scw Exp $	*/
+/*	$NetBSD: if_vlan.c,v 1.39 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*-
  * Copyright (c) 2000, 2001 The NetBSD Foundation, Inc.
@@ -85,7 +85,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_vlan.c,v 1.38 2003/12/05 19:35:43 scw Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_vlan.c,v 1.39 2004/04/21 18:40:41 itojun Exp $");
 
 #include "opt_inet.h"
 #include "bpfilter.h"
@@ -233,7 +233,8 @@ vlan_clone_create(struct if_clone *ifc, int unit)
 	LIST_INSERT_HEAD(&ifv_list, ifv, ifv_list);
 	splx(s);
 
-	sprintf(ifp->if_xname, "%s%d", ifc->ifc_name, unit);
+	snprintf(ifp->if_xname, sizeof(ifp->if_xname), "%s%d", ifc->ifc_name,
+	    unit);
 	ifp->if_softc = ifv;
 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 	ifp->if_start = vlan_start;
diff --git a/sys/netatalk/at_rmx.c b/sys/netatalk/at_rmx.c
index 29c18c884cb8..e63920d44299 100644
--- a/sys/netatalk/at_rmx.c
+++ b/sys/netatalk/at_rmx.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: at_rmx.c,v 1.2 2001/11/13 00:00:58 lukem Exp $	*/
+/*	$NetBSD: at_rmx.c,v 1.3 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*
  * Copyright 1994, 1995 Massachusetts Institute of Technology
@@ -34,7 +34,7 @@
 /* This code generates debugging traces to the radix code */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: at_rmx.c,v 1.2 2001/11/13 00:00:58 lukem Exp $");
+__KERNEL_RCSID(0, "$NetBSD: at_rmx.c,v 1.3 2004/04/21 18:40:41 itojun Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -65,13 +65,13 @@ prsockaddr(void *v)
 
 		/* return: "(len) hexdump" */
 
-		bp += sprintf(bp, "(%d)", len);
+		bp += snprintf(bp, sizeof(hexbuf), "(%d)", len);
 		for (cp++; cp < cplim && bp < hexbuf + 252; cp++) {
 			*bp++ = "0123456789abcdef"[*cp / 16];
 			*bp++ = "0123456789abcdef"[*cp % 16];
 		}
 	} else {
-		bp += sprintf(bp, "null");
+		bp += snprintf(bp, sizeof(hexbuf), "null");
 	}
 	*bp = '\0';
 
diff --git a/sys/netccitt/pk_input.c b/sys/netccitt/pk_input.c
index 06100f2c2b8e..f8e45bb8303a 100644
--- a/sys/netccitt/pk_input.c
+++ b/sys/netccitt/pk_input.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pk_input.c,v 1.21 2004/04/18 19:11:39 matt Exp $	*/
+/*	$NetBSD: pk_input.c,v 1.22 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*
  * Copyright (c) 1991, 1992, 1993
@@ -78,7 +78,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: pk_input.c,v 1.21 2004/04/18 19:11:39 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pk_input.c,v 1.22 2004/04/21 18:40:41 itojun Exp $");
 
 #include "opt_hdlc.h"
 #include "opt_llc.h"
@@ -924,7 +924,8 @@ pk_from_bcd(a, iscalling, sa, xcp)
 	if (xcp->xc_addr.x25_net && (xcp->xc_nodnic || xcp->xc_prepnd0)) {
 		octet           dnicname[sizeof(long) * NBBY / 3 + 2];
 
-		sprintf((char *) dnicname, "%d", xcp->xc_addr.x25_net);
+		snprintf((char *) dnicname, sizeof(dnicname), "%d",
+		    xcp->xc_addr.x25_net);
 		prune_dnic((char *) buf, sa->x25_addr, dnicname, xcp);
 	} else
 		bcopy((caddr_t) buf, (caddr_t) sa->x25_addr, count + 1);
diff --git a/sys/netccitt/pk_subr.c b/sys/netccitt/pk_subr.c
index c59610071b0a..4916161ca393 100644
--- a/sys/netccitt/pk_subr.c
+++ b/sys/netccitt/pk_subr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pk_subr.c,v 1.26 2004/04/18 19:11:39 matt Exp $	*/
+/*	$NetBSD: pk_subr.c,v 1.27 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*
  * Copyright (c) 1991, 1992, 1993
@@ -78,7 +78,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: pk_subr.c,v 1.26 2004/04/18 19:11:39 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: pk_subr.c,v 1.27 2004/04/21 18:40:41 itojun Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -745,7 +745,8 @@ to_bcd(b, sa, xcp)
 		char            dnicname[sizeof(long) * NBBY / 3 + 2];
 		char  *p = dnicname;
 
-		sprintf(p, "%d", xcp->xc_addr.x25_net & 0x7fff);
+		snprintf(p, sizeof(dnicname), "%d",
+		    xcp->xc_addr.x25_net & 0x7fff);
 		for (; *p; p++)	/* *p == 0 means dnic matched */
 			if ((*p ^ *x++) & 0x0f)
 				break;
diff --git a/sys/netinet/in.c b/sys/netinet/in.c
index 75677080022c..79b4e28cfef7 100644
--- a/sys/netinet/in.c
+++ b/sys/netinet/in.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: in.c,v 1.93 2003/11/11 20:25:26 jonathan Exp $	*/
+/*	$NetBSD: in.c,v 1.94 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -98,7 +98,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: in.c,v 1.93 2003/11/11 20:25:26 jonathan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: in.c,v 1.94 2004/04/21 18:40:41 itojun Exp $");
 
 #include "opt_inet.h"
 #include "opt_inet_conf.h"
@@ -232,7 +232,7 @@ in_fmtaddr(addr)
 
 	addr.s_addr = ntohl(addr.s_addr);
 
-	sprintf(buf, "%d.%d.%d.%d",
+	snprintf(buf, sizeof(buf), "%d.%d.%d.%d",
 		(addr.s_addr >> 24) & 0xFF,
 		(addr.s_addr >> 16) & 0xFF,
 		(addr.s_addr >>  8) & 0xFF,
diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c
index eb98db22cba2..11dba29ed1bf 100644
--- a/sys/netinet/ip_mroute.c
+++ b/sys/netinet/ip_mroute.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ip_mroute.c,v 1.82 2003/11/19 18:39:34 jonathan Exp $	*/
+/*	$NetBSD: ip_mroute.c,v 1.83 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*
  * Copyright (c) 1992, 1993
@@ -86,7 +86,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.82 2003/11/19 18:39:34 jonathan Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_mroute.c,v 1.83 2004/04/21 18:40:41 itojun Exp $");
 
 #include "opt_inet.h"
 #include "opt_ipsec.h"
@@ -695,7 +695,8 @@ add_vif(m)
 		/* Create a fake encapsulation interface. */
 		ifp = (struct ifnet *)malloc(sizeof(*ifp), M_MRTABLE, M_WAITOK);
 		bzero(ifp, sizeof(*ifp));
-		sprintf(ifp->if_xname, "mdecap%d", vifcp->vifc_vifi);
+		snprintf(ifp->if_xname, sizeof(ifp->if_xname), "mdecap%d",
+		    vifcp->vifc_vifi);
 
 		/* Prepare cached route entry. */
 		bzero(&vifp->v_route, sizeof(vifp->v_route));
diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 14b67f9317c9..9fd1aee04818 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec.c,v 1.10 2004/03/02 02:24:02 thorpej Exp $	*/
+/*	$NetBSD: ipsec.c,v 1.11 2004/04/21 18:40:41 itojun Exp $	*/
 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $	*/
 /*	$KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $	*/
 
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.10 2004/03/02 02:24:02 thorpej Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.11 2004/04/21 18:40:41 itojun Exp $");
 
 /*
  * IPsec controller part.
@@ -2062,8 +2062,8 @@ inet_ntoa4(struct in_addr ina)
 	static int i = 3;
 
 	i = (i + 1) % 4;
-	sprintf(buf[i], "%d.%d.%d.%d", ucp[0] & 0xff, ucp[1] & 0xff,
-	    ucp[2] & 0xff, ucp[3] & 0xff);
+	snprintf(buf[i], sizeof(buf[i]), "%d.%d.%d.%d",
+	    ucp[0] & 0xff, ucp[1] & 0xff, ucp[2] & 0xff, ucp[3] & 0xff);
 	return (buf[i]);
 }
 
diff --git a/sys/netisdn/i4b_ipr.c b/sys/netisdn/i4b_ipr.c
index 6e1f4c8cb4b7..57945ec94388 100644
--- a/sys/netisdn/i4b_ipr.c
+++ b/sys/netisdn/i4b_ipr.c
@@ -27,7 +27,7 @@
  *	i4b_ipr.c - isdn4bsd IP over raw HDLC ISDN network driver
  *	---------------------------------------------------------
  *
- *	$Id: i4b_ipr.c,v 1.15 2003/04/11 14:45:29 drochner Exp $
+ *	$Id: i4b_ipr.c,v 1.16 2004/04/21 18:40:41 itojun Exp $
  *
  * $FreeBSD$
  *
@@ -59,7 +59,7 @@
  *---------------------------------------------------------------------------*/ 
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i4b_ipr.c,v 1.15 2003/04/11 14:45:29 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i4b_ipr.c,v 1.16 2004/04/21 18:40:41 itojun Exp $");
 
 #include "irip.h"
 #include "opt_irip.h"
@@ -320,7 +320,8 @@ iripattach()
 		sc->sc_if.if_name = "irip";
 		sc->sc_if.if_unit = i;
 #else
-		sprintf(sc->sc_if.if_xname, "irip%d", i);
+		snprintf(sc->sc_if.if_xname, sizeof(sc->sc_if.if_xname),
+		    "irip%d", i);
 		sc->sc_if.if_softc = sc;
 #endif
 
diff --git a/sys/netisdn/i4b_isppp.c b/sys/netisdn/i4b_isppp.c
index 81c8fb7acae1..8df7cde0391a 100644
--- a/sys/netisdn/i4b_isppp.c
+++ b/sys/netisdn/i4b_isppp.c
@@ -34,7 +34,7 @@
  *	the "cx" driver for Cronyx's HDLC-in-hardware device).  This driver
  *	is only the glue between sppp and i4b.
  *
- *	$Id: i4b_isppp.c,v 1.16 2003/08/12 19:49:27 martin Exp $
+ *	$Id: i4b_isppp.c,v 1.17 2004/04/21 18:40:41 itojun Exp $
  *
  * $FreeBSD$
  *
@@ -43,7 +43,7 @@
  *---------------------------------------------------------------------------*/
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: i4b_isppp.c,v 1.16 2003/08/12 19:49:27 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: i4b_isppp.c,v 1.17 2004/04/21 18:40:41 itojun Exp $");
 
 #ifndef __NetBSD__
 #define USE_ISPPP
@@ -271,7 +271,8 @@ ipppattach()
 #endif
 		sc->sc_sp.pp_if.if_unit = i;
 #else
-		sprintf(sc->sc_sp.pp_if.if_xname, "ippp%d", i);
+		snprintf(sc->sc_sp.pp_if.if_xname,
+		    sizeof(sc->sc_sp.pp_if.if_xname), "ippp%d", i);
 		sc->sc_unit = i;
 #endif
 
diff --git a/sys/netiso/clnp_debug.c b/sys/netiso/clnp_debug.c
index bcbb377a0d83..f616ce3a2d93 100644
--- a/sys/netiso/clnp_debug.c
+++ b/sys/netiso/clnp_debug.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: clnp_debug.c,v 1.13 2004/04/19 05:16:45 matt Exp $	*/
+/*	$NetBSD: clnp_debug.c,v 1.14 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*-
  * Copyright (c) 1991, 1993
@@ -59,7 +59,7 @@ SOFTWARE.
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: clnp_debug.c,v 1.13 2004/04/19 05:16:45 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: clnp_debug.c,v 1.14 2004/04/21 18:40:41 itojun Exp $");
 
 #include <sys/param.h>
 #include <sys/mbuf.h>
@@ -174,7 +174,7 @@ clnp_iso_addrp(struct iso_addr *isoa)
 #endif
 
 	/* print length */
-	sprintf(iso_addr_b, "[%d] ", isoa->isoa_len);
+	snprintf(iso_addr_b, sizeof(iso_addr_b), "[%d] ", isoa->isoa_len);
 
 	/* set cp to end of what we have */
 	cp = iso_addr_b;
diff --git a/sys/netiso/if_eon.c b/sys/netiso/if_eon.c
index 0982f36e3308..1bf806c93378 100644
--- a/sys/netiso/if_eon.c
+++ b/sys/netiso/if_eon.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: if_eon.c,v 1.44 2004/04/21 04:17:29 matt Exp $	*/
+/*	$NetBSD: if_eon.c,v 1.45 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*-
  * Copyright (c) 1991, 1993
@@ -67,7 +67,7 @@ SOFTWARE.
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_eon.c,v 1.44 2004/04/21 04:17:29 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_eon.c,v 1.45 2004/04/21 18:40:41 itojun Exp $");
 
 #include "opt_eon.h"
 
@@ -147,7 +147,7 @@ eonattach(void)
 		printf("eonattach()\n");
 	}
 #endif
-	sprintf(ifp->if_xname, "eon%d", 0);
+	snprintf(ifp->if_xname, sizeof(ifp->if_xname), "eon%d", 0);
 	ifp->if_mtu = ETHERMTU;
 	ifp->if_softc = NULL;
 	/* since everything will go out over ether or token ring */
diff --git a/sys/netnatm/natm.c b/sys/netnatm/natm.c
index db58571908f6..a4a66e0f52c0 100644
--- a/sys/netnatm/natm.c
+++ b/sys/netnatm/natm.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: natm.c,v 1.9 2003/06/29 22:32:07 fvdl Exp $	*/
+/*	$NetBSD: natm.c,v 1.10 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*
  *
@@ -37,7 +37,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: natm.c,v 1.9 2003/06/29 22:32:07 fvdl Exp $");
+__KERNEL_RCSID(0, "$NetBSD: natm.c,v 1.10 2004/04/21 18:40:41 itojun Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -276,8 +276,8 @@ struct proc *p;
 #if defined(__NetBSD__) || defined(__OpenBSD__)
       bcopy(npcb->npcb_ifp->if_xname, snatm->snatm_if, sizeof(snatm->snatm_if));
 #elif defined(__FreeBSD__)
-      sprintf(snatm->snatm_if, "%s%d", npcb->npcb_ifp->if_name,
-	npcb->npcb_ifp->if_unit);
+      snprintf(snatm->snatm_if, sizeof(snatm->snatm_if), "%s%d",
+          npcb->npcb_ifp->if_name, npcb->npcb_ifp->if_unit);
 #endif
       snatm->snatm_vci = npcb->npcb_vci;
       snatm->snatm_vpi = npcb->npcb_vpi;
diff --git a/sys/netns/ns_ip.c b/sys/netns/ns_ip.c
index 7f7c00c6ddae..1192f250fced 100644
--- a/sys/netns/ns_ip.c
+++ b/sys/netns/ns_ip.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ns_ip.c,v 1.38 2004/04/19 00:10:48 matt Exp $	*/
+/*	$NetBSD: ns_ip.c,v 1.39 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*
  * Copyright (c) 1984, 1985, 1986, 1987, 1993
@@ -36,7 +36,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ns_ip.c,v 1.38 2004/04/19 00:10:48 matt Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ns_ip.c,v 1.39 2004/04/21 18:40:41 itojun Exp $");
 
 #include "opt_ns.h"		/* options NSIP, needed by ns_if.h */
 
@@ -97,7 +97,8 @@ nsipattach(void)
 
 	if (nsipif.if_mtu == 0) {
 		ifp = &nsipif;
-		sprintf(ifp->if_xname, "nsip%d", nsipif_unit);
+		snprintf(ifp->if_xname, sizeof(ifp->if_xname), "nsip%d",
+		    nsipif_unit);
 		ifp->if_mtu = LOMTU;
 		ifp->if_ioctl = nsipioctl;
 		ifp->if_output = nsipoutput;
@@ -111,7 +112,7 @@ nsipattach(void)
 	nsip_list = m;
 	ifp = &m->ifen_ifnet;
 
-	sprintf(ifp->if_xname, "nsip%d", nsipif_unit++);
+	snprintf(ifp->if_xname, sizeof(ifp->if_xname), "nsip%d", nsipif_unit++);
 	ifp->if_mtu = LOMTU;
 	ifp->if_ioctl = nsipioctl;
 	ifp->if_output = nsipoutput;
@@ -125,7 +126,8 @@ nsipattach(void)
 	 * XXX in the days before if_xname.
 	 */
 	bzero(nsipif.if_xname, sizeof(nsipif.if_xname));
-	sprintf(nsipif.if_xname, "nsip%d", nsipif_unit);
+	snprintf(nsipif.if_xname, sizeof(nsipif.if_xname), "nsip%d",
+	    nsipif_unit);
 
 	return (m);
 }
@@ -397,7 +399,7 @@ nsip_route(struct mbuf *m)
 	 * now configure this as a point to point link
 	 */
 	bzero(ifr.ifr_name, sizeof(ifr.ifr_name));
-	sprintf(ifr.ifr_name, "nsip%d", nsipif_unit - 1);
+	snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "nsip%d", nsipif_unit - 1);
 	ifr.ifr_dstaddr = *snstosa(ns_dst);
 	(void)ns_control((struct socket *)0, SIOCSIFDSTADDR, (caddr_t)&ifr,
 	    (struct ifnet *)ifn, NULL);
diff --git a/sys/nfs/nfs_bootdhcp.c b/sys/nfs/nfs_bootdhcp.c
index 7be0a8e72fb9..d6667d1b3349 100644
--- a/sys/nfs/nfs_bootdhcp.c
+++ b/sys/nfs/nfs_bootdhcp.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: nfs_bootdhcp.c,v 1.24 2003/06/29 22:32:14 fvdl Exp $	*/
+/*	$NetBSD: nfs_bootdhcp.c,v 1.25 2004/04/21 18:40:41 itojun Exp $	*/
 
 /*-
  * Copyright (c) 1995, 1997 The NetBSD Foundation, Inc.
@@ -51,7 +51,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: nfs_bootdhcp.c,v 1.24 2003/06/29 22:32:14 fvdl Exp $");
+__KERNEL_RCSID(0, "$NetBSD: nfs_bootdhcp.c,v 1.25 2004/04/21 18:40:41 itojun Exp $");
 
 #include "opt_nfs_boot.h"
 
@@ -584,7 +584,8 @@ bootpc_call(nd, procp)
 	/*
 	 * Insert a NetBSD Vendor Class Identifier option.
 	 */
-	sprintf(vci, "%s:%s:kernel:%s", ostype, MACHINE, osrelease);
+	snprintf(vci, sizeof(vci), "%s:%s:kernel:%s", ostype, MACHINE,
+	    osrelease);
 	vcilen = strlen(vci);
 	bootp->bp_vend[7] = TAG_CLASSID;
 	bootp->bp_vend[8] = vcilen;
@@ -627,7 +628,8 @@ bootpc_call(nd, procp)
 		/*
 		 * Insert a NetBSD Vendor Class Identifier option.
 		 */
-		sprintf(vci, "%s:%s:kernel:%s", ostype, MACHINE, osrelease);
+		snprintf(vci, sizeof(vci), "%s:%s:kernel:%s", ostype, MACHINE,
+		    osrelease);
 		vcilen = strlen(vci);
 		bootp->bp_vend[25] = TAG_CLASSID;
 		bootp->bp_vend[26] = vcilen;