--- old/usr/src/lib/libipsecutil/common/ipsec_util.c	Wed Jan 10 10:38:06 2018
+++ new/usr/src/lib/libipsecutil/common/ipsec_util.c	Wed Jan 10 10:38:06 2018
@@ -2602,12 +2602,15 @@
 			cookie_label =
 			    dgettext(TEXT_DOMAIN, "<Label not found.>");
 		(void) fprintf(file, dgettext(TEXT_DOMAIN,
-		    "%sProtocol %u, cookie=\"%s\" (%u)\n"), prefix,
+		    "%s Protocol %u, cookie=\"%s\" (%u)\n"), prefix,
 		    kmc->sadb_x_kmc_proto, cookie_label,
 		    kmc->sadb_x_kmc_cookie);
 		return;
+	case SADB_X_KMP_KINK:
+		cookie_label = dgettext(TEXT_DOMAIN, "KINK:");
+		break;
 	case SADB_X_KMP_MANUAL:
-		cookie_label = dgettext(TEXT_DOMAIN, "Manual SA with cookie");
+		cookie_label = dgettext(TEXT_DOMAIN, "Manual SA with cookie:");
 		break;
 	/* case SADB_X_KMP_IKEV2: */
 	default:
@@ -2616,9 +2619,12 @@
 		break;
 	}
 
-	/* XXX KEBE ASKS... htonll() on generic kmc_cookie? */
+	/*
+	 * Assume native-byte-order printing for now.  Exceptions (like
+	 * byte-swapping) should be handled in per-KM-protocol cases above.
+	 */
 	(void) fprintf(file, dgettext(TEXT_DOMAIN,
-	    "%sProtocol %u, cookie=\"%s\" (0x%"PRIx64"/%"PRIu64")\n"),
+	    "%s Protocol %u, cookie=\"%s\" (0x%"PRIx64"/%"PRIu64")\n"),
 	    prefix, kmc->sadb_x_kmc_proto, cookie_label,
 	    kmc->sadb_x_kmc_cookie64, kmc->sadb_x_kmc_cookie64);
 }
--- old/usr/src/test/os-tests/tests/pf_key/kmc-update.sh	Wed Jan 10 10:38:10 2018
+++ new/usr/src/test/os-tests/tests/pf_key/kmc-update.sh	Wed Jan 10 10:38:10 2018
@@ -15,7 +15,7 @@
 # Copyright (c) 2017 Joyent, Inc.
 #
 
-if [ `id -u` -ne 0 ]; then
+if [[ `id -u` -ne 0 ]]; then
 	echo "Need to be root or have effective UID of root."
 	exit 255
 fi
--- old/usr/src/test/os-tests/tests/pf_key/kmc-updater.c	Wed Jan 10 10:38:14 2018
+++ new/usr/src/test/os-tests/tests/pf_key/kmc-updater.c	Wed Jan 10 10:38:14 2018
@@ -26,6 +26,10 @@
 #define	COOKIE32 0x90125
 #define	RESERVED 0xc0ffee
 
+#define	EXIT_SETUP_FAIL -1
+#define	EXIT_TEST_FAIL 1
+#define	EXIT_SUCCESS 0
+
 /*
  * Exits app on failure.
  */
@@ -33,7 +37,7 @@
 write_and_read(int s, sadb_msg_t *samsg, uint64_t *readbuf, int readlen,
     char *msgtypestr)
 {
-	int rc;
+	ssize_t rc;
 	uint8_t msgtype = samsg->sadb_msg_type;
 	pid_t pid = samsg->sadb_msg_pid;
 	uint8_t seq = samsg->sadb_msg_seq;
@@ -40,7 +44,7 @@
 
 	rc = write(s, samsg, SADB_64TO8(samsg->sadb_msg_len));
 	if (rc == -1)
-		err(-1, "%s write error", msgtypestr);
+		err(EXIT_SETUP_FAIL, "%s write error", msgtypestr);
 
 	/* Yes, parameter re-use, but we're done writing. */
 	samsg = (sadb_msg_t *)readbuf;
@@ -47,14 +51,14 @@
 	do {
 		rc = read(s, readbuf, readlen);
 		if (rc == -1)
-			err(-1, "%s read reply error", msgtypestr);
+			err(EXIT_SETUP_FAIL, "%s read reply error", msgtypestr);
 	} while (samsg->sadb_msg_seq != seq || samsg->sadb_msg_pid != pid ||
 	    samsg->sadb_msg_type != msgtype);
 
 	if (samsg->sadb_msg_errno != 0) {
 		errno = samsg->sadb_msg_errno;
-		err(-1, "%s reply has error (diag = %d)", msgtypestr,
-		    samsg->sadb_x_msg_diagnostic);
+		err(EXIT_SETUP_FAIL, "%s reply has error (diag = %d)",
+		    msgtypestr, samsg->sadb_x_msg_diagnostic);
 	}
 }
 
@@ -78,24 +82,25 @@
 	if (argc != 2 && argc != 3) {
 		(void) fprintf(stderr, "Usage: %s <spi-value> {64}\n",
 		    argv[0]);
-		exit(-1);
+		exit(EXIT_SETUP_FAIL);
 	}
 	do_64_test = (argc == 3);
 
+	errno = 0;	/* Clear for strtoul() call. */
 	spi = strtoul(argv[1], NULL, 0);
 	if (spi == 0) {
 		if (errno != 0) {
-			err(-1, "Argument %s is not a parsable number:",
-			    argv[1]);
+			err(EXIT_SETUP_FAIL,
+			    "Argument %s is not a parsable number:", argv[1]);
 		} else {
 			errno = EINVAL;
-			err(-1, "Zero SPI not allowed:");
+			err(EXIT_SETUP_FAIL, "Zero SPI not allowed:");
 		}
 	}
 
 	s = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
 	if (s == -1)
-		err(-1, "socket(PF_KEY)");
+		err(EXIT_SETUP_FAIL, "socket(PF_KEY)");
 
 	/* Base message. */
 	samsg = (sadb_msg_t *)writebuf;
@@ -185,7 +190,7 @@
 
 	if (extptr == endptr) {
 		(void) fprintf(stderr, "Can't find KMC extension in reply.\n");
-		exit(-1);
+		exit(EXIT_SETUP_FAIL);
 	}
 	kmcext = (sadb_x_kmc_t *)extptr;
 
@@ -198,7 +203,7 @@
 			(void) fprintf(stderr, "64-bit cookie recevied was "
 			    "0x%"PRIx64", expecting 0x%"PRIx64"\n",
 			    kmcext->sadb_x_kmc_cookie64, COOKIE64);
-			exit(1);
+			exit(EXIT_TEST_FAIL);
 		}
 	} else {
 		if (kmcext->sadb_x_kmc_proto != SADB_X_KMP_IKE ||
@@ -213,9 +218,9 @@
 			(void) fprintf(stderr, "32-bit reserved recevied was "
 			    "0x%"PRIx32", expecting 0\n",
 			    kmcext->sadb_x_kmc_cookie64);
-			exit(1);
+			exit(EXIT_TEST_FAIL);
 		}
 	}
 
-	exit(0);
+	exit(EXIT_SUCCESS);
 }
--- old/usr/src/uts/common/inet/ip/sadb.c	Wed Jan 10 10:38:18 2018
+++ new/usr/src/uts/common/inet/ip/sadb.c	Wed Jan 10 10:38:18 2018
@@ -2330,7 +2330,12 @@
 
 	if ((match & IPSA_Q_KMC) && (sq->kmcext)) {
 		sq->kmp = sq->kmcext->sadb_x_kmc_proto;
-		/* Be liberal in what we receive.  Special-case IKEv1. */
+		/*
+		 * Be liberal in what we receive.  Special-case the IKEv1
+		 * cookie, which closed-source in.iked assumes is 32 bits.
+		 * Now that we store all 64 bits, we should pre-zero the
+		 * reserved field on behalf of closed-source in.iked.
+		 */
 		if (sq->kmp == SADB_X_KMP_IKE) {
 			/* Just in case in.iked is misbehaving... */
 			sq->kmcext->sadb_x_kmc_reserved = 0;
@@ -3137,7 +3142,12 @@
 
 	if (kmcext != NULL) {
 		newbie->ipsa_kmp = kmcext->sadb_x_kmc_proto;
-		/* Be liberal in what we receive.  Special-case IKEv1. */
+		/*
+		 * Be liberal in what we receive.  Special-case the IKEv1
+		 * cookie, which closed-source in.iked assumes is 32 bits.
+		 * Now that we store all 64 bits, we should pre-zero the
+		 * reserved field on behalf of closed-source in.iked.
+		 */
 		if (newbie->ipsa_kmp == SADB_X_KMP_IKE) {
 			/* Just in case in.iked is misbehaving... */
 			kmcext->sadb_x_kmc_reserved = 0;
