diff --git a/third_party/musl/fnmatch.c b/third_party/musl/fnmatch.c
index f857b3d1c..89b597e43 100644
--- a/third_party/musl/fnmatch.c
+++ b/third_party/musl/fnmatch.c
@@ -152,7 +152,7 @@ static int match_bracket(const char *p, int k, int kfold)
 	for (; *p != ']'; p++) {
 		if (p[0]=='-' && p[1]!=']') {
 			wchar_t wc2;
-			int l = mbtowc(&wc2, p+1, 4);
+			int l = mbtowc(&wc2, ++p, 4);
 			if (l < 0) return 0;
 			if (wc <= wc2)
 				if ((unsigned)k-wc <= wc2-wc ||
@@ -183,7 +183,8 @@ static int match_bracket(const char *p, int k, int kfold)
 			if (l < 0) return 0;
 			p += l-1;
 		}
-		if (wc==k || wc==kfold) return !inv;
+		if ((wc==k || wc==kfold) && (p[1]!='-' || p[2]==']'))
+			return !inv;
 	}
 	return inv;
 }
@@ -196,7 +197,7 @@ static int fnmatch_internal(const char *pat, size_t m, const char *str, size_t n
 	int c, k, kfold;
 
 	if (flags & FNM_PERIOD) {
-		if (*str == '.' && *pat != '.')
+		if (*str == '.' && *pat != '.' && *pat != '\\')
 			return FNM_NOMATCH;
 	}
 	for (;;) {
diff --git a/third_party/musl/iconv.c b/third_party/musl/iconv.c
index cea641664..fafab80f7 100644
--- a/third_party/musl/iconv.c
+++ b/third_party/musl/iconv.c
@@ -537,7 +537,7 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
 			if (c >= 93 || d >= 94) {
 				c += (0xa1-0x81);
 				d += 0xa1;
-				if (c >= 93 || c>=0xc6-0x81 && d>0x52)
+				if (c > 0xc6-0x81 || c==0xc6-0x81 && d>0x52)
 					goto ilseq;
 				if (d-'A'<26) d = d-'A';
 				else if (d-'a'<26) d = d-'a'+26;
diff --git a/third_party/musl/res_msend.c b/third_party/musl/res_msend.c
index 22250d5a7..14a5b4619 100644
--- a/third_party/musl/res_msend.c
+++ b/third_party/musl/res_msend.c
@@ -119,8 +119,8 @@ int __res_msend_rc(int nqueries, const unsigned char *const *queries,
 	int fd;
 	int timeout, attempts, retry_interval, servfail_retry = 0;
 	union {
-		struct sockaddr_in sin;
 		struct sockaddr_in6 sin6;
+		struct sockaddr_in sin;
 	} sa = {0}, ns[MAXNS] = {0};
 	socklen_t sl = sizeof sa.sin;
 	int nns = 0;
@@ -135,10 +135,12 @@ int __res_msend_rc(int nqueries, const unsigned char *const *queries,
 	int r;
 	unsigned long t0, t1, t2;
 
-	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
-
 	timeout = 1000*conf->timeout;
 	attempts = conf->attempts;
+	if (!attempts)
+		return -1;
+
+	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cs);
 
 	for (nns=0; nns<conf->nns; nns++) {
 		const struct address *iplit = &conf->ns[nns];
@@ -160,7 +162,7 @@ int __res_msend_rc(int nqueries, const unsigned char *const *queries,
 
 	/* Handle case where system lacks IPv6 support */
 	if (fd < 0 && family == AF_INET6 && errno == EAFNOSUPPORT) {
-		for (i=0; i<nns && conf->ns[nns].family == AF_INET6; i++);
+		for (i=0; i<nns && conf->ns[i].family == AF_INET6; i++);
 		if (i==nns) {
 			pthread_setcancelstate(cs, 0);
 			return -1;
diff --git a/third_party/regex/regcomp.c b/third_party/regex/regcomp.c
index 0031fe059..486591ca1 100644
--- a/third_party/regex/regcomp.c
+++ b/third_party/regex/regcomp.c
@@ -436,6 +436,8 @@ typedef struct {
 	int position;
 	/* The highest back reference or -1 if none seen so far. */
 	int max_backref;
+	/* Bit mask of submatch IDs that can be back referenced. */
+	int backref_ok;
 	/* Compilation flags. */
 	int cflags;
 } tre_parse_ctx_t;
@@ -796,6 +798,8 @@ static reg_errcode_t marksub(tre_parse_ctx_t *ctx, tre_ast_node_t *node, int sub
 	node->submatch_id = subid;
 	node->num_submatches++;
 	ctx->n = node;
+	if (subid < 10)
+		ctx->backref_ok |= 1<<subid;
 	return REG_OK;
 }
 
@@ -891,6 +895,8 @@ static reg_errcode_t parse_atom(tre_parse_ctx_t *ctx, const char *s)
 			if (!ere && (unsigned)*s-'1' < 9) {
 				/* back reference */
 				int val = *s - '0';
+				if (!(ctx->backref_ok & 1<<val))
+					return REG_ESUBREG;
 				node = tre_ast_new_literal(ctx->mem, BACKREF, val, ctx->position++);
 				ctx->max_backref = MAX(val, ctx->max_backref);
 			} else {