* SECURITY UPDATE: avoid buffering the whole DTLS read buffer for a record arriving early for the next epoch (ssl/record/rec_layer_d1.c) - debian/patches/CVE-2026-54874.patch: dtls1_buffer_record() took over the entire live read buffer for every queued record and allocated a fresh one, pinning about 16.7 KB of heap per queued record however small the record actually was, across three queues capped at 100 entries each; copy only the record's own on-wire bytes into a right-sized allocation and restore them into the live read buffer on retrieval, in ssl/record/rec_layer_d1.c, ssl/record/record.h and ssl/record/ssl3_record.c - CVE-2026-54874 * Stop 30-test_afalg.t failing the armel build - debian/rules: exclude that one test recipe on armel, where the builder's io_setup(2) is not implemented so the AF_ALG engine cannot be exercised; the engine is still built and shipped and every other architecture still runs the test