If anything, this should demonstrate the exact opposite. The code that just got fixed predates OpenBSD. If you could measure the amount of buffer overflows in

If anything, this should demonstrate the exact opposite. The code that just got fixed predates OpenBSD. If you could measure the amount of buffer overflows in the tree on the day OpenBSD was forked from NetBSD, and year after year up to now, you'd see a very clear trend. The situation is only getting better, and the fact that the OpenBSD team tries to clean up and polish old code instead of just rewriting and churning out "cool new" replacements for everything really helps. Year after year, the same old code is subjected to mass audits (such as the recent reallocarray() job, wight might've very well triggered the discovery of some bugs in col, including the one referred to in this commit). Other bugs are found in actual use. And, of course, new tools find new problems. New "hostile" changes in the system reveal new bugs. The mature code in the system really does get better.