diff --git a/external/bsd/dhcpcd/dist/hooks/dhcpcd-run-hooks.8.in b/external/bsd/dhcpcd/dist/hooks/dhcpcd-run-hooks.8.in
index 499157679e7a..9b5483a4204d 100644
--- a/external/bsd/dhcpcd/dist/hooks/dhcpcd-run-hooks.8.in
+++ b/external/bsd/dhcpcd/dist/hooks/dhcpcd-run-hooks.8.in
@@ -22,7 +22,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd May 24, 2020
+.Dd December 27, 2020
 .Dt DHCPCD-RUN-HOOKS 8
 .Os
 .Sh NAME
@@ -92,6 +92,9 @@ This is generally just a notification and no action need be taken.
 .It Dv NOCARRIER
 dhcpcd lost the carrier.
 The cable may have been unplugged or association to the wireless point lost.
+.It Dv NOCARRIER_ROAMING
+dhcpcd lost the carrier but the interface configuration is persisted.
+The OS has to support wireless roaming or IP Persistance for this to happen.
 .It Dv INFORM | Dv INFORM6
 dhcpcd informed a DHCP server about its address and obtained other
 configuration details.
@@ -147,10 +150,6 @@ will clear the environment variables aside from
 The following variables will then be set, along with any protocol supplied
 ones.
 .Bl -tag -width xnew_delegated_dhcp6_prefix
-.It Ev $chroot
-the directory where
-.Nm dhcpcd
-is chrooted.
 .It Ev $interface
 the name of the interface.
 .It Ev $protocol
@@ -193,12 +192,14 @@ if the
 .Ev interface
 is up, otherwise
 .Dv false .
+This is more than IFF_UP and may not be equal.
 .It Ev $if_down
 .Dv true
 if the
 .Ev interface
 is down, otherwise
 .Dv false .
+This is more than IFF_UP and may not be equal.
 .It Ev $af_waiting
 Address family waiting for, as defined in
 .Xr dhcpcd.conf 5 .
diff --git a/external/bsd/dhcpcd/dist/src/defs.h b/external/bsd/dhcpcd/dist/src/defs.h
index 26619e0080da..39f14a87d771 100644
--- a/external/bsd/dhcpcd/dist/src/defs.h
+++ b/external/bsd/dhcpcd/dist/src/defs.h
@@ -29,7 +29,7 @@
 #define CONFIG_H
 
 #define PACKAGE			"dhcpcd"
-#define VERSION			"9.3.4"
+#define VERSION			"9.4.0"
 
 #ifndef PRIVSEP_USER
 # define PRIVSEP_USER		"_" PACKAGE
diff --git a/external/bsd/dhcpcd/dist/src/dhcpcd.conf.5.in b/external/bsd/dhcpcd/dist/src/dhcpcd.conf.5.in
index 2afb23c0b140..fb89580dad5e 100644
--- a/external/bsd/dhcpcd/dist/src/dhcpcd.conf.5.in
+++ b/external/bsd/dhcpcd/dist/src/dhcpcd.conf.5.in
@@ -24,7 +24,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd November 25, 2020
+.Dd December 27, 2020
 .Dt DHCPCD.CONF 5
 .Os
 .Sh NAME
@@ -61,9 +61,7 @@ which is a space or comma separated list of patterns passed to
 .Xr fnmatch 3 .
 .It Ic anonymous
 Enables Anonymity Profiles for DHCP, RFC 7844.
-This implementation forces a hardware address randomisaton when
-the interface link is down and that ClientID's are only LL.
-Any DUID is ignored.
+Any DUID is ignored and ClientID is set to LL only.
 All non essential options are then masked at this point,
 but they could be unmasked by explicitly requesting the option
 .Sy after
@@ -79,6 +77,10 @@ send something which could identify you.
 .Nm dhcpcd
 will not try and reboot an old lease, it will go straight into
 DISCOVER/SOLICIT.
+.It Ic randomise_hwaddr
+Forces a hardware address randomisation when the interface is brought up
+or when the carrier is lost.
+This is generally used in tandem with the anonymous option.
 .It Ic arping Ar address Op address
 .Nm dhcpcd
 will arping each address in order before attempting DHCP.
diff --git a/external/bsd/dhcpcd/dist/src/if-options.h b/external/bsd/dhcpcd/dist/src/if-options.h
index 689d9344ba9e..e4e39e2820a6 100644
--- a/external/bsd/dhcpcd/dist/src/if-options.h
+++ b/external/bsd/dhcpcd/dist/src/if-options.h
@@ -182,6 +182,7 @@
 #define O_MSUSERCLASS		O_BASE + 49
 #define O_CONFIGURE		O_BASE + 50
 #define O_NOCONFIGURE		O_BASE + 51
+#define O_RANDOMISE_HWADDR	O_BASE + 52
 
 extern const struct option cf_options[];
 
@@ -234,6 +235,7 @@ struct if_options {
 	uint32_t timeout;
 	uint32_t reboot;
 	unsigned long long options;
+	bool randomise_hwaddr;
 
 	struct in_addr req_addr;
 	struct in_addr req_mask;
diff --git a/external/bsd/dhcpcd/dist/src/if.c b/external/bsd/dhcpcd/dist/src/if.c
index deb5280b3414..d3852f3dc68e 100644
--- a/external/bsd/dhcpcd/dist/src/if.c
+++ b/external/bsd/dhcpcd/dist/src/if.c
@@ -697,12 +697,11 @@ if_discover(struct dhcpcd_ctx *ctx, struct ifaddrs **ifaddrs,
 			ifp->metric = (unsigned int)ifr.ifr_metric;
 		if_getssid(ifp);
 #else
-		/* We reserve the 100 range for virtual interfaces, if and when
-		 * we can work them out. */
-		ifp->metric = 200 + ifp->index;
+		/* Leave a low portion for user config */
+		ifp->metric = RTMETRIC_BASE + ifp->index;
 		if (if_getssid(ifp) != -1) {
 			ifp->wireless = true;
-			ifp->metric += 100;
+			ifp->metric += RTMETRIC_WIRELESS;
 		}
 #endif
 
diff --git a/external/bsd/dhcpcd/dist/src/if.h b/external/bsd/dhcpcd/dist/src/if.h
index 8474deb70d71..43d133075d23 100644
--- a/external/bsd/dhcpcd/dist/src/if.h
+++ b/external/bsd/dhcpcd/dist/src/if.h
@@ -42,14 +42,6 @@
  * dhcpcd can poll it for the relevant flags periodically */
 #define IF_POLL_UP	100	/* milliseconds */
 
-/* Some systems have in-built IPv4 DAD.
- * However, we need them to do DAD at carrier up as well. */
-#ifdef IN_IFF_TENTATIVE
-#  ifdef __NetBSD__
-#    define NOCARRIER_PRESERVE_IP
-#  endif
-#endif
-
 /*
  * Systems which handle 1 address per alias.
  * Currenly this is just Solaris.
@@ -161,6 +153,7 @@ int if_domtu(const struct interface *, short int);
 #define if_getmtu(ifp) if_domtu((ifp), 0)
 #define if_setmtu(ifp, mtu) if_domtu((ifp), (mtu))
 int if_carrier(struct interface *, const void *);
+bool if_roaming(struct interface *);
 
 #ifdef ALIAS_ADDR
 int if_makealias(char *, size_t, const char *, int);
diff --git a/external/bsd/dhcpcd/dist/src/ipv4ll.c b/external/bsd/dhcpcd/dist/src/ipv4ll.c
index 93898109f7ab..6f9cd73d5cf8 100644
--- a/external/bsd/dhcpcd/dist/src/ipv4ll.c
+++ b/external/bsd/dhcpcd/dist/src/ipv4ll.c
@@ -137,7 +137,7 @@ ipv4ll_defaultroute(rb_tree_t *routes, struct interface *ifp)
 	sa_in_init(&rt->rt_ifa, &state->addr->addr);
 	rt->rt_dflags |= RTDF_IPV4LL;
 #ifdef HAVE_ROUTE_METRIC
-	rt->rt_metric += 10000;
+	rt->rt_metric += RTMETRIC_IPV4LL;
 #endif
 	return rt_proto_add(routes, rt) ? 1 : 0;
 }
diff --git a/external/bsd/dhcpcd/dist/src/privsep-bpf.c b/external/bsd/dhcpcd/dist/src/privsep-bpf.c
index 23da9a074f25..79c4696d38c2 100644
--- a/external/bsd/dhcpcd/dist/src/privsep-bpf.c
+++ b/external/bsd/dhcpcd/dist/src/privsep-bpf.c
@@ -73,7 +73,8 @@ ps_bpf_recvbpf(void *arg)
 		if (len == -1) {
 			int error = errno;
 
-			logerr("%s: %s", psp->psp_ifname, __func__);
+			if (errno != ENETDOWN)
+				logerr("%s: %s", psp->psp_ifname, __func__);
 			if (error != ENXIO)
 				break;
 			/* If the interface has departed, close the BPF
diff --git a/external/bsd/dhcpcd/dist/src/route.c b/external/bsd/dhcpcd/dist/src/route.c
index 47fd6cf2a33d..71523c146a86 100644
--- a/external/bsd/dhcpcd/dist/src/route.c
+++ b/external/bsd/dhcpcd/dist/src/route.c
@@ -168,6 +168,15 @@ rt_compare_proto(void *context, const void *node1, const void *node2)
 	if (c != 0)
 		return -c;
 
+	/* Prefer roaming over non roaming if both carriers are down. */
+	if (ifp1->carrier == LINK_DOWN && ifp2->carrier == LINK_DOWN) {
+		bool roam1 = if_roaming(ifp1);
+		bool roam2 = if_roaming(ifp2);
+
+		if (roam1 != roam2)
+			return roam1 ? 1 : -1;
+	}
+
 #ifdef INET
 	/* IPv4LL routes always come last */
 	if (rt1->rt_dflags & RTDF_IPV4LL && !(rt2->rt_dflags & RTDF_IPV4LL))
@@ -374,6 +383,8 @@ rt_setif(struct rt *rt, struct interface *ifp)
 	rt->rt_ifp = ifp;
 #ifdef HAVE_ROUTE_METRIC
 	rt->rt_metric = ifp->metric;
+	if (if_roaming(ifp))
+		rt->rt_metric += RTMETRIC_ROAM;
 #endif
 }
 
diff --git a/external/bsd/dhcpcd/dist/src/route.h b/external/bsd/dhcpcd/dist/src/route.h
index e9ac121af3d2..cb935c83bdfd 100644
--- a/external/bsd/dhcpcd/dist/src/route.h
+++ b/external/bsd/dhcpcd/dist/src/route.h
@@ -93,6 +93,15 @@ struct rt {
 #ifdef HAVE_ROUTE_METRIC
 	unsigned int		rt_metric;
 #endif
+/* Maximum interface index is generally USHORT_MAX or 65535.
+ * Add some padding for other stuff and we get offsets for the
+ * below that should work automatically.
+ * This is only an issue if the user defines higher metrics in
+ * their configuration, but then they might wish to override also. */
+#define	RTMETRIC_BASE		   1000U
+#define	RTMETRIC_WIRELESS	   2000U
+#define	RTMETRIC_IPV4LL		1000000U
+#define	RTMETRIC_ROAM		2000000U
 #ifdef HAVE_ROUTE_PREF
 	int			rt_pref;
 #endif