--- old/usr/src/man/man1/psecflags.1	2016-08-29 10:16:14.527493500 -0400
+++ new/usr/src/man/man1/psecflags.1	2016-08-29 10:16:14.584446809 -0400
@@ -273,7 +273,7 @@
 .TP
 \fBnon-zero\fR
 .IP
-An error has occured.
+An error has occurred. 
 
 .SH "ATTRIBUTES"
 .LP
--- old/usr/src/test/os-tests/tests/secflags/secflags_core.sh	2016-08-29 10:16:16.359370908 -0400
+++ new/usr/src/test/os-tests/tests/secflags/secflags_core.sh	2016-08-29 10:16:16.408651516 -0400
@@ -47,6 +47,7 @@
 
 ## kernel-produced core
 kill -SEGV $pid
+wait $pid >/dev/null 2>&1
 
 cat > core-expected.$$ <<EOF
 core 'core' of $pid:	sleep 100000
--- old/usr/src/test/os-tests/tests/secflags/secflags_dts.sh	2016-08-29 10:16:17.334141809 -0400
+++ new/usr/src/test/os-tests/tests/secflags/secflags_dts.sh	2016-08-29 10:16:17.370032536 -0400
@@ -46,11 +46,12 @@
 check() {
     bin=$1
     state=$2
+    set=$3
     ret=0
 
     $bin &
     pid=$!
-    psecflags $pid | grep -q 'E:.*aslr'
+    psecflags $pid | grep -q "${set}:.*aslr"
     (( $? != $state )) && ret=1
     kill -9 $pid
     return $ret
@@ -62,10 +63,11 @@
 }
 
 psecflags -s none $$
-check ./tester-aslr 0 || fail "DT_SUNW_ASLR 1 failed"
-check ./many-dts-aslr 0 || fail "DT_SUNW_ASLR 1 with many DTs failed"
+check ./tester-aslr 0 E || fail "DT_SUNW_ASLR 1 failed"
+check ./many-dts-aslr 0 E || fail "DT_SUNW_ASLR 1 with many DTs failed"
+check ./tester-aslr 1 I || fail "DT_SUNW_ASLR 1 incorrectly set the inheritable flag"
 
 psecflags -s aslr $$
-check ./tester-noaslr 1 || fail "DT_SUNW_ASLR 0 failed"
-check ./many-dts-noaslr 1 || fail "DT_SUNW_ASLR 0 with many DTs failed"
+check ./tester-noaslr 1 E || fail "DT_SUNW_ASLR 0 failed"
+check ./many-dts-noaslr 1 E || fail "DT_SUNW_ASLR 0 with many DTs failed"
 
--- old/usr/src/test/os-tests/tests/secflags/secflags_elfdump.sh	2016-08-29 10:16:18.294936436 -0400
+++ new/usr/src/test/os-tests/tests/secflags/secflags_elfdump.sh	2016-08-29 10:16:18.330828654 -0400
@@ -55,6 +55,7 @@
 
 ## kernel-produced core
 kill -SEGV $pid
+wait $pid >/dev/null 2>&1
 
 cat > core-expected.$$ <<EOF
     namesz: 0x5
--- old/usr/src/uts/common/exec/elf/elf.c	2016-08-29 10:16:19.299787653 -0400
+++ new/usr/src/uts/common/exec/elf/elf.c	2016-08-29 10:16:19.337266550 -0400
@@ -185,7 +185,6 @@
 		    secflag_isset(p->p_secflags.psf_inherit, flag))
 			return (EPERM);
 
-		secflag_clear(&p->p_secflags.psf_inherit, flag);
 		secflag_clear(&p->p_secflags.psf_effective, flag);
 	} else {
 		if (!secflag_isset(p->p_secflags.psf_upper, flag))
@@ -195,7 +194,6 @@
 		    !secflag_isset(p->p_secflags.psf_inherit, flag))
 			return (EPERM);
 
-		secflag_set(&p->p_secflags.psf_inherit, flag);
 		secflag_set(&p->p_secflags.psf_effective, flag);
 	}
 
--- old/usr/src/uts/common/os/grow.c	2016-08-29 10:16:20.915350913 -0400
+++ new/usr/src/uts/common/os/grow.c	2016-08-29 10:16:20.951961686 -0400
@@ -62,6 +62,12 @@
 int use_brk_lpg = 1;
 int use_stk_lpg = 1;
 
+/*
+ * If set, we will not randomize mappings where the 'addr' argument is
+ * non-NULL and not an alignment.
+ */
+int aslr_respect_mmap_hint = 0;
+
 static int brk_lpg(caddr_t nva);
 static int grow_lpg(caddr_t sp);
 
@@ -72,18 +78,21 @@
 	proc_t *p = curproc;
 
 	/*
-	 * As a special case to aid the implementation of sbrk(3C), if given a
-	 * new brk of 0, return the current brk.  We'll hide this in brk(3C).
-	 */
-	if (nva == 0)
-		return ((intptr_t)(p->p_brkbase + p->p_brksize));
-
-	/*
 	 * Serialize brk operations on an address space.
 	 * This also serves as the lock protecting p_brksize
 	 * and p_brkpageszc.
 	 */
 	as_rangelock(p->p_as);
+
+	/*
+	 * As a special case to aid the implementation of sbrk(3C), if given a
+	 * new brk of 0, return the current brk.  We'll hide this in brk(3C).
+	 */
+	if (nva == 0) {
+		as_rangeunlock(p->p_as);
+		return ((intptr_t)(p->p_brkbase + p->p_brksize));
+	}
+
 	if (use_brk_lpg && (p->p_flag & SAUTOLPG) != 0) {
 		error = brk_lpg(nva);
 	} else {
@@ -595,6 +604,9 @@
 	return (as_map(as, *addrp, len, segvn_create, &vn_a));
 }
 
+#define	RANDOMIZABLE_MAPPING(addr, flags) (((flags & MAP_FIXED) == 0) && \
+	!(((flags & MAP_ALIGN) == 0) && (addr != 0) && aslr_respect_mmap_hint))
+
 static int
 smmap_common(caddr_t *addrp, size_t len,
     int prot, int flags, struct file *fp, offset_t pos)
@@ -629,7 +641,7 @@
 	 * If it's not a fixed allocation and mmap ASLR is enabled, randomize
 	 * it.
 	 */
-	if (((flags & MAP_FIXED) == 0) &&
+	if (RANDOMIZABLE_MAPPING(*addrp, flags) &&
 	    secflag_enabled(curproc, PROC_SEC_ASLR))
 		flags |= _MAP_RANDOMIZE;
 
