Pull up following revision(s) (requested by maxv in ticket #1114):
	sys/netinet6/ip6_output.c			1.158 via patch

Fix a memory leak in calling setsockopt() on an INET6 socket.
Pull up following revision(s) (requested by maxv in ticket #1115):
	sys/miscfs/umapfs/umap_vfsops.c: revision 1.94
	sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.52
Overflow if *data_len == OSIZE and args->version >= PTYFS_ARGSVERSION.
Sent on tech-kern@, ok christos@
1) 'error' is returned while it does not even hold an error code. Which
   means that zero is returned, and the kernel keeps mounting (and it
   probably ends up in a deadlock/memory corruption somewhere).
2) 'nentries' and 'gnentries' are int and user-controlled, and there's no
   check to ensure they are greater than zero. Since they are used to
   compute the size of two copyin's, a user can control the copied size
   by giving a negative value (like 128-2^29), and thus overwrite kernel
   memory.
Both triggerable from root only.
Pull up following revision(s) (requested by maxv in ticket #1141):
	sys/compat/osf1/osf1_file.c: revision 1.42
Ensure nbytes > 0. Otherwise bad things may happen.
Compile-tested only.
ok christos@
Ticket 1114-1115 and 1141.