diff --git a/net/rsync/Makefile b/net/rsync/Makefile
index 5977ac517199..e495116560b8 100644
--- a/net/rsync/Makefile
+++ b/net/rsync/Makefile
@@ -1,115 +1,115 @@
 PORTNAME=	rsync
 DISTVERSION=	3.4.1
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	net
 MASTER_SITES=	https://www.mirrorservice.org/sites/rsync.samba.org/src/ \
 		http://rsync.mirror.garr.it/src/ \
 		http://www.mirrorservice.org/sites/rsync.samba.org/src/ \
 		https://download.samba.org/pub/rsync/src/
 DISTFILES=	${DISTNAME}${EXTRACT_SUFX}
 
 MAINTAINER=	rodrigo@FreeBSD.org
 COMMENT=	Network file distribution/synchronization utility
 WWW=		https://rsync.samba.org/
 
 LICENSE=	GPLv3+
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 LIB_DEPENDS=	liblz4.so:archivers/liblz4 \
 		libxxhash.so:devel/xxhash \
 		libzstd.so:archivers/zstd
 
 USES=		autoreconf:build cpe python shebangfix ssl
 PYTHON_NO_DEPENDS=	yes
 CPE_VENDOR=	samba
 CPE_PRODUCT=	rsync
 USE_RC_SUBR=	rsyncd
 
 SHEBANG_FILES=	support/rrsync
 
 GNU_CONFIGURE=	yes
 GNU_CONFIGURE_MANPREFIX=${PREFIX}/share
 CONFIGURE_ARGS=	--disable-debug \
 		--enable-ipv6 \
 		--with-rsyncd-conf=${ETCDIR}/rsyncd.conf
 
 INSTALL_TARGET=	install-strip
 TEST_TARGET=	check
 
 CPPFLAGS+=	-I${LOCALBASE}/include
 LDFLAGS+=	-L${LOCALBASE}/lib
 
 PATCH_STRIP=	-p1
 SUB_LIST=	NAME=rsyncd
 
 PORTDOCS=	NEWS.md README.md csprotocol.txt tech_report.tex
 
 # define options
 OPTIONS_DEFINE=		DOCS ICONV POPT_PORT SSH ZLIB_BASE
 OPTIONS_DEFAULT=	FLAGS ICONV SSH ZLIB_BASE
 OPTIONS_RADIO=		PTS
 OPTIONS_RADIO_PTS=	FLAGS RENAMED
 
 # options provided upstream
 FLAGS_DESC=	File system flags support patch, adds --fileflags
 POPT_PORT_DESC=	Use popt from devel/popt instead of bundled one
 SSH_DESC=	Use SSH instead of RSH
 ZLIB_BASE_DESC=	Use zlib from base instead of bundled one
 
 # options provided by patch (mutually exclusive)
 PTS_DESC=	Functionality provided by third party patches
 RENAMED_DESC=	Add support for renamed file detection
 
 FLAGS_EXTRA_PATCHES=	${WRKSRC}/patches/fileflags.diff \
 			${FILESDIR}/extrapatch-main.c
 
 ICONV_USES=		iconv:translit
 ICONV_CONFIGURE_ENABLE=	iconv iconv-open
 
 POPT_PORT_LIB_DEPENDS=		libpopt.so:devel/popt
 POPT_PORT_CONFIGURE_OFF=	--with-included-popt
 
 RENAMED_EXTRA_PATCHES=	${WRKSRC}/patches/detect-renamed.diff
 
 SSH_CONFIGURE_ON=	--with-rsh=ssh
 SSH_CONFIGURE_OFF=	--with-rsh=rsh
 
 ZLIB_BASE_CONFIGURE_ON=	--with-included-zlib=no
 
 .include <bsd.port.options.mk>
 
 .if ${PORT_OPTIONS:MRENAMED} || ${PORT_OPTIONS:MICONV} || ${PORT_OPTIONS:MFLAGS}
 DISTFILES+=	${PORTNAME}-patches-${DISTVERSION}${EXTRACT_SUFX}
 .endif
 
 .include <bsd.port.pre.mk>
 
 .if empty(ICONV_LIB) || !${PORT_OPTIONS:MICONV}
 CONFIGURE_ARGS+=	ac_cv_search_libiconv_open=no
 .endif
 
 .if make(makesum) || ${PORT_OPTIONS:MRENAMED} || ${PORT_OPTIONS:MICONV} || ${PORT_OPTIONS:MFLAGS}
 pre-patch:
 	@${REINPLACE_CMD} 's:+int module_dirlen = 0;:+:' ${WRKSRC}/patches/fileflags.diff
 .endif
 
 post-patch:
 	@${REINPLACE_CMD} -e 's:/etc/r{1,2}sync:${ETCDIR}/:g' \
 					  -e 's:/etc/letsencrypt:${PREFIX}/etc/letsencrypt:g' \
 					  ${WRKSRC}/rsync.1 ${WRKSRC}/rsyncd.conf.5
 	@${REINPLACE_CMD} -e 's|/usr/bin/rsync|${PREFIX}/bin/rsync|g' ${WRKSRC}/support/rrsync
 
 pre-configure:
 	@(cd ${WRKSRC} && ${SETENVI} ${WRK_ENV} ${MAKE_CMD} -f prepare-source.mak)
 
 post-install:
 	@${MKDIR} ${STAGEDIR}${ETCDIR}
 	${INSTALL_DATA} ${FILESDIR}/rsyncd.conf.sample ${STAGEDIR}${ETCDIR}/
 	${INSTALL_SCRIPT} ${WRKSRC}/support/rrsync ${STAGEDIR}${PREFIX}/sbin
 
 post-install-DOCS-on:
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${PORTDOCS:S,^,${WRKSRC}/,} ${STAGEDIR}${DOCSDIR}
 	${INSTALL_DATA} ${WRKSRC}/support/rrsync.1.md ${STAGEDIR}${DOCSDIR}
 
 .include <bsd.port.post.mk>
diff --git a/net/rsync/files/patch-lib_sysxattrs.c b/net/rsync/files/patch-lib_sysxattrs.c
new file mode 100644
index 000000000000..16a307a83ad6
--- /dev/null
+++ b/net/rsync/files/patch-lib_sysxattrs.c
@@ -0,0 +1,42 @@
+--- a/lib/sysxattrs.c.orig	2022-01-16 01:21:01.000000000 +0000
++++ b/lib/sysxattrs.c	2025-07-28 12:05:43.501532000 +0000
+@@ -126,22 +126,29 @@
+ 	unsigned char keylen;
+ 	ssize_t off, len = extattr_list_link(path, EXTATTR_NAMESPACE_USER, list, size);
+ 
+-	if (len <= 0 || (size_t)len > size)
++	if (len <= 0 || size == 0)
+ 		return len;
+ 
++	if ((size_t)len == size) {
++		/* extattr_list_link fills a buffer with a list of file attributes.
++		 * If the buffer size is too small the content is truncated and
++		 * extattr_list_link returns the number of written bytes and no
++		 * error is raised. If size == len assumes the buffer was too small
++		 * and behave like Linux requesting a larger buffer. */
++		errno = ERANGE;
++		return -1;
++	}
++
+ 	/* FreeBSD puts a single-byte length before each string, with no '\0'
+ 	 * terminator.  We need to change this into a series of null-terminted
+ 	 * strings.  Since the size is the same, we can simply transform the
+ 	 * output in place. */
+-	for (off = 0; off < len; off += keylen + 1) {
+-		keylen = ((unsigned char*)list)[off];
+-		if (off + keylen >= len) {
+-			/* Should be impossible, but kernel bugs happen! */
+-			errno = EINVAL;
+-			return -1;
+-		}
+-		memmove(list+off, list+off+1, keylen);
+-		list[off+keylen] = '\0';
++	keylen = (unsigned char)list[0];
++	memmove(list, list+1, len-1);
++	list[len-1] = '\0';
++	for (off = keylen; off < (len - 1); off += (keylen + 1)) {
++		keylen = (unsigned char)list[off];
++		list[off] = '\0';
+ 	}
+ 
+ 	return len;
diff --git a/net/rsync/files/patch-testsuite_xattrs.test b/net/rsync/files/patch-testsuite_xattrs.test
new file mode 100644
index 000000000000..95a1a285d96b
--- /dev/null
+++ b/net/rsync/files/patch-testsuite_xattrs.test
@@ -0,0 +1,67 @@
+--- a/testsuite/xattrs.test.orig	2022-10-20 16:09:26.000000000 +0000
++++ b/testsuite/xattrs.test	2025-06-29 07:49:45.880992000 +0000
+@@ -10,7 +10,14 @@
+ 
+ $RSYNC -VV | grep '"xattrs": true' >/dev/null || test_skipped "Rsync is configured without xattr support"
+ 
++CYGWIN=0
++
+ case "$HOST_OS" in
++cygwin*)
++    CYGWIN=1
++esac
++
++case "$HOST_OS" in
+ darwin*)
+     xset() {
+ 	xnam="$1"
+@@ -80,6 +87,9 @@
+ echo deep >"$fromdir/foo/file3"
+ echo normal >"$fromdir/file4"
+ echo deeper >"$fromdir/foo/bar/file5"
++if [ $CYGWIN -eq 0 ]; then
++    echo longxattrname >"$fromdir/file7"
++fi
+ 
+ makepath "$chkdir/foo"
+ echo wow >"$chkdir/file1"
+@@ -87,6 +97,10 @@
+ 
+ dirs='foo foo/bar'
+ files='file0 file1 file2 foo/file3 file4 foo/bar/file5'
++if [ $CYGWIN -eq 0 ]
++then
++        files="$files file7"
++fi
+ 
+ uid_gid=`"$TOOLDIR/tls" "$fromdir/foo" | sed 's/^.* \([0-9][0-9]*\)\.\([0-9][0-9]*\) .*/\1:\2/'`
+ 
+@@ -125,6 +139,16 @@
+ xset user.foo 'old foo' "$chkdir/foo/file3"
+ xset $RUSR.equal 'this long attribute should remain the same and not need to be transferred' "$chkdir/foo/file3"
+ 
++if [ $CYGWIN -eq 0 ] ; then
++# Generate xattr names
++SEQ=`seq 1 200`
++xset user."`printf -- 'A%0.s' $SEQ`" 'first xattr' file7
++xset user."`printf -- 'B%0.s' $SEQ`" 'second xattr' file7
++xset user."`printf -- 'C%0.s' $SEQ`" 'third xattr' file7
++xset user."`printf -- 'D%0.s' $SEQ`" 'another xattr' file7
++xset user."`printf -- 'E%0.s' $SEQ`" 'final xattr' file7
++fi
++
+ case $0 in
+ *hlink*)
+     ln foo/bar/file5 foo/bar/file6 || test_skipped "Can't create hardlink"
+@@ -234,6 +258,11 @@
+ 
+ cd "$todir"
+ xls file1 file2 | diff $diffopt "$scratchdir/xattrs.txt" -
++
++cd "$fromdir"
++rm -rf "$todir"
++mkfifo fifo1
++checktee "$RSYNC -avX --specials  $XFILT $dashH --super . '$chkdir/'" "$fromdir" "$chkdir"
+ 
+ # The script would have aborted on error, so getting here means we've won.
+ exit 0