We might want to add a special note that 13.2-RELEASE is not affected (I'm assuming that's the case), since we do list a stable/13 correction.

Something like

Note: This issue does not affect 13.2-RELEASE, as the bug was introduced into the stable/13 branch after the release.

is it "two bytes or larger" rather than "larger than two bytes"

13.2-RELEASE is not affected by this issue because the IUTF8 series of patches have not been MFC'd there at all. The only affected branch which the fix hasn't been MFC'd to is 14.0-RELEASE, hence why I've left the related fields empty in this EN.

The former. Didn't notice this typo, thanks!

Yes, omitting it from "Corrected" above is correct, it's just that this same case of a stable/X branch having a correction date but no patch for the X.Y release has prompted questions in the past, so some explicit note is useful. It might not even need the explanation, maybe just "Note: 13.2-RELEASE is not affected by this issue."

Alright. @markj will you take care of this or do you want me to? Also, when should we MFC the fix to 14.0-RELEASE?

I'll take care of that. The merge to releng/* is always handled by secteam@, since they "own" that branch, so I'll handle that too. :)

(Typically we merge to releng/* the day that errata and security advisories will be released.)