VirtualBox · tvataire · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026 · Aug 4, 2026
diff --git a/.github/ISSUE_TEMPLATE/10-bug-report.yml b/.github/ISSUE_TEMPLATE/10-bug-report.yml
@@ -45,6 +45,7 @@ body:
       label: Version
       options:
         - trunk/main
+        - 7.2.16
         - 7.2.14
         - 7.2.12
         - 7.2.10

diff --git a/Config.kmk b/Config.kmk
@@ -1,4 +1,4 @@
-# $Id: Config.kmk 114504 2026-06-23 16:56:50Z aleksey.ilyushin@oracle.com $
+# $Id: Config.kmk 115021 2026-08-12 23:45:19Z knut.osmundsen@oracle.com $
 ## @file
 # The global build configuration file for VBox.
 #
@@ -568,11 +568,21 @@ endif
 if1of ($(KBUILD_TARGET).$(KBUILD_TARGET_ARCH), darwin.amd64 darwin.arm64 linux.amd64 linux.arm64 win.arm64)
  VBOX_WITH_DRIVERLESS_NEM_FALLBACK = 1
 endif
+# Enable local IPC testcase coverage together with the production transport.
+VBOX_WITH_INTNET_SERVICE_IN_R3_LOCALIPC_TESTCASES = $(if $(VBOX_WITH_INTNET_SERVICE_IN_R3_LOCALIPC),1,)
 # Enable forced driverless mode by default.
 if1of ($(KBUILD_TARGET).$(KBUILD_TARGET_ARCH), darwin.amd64 darwin.arm64)
  VBOX_WITH_DRIVERLESS_FORCED = 1
  if1of ($(KBUILD_TARGET), darwin)
   VBOX_WITH_INTNET_SERVICE_IN_R3 = 1
+  VBOX_WITH_INTNET_SERVICE_IN_R3_LOCALIPC_TESTCASES = 1
+ endif
+endif
+# The local IPC implementation of the R3 IntNet service is
+# experimental and intentionally disabled by default for now, see @bugref{11149}
+if1of ($(KBUILD_TARGET), win linux)
+ ifdef VBOX_WITH_INTNET_SERVICE_IN_R3_LOCALIPC
+  VBOX_WITH_INTNET_SERVICE_IN_R3 := 1
  endif
 endif
 # Enables the new breakpoint handling code, see @bugref{8650}
@@ -966,7 +976,7 @@ VBOX_WITH_SHARED_FOLDERS = 1
 # Enable shared clipboard
 VBOX_WITH_SHARED_CLIPBOARD = 1
 # Enable shared clipboard (file) transfers
-if1of ($(KBUILD_TARGET), win linux)
+if1of ($(KBUILD_TARGET), win linux darwin)
  VBOX_WITH_SHARED_CLIPBOARD_TRANSFERS = 1
  if1of ($(KBUILD_TARGET), linux)
   VBOX_WITH_SHARED_CLIPBOARD_TRANSFERS_HTTP = 1
@@ -2054,7 +2064,8 @@ ASTOOL := $(VBOX_ASTOOL)
 #
 INCS += $(PATH_ROOT)/include $(PATH_OUT)
 DEFS += VBOX
-DEFS.debug      := DEBUG DEBUG_$(subst $(subst _, ,_),_,$(USERNAME)) DEBUG_USERNAME=$(subst $(subst _, ,_),_,$(USERNAME))
+USERNAME_FIXUP  := $(subst -,_,$(subst $(subst _, ,_),_,$(USERNAME)))
+DEFS.debug      := DEBUG DEBUG_$(USERNAME_FIXUP) DEBUG_USERNAME=$(USERNAME_FIXUP)
 DEFS.dbgopt      = $(DEFS.debug)
 DEFS.profile     = VBOX_WITH_STATISTICS
 DEFS.strict      = RT_STRICT VBOX_STRICT
@@ -3200,9 +3211,6 @@ VBOX_PATH_X11_ROOT      = $(PATH_ROOT)/src/VBox/Additions/x11/x11include
 # Miscellaneous includes
 #
 VBOX_GRAPHICS_INCS = $(PATH_ROOT)/include/VBox/Graphics
-VBOX_JPEG_INCS     = \
-	$(PATH_ROOT)/src/libs/libjpeg-turbo-3.1.0/src \
-	$(PATH_ROOT)/src/libs/libjpeg-turbo-3.1.0
 
 
 # The icons to use.
@@ -3478,6 +3486,7 @@ ifndef VBOX_NOINC_DYNAMIC_CONFIG_KMK
 	$(QUIET)$(APPEND) '$@' 'VBOX_GCC_msse4.1                         ?= $(call VBOX_GCC_CHECK_CC,-msse4.1,)'
 	$(QUIET)$(APPEND) '$@' 'VBOX_GCC_mavx                            ?= $(call VBOX_GCC_CHECK_CC,-mavx,)'
 	$(QUIET)$(APPEND) '$@' 'VBOX_GCC_mavx2                           ?= $(call VBOX_GCC_CHECK_CC,-mavx2,)'
+	$(QUIET)$(APPEND) '$@' 'VBOX_GCC_mharden-sls-all                 ?= $(call VBOX_GCC_CHECK_CXX,-mharden-sls=all,)'
   ifdef VBOX_USE_CLANG
 	$(QUIET)$(APPEND) '$@' 'VBOX_GCC_no-pie                          ?= $(call VBOX_GCC_CHECK_LD,--no-pie,)'
   else
@@ -3862,6 +3871,9 @@ if1of (win, $(KBUILD_TARGET) $(KBUILD_HOST))
  VBOX_VCC_LD_GUARD_CF         :=
  VBOX_VCC_CC_GUARD_EHCONT     :=
  VBOX_VCC_LD_GUARD_EHCONT     :=
+ VBOX_VCC_LD_GUARD_RETPOLINE  :=
+ VBOX_VCC_LD_GUARD_RETPOLINE_IGNORE :=
+ VBOX_VCC_LD_GUARD_RETPOLINE_WITH_IGNORE :=
  VBOX_VCC_LD_HIGH_ENTRYOPY_VA :=
  VBOX_VCC_LD_CET_COMPAT       :=
 
@@ -3876,6 +3888,11 @@ if1of (win, $(KBUILD_TARGET) $(KBUILD_HOST))
    VBOX_VCC_CC_GUARD_EHCONT   := -guard:ehcont
    VBOX_VCC_LD_GUARD_EHCONT   := -Guard:ehcont
   endif
+  if $(VBOX_VCC_TOOL_STEM) >= VCC142 # Since when? (Also present in older versions.)
+   VBOX_VCC_LD_GUARD_RETPOLINE             := -Guard:retpoline
+   VBOX_VCC_LD_GUARD_RETPOLINE_IGNORE      := -Ignore:4287
+   VBOX_VCC_LD_GUARD_RETPOLINE_WITH_IGNORE := -Guard:retpoline -Ignore:4287
+  endif
  endif
 endif
 
@@ -5271,7 +5288,7 @@ SDK_VBoxSoftFloatGuestR3Shared_LIBS.$(KBUILD_TARGET_ARCH) = \
 
 ifdef VBOX_WITH_LIBSSH
  SDK_VBoxLibSsh                := libssh for dynamic dll loading with assembly stubs.
- SDK_VBoxLibSsh_INCS           ?= $(PATH_ROOT)/src/libs/libssh-0.11.4/include
+ SDK_VBoxLibSsh_INCS           ?= $(PATH_ROOT)/src/libs/libssh-0.12.2/include
  # SDK_VBoxLibSsh_LIBS is not defined, as VBoxLibSsh dll is not linked, but loaded explicitly
  # by auto-generated stub code (lazy loading)
 endif
@@ -5322,6 +5339,15 @@ SDK_VBoxLibXml2_DEFS.win      ?= WIN32 _WINDOWS _MBCS HAVE_WIN32_THREADS HAVE_CO
 # Note: no linking to LIB here, we do that explicitly in src/VBox/Runtime/Makefile.kmk to link
 #       libxml against VBoxRT
 
+# libjpeg
+SDK_VBoxLibJpeg              := libjpeg for dll linking.
+SDK_VBoxLibJpeg_DEFAULT_INCS ?= $(PATH_ROOT)/src/libs/libjpeg-turbo-3.1.0/src \
+	$(PATH_ROOT)/src/libs/libjpeg-turbo-3.1.0
+SDK_VBoxLibJpeg_INCS         ?= $(SDK_VBoxLibJpeg_DEFAULT_INCS)
+SDK_VBoxLibJpeg_LIBS         ?= $(PATH_STAGE_LIB)/VBox-libjpeg$(VBOX_SUFF_LIB) \
+	$(PATH_STAGE_LIB)/VBox-libjpeg12$(VBOX_SUFF_LIB) \
+	$(PATH_STAGE_LIB)/VBox-libjpeg16$(VBOX_SUFF_LIB)
+
 # zlib
 SDK_VBoxZlib                  := zlib for dll linking.
 SDK_VBoxZlib_VBOX_DEFAULT_INCS := $(PATH_ROOT)/src/libs/zlib-1.3.2
@@ -5669,6 +5695,13 @@ ifeq ($(VBOX_LDR_FMT),pe)
  if "$(VBOX_VCC_TOOL_STEM)" >= "VCC142" # Don't waste space on x86/amd64-on-arm emulation optimizations.
   TEMPLATE_VBoxR0_CXXFLAGS         += /volatileMetadata-
  endif
+ if "$(VBOX_VCC_TOOL_STEM)" >= "VCC142" # Speculative execution hardening.
+  TEMPLATE_VBoxR0_CXXFLAGS         += -Qspectre
+  if1of ($(KBUILD_TARGET_ARCH), amd64 x86)
+   TEMPLATE_VBoxR0_CXXFLAGS        += -Qspectre-jmp
+   #TEMPLATE_VBoxR0_CXXFLAGS        += -d2guardretpoline - requires RTLdr support or the VM fails to start due to mismatches.
+  endif
+ endif
  ifdef VBOX_WITH_MSC_ANALYZE_THIS
   TEMPLATE_VBoxR0_CXXFLAGS         += /analyze
  endif
@@ -5695,6 +5728,9 @@ ifeq ($(VBOX_LDR_FMT),pe)
   TEMPLATE_VBoxR0_LDFLAGS.win.x86  += -Include:___security_init_cookie -Export:ModuleInitSecurityCookie=__security_init_cookie
   TEMPLATE_VBoxR0_LDFLAGS.win.arm64 += -Include:__security_init_cookie -Export:ModuleInitSecurityCookie=__security_init_cookie
  endif
+ if "$(VBOX_VCC_TOOL_STEM)" >= "VCC142" # Speculative execution hardening.
+  #TEMPLATE_VBoxR0_LDFLAGS.win.amd64 += $(VBOX_VCC_LD_GUARD_RETPOLINE) - requires RTLdr support or the VM fails to start due to mismatches.
+ endif
  TEMPLATE_VBoxR0_LATE_LIBS          = \
  	$(PATH_STAGE_LIB)/RuntimeR0Stub$(VBOX_SUFF_LIB)
  ifneq ($(VBOX_VCC_CC_GUARD_CF),)
@@ -5722,8 +5758,8 @@ ifeq ($(VBOX_LDR_FMT),elf)
  if $(VBOX_GCC_VERSION_CC) >= 40500 # 4.1.2 complains, 4.5.2 is okay, didn't check which version inbetween made it okay with g++.
   TEMPLATE_VBoxR0_CXXFLAGS         += -ffreestanding
  endif
- TEMPLATE_VBoxR0_CFLAGS.amd64       = -m64 -mno-red-zone -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -fasynchronous-unwind-tables -ffreestanding
- TEMPLATE_VBoxR0_CXXFLAGS.amd64     = -m64 -mno-red-zone -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -fasynchronous-unwind-tables
+ TEMPLATE_VBoxR0_CFLAGS.amd64       = -m64 -mno-red-zone -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -fasynchronous-unwind-tables $(VBOX_GCC_mharden-sls-all) -ffreestanding
+ TEMPLATE_VBoxR0_CXXFLAGS.amd64     = -m64 -mno-red-zone -mno-sse -mno-mmx -mno-sse2 -mno-3dnow -fasynchronous-unwind-tables $(VBOX_GCC_mharden-sls-all)
  TEMPLATE_VBoxR0_CXXFLAGS.arm64     = -mabi=lp64 -mgeneral-regs-only -ffixed-x18 -fconserve-stack \
  	-fno-stack-check $(VBOX_GCC_fno-stack-clash-protection) $(VBOX_GCC_fno-allow-store-data-races) -fno-delete-null-pointer-checks # (linux 6.11)
  # arm64: Add -mbranch-protection=pac-ret ?
@@ -5901,10 +5937,17 @@ ifeq ($(KBUILD_TARGET),win)
  if "$(VBOX_VCC_TOOL_STEM)" >= "VCC142" # Don't waste space on x86/amd64-on-arm emulation optimizations.
   TEMPLATE_VBoxR0Drv_CXXFLAGS         += /volatileMetadata-
  endif
+ if "$(VBOX_VCC_TOOL_STEM)" >= "VCC142" # Speculative execution hardening.
+  TEMPLATE_VBoxR0Drv_CXXFLAGS         += -Qspectre
+  TEMPLATE_VBoxR0Drv_CXXFLAGS.win.x86 += -Qspectre-jmp
+  TEMPLATE_VBoxR0Drv_CXXFLAGS.win.amd64 += -Qspectre-jmp -d2guardretpoline
+ endif
  ifdef VBOX_WITH_MSC_ANALYZE_THIS
   TEMPLATE_VBoxR0Drv_CXXFLAGS         += /analyze
  endif
  TEMPLATE_VBoxR0Drv_CFLAGS             = $(TEMPLATE_VBoxR0Drv_CXXFLAGS)
+ TEMPLATE_VBoxR0Drv_CFLAGS.win.x86     = $(TEMPLATE_VBoxR0Drv_CXXFLAGS.win.x86)
+ TEMPLATE_VBoxR0Drv_CFLAGS.win.amd64   = $(TEMPLATE_VBoxR0Drv_CXXFLAGS.win.amd64)
  TEMPLATE_VBoxR0Drv_LDFLAGS            = -WX -Ignore:4197 \
  	-Driver -Subsystem:NATIVE -Incremental:NO -Align:4096 -MapInfo:Exports -NoD -Release -Debug -Opt:Ref -Opt:Icf \
  	$(VBOX_VCC_LD_GUARD_CF) \
@@ -5922,6 +5965,9 @@ ifeq ($(KBUILD_TARGET),win)
  TEMPLATE_VBoxR0Drv_LDFLAGS.win.amd64  = $(VBOX_VCC_LD_HIGH_ENTRYOPY_VA) $(VBOX_VCC_LD_GUARD_EHCONT) $(VBOX_VCC_LD_CET_COMPAT)
  TEMPLATE_VBoxR0Drv_LDFLAGS.win.arm64  = $(VBOX_VCC_LD_HIGH_ENTRYOPY_VA) $(VBOX_VCC_LD_GUARD_EHCONT)
  TEMPLATE_VBoxR0Drv_LDFLAGS.win.x86    = $(VBOX_VCC_LD_CET_COMPAT)
+ if "$(VBOX_VCC_TOOL_STEM)" >= "VCC142" # Speculative execution hardening.
+  TEMPLATE_VBoxR0Drv_LDFLAGS.win.amd64 += $(VBOX_VCC_LD_GUARD_RETPOLINE)
+ endif
  TEMPLATE_VBoxR0Drv_ORDERDEPS          = $(VBOX_SIGN_DRIVER_ORDERDEPS)
  TEMPLATE_VBoxR0Drv_POST_CMDS          = $(VBOX_SIGN_DRIVER_CMDS)
 endif
@@ -9591,7 +9637,7 @@ SVN                    ?= svn$(HOSTSUFF_EXE)
 GIT                    ?= git$(HOSTSUFF_EXE)
 VBOX_SVN_REV_KMK        = $(PATH_OUT)/revision.kmk
 ifndef VBOX_SVN_REV
- VBOX_SVN_REV_CONFIG_FALLBACK := $(patsubst %:,,  $Rev: 114504 $  )
+ VBOX_SVN_REV_CONFIG_FALLBACK := $(patsubst %:,,  $Rev: 115021 $  )
  VBOX_SVN_REV_FALLBACK := $(if-expr $(VBOX_SVN_REV_CONFIG_FALLBACK) > $(VBOX_SVN_REV_VERSION_FALLBACK),$(VBOX_SVN_REV_CONFIG_FALLBACK),$(VBOX_SVN_REV_VERSION_FALLBACK))
  VBOX_SVN_DEP          := $(firstword $(wildcard $(PATH_ROOT)/.svn/wc.db $(abspath $(PATH_ROOT)/../.svn/wc.db) $(abspath $(PATH_ROOT)/../../.svn/wc.db) $(PATH_ROOT)/.svn/entries))
  VBOX_GIT_DEP          := $(firstword $(wildcard $(PATH_ROOT)/.git/config $(abspath $(PATH_ROOT)/../.git/config) $(abspath $(PATH_ROOT)/../../.git/config)))
@@ -9605,7 +9651,7 @@ ifndef VBOX_SVN_REV
  ifneq ($(VBOX_GIT_DEP),)
   #
   # VBOX_SVN_REV_CONFIG_FALLBACK is not properly populated for a git checkout,
-  # as the $Rev: 114504 $ is not expanded, so we have to set it based on the information in the repo.
+  # as the $Rev: 115021 $ is not expanded, so we have to set it based on the information in the repo.
   #
   VBOX_SVN_REV_FALLBACK := $(shell $(GIT) log -1 $(PATH_ROOT)/Config.kmk | $(SED) -e 's/^[ \t]*//' -e '/svn:sync-xref-src-repo-rev\: r/!d' -e 's/svn:sync-xref-src-repo-rev\: r*//; t a; :a q')
  endif
-Original file line number
+Diff line change
@@ Expand Up / @@ -45,6 +45,7 @@ body: @@
           label: Version
           options:
             - trunk/main
+            - 7.2.16
             - 7.2.14
             - 7.2.12
             - 7.2.10
@@ Expand Down @@