diff --git a/libc/Android.mk b/libc/Android.mk
index c1a3dff..330bb6d 100644
--- a/libc/Android.mk
+++ b/libc/Android.mk
@@ -271,10 +271,12 @@
     upstream-netbsd/lib/libc/gen/psignal.c \
     upstream-netbsd/lib/libc/gen/utime.c \
     upstream-netbsd/lib/libc/gen/utmp.c \
+    upstream-netbsd/lib/libc/inet/nsap_addr.c \
     upstream-netbsd/lib/libc/regex/regcomp.c \
     upstream-netbsd/lib/libc/regex/regerror.c \
     upstream-netbsd/lib/libc/regex/regexec.c \
     upstream-netbsd/lib/libc/regex/regfree.c \
+    upstream-netbsd/lib/libc/resolv/mtctxres.c \
     upstream-netbsd/lib/libc/stdlib/bsearch.c \
     upstream-netbsd/lib/libc/stdlib/div.c \
     upstream-netbsd/lib/libc/stdlib/drand48.c \
diff --git a/libc/dns/gethnamaddr.c b/libc/dns/gethnamaddr.c
index 1afad6d..6f30f75 100644
--- a/libc/dns/gethnamaddr.c
+++ b/libc/dns/gethnamaddr.c
@@ -539,7 +539,7 @@
 	const int one = 1;
 	struct sockaddr_un proxy_addr;
 
-	sock = socket(AF_UNIX, SOCK_STREAM, 0);
+	sock = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
 	if (sock < 0) {
 		return NULL;
 	}
diff --git a/libc/dns/net/getaddrinfo.c b/libc/dns/net/getaddrinfo.c
index be692e3..65fd1c1 100644
--- a/libc/dns/net/getaddrinfo.c
+++ b/libc/dns/net/getaddrinfo.c
@@ -362,7 +362,7 @@
  */
 static int
 _test_connect(int pf, struct sockaddr *addr, size_t addrlen, unsigned mark) {
-	int s = socket(pf, SOCK_DGRAM, IPPROTO_UDP);
+	int s = socket(pf, SOCK_DGRAM | SOCK_CLOEXEC, IPPROTO_UDP);
 	if (s < 0)
 		return 0;
 	if (mark != MARK_UNSET && setsockopt(s, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0)
@@ -433,7 +433,7 @@
 		return EAI_NODATA;
 	}
 
-	sock = socket(AF_UNIX, SOCK_STREAM, 0);
+	sock = socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
 	if (sock < 0) {
 		return EAI_NODATA;
 	}
@@ -884,7 +884,7 @@
 	 * filter out AFs that are not supported by the kernel
 	 * XXX errno?
 	 */
-	s = socket(pai->ai_family, SOCK_DGRAM, 0);
+	s = socket(pai->ai_family, SOCK_DGRAM | SOCK_CLOEXEC, 0);
 	if (s < 0) {
 		if (errno != EMFILE)
 			return 0;
@@ -1792,7 +1792,7 @@
 		return 0;
 	}
 
-	sock = socket(addr->sa_family, SOCK_DGRAM, IPPROTO_UDP);
+	sock = socket(addr->sa_family, SOCK_DGRAM | SOCK_CLOEXEC, IPPROTO_UDP);
 	if (sock == -1) {
 		if (errno == EAFNOSUPPORT) {
 			return 0;
diff --git a/libc/dns/net/nsdispatch.c b/libc/dns/net/nsdispatch.c
index 15282be..fb6d8f6 100644
--- a/libc/dns/net/nsdispatch.c
+++ b/libc/dns/net/nsdispatch.c
@@ -69,26 +69,14 @@
  */
 
 #include <sys/cdefs.h>
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/stat.h>
 
 #include <assert.h>
-#ifdef __ELF__
-#include <dlfcn.h>
-#endif /* __ELF__ */
-#include <fcntl.h>
-#define _NS_PRIVATE
 #include <nsswitch.h>
 #include <stdarg.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
 #include <strings.h>
-#include <unistd.h>
 
 static nss_method
-_nsmethod(const char *source, const char *database, const char *method,
+_nsmethod(const char *source, const char *database __unused, const char *method __unused,
     const ns_dtab disp_tab[], void **cb_data)
 {
 	int	curdisp;
diff --git a/libc/dns/resolv/res_init.c b/libc/dns/resolv/res_init.c
index 9f3a9da..158466e 100644
--- a/libc/dns/resolv/res_init.c
+++ b/libc/dns/resolv/res_init.c
@@ -611,7 +611,7 @@
 static int
 real_randomid(u_int *random_value) {
 	/* open the nonblocking random device, returning -1 on failure */
-	int random_device = open("/dev/urandom", O_RDONLY);
+	int random_device = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
 	if (random_device < 0) {
 		return -1;
 	}
diff --git a/libc/dns/resolv/res_send.c b/libc/dns/resolv/res_send.c
index 9b36f55..b6a990a 100644
--- a/libc/dns/resolv/res_send.c
+++ b/libc/dns/resolv/res_send.c
@@ -779,7 +779,7 @@
 		if (statp->_vcsock >= 0)
 			res_nclose(statp);
 
-		statp->_vcsock = socket(nsap->sa_family, SOCK_STREAM, 0);
+		statp->_vcsock = socket(nsap->sa_family, SOCK_STREAM | SOCK_CLOEXEC, 0);
 		if (statp->_vcsock > highestFD) {
 			res_nclose(statp);
 			errno = ENOTSOCK;
@@ -1062,7 +1062,7 @@
 	nsap = get_nsaddr(statp, (size_t)ns);
 	nsaplen = get_salen(nsap);
 	if (EXT(statp).nssocks[ns] == -1) {
-		EXT(statp).nssocks[ns] = socket(nsap->sa_family, SOCK_DGRAM, 0);
+		EXT(statp).nssocks[ns] = socket(nsap->sa_family, SOCK_DGRAM | SOCK_CLOEXEC, 0);
 		if (EXT(statp).nssocks[ns] > highestFD) {
 			res_nclose(statp);
 			errno = ENOTSOCK;
diff --git a/libc/dns/include/nsswitch.h b/libc/include/nsswitch.h
similarity index 91%
rename from libc/dns/include/nsswitch.h
rename to libc/include/nsswitch.h
index e03844b..af88433 100644
--- a/libc/dns/include/nsswitch.h
+++ b/libc/include/nsswitch.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: nsswitch.h,v 1.18 2005/11/29 03:12:58 christos Exp $	*/
+/*	$NetBSD: nsswitch.h,v 1.21 2011/07/17 20:54:34 joerg Exp $	*/
 
 /*-
  * Copyright (c) 1997, 1998, 1999, 2004 The NetBSD Foundation, Inc.
@@ -15,13 +15,6 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *        This product includes software developed by the NetBSD
- *        Foundation, Inc. and its contributors.
- * 4. Neither the name of The NetBSD Foundation nor the names of its
- *    contributors may be used to endorse or promote products derived
- *    from this software without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
@@ -137,6 +130,7 @@
 #else
 #   define NS_NIS_CB(F,C)
 #endif
+#define	NS_NULL_CB		{ .src = NULL },
 
 /*
  * ns_src - `nsswitch source'
@@ -149,7 +143,6 @@
 } ns_src;
 
 
-#if 0
 /*
  * Default sourcelists (if nsswitch.conf is missing, corrupt,
  * or the requested database doesn't have an entry)
@@ -161,7 +154,7 @@
 extern const ns_src __nsdefaultfiles_forceall[];
 extern const ns_src __nsdefaultnis[];
 extern const ns_src __nsdefaultnis_forceall[];
-#endif
+
 
 /*
  * ns_mtab - `nsswitch method table'
@@ -222,7 +215,7 @@
 
 __BEGIN_DECLS
 int	nsdispatch(void *, const ns_dtab [], const char *,
-			const char *, const ns_src [], ...);
+			const char *, const ns_src [], ...) __LIBC_ABI_PUBLIC__;
 
 #ifdef _NS_PRIVATE
 int		 _nsdbtaddsrc(ns_dbt *, const ns_src *);
diff --git a/libc/upstream-netbsd/lib/libc/include/resolv_mt.h b/libc/upstream-netbsd/lib/libc/include/resolv_mt.h
new file mode 100644
index 0000000..73a8dcc
--- /dev/null
+++ b/libc/upstream-netbsd/lib/libc/include/resolv_mt.h
@@ -0,0 +1,49 @@
+/*	$NetBSD: resolv_mt.h,v 1.1.1.3 2009/04/12 16:35:44 christos Exp $	*/
+
+#ifndef _RESOLV_MT_H
+#define _RESOLV_MT_H
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <resolv.h>
+
+/* Access functions for the libresolv private interface */
+
+int	__res_enable_mt(void);
+int	__res_disable_mt(void);
+
+/* Per-thread context */
+
+typedef struct {
+int	no_hosts_fallback_private;
+int	retry_save;
+int	retry_private;
+char	inet_nsap_ntoa_tmpbuf[255*3];
+char	sym_ntos_unname[20];
+char	sym_ntop_unname[20];
+char	p_option_nbuf[40];
+char	p_time_nbuf[40];
+char	precsize_ntoa_retbuf[sizeof "90000000.00"];
+char	loc_ntoa_tmpbuf[sizeof
+"1000 60 60.000 N 1000 60 60.000 W -12345678.00m 90000000.00m 90000000.00m 90000000.00m"];
+char	p_secstodate_output[15];
+} mtctxres_t;
+
+/* Thread-specific data (TSD) */
+
+mtctxres_t	*___mtctxres(void);
+#define mtctxres	(___mtctxres())
+
+/* Various static data that should be TSD */
+
+#define sym_ntos_unname		(mtctxres->sym_ntos_unname)
+#define sym_ntop_unname		(mtctxres->sym_ntop_unname)
+#define inet_nsap_ntoa_tmpbuf	(mtctxres->inet_nsap_ntoa_tmpbuf)
+#define p_option_nbuf		(mtctxres->p_option_nbuf)
+#define p_time_nbuf		(mtctxres->p_time_nbuf)
+#define precsize_ntoa_retbuf	(mtctxres->precsize_ntoa_retbuf)
+#define loc_ntoa_tmpbuf		(mtctxres->loc_ntoa_tmpbuf)
+#define p_secstodate_output	(mtctxres->p_secstodate_output)
+
+#endif /* _RESOLV_MT_H */
diff --git a/libc/dns/inet/nsap_addr.c b/libc/upstream-netbsd/lib/libc/inet/nsap_addr.c
similarity index 81%
rename from libc/dns/inet/nsap_addr.c
rename to libc/upstream-netbsd/lib/libc/inet/nsap_addr.c
index 4deabac..8633205 100644
--- a/libc/dns/inet/nsap_addr.c
+++ b/libc/upstream-netbsd/lib/libc/inet/nsap_addr.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: nsap_addr.c,v 1.2 2004/05/20 23:12:33 christos Exp $	*/
+/*	$NetBSD: nsap_addr.c,v 1.6 2009/04/12 17:07:17 christos Exp $	*/
 
 /*
  * Copyright (c) 2004 by Internet Systems Consortium, Inc. ("ISC")
@@ -20,12 +20,15 @@
 #include <sys/cdefs.h>
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
-static const char rcsid[] = "Id: nsap_addr.c,v 1.2.206.1 2004/03/09 08:33:33 marka Exp";
+static const char rcsid[] = "Id: nsap_addr.c,v 1.5 2005/07/28 06:51:48 marka Exp";
 #else
-__RCSID("$NetBSD: nsap_addr.c,v 1.2 2004/05/20 23:12:33 christos Exp $");
+__RCSID("$NetBSD: nsap_addr.c,v 1.6 2009/04/12 17:07:17 christos Exp $");
 #endif
 #endif /* LIBC_SCCS and not lint */
 
+#include "port_before.h"
+
+#include "namespace.h"
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/socket.h>
@@ -36,10 +39,14 @@
 
 #include <assert.h>
 #include <ctype.h>
-#ifdef ANDROID_CHANGES
-#include "resolv_private.h"
-#else
 #include <resolv.h>
+#include <resolv_mt.h>
+
+#include "port_after.h"
+
+#ifdef __weak_alias
+__weak_alias(inet_nsap_addr,_inet_nsap_addr)
+__weak_alias(inet_nsap_ntoa,_inet_nsap_ntoa)
 #endif
 
 static char
@@ -52,8 +59,8 @@
 	u_char c, nib;
 	u_int len = 0;
 
-	assert(ascii != NULL);
-	assert(binary != NULL);
+	_DIAGASSERT(ascii != NULL);
+	_DIAGASSERT(binary != NULL);
 
 	if (ascii[0] != '0' || (ascii[1] != 'x' && ascii[1] != 'X'))
 		return (0);
@@ -90,10 +97,10 @@
 inet_nsap_ntoa(int binlen, const u_char *binary, char *ascii) {
 	int nib;
 	int i;
-	static char tmpbuf[2+255*3];
+	char *tmpbuf = inet_nsap_ntoa_tmpbuf;
 	char *start;
 
-	assert(binary != NULL);
+	_DIAGASSERT(binary != NULL);
 
 	if (ascii)
 		start = ascii;
@@ -119,3 +126,5 @@
 	*ascii = '\0';
 	return (start);
 }
+
+/*! \file */
diff --git a/libc/upstream-netbsd/lib/libc/resolv/mtctxres.c b/libc/upstream-netbsd/lib/libc/resolv/mtctxres.c
new file mode 100644
index 0000000..6e3281a
--- /dev/null
+++ b/libc/upstream-netbsd/lib/libc/resolv/mtctxres.c
@@ -0,0 +1,130 @@
+/*	$NetBSD: mtctxres.c,v 1.4 2007/03/30 20:40:52 ghen Exp $	*/
+
+#include <port_before.h>
+#ifdef DO_PTHREADS
+#include <pthread.h>
+#endif
+#include <errno.h>
+#include <netdb.h>
+#include <stdlib.h>
+#include <string.h>
+#include <resolv_mt.h>
+#include <port_after.h>
+
+#ifdef DO_PTHREADS
+static pthread_key_t	key;
+static int		mt_key_initialized = 0;
+
+static int		__res_init_ctx(void);
+static void		__res_destroy_ctx(void *);
+
+#if defined(sun) && !defined(__GNUC__)
+#pragma init	(_mtctxres_init)
+#endif
+#endif
+
+static mtctxres_t	sharedctx;
+
+#ifdef DO_PTHREADS
+/*
+ * Initialize the TSD key. By doing this at library load time, we're
+ * implicitly running without interference from other threads, so there's
+ * no need for locking.
+ */
+static void
+_mtctxres_init(void) {
+	int pthread_keycreate_ret;
+
+	pthread_keycreate_ret = pthread_key_create(&key, __res_destroy_ctx);
+	if (pthread_keycreate_ret == 0)
+		mt_key_initialized = 1;
+}
+#endif
+
+/*
+ * To support binaries that used the private MT-safe interface in
+ * Solaris 8, we still need to provide the __res_enable_mt()
+ * and __res_disable_mt() entry points. They're do-nothing routines.
+ */
+int
+__res_enable_mt(void) {
+	return (-1);
+}
+
+int
+__res_disable_mt(void) {
+	return (0);
+}
+
+#ifdef DO_PTHREADS
+static int
+__res_init_ctx(void) {
+
+	mtctxres_t	*mt;
+	int		ret;
+
+
+	if (pthread_getspecific(key) != 0) {
+		/* Already exists */
+		return (0);
+	}
+
+	if ((mt = malloc(sizeof (mtctxres_t))) == 0) {
+		errno = ENOMEM;
+		return (-1);
+	}
+
+	memset(mt, 0, sizeof (mtctxres_t));
+
+	if ((ret = pthread_setspecific(key, mt)) != 0) {
+		free(mt);
+		errno = ret;
+		return (-1);
+	}
+
+	return (0);
+}
+
+static void
+__res_destroy_ctx(void *value) {
+
+	mtctxres_t	*mt = (mtctxres_t *)value;
+
+	if (mt != 0)
+		free(mt);
+}
+#endif
+
+mtctxres_t *
+___mtctxres(void) {
+#ifdef DO_PTHREADS
+	mtctxres_t	*mt;
+
+	/*
+	 * This if clause should only be executed if we are linking
+	 * statically.  When linked dynamically _mtctxres_init() should
+	 * be called at binding time due the #pragma above.
+	 */
+	if (!mt_key_initialized) {
+		static pthread_mutex_t keylock = PTHREAD_MUTEX_INITIALIZER;
+                if (pthread_mutex_lock(&keylock) == 0) {
+			_mtctxres_init();
+			(void) pthread_mutex_unlock(&keylock);
+		}
+	}
+
+	/*
+	 * If we have already been called in this thread return the existing
+	 * context.  Otherwise recreat a new context and return it.  If
+	 * that fails return a global context.
+	 */
+	if (mt_key_initialized) {
+		if (((mt = pthread_getspecific(key)) != 0) ||
+		    (__res_init_ctx() == 0 &&
+		     (mt = pthread_getspecific(key)) != 0)) {
+			return (mt);
+		}
+	}
+#endif
+	return (&sharedctx);
+}
diff --git a/linker/dlfcn.cpp b/linker/dlfcn.cpp
index 0b60ef5..529e20f 100644
--- a/linker/dlfcn.cpp
+++ b/linker/dlfcn.cpp
@@ -100,9 +100,9 @@
 
   soinfo* found = NULL;
   ElfW(Sym)* sym = NULL;
-  if (handle == RTLD_DEFAULT || handle == (void*)0xffffffffL) {
+  if (handle == RTLD_DEFAULT) {
     sym = dlsym_linear_lookup(symbol, &found, NULL);
-  } else if (handle == RTLD_NEXT || handle == (void*)0xfffffffeL) {
+  } else if (handle == RTLD_NEXT) {
     void* caller_addr = __builtin_return_address(0);
     soinfo* si = find_containing_library(caller_addr);
 
diff --git a/linker/linker.cpp b/linker/linker.cpp
index e202aaf..4588948 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -669,8 +669,7 @@
     }
     // ...but nvidia binary blobs (at least) rely on this behavior, so fall through for now.
 #if defined(__LP64__)
-    // TODO: uncomment this after bug b/7465467 is fixed.
-    // return -1;
+    return -1;
 #endif
   }
 
@@ -1930,10 +1929,8 @@
     if (si->has_text_relocations) {
         // Make segments writable to allow text relocations to work properly. We will later call
         // phdr_table_protect_segments() after all of them are applied and all constructors are run.
-#if !defined(__i386__) // The platform itself has too many text relocations on x86.
         DL_WARN("%s has text relocations. This is wasting memory and prevents "
                 "security hardening. Please fix.", si->name);
-#endif
         if (phdr_table_unprotect_segments(si->phdr, si->phnum, si->load_bias) < 0) {
             DL_ERR("can't unprotect loadable segments for \"%s\": %s",
                    si->name, strerror(errno));
diff --git a/tests/string_test.cpp b/tests/string_test.cpp
index 2ab60d7..bc2c05b 100644
--- a/tests/string_test.cpp
+++ b/tests/string_test.cpp
@@ -359,6 +359,24 @@
   EXPECT_TRUE(strchr(buf, '\0') == (buf + strlen(s)));
 }
 
+TEST(string, strchr_multiple) {
+  char str[128];
+  memset(str, 'a', sizeof(str) - 1);
+  str[sizeof(str)-1] = '\0';
+
+  // Verify that strchr finds the first occurrence of 'a' in a string
+  // filled with 'a' characters. Iterate over the string putting
+  // non 'a' characters at the front of the string during each iteration
+  // and continue to verify that strchr can find the first occurrence
+  // properly. The idea is to cover all possible alignments of the location
+  // of the first occurrence of the 'a' character and which includes
+  // other 'a' characters close by.
+  for (size_t i = 0; i < sizeof(str) - 1; i++) {
+    EXPECT_EQ(&str[i], strchr(str, 'a'));
+    str[i] = 'b';
+  }
+}
+
 TEST(string, strchr) {
   int seek_char = random() & 255;
 
@@ -1235,3 +1253,29 @@
 TEST(string, memcmp_overread) {
   RunCmpBufferOverreadTest(DoMemcmpTest, DoMemcmpFailTest);
 }
+
+static void DoStrchrTest(uint8_t* buf, size_t len) {
+  if (len >= 1) {
+    char value = 32 + (len % 96);
+    char search_value = 33 + (len % 96);
+    memset(buf, value, len - 1);
+    buf[len-1] = '\0';
+    ASSERT_EQ(NULL, strchr(reinterpret_cast<char*>(buf), search_value));
+    ASSERT_EQ(reinterpret_cast<char*>(&buf[len-1]), strchr(reinterpret_cast<char*>(buf), '\0'));
+    if (len >= 2) {
+      buf[0] = search_value;
+      ASSERT_EQ(reinterpret_cast<char*>(&buf[0]), strchr(reinterpret_cast<char*>(buf), search_value));
+      buf[0] = value;
+      buf[len-2] = search_value;
+      ASSERT_EQ(reinterpret_cast<char*>(&buf[len-2]), strchr(reinterpret_cast<char*>(buf), search_value));
+    }
+  }
+}
+
+TEST(string, strchr_align) {
+  RunSingleBufferAlignTest(MEDIUM, DoStrchrTest);
+}
+
+TEST(string, strchr_overread) {
+  RunSingleBufferOverreadTest(DoStrchrTest);
+}