Use arc4 to bit-spread the 512-byte random buffer over the .openbsd.randomdata

section, which has grown a fair bit with the introduction of retguard.
Mortimer discovered the repeated 512-byte sequence as retguard keys, and
this resolves the issue.  (Chacha does not fit on the media, so 1.5K early
drop RC4 is hopefully sufficient in our KARL link universe)
Version crank the bootblocks. sysupgrade -s will install new bootblocks.
ok djm mortimer

44 files changed, 117 insertions, 92 deletions

diff --git a/sys/arch/alpha/stand/boot/Makefile b/sys/arch/alpha/stand/boot/Makefile
index 3f61ed44139..16d551dc373 100644
--- a/sys/arch/alpha/stand/boot/Makefile
+++ b/sys/arch/alpha/stand/boot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.23 2017/07/25 13:32:14 robert Exp $
+#	$OpenBSD: Makefile,v 1.24 2019/10/29 02:55:50 deraadt Exp $
 #	$NetBSD: Makefile,v 1.17 1997/04/17 07:27:46 thorpej Exp $
 
 S=	${.CURDIR}/../../../..
@@ -22,7 +22,7 @@ SRCS+=	__divlu.S __remqu.S __reml.S strlen.c bzero.c __divl.S __divqu.S \
 	__remlu.S
 
 .PATH:	${S}/lib/libkern/arch/alpha ${S}/lib/libsa
-SRCS+=	loadfile.c
+SRCS+=	loadfile.c arc4.c
 
 DEFNS= -DCOMPAT_UFS
 
diff --git a/sys/arch/alpha/stand/boot/boot.c b/sys/arch/alpha/stand/boot/boot.c
index b379f765102..b0ed0b70b09 100644
--- a/sys/arch/alpha/stand/boot/boot.c
+++ b/sys/arch/alpha/stand/boot/boot.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: boot.c,v 1.24 2019/04/10 04:17:31 deraadt Exp $	*/
+/*	$OpenBSD: boot.c,v 1.25 2019/10/29 02:55:50 deraadt Exp $	*/
 /*	$NetBSD: boot.c,v 1.10 1997/01/18 01:58:33 cgd Exp $	*/
 
 /*
@@ -38,6 +38,7 @@
 #include <lib/libkern/libkern.h>
 #include <lib/libsa/stand.h>
 #include <lib/libsa/loadfile.h>
+#include <lib/libsa/arc4.h>
 
 #include <sys/param.h>
 #include <sys/exec.h>
@@ -62,6 +63,7 @@ paddr_t ptbr_save;
 int debug;
 
 char   rnddata[BOOTRANDOM_MAX];
+struct rc4_ctx randomctx;
 
 void
 loadrandom(char *name, char *buf, size_t buflen)
@@ -119,6 +121,8 @@ main()
 #endif
 
 	loadrandom(BOOTRANDOM, rnddata, sizeof(rnddata));
+	rc4_keysetup(&randomctx, rnddata, sizeof rnddata);
+	rc4_skip(&randomctx, 1536);
 
 	prom_getenv(PROM_E_BOOTED_FILE, boot_file, sizeof(boot_file));
 	prom_getenv(PROM_E_BOOTED_OSFLAGS, boot_flags, sizeof(boot_flags));
diff --git a/sys/arch/alpha/stand/netboot/Makefile b/sys/arch/alpha/stand/netboot/Makefile
index a178b9b465e..766ed70d960 100644
--- a/sys/arch/alpha/stand/netboot/Makefile
+++ b/sys/arch/alpha/stand/netboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.16 2019/02/24 12:57:14 kn Exp $
+#	$OpenBSD: Makefile,v 1.17 2019/10/29 02:55:50 deraadt Exp $
 #	$NetBSD: Makefile,v 1.11 1997/04/17 07:27:50 thorpej Exp $
 
 S=	${.CURDIR}/../../../..
@@ -21,10 +21,10 @@ BOOT_RELOC = ${PRIMARY_LOAD_ADDRESS}
 CLEANFILES+= vers.c vers.o ${PROG}.sym ${PROG}.nosym
 
 .PATH:  ${S}/lib/libkern/arch/alpha ${S}/lib/libkern
-SRCS+=  bzero.c __divqu.S strlen.c __remqu.S
+SRCS+=  bzero.c __divqu.S strlen.c __remqu.S __remlu.S
 
 .PATH:	${S}/lib/libkern/arch/alpha ${S}/lib/libsa
-SRCS+=	loadfile.c
+SRCS+=	loadfile.c arc4.c
 
 DEFNS= -DPRIMARY_BOOTBLOCK -DSUN_BOOTPARAMS
 
diff --git a/sys/arch/amd64/stand/boot/Makefile b/sys/arch/amd64/stand/boot/Makefile
index b2b6d03abb8..5ff7d85b3ec 100644
--- a/sys/arch/amd64/stand/boot/Makefile
+++ b/sys/arch/amd64/stand/boot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.42 2019/08/03 15:22:19 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.43 2019/10/29 02:55:50 deraadt Exp $
 
 COPTS?=
 MAN?=	boot.8
@@ -37,7 +37,7 @@ SRCS+=	alloc.c ctime.c exit.c getchar.c memcmp.c memcpy.c memmove.c memset.c pri
 	strtol.c strtoll.c
 SRCS+=	close.c closeall.c cons.c cread.c dev.c disklabel.c dkcksum.c fchmod.c \
 	fstat.c lseek.c open.c read.c readdir.c stat.c
-SRCS+=	elf32.c elf64.c loadfile.c
+SRCS+=	elf32.c elf64.c loadfile.c arc4.c
 SRCS+=	ufs.c
 .if ${SOFTRAID:L} == "yes"
 SRCS+=	aes_xts.c bcrypt_pbkdf.c blowfish.c explicit_bzero.c hmac_sha1.c \
diff --git a/sys/arch/amd64/stand/boot/conf.c b/sys/arch/amd64/stand/boot/conf.c
index bb801317c5a..26c4a468279 100644
--- a/sys/arch/amd64/stand/boot/conf.c
+++ b/sys/arch/amd64/stand/boot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.48 2019/08/03 15:22:19 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.49 2019/10/29 02:55:50 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -40,7 +40,7 @@
 #include <biosdev.h>
 #include <dev/cons.h>
 
-const char version[] = "3.45";
+const char version[] = "3.46";
 int	debug = 1;
 
 
diff --git a/sys/arch/amd64/stand/cdboot/Makefile b/sys/arch/amd64/stand/cdboot/Makefile
index eea6875dd0a..30ce768a9c2 100644
--- a/sys/arch/amd64/stand/cdboot/Makefile
+++ b/sys/arch/amd64/stand/cdboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.37 2019/08/03 15:22:19 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.38 2019/10/29 02:55:50 deraadt Exp $
 
 MAN=	cdboot.8
 
@@ -29,8 +29,8 @@ SRCS+=	alloc.c exit.c getchar.c putchar.c strcmp.c strlen.c \
 	strncmp.c memcmp.c memcpy.c memmove.c memset.c printf.c snprintf.c \
 	strerror.c strncpy.c strtol.c strtoll.c ctime.c strlcpy.c
 SRCS+=	close.c closeall.c dev.c disklabel.c dkcksum.c fchmod.c fstat.c \
-	lseek.c open.c read.c stat.c cread.c readdir.c cons.c loadfile.c \
-	elf32.c elf64.c
+	lseek.c open.c read.c stat.c cread.c readdir.c cons.c \
+	loadfile.c arc4.c elf32.c elf64.c
 SRCS+=	ufs.c cd9660.c
 SRCS+=	aes_xts.c bcrypt_pbkdf.c blowfish.c explicit_bzero.c hmac_sha1.c \
 	pkcs5_pbkdf2.c rijndael.c sha1.c sha2.c softraid.c
diff --git a/sys/arch/amd64/stand/cdboot/conf.c b/sys/arch/amd64/stand/cdboot/conf.c
index 30926a9042c..a21db360b53 100644
--- a/sys/arch/amd64/stand/cdboot/conf.c
+++ b/sys/arch/amd64/stand/cdboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.42 2019/08/04 13:45:14 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.43 2019/10/29 02:55:50 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2004 Tom Cosgrove
@@ -41,7 +41,7 @@
 #include <biosdev.h>
 #include <dev/cons.h>
 
-const char version[] = "3.44";
+const char version[] = "3.45";
 int	debug = 1;
 
 
diff --git a/sys/arch/amd64/stand/efi32/Makefile.common b/sys/arch/amd64/stand/efi32/Makefile.common
index d8b7e795ade..a90d404eae9 100644
--- a/sys/arch/amd64/stand/efi32/Makefile.common
+++ b/sys/arch/amd64/stand/efi32/Makefile.common
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile.common,v 1.2 2019/08/03 15:22:19 deraadt Exp $
+#	$OpenBSD: Makefile.common,v 1.3 2019/10/29 02:55:50 deraadt Exp $
 
 S=		${.CURDIR}/../../../../..
 SADIR=		${.CURDIR}/../..
@@ -51,7 +51,7 @@ SRCS+=	divdi3.c moddi3.c qdivrem.c
 SRCS+=	strlcpy.c
 
 .PATH:	${SADIR}/libsa
-SRCS+=	loadfile.c elf64.c elf32.c
+SRCS+=	loadfile.c arc4.c elf64.c elf32.c
 
 .if ${SOFTRAID:L} == "yes"
 SRCS+=	softraid_amd64.c
diff --git a/sys/arch/amd64/stand/efi32/conf.c b/sys/arch/amd64/stand/efi32/conf.c
index e8e52605587..a65accb8030 100644
--- a/sys/arch/amd64/stand/efi32/conf.c
+++ b/sys/arch/amd64/stand/efi32/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.5 2019/08/13 09:00:20 patrick Exp $	*/
+/*	$OpenBSD: conf.c,v 1.6 2019/10/29 02:55:50 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -39,7 +39,7 @@
 #include "efidev.h"
 #include "efipxe.h"
 
-const char version[] = "3.46";
+const char version[] = "3.47";
 
 #ifdef EFI_DEBUG
 int	debug = 0;
diff --git a/sys/arch/amd64/stand/efi64/Makefile.common b/sys/arch/amd64/stand/efi64/Makefile.common
index 64052ba2b20..a90d404eae9 100644
--- a/sys/arch/amd64/stand/efi64/Makefile.common
+++ b/sys/arch/amd64/stand/efi64/Makefile.common
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile.common,v 1.2 2019/08/03 15:22:20 deraadt Exp $
+#	$OpenBSD: Makefile.common,v 1.3 2019/10/29 02:55:50 deraadt Exp $
 
 S=		${.CURDIR}/../../../../..
 SADIR=		${.CURDIR}/../..
@@ -51,7 +51,7 @@ SRCS+=	divdi3.c moddi3.c qdivrem.c
 SRCS+=	strlcpy.c
 
 .PATH:	${SADIR}/libsa
-SRCS+=	loadfile.c elf64.c elf32.c
+SRCS+=	loadfile.c arc4.c elf64.c elf32.c
 
 .if ${SOFTRAID:L} == "yes"
 SRCS+=	softraid_amd64.c
diff --git a/sys/arch/amd64/stand/efi64/conf.c b/sys/arch/amd64/stand/efi64/conf.c
index 7e04209e118..27d5bb833ca 100644
--- a/sys/arch/amd64/stand/efi64/conf.c
+++ b/sys/arch/amd64/stand/efi64/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.4 2019/08/13 09:00:20 patrick Exp $	*/
+/*	$OpenBSD: conf.c,v 1.5 2019/10/29 02:55:50 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -39,7 +39,7 @@
 #include "efidev.h"
 #include "efipxe.h"
 
-const char version[] = "3.46";
+const char version[] = "3.47";
 
 #ifdef EFI_DEBUG
 int	debug = 0;
diff --git a/sys/arch/amd64/stand/efiboot/Makefile.common b/sys/arch/amd64/stand/efiboot/Makefile.common
index b45c3f6b2db..de6b0cf7175 100644
--- a/sys/arch/amd64/stand/efiboot/Makefile.common
+++ b/sys/arch/amd64/stand/efiboot/Makefile.common
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile.common,v 1.17 2019/08/03 15:22:20 deraadt Exp $
+#	$OpenBSD: Makefile.common,v 1.18 2019/10/29 02:55:51 deraadt Exp $
 
 S=		${.CURDIR}/../../../../..
 SADIR=		${.CURDIR}/../..
@@ -51,7 +51,7 @@ SRCS+=	divdi3.c moddi3.c qdivrem.c
 SRCS+=	strlcpy.c
 
 .PATH:	${SADIR}/libsa
-SRCS+=	loadfile.c elf64.c elf32.c
+SRCS+=	loadfile.c arc4.c elf64.c elf32.c
 
 .if ${SOFTRAID:L} == "yes"
 SRCS+=	softraid_amd64.c
diff --git a/sys/arch/amd64/stand/efiboot/conf.c b/sys/arch/amd64/stand/efiboot/conf.c
index 2a1eadc49f0..3da9127caf0 100644
--- a/sys/arch/amd64/stand/efiboot/conf.c
+++ b/sys/arch/amd64/stand/efiboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.23 2019/08/13 09:00:20 patrick Exp $	*/
+/*	$OpenBSD: conf.c,v 1.24 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -39,7 +39,7 @@
 #include "efidev.h"
 #include "efipxe.h"
 
-const char version[] = "3.46";
+const char version[] = "3.47";
 
 #ifdef EFI_DEBUG
 int	debug = 0;
diff --git a/sys/arch/amd64/stand/pxeboot/Makefile b/sys/arch/amd64/stand/pxeboot/Makefile
index aba27c94e2f..d61ad0676e4 100644
--- a/sys/arch/amd64/stand/pxeboot/Makefile
+++ b/sys/arch/amd64/stand/pxeboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.35 2019/08/03 15:22:20 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.36 2019/10/29 02:55:51 deraadt Exp $
 
 MAN=	pxeboot.8
 
@@ -36,7 +36,7 @@ SRCS+=	aes_xts.c bcrypt_pbkdf.c blowfish.c explicit_bzero.c hmac_sha1.c \
 
 SRCS+=	close.c closeall.c dev.c disklabel.c dkcksum.c fchmod.c fstat.c \
 	ioctl.c lseek.c read.c stat.c write.c cread.c readdir.c cons.c \
-	loadfile.c elf32.c elf64.c
+	loadfile.c arc4.c elf32.c elf64.c
 SRCS+=	ether.c net.c netif.c rpc.c
 SRCS+=	bootp.c bootparam.c
 SRCS+=	ufs.c nfs.c tftp.c
diff --git a/sys/arch/amd64/stand/pxeboot/conf.c b/sys/arch/amd64/stand/pxeboot/conf.c
index a5ad50f428c..1b84eae06fe 100644
--- a/sys/arch/amd64/stand/pxeboot/conf.c
+++ b/sys/arch/amd64/stand/pxeboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.46 2019/08/04 13:45:14 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.47 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2004 Tom Cosgrove
@@ -43,7 +43,7 @@
 #include "pxeboot.h"
 #include "pxe_net.h"
 
-const char version[] = "3.44";
+const char version[] = "3.45";
 int	debug = 0;
 
 void (*sa_cleanup)(void) = pxe_shutdown;
diff --git a/sys/arch/arm64/stand/efiboot/Makefile b/sys/arch/arm64/stand/efiboot/Makefile
index a7b00e48e18..9594d741f73 100644
--- a/sys/arch/arm64/stand/efiboot/Makefile
+++ b/sys/arch/arm64/stand/efiboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.9 2019/08/12 19:17:35 kettenis Exp $
+#	$OpenBSD: Makefile,v 1.10 2019/10/29 02:55:51 deraadt Exp $
 
 NOMAN=		#
 
@@ -29,7 +29,7 @@ SRCS+=	alloc.c ctime.c exit.c getchar.c memcmp.c memcpy.c memmove.c memset.c \
 	strncpy.c strtol.c
 SRCS+=	close.c closeall.c cons.c cread.c dev.c disklabel.c dkcksum.c fchmod.c \
 	fstat.c lseek.c open.c read.c readdir.c stat.c
-SRCS+=	loadfile.c
+SRCS+=	loadfile.c arc4.c
 SRCS+=	ufs.c
 SRCS+=	arp.c ether.c globals.c in_cksum.c net.c netif.c netudp.c tftp.c
 SRCS+=	aes_xts.c bcrypt_pbkdf.c blowfish.c explicit_bzero.c hmac_sha1.c \
diff --git a/sys/arch/arm64/stand/efiboot/conf.c b/sys/arch/arm64/stand/efiboot/conf.c
index 3b47ff62681..fa07e6cfefa 100644
--- a/sys/arch/arm64/stand/efiboot/conf.c
+++ b/sys/arch/arm64/stand/efiboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.23 2019/08/13 09:00:20 patrick Exp $	*/
+/*	$OpenBSD: conf.c,v 1.24 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -45,7 +45,7 @@
 #include "efipxe.h"
 #include "softraid_arm64.h"
 
-const char version[] = "0.19";
+const char version[] = "0.20";
 int	debug = 0;
 
 struct fs_ops file_system[] = {
diff --git a/sys/arch/armv7/stand/efiboot/Makefile b/sys/arch/armv7/stand/efiboot/Makefile
index 43f78b723ec..c07e0d254f2 100644
--- a/sys/arch/armv7/stand/efiboot/Makefile
+++ b/sys/arch/armv7/stand/efiboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.13 2019/10/25 10:06:40 kettenis Exp $
+#	$OpenBSD: Makefile,v 1.14 2019/10/29 02:55:51 deraadt Exp $
 
 NOMAN=		#
 
@@ -29,7 +29,7 @@ SRCS+=	alloc.c ctime.c exit.c getchar.c memcmp.c memcpy.c memmove.c memset.c \
 	strncpy.c strtol.c
 SRCS+=	close.c closeall.c cons.c cread.c dev.c disklabel.c dkcksum.c fchmod.c \
 	fstat.c lseek.c open.c read.c readdir.c stat.c
-SRCS+=	loadfile.c
+SRCS+=	loadfile.c arc4.c
 SRCS+=	ufs.c
 SRCS+=	arp.c ether.c globals.c in_cksum.c net.c netif.c netudp.c tftp.c
 
diff --git a/sys/arch/armv7/stand/efiboot/conf.c b/sys/arch/armv7/stand/efiboot/conf.c
index b107e4009ca..929e063e0ea 100644
--- a/sys/arch/armv7/stand/efiboot/conf.c
+++ b/sys/arch/armv7/stand/efiboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.20 2019/10/25 10:06:40 kettenis Exp $	*/
+/*	$OpenBSD: conf.c,v 1.21 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -36,7 +36,7 @@
 #include "efidev.h"
 #include "efipxe.h"
 
-const char version[] = "1.7";
+const char version[] = "1.8";
 int	debug = 0;
 
 struct fs_ops file_system[] = {
diff --git a/sys/arch/hppa/stand/boot/conf.c b/sys/arch/hppa/stand/boot/conf.c
index 4f4194ffcdf..25757e1e8d0 100644
--- a/sys/arch/hppa/stand/boot/conf.c
+++ b/sys/arch/hppa/stand/boot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.33 2019/08/04 13:45:15 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.34 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1998-2004 Michael Shalayeff
@@ -32,7 +32,7 @@
 #include <lib/libsa/cd9660.h>
 #include <dev/cons.h>
 
-const char version[] = "1.7";
+const char version[] = "1.8";
 int	debug = 0;
 
 struct fs_ops file_system[] = {
diff --git a/sys/arch/hppa/stand/cdboot/Makefile b/sys/arch/hppa/stand/cdboot/Makefile
index 83ea3e345cc..ed9c79c1f5d 100644
--- a/sys/arch/hppa/stand/cdboot/Makefile
+++ b/sys/arch/hppa/stand/cdboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.10 2016/07/30 03:25:48 guenther Exp $
+#	$OpenBSD: Makefile,v 1.11 2019/10/29 02:55:51 deraadt Exp $
 
 NOMAN=	no man
 S	=${.CURDIR}/../../../..
@@ -13,8 +13,9 @@ SRCS+=	srt0.S
 
 SRCS=	srt0.S cdboot.c
 
+.PATH:	${.CURDIR}/../../../../lib/libsa
 .PATH:	${.CURDIR}/../libsa
-SRCS+=	pdc.c itecons.c dev_hppa.c dk.c elf32.c elf64.c
+SRCS+=	pdc.c itecons.c dev_hppa.c dk.c elf32.c elf64.c arc4.c
 CPPFLAGS+=-DCONSPEED=9600
 
 .PATH:	${S}/lib/libkern/arch/hppa ${S}/lib/libkern
diff --git a/sys/arch/hppa/stand/cdboot/cdboot.c b/sys/arch/hppa/stand/cdboot/cdboot.c
index dfba5a1cbe7..35730f1aad8 100644
--- a/sys/arch/hppa/stand/cdboot/cdboot.c
+++ b/sys/arch/hppa/stand/cdboot/cdboot.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cdboot.c,v 1.14 2019/04/10 04:17:34 deraadt Exp $	*/
+/*	$OpenBSD: cdboot.c,v 1.15 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2003 Michael Shalayeff
@@ -32,6 +32,7 @@
 #include <libsa.h>
 #include <lib/libsa/cd9660.h>
 #include <lib/libsa/loadfile.h>
+#include <lib/libsa/arc4.h>
 #include <dev/cons.h>
 #include <machine/pdc.h>
 #include <machine/cpu.h>
@@ -64,6 +65,7 @@ typedef void (*startfuncp)(int, int, int, int, int, int, caddr_t)
     __attribute__ ((noreturn));
 
 char   rnddata[BOOTRANDOM_MAX];		/* XXX dummy */
+struct rc4_ctx randomctx;
 
 void
 boot(dev_t dev)
@@ -78,6 +80,10 @@ boot(dev_t dev)
 	printf(">> OpenBSD/" MACHINE " CDBOOT 0.2\n"
 	    "booting %s: ", path);
 
+	/* XXX note that rnddata is not initialized */
+	rc4_keysetup(&randomctx, rnddata, sizeof rnddata);
+	rc4_skip(&randomctx, 1536);
+
 	marks[MARK_START] = (u_long)DEFAULT_KERNEL_ADDRESS;
 	if (!loadfile(path, marks, LOAD_KERNEL)) {
 		marks[MARK_END] = ALIGN(marks[MARK_END] -
diff --git a/sys/arch/hppa/stand/libsa/Makefile b/sys/arch/hppa/stand/libsa/Makefile
index 99ba3d5867e..e9f52c6976a 100644
--- a/sys/arch/hppa/stand/libsa/Makefile
+++ b/sys/arch/hppa/stand/libsa/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.21 2019/08/03 15:22:20 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.22 2019/10/29 02:55:51 deraadt Exp $
 
 .include "${.CURDIR}/../Makefile.inc"
 
@@ -17,7 +17,7 @@ NOPIC=nopic
 
 # hppa stuff
 SRCS=	machdep.c pdc.c itecons.c dev_hppa.c time.c \
-	ct.c dk.c lf.c lif.c cmd_hppa.c loadfile.c elf32.c elf64.c
+	ct.c dk.c lf.c lif.c cmd_hppa.c loadfile.c arc4.c elf32.c elf64.c
 
 # stand routines
 SRCS+=	alloc.c exit.c getfile.c getln.c getchar.c globals.c \
diff --git a/sys/arch/i386/stand/boot/Makefile b/sys/arch/i386/stand/boot/Makefile
index 4b7f7ab71c2..c4abfabb8dc 100644
--- a/sys/arch/i386/stand/boot/Makefile
+++ b/sys/arch/i386/stand/boot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.69 2019/08/03 15:22:20 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.70 2019/10/29 02:55:51 deraadt Exp $
 
 COPTS?=
 MAN?=	boot.8
@@ -41,7 +41,7 @@ SRCS+=	alloc.c ctime.c exit.c getchar.c memcmp.c memcpy.c memmove.c memset.c pri
 	strtol.c strtoll.c
 SRCS+=	close.c closeall.c cons.c cread.c dev.c disklabel.c dkcksum.c fchmod.c \
 	fstat.c lseek.c open.c read.c readdir.c stat.c
-SRCS+=	elf32.c elf64.c loadfile.c
+SRCS+=	elf32.c elf64.c loadfile.c arc4.c
 SRCS+=	ufs.c
 .if ${SOFTRAID:L} == "yes"
 SRCS+=	aes_xts.c bcrypt_pbkdf.c blowfish.c explicit_bzero.c hmac_sha1.c \
diff --git a/sys/arch/i386/stand/boot/conf.c b/sys/arch/i386/stand/boot/conf.c
index b2fb45d7dd6..c3520f05e4d 100644
--- a/sys/arch/i386/stand/boot/conf.c
+++ b/sys/arch/i386/stand/boot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.71 2019/08/04 13:45:15 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.72 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 Michael Shalayeff
@@ -41,7 +41,7 @@
 #include <dev/cons.h>
 #include "debug.h"
 
-const char version[] = "3.39";
+const char version[] = "3.40";
 int	debug = 1;
 
 
diff --git a/sys/arch/i386/stand/cdboot/Makefile b/sys/arch/i386/stand/cdboot/Makefile
index 064803c8d95..aaf33480aa4 100644
--- a/sys/arch/i386/stand/cdboot/Makefile
+++ b/sys/arch/i386/stand/cdboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.33 2019/08/03 15:22:21 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.34 2019/10/29 02:55:51 deraadt Exp $
 
 MAN=	cdboot.8
 
@@ -32,7 +32,7 @@ SRCS+=	alloc.c ctime.c exit.c getchar.c memcmp.c memcpy.c memmove.c memset.c pri
 	strtol.c strtoll.c
 SRCS+=	close.c closeall.c cons.c cread.c dev.c disklabel.c dkcksum.c fchmod.c \
 	fstat.c lseek.c open.c read.c readdir.c stat.c
-SRCS+=	elf32.c elf64.c loadfile.c
+SRCS+=	elf32.c elf64.c loadfile.c arc4.c
 SRCS+=	cd9660.c ufs.c
 SRCS+=	aes_xts.c bcrypt_pbkdf.c blowfish.c explicit_bzero.c hmac_sha1.c \
 	pkcs5_pbkdf2.c rijndael.c sha1.c sha2.c softraid.c
diff --git a/sys/arch/i386/stand/cdboot/conf.c b/sys/arch/i386/stand/cdboot/conf.c
index 69fe649cc32..cf619c5f1a3 100644
--- a/sys/arch/i386/stand/cdboot/conf.c
+++ b/sys/arch/i386/stand/cdboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.38 2019/08/04 13:45:15 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.39 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2004 Tom Cosgrove
@@ -42,7 +42,7 @@
 #include <dev/cons.h>
 #include "debug.h"
 
-const char version[] = "3.34";
+const char version[] = "3.35";
 int	debug = 1;
 
 void (*sa_cleanup)(void) = NULL;
diff --git a/sys/arch/i386/stand/pxeboot/Makefile b/sys/arch/i386/stand/pxeboot/Makefile
index 926e2b2cf2c..0f2e4d2b5bc 100644
--- a/sys/arch/i386/stand/pxeboot/Makefile
+++ b/sys/arch/i386/stand/pxeboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.30 2019/08/03 15:22:21 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.31 2019/10/29 02:55:51 deraadt Exp $
 
 MAN=	pxeboot.8
 
@@ -33,7 +33,7 @@ SRCS+=	alloc.c ctime.c exit.c getchar.c globals.c memcmp.c memmove.c memcpy.c me
 	strncpy.c strtol.c strtoll.c
 SRCS+=	close.c closeall.c cons.c cread.c dev.c disklabel.c dkcksum.c fchmod.c \
 	fstat.c lseek.c read.c readdir.c stat.c
-SRCS+=	elf32.c elf64.c loadfile.c
+SRCS+=	elf32.c elf64.c loadfile.c arc4.c
 SRCS+=	nfs.c ufs.c tftp.c
 SRCS+=	bootp.c ether.c net.c netif.c rpc.c
 SRCS+=	aes_xts.c bcrypt_pbkdf.c blowfish.c explicit_bzero.c hmac_sha1.c \
diff --git a/sys/arch/i386/stand/pxeboot/conf.c b/sys/arch/i386/stand/pxeboot/conf.c
index 5dba51b2cc1..c1ecad5f519 100644
--- a/sys/arch/i386/stand/pxeboot/conf.c
+++ b/sys/arch/i386/stand/pxeboot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.43 2019/08/04 13:45:15 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.44 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2004 Tom Cosgrove
@@ -44,7 +44,7 @@
 #include "pxeboot.h"
 #include "pxe_net.h"
 
-const char version[] = "3.34";
+const char version[] = "3.35";
 int	debug = 1;
 
 void (*sa_cleanup)(void) = pxe_shutdown;
diff --git a/sys/arch/landisk/stand/boot/Makefile b/sys/arch/landisk/stand/boot/Makefile
index 1b15f01a14d..16f43e02b69 100644
--- a/sys/arch/landisk/stand/boot/Makefile
+++ b/sys/arch/landisk/stand/boot/Makefile
@@ -1,10 +1,10 @@
-#	$OpenBSD: Makefile,v 1.14 2016/11/28 16:42:45 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.15 2019/10/29 02:55:51 deraadt Exp $
 
 MAN=	boot.8
 
 .if ${MACHINE} == "landisk"
 PROG=	boot
-SRCS=	srt0.S conf.c devs.c getsecs.c scifcons.c delay.c
+SRCS=	srt0.S conf.c devs.c getsecs.c scifcons.c delay.c arc4.c
 LDFLAGS=-nostdlib -Ttext 0x8ff00000 -N -x -Bstatic -e start -nopie -znorelro
 OBJCOPY?=objcopy
 
diff --git a/sys/arch/landisk/stand/boot/conf.c b/sys/arch/landisk/stand/boot/conf.c
index 0dd82c5a299..2016ea0a138 100644
--- a/sys/arch/landisk/stand/boot/conf.c
+++ b/sys/arch/landisk/stand/boot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.14 2019/08/04 13:45:15 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.15 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2006 Michael Shalayeff
@@ -29,7 +29,7 @@
 #endif
 #include <dev/cons.h>
 
-const char version[] = "1.07";
+const char version[] = "1.08";
 int	debug = 1;
 
 struct fs_ops file_system[] = {
diff --git a/sys/arch/loongson/stand/boot/conf.c b/sys/arch/loongson/stand/boot/conf.c
index 9eaed95e8cf..0dffd0910e6 100644
--- a/sys/arch/loongson/stand/boot/conf.c
+++ b/sys/arch/loongson/stand/boot/conf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: conf.c,v 1.12 2019/08/04 13:45:15 deraadt Exp $	*/
+/*	$OpenBSD: conf.c,v 1.13 2019/10/29 02:55:51 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1982, 1986, 1990, 1993
@@ -39,7 +39,7 @@
 #include <lib/libsa/ufs.h>
 #include <lib/libsa/cd9660.h>
 
-const char version[] = "0.9";
+const char version[] = "1.0";
 #if 0	/* network code not compiled in */
 int	debug = 0;
 #endif
diff --git a/sys/arch/loongson/stand/libsa/Makefile b/sys/arch/loongson/stand/libsa/Makefile
index 7a23329b899..83002e27f3e 100644
--- a/sys/arch/loongson/stand/libsa/Makefile
+++ b/sys/arch/loongson/stand/libsa/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.10 2019/08/03 15:22:21 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.11 2019/10/29 02:55:51 deraadt Exp $
 
 .include "${.CURDIR}/../Makefile.inc"
 
@@ -33,7 +33,7 @@ SRCS+=	ufs.c cd9660.c
 
 CFLAGS+=-DNO_NET
 
-SRCS+=	loadfile.c
+SRCS+=	loadfile.c arc4.c
 
 ${OBJS}:	${.CURDIR}/../Makefile.inc
 
diff --git a/sys/arch/luna88k/stand/boot/boot.c b/sys/arch/luna88k/stand/boot/boot.c
index a37efe4bba6..2251fe07713 100644
--- a/sys/arch/luna88k/stand/boot/boot.c
+++ b/sys/arch/luna88k/stand/boot/boot.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: boot.c,v 1.7 2019/04/10 22:02:03 aoyama Exp $	*/
+/*	$OpenBSD: boot.c,v 1.8 2019/10/29 02:55:51 deraadt Exp $	*/
 /*	$NetBSD: boot.c,v 1.3 2013/03/05 15:34:53 tsutsui Exp $	*/
 
 /*
@@ -87,6 +87,7 @@
 #include <luna88k/stand/boot/samachdep.h>
 #include <luna88k/stand/boot/status.h>
 #include <lib/libsa/loadfile.h>
+#include <lib/libsa/arc4.h>
 
 int howto;
 
@@ -100,6 +101,7 @@ uint32_t cpu_bootarg1;
 uint32_t cpu_bootarg2;
 
 char rnddata[BOOTRANDOM_MAX];
+struct rc4_ctx randomctx;
 
 #if 0
 int
@@ -197,6 +199,9 @@ bootunix(char *line)
 		rnd_loaded = loadrandom(rndpath, rnddata, sizeof(rnddata));
 	}
 
+	rc4_keysetup(&randomctx, rnddata, sizeof rnddata);
+	rc4_skip(&randomctx, 1536);
+
 	/* Note marks[MARK_START] is passed as an load address offset */
 	memset(marks, 0, sizeof(marks));
 
diff --git a/sys/arch/macppc/stand/boot.mac/Makefile b/sys/arch/macppc/stand/boot.mac/Makefile
index 4871944fc5d..cfe85255ec2 100644
--- a/sys/arch/macppc/stand/boot.mac/Makefile
+++ b/sys/arch/macppc/stand/boot.mac/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.16 2019/08/03 15:22:21 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.17 2019/10/29 02:55:51 deraadt Exp $
 #       $NetBSD: Makefile,v 1.1 1996/09/30 16:35:05 ws Exp $
 
 S=      ${.CURDIR}/../../../..
@@ -10,7 +10,7 @@ NOMAN=
 PROG=           boot.mac
 CFLAGS+=	-D_STANDALONE
 SRCS=           Locore.c main.c ofdev.c net.c netif_of.c netudp.c
-SRCS+=		alloc.c cache.c hfs.c fchmod.c
+SRCS+=		alloc.c cache.c hfs.c fchmod.c arc4.c
 SRCS+=          boot.c conf.c cmd.c vars.c ctime.c strtol.c
 
 INSTALL_STRIP=
diff --git a/sys/arch/macppc/stand/ofwboot/Makefile b/sys/arch/macppc/stand/ofwboot/Makefile
index ec2468b05cd..1fc75f7d87f 100644
--- a/sys/arch/macppc/stand/ofwboot/Makefile
+++ b/sys/arch/macppc/stand/ofwboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.17 2019/08/03 15:22:21 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.18 2019/10/29 02:55:51 deraadt Exp $
 #	$NetBSD: Makefile,v 1.2 1997/04/17 07:46:24 thorpej Exp $
 
 S=	${.CURDIR}/../../../..
@@ -7,7 +7,7 @@ R=../
 PROG=		ofwboot
 CFLAGS+=	-D_STANDALONE
 SRCS=		Locore.c main.c ofdev.c net.c netif_of.c netudp.c
-SRCS+=		alloc.c cache.c fchmod.c hfs.c
+SRCS+=		alloc.c cache.c fchmod.c hfs.c arc4.c
 SRCS+=		boot.c conf.c cmd.c vars.c ctime.c strtol.c
 .PATH:		${S}/arch/macppc/stand
 SRCS+=		ofwmagic.S
diff --git a/sys/arch/octeon/stand/libsa/Makefile b/sys/arch/octeon/stand/libsa/Makefile
index d986197249e..3b2961f25c0 100644
--- a/sys/arch/octeon/stand/libsa/Makefile
+++ b/sys/arch/octeon/stand/libsa/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.7 2019/04/20 22:59:04 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.8 2019/10/29 02:55:52 deraadt Exp $
 
 .include "${.CURDIR}/../Makefile.inc"
 
@@ -32,7 +32,7 @@ SRCS+=	ufs.c cd9660.c
 
 CFLAGS+=-DNO_NET
 
-SRCS+=	loadfile.c
+SRCS+=	loadfile.c arc4.c
 
 ${OBJS}:	${.CURDIR}/../Makefile.inc
 
diff --git a/sys/arch/octeon/stand/rdboot/rdboot.c b/sys/arch/octeon/stand/rdboot/rdboot.c
index 0b66162142e..023dba11af1 100644
--- a/sys/arch/octeon/stand/rdboot/rdboot.c
+++ b/sys/arch/octeon/stand/rdboot/rdboot.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rdboot.c,v 1.1 2019/07/17 14:36:32 visa Exp $	*/
+/*	$OpenBSD: rdboot.c,v 1.2 2019/10/29 02:55:52 deraadt Exp $	*/
 
 /*
  * Copyright (c) 2019 Visa Hankala
@@ -49,7 +49,7 @@ void	kexec(void);
 
 struct cmd_state cmd;
 int octbootfd = -1;
-const char version[] = "1.0";
+const char version[] = "1.1";
 
 int
 main(void)
diff --git a/sys/arch/sgi/stand/boot/Makefile b/sys/arch/sgi/stand/boot/Makefile
index f5e73dba1cb..b9283f2d3b9 100644
--- a/sys/arch/sgi/stand/boot/Makefile
+++ b/sys/arch/sgi/stand/boot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.19 2019/04/20 22:59:04 deraadt Exp $
+#	$OpenBSD: Makefile,v 1.20 2019/10/29 02:55:52 deraadt Exp $
 
 NOMAN=		noman
 
@@ -16,7 +16,7 @@ SRCS=		start.S arcbios.c boot.c conf.c diskio.c filesystem.c \
 		netfs.c netio.c strstr.c
 
 .PATH:		${S}/lib/libsa
-SRCS+=		loadfile.c
+SRCS+=		loadfile.c arc4.c
 
 .PATH:		${S}/lib/libkern/arch/mips64 ${S}/lib/libkern
 SRCS+=		memcpy.c memmove.c strchr.c strcmp.S strlcat.c strlcpy.c strlen.c \
diff --git a/sys/arch/sgi/stand/boot/boot.c b/sys/arch/sgi/stand/boot/boot.c
index 3eb8722185c..58a1c121c87 100644
--- a/sys/arch/sgi/stand/boot/boot.c
+++ b/sys/arch/sgi/stand/boot/boot.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: boot.c,v 1.26 2019/10/28 04:11:30 deraadt Exp $ */
+/*	$OpenBSD: boot.c,v 1.27 2019/10/29 02:55:52 deraadt Exp $ */
 
 /*
  * Copyright (c) 2004 Opsycon AB, www.opsycon.se.
@@ -33,6 +33,7 @@
 #undef _KERNEL
 
 #include <lib/libkern/libkern.h>
+#include <lib/libsa/arc4.h>
 #include <stand.h>
 
 #include <mips64/arcbios.h>
@@ -59,6 +60,7 @@ char *OSLoadFilename = NULL;
 int	IP;
 
 char   rnddata[BOOTRANDOM_MAX];
+struct rc4_ctx randomctx;
 
 /*
  * OpenBSD/sgi Boot Loader.
@@ -109,6 +111,9 @@ boot_main(int argc, char *argv[])
 		    sizeof(rnddata));
 	}
 
+	rc4_keysetup(&randomctx, rnddata, sizeof rnddata);
+	rc4_skip(&randomctx, 1536);
+
 	/*
 	 * Load the kernel and symbol table.
 	 */
diff --git a/sys/arch/sparc64/stand/ofwboot/Makefile b/sys/arch/sparc64/stand/ofwboot/Makefile
index 2cf8dfc74ef..5907e1371fc 100644
--- a/sys/arch/sparc64/stand/ofwboot/Makefile
+++ b/sys/arch/sparc64/stand/ofwboot/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.26 2018/12/31 11:44:57 claudio Exp $
+#	$OpenBSD: Makefile,v 1.27 2019/10/29 02:55:52 deraadt Exp $
 #	$NetBSD: Makefile,v 1.2 2001/03/04 14:50:05 mrg Exp $
 
 CURDIR=	${.CURDIR}
@@ -20,8 +20,9 @@ SOFTRAID?=	no
 .endif
 
 .PATH:		${S}/arch/sparc64/sparc64
-SRCS=		srt0.s Locore.c alloc.c boot.c elf64_exec.c net.c netif_of.c \
-		ofdev.c vers.c
+.PATH:		${S}/lib/libsa
+SRCS=		srt0.s Locore.c alloc.c boot.c elf64_exec.c arc4.c \
+		net.c netif_of.c ofdev.c vers.c
 .if ${SOFTRAID:L} == "yes"
 SRCS+=		diskprobe.c softraid_sparc64.c
 .endif
@@ -30,7 +31,6 @@ SRCS+=		diskprobe.c softraid_sparc64.c
 SRCS+=		strlcpy.c strcmp.c strlcat.c strlen.c ffs.S
 
 .if ${SOFTRAID:L} == "yes"
-.PATH:		${S}/lib/libsa
 SRCS+=		aes_xts.c bcrypt_pbkdf.c blowfish.c explicit_bzero.c \
 		hmac_sha1.c pkcs5_pbkdf2.c rijndael.c sha1.c sha2.c softraid.c
 .endif
diff --git a/sys/arch/sparc64/stand/ofwboot/boot.c b/sys/arch/sparc64/stand/ofwboot/boot.c
index 8958ec0b340..2d49d95405c 100644
--- a/sys/arch/sparc64/stand/ofwboot/boot.c
+++ b/sys/arch/sparc64/stand/ofwboot/boot.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: boot.c,v 1.31 2019/05/10 19:38:52 claudio Exp $	*/
+/*	$OpenBSD: boot.c,v 1.32 2019/10/29 02:55:52 deraadt Exp $	*/
 /*	$NetBSD: boot.c,v 1.3 2001/05/31 08:55:19 mrg Exp $	*/
 /*
  * Copyright (c) 1997, 1999 Eduardo E. Horvath.  All rights reserved.
@@ -56,6 +56,7 @@
 #include <machine/boot_flag.h>
 
 #include <machine/cpu.h>
+#include <lib/libsa/arc4.h>
 
 #ifdef SOFTRAID
 #include <sys/param.h>
@@ -95,6 +96,7 @@ int boothowto;
 int debug;
 
 char rnddata[BOOTRANDOM_MAX];
+struct rc4_ctx randomctx;
 
 int	elf64_exec(int, Elf64_Ehdr *, u_int64_t *, void **, void **);
 
@@ -463,6 +465,10 @@ main(void)
 		}
 		if (loadrandom(BOOTRANDOM, rnddata, sizeof(rnddata)))
 			printf("open %s: %s\n", opened_name, strerror(errno));
+
+		rc4_keysetup(&randomctx, rnddata, sizeof rnddata);
+		rc4_skip(&randomctx, 1536);
+
 		if ((fd = open(bootline, 0)) < 0) {
 			printf("open %s: %s\n", opened_name, strerror(errno));
 			continue;
diff --git a/sys/arch/sparc64/stand/ofwboot/elf64_exec.c b/sys/arch/sparc64/stand/ofwboot/elf64_exec.c
index 4ae5bee3821..f50d2d23d49 100644
--- a/sys/arch/sparc64/stand/ofwboot/elf64_exec.c
+++ b/sys/arch/sparc64/stand/ofwboot/elf64_exec.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: elf64_exec.c,v 1.9 2018/12/31 11:44:57 claudio Exp $	*/
+/*	$OpenBSD: elf64_exec.c,v 1.10 2019/10/29 02:55:52 deraadt Exp $	*/
 /*	$NetBSD: elfXX_exec.c,v 1.2 2001/08/15 20:08:15 eeh Exp $	*/
 
 /*
@@ -67,6 +67,8 @@
 #include "softraid_sparc64.h"
 #endif
 
+#include <lib/libsa/arc4.h>
+
 #include "openfirm.h"
 
 void syncicache(void *, int);
@@ -128,14 +130,10 @@ elf64_exec(int fd, Elf_Ehdr *elf, u_int64_t *entryp, void **ssymp, void **esymp)
 		}
 
 		if (phdr.p_type == PT_OPENBSD_RANDOMIZE) {
-			int m, pos;
+			extern struct rc4_ctx randomctx;
 
-			/* Fill segment. */
-			for (pos = 0; pos < phdr.p_filesz; pos += m) {
-				m = MIN(phdr.p_filesz - pos, sizeof(rnddata));
-				bcopy(rnddata, (void *)(long)phdr.p_paddr + pos, m);
-			}
-			continue;
+			rc4_getbytes(&randomctx, (void *)(long)phdr.p_paddr,
+			    phdr.p_filesz);
 		}
 
 		if (phdr.p_type != PT_LOAD ||
diff --git a/sys/arch/sparc64/stand/ofwboot/vers.c b/sys/arch/sparc64/stand/ofwboot/vers.c
index 7022c29e34d..bb8d969b4fc 100644
--- a/sys/arch/sparc64/stand/ofwboot/vers.c
+++ b/sys/arch/sparc64/stand/ofwboot/vers.c
@@ -1 +1 @@
-const char version[] = "1.14";
+const char version[] = "1.15";