OpenBSD 8.0 Adds 64-vCPU VMs as Experimental 64-Bit Wine Port Emerges

The release at a glance​

OpenBSD 8.0 arrived right after the Wine port news. The project's homepage says the release is the project's 61st, and the official release page dates it to October 20, 2026. The homepage still carries the long-running boast of only two remote holes in the default install.

The release notes call their feature list partial and point readers to the full changelog. The Register's coverage frames 8.0 as an evolutionary release rather than a radical break. The round number is mostly a milestone.

Virtual machines: the 64-vCPU ceiling​

The headline change for IT readers is in the VMM/VMD hypervisor. The release notes list multiprocessor support for up to 64 virtual CPUs per guest VM. The OpenBSD 8.0 vm.conf(5) manual confirms the practical effect. The cpus setting in a VM block defaults to 1 and now has a maximum of 64.

A minimal example, based on the manual's syntax, looks like this:

vm "example.vm" {
    cpus 8
    memory 4G
    disk "/home/joe/example.img"
}

The same manual page lets an administrator allow non-root users to set cpus on VM instances, through the allow instance block. The release notes list other VMM/VMD work:

• VM ownership is now managed using files.
• Guests get x2apic mode support.
• Checksum offload is added for vmd guests.
• Missing lapic/ioapic modes are implemented. This fixes vmd support for 32-bit Linux guests.
• vmd now guards against out-of-bounds reads when loading malformed ELF kernels.

A higher vCPU limit is a ceiling, not a performance promise. Guests still depend on host cores, workload parallelism and memory. Anyone hosting guests should test before assuming a larger VM runs faster.

Hardware, graphics and platform changes​

• Kernel address space (amd64): the release notes say the amd64 kernel virtual address space grew from 4 GB to 512 GB. They tie this to inteldrm, saying the larger space allows mapping more than 4 GB of VRAM.
• Graphics: the DRM drivers now track Linux 6.18.53. Slashdot, relaying Linuxiac's report, says this adds support for Intel Arc A-Series (Alchemist) cards.
• Encrypted swap: both amd64 and arm64 use CPU AES instructions to speed up swap encryption.
• arm64 hibernation: support for hibernating on arm64 is new.
• Architectures: the release notes say support for loongson was retired because it does not work with Clang 22. They also list RISC-V work, including the 'V' vector extension and new interrupt drivers.
• Components: the release page lists LibreSSL 4.4.0, OpenSSH 10.6 and LLVM/Clang 22.1.6.

Errata: four patches already​

The Register says the errata list is short, with four fixes. The official errata page confirms this. It listed four patches, all dated October 20, 2026:

1. 001 (reliability): an off-by-one error in ppp(4) could lead to an out-of-bounds write.
2. 002 (security): backported fixes from nsd(8) 4.15.3.
3. 003 (security): a remotely triggerable kernel heap overflow when IPsec uses AES-GMAC. Only amd64 with AES-NI and octeon with the crypto coprocessor are affected. AES-GCM is not.
4. 004 (security): multiple bugs in video(4) could cause use-after-free and kernel memory corruption.

Administrators should apply these. The errata page says syspatch(8) delivers binary updates on amd64, i386 and arm64. Other architectures get only rare machine-independent updates. Patches are also folded into the -stable branch, which is maintained for one year after release. Errata lists grow over time, so check the page again rather than relying on this count.

The Wine port: what it is and isn't​

A couple of days before the release, OpenBSD developer Thomas Frohwein posted a port proposal for Wine to the openbsd-ports mailing list. Linuxiac reports he called it possibly the most surprising port proposal of the year. Its status matters:

• Linuxiac says Wine has not been officially accepted into the OpenBSD ports collection. The submission is a work in progress, offered for testing, feedback and review.
• The Register describes it as a 64-bit Wine 11 build for OpenBSD on x86-64.
• It does not ship with OpenBSD 8.0.

Why it was hard​

Windows on x86-64 uses the GS segment base to find the Thread Environment Block. OpenBSD does not let userland set that. According to Adafruit's write-up, the workaround emulates the %gs prefix on instructions in software, which unblocked the rest of the port. The Register adds two consequences:

• 32-bit code does not work.
• Because Linux doesn't need the workaround, the code is unlikely to be merged back into upstream Wine. That is the Register's assessment, not a decision by the Wine project.

What works and what doesn't​

• Testing reported: Frohwein says several dozen 64-bit Windows programs were tested, mostly successfully. He says the Witcher 3 remaster runs well when vkd3d-proton is added. These are the developer's early results, not an independent benchmark.
• 32-bit software: WoW64 does not work, so 32-bit Windows programs will not run. Adafruit suggests checking a binary with file(1). If it reports a 32-bit Intel 80386 PE, it is out.
• Test suite: Adafruit says the built-in tests are disabled for now. They need an X server and several hang.
• First try: Linuxiac says Frohwein suggests 64-bit Notepad++ as a light first test.

An OpenNews commenter argued that a 32-bit path is unlikely because it would need user-level control of processor descriptor tables, which OpenBSD disallows for security reasons. That is one commenter's view, but it fits the port's stated constraints.

The security caveat​

The Register notes the port comes with a warning: Wine does not sandbox anything. Running Windows binaries could therefore expose an OpenBSD machine to Windows malware. Reporting on the proposal says Frohwein recommends a separate unprivileged user account. Adafruit adds that unveil(2) fencing is still an open question.

A separate user reduces exposure, but it is not a sandbox. Wine has never been a security boundary on any platform, and nothing here changes that. Treat this as an experiment for known software, not a way to open unknown downloads on a hardened box.

What this means for Windows users​

OpenBSD readers get two separate stories:

For Windows admins, the practical takeaways are modest:

• OpenBSD's hypervisor is now a more credible host for larger guests, though it remains a niche choice next to Hyper-V or KVM.
• The Wine port is a curiosity. It will not replace Windows, and it is not aimed at running business software.
• Anyone testing 8.0 should apply the four errata first.

Brief notes on the rest​

The Register also covers the release's anti-AI theme, with mascot artwork and a theme song titled "The Simps on AI." The release page credits the song and artwork. The Register also links the release to the recent "Big Fish" research by Calif, which describes an old shared-memory bug chained with a kernel flaw. I couldn't confirm those details independently, so I'm not repeating them here.

OpenBSD 8.0 is a solid, security-minded update. The Wine port is the more novel story, but it is still a proposal with real limits.