diff --git a/external/toxcore/c-toxcore/.circleci/cmake-ubsan b/external/toxcore/c-toxcore/.circleci/cmake-ubsan
index 45e64d8..8275f83 100755
--- a/external/toxcore/c-toxcore/.circleci/cmake-ubsan
+++ b/external/toxcore/c-toxcore/.circleci/cmake-ubsan
@@ -6,6 +6,7 @@ CACHEDIR="$HOME/cache"
 
 . ".github/scripts/flags-$CC.sh"
 add_flag -Werror
+add_flag -D_DEBUG
 add_flag -fdiagnostics-color=always
 add_flag -fno-omit-frame-pointer
 add_flag -fno-sanitize-recover=all
diff --git a/external/toxcore/c-toxcore/.cirrus.yml b/external/toxcore/c-toxcore/.cirrus.yml
index 3050ead..903d98a 100644
--- a/external/toxcore/c-toxcore/.cirrus.yml
+++ b/external/toxcore/c-toxcore/.cirrus.yml
@@ -9,7 +9,6 @@ bazel-opt_task:
     - /src/workspace/tools/inject-repo c-toxcore
   test_all_script:
     - cd /src/workspace && bazel test -k
-        --config=ci
         --build_tag_filters=-haskell
         --test_tag_filters=-haskell
         --
@@ -26,7 +25,6 @@ bazel-dbg_task:
     - /src/workspace/tools/inject-repo c-toxcore
   test_all_script:
     - cd /src/workspace && bazel test -k
-        --config=ci
         --build_tag_filters=-haskell
         --test_tag_filters=-haskell
         --
@@ -43,8 +41,19 @@ cimple_task:
     - /src/workspace/tools/inject-repo c-toxcore
   test_all_script:
     - cd /src/workspace && bazel test -k
-        --config=ci
         --build_tag_filters=haskell
         --test_tag_filters=haskell
         --
         //c-toxcore/...
+
+freebsd_task:
+  container:
+    image: toxchat/freebsd:latest
+    cpu: 2
+    memory: 4G
+    kvm: true
+  configure_script:
+    - git submodule update --init --recursive
+    - cd .. && mv cirrus-ci-build /work/c-toxcore && mkdir cirrus-ci-build
+  test_all_script:
+    - cd /work/c-toxcore && .github/scripts/cmake-freebsd
diff --git a/external/toxcore/c-toxcore/.dockerignore b/external/toxcore/c-toxcore/.dockerignore
new file mode 100644
index 0000000..e4213a7
--- /dev/null
+++ b/external/toxcore/c-toxcore/.dockerignore
@@ -0,0 +1,2 @@
+/_build
+/_install
diff --git a/external/toxcore/c-toxcore/.github/scripts/cmake-alpine-s390x b/external/toxcore/c-toxcore/.github/scripts/cmake-alpine-s390x
new file mode 100755
index 0000000..13b99bd
--- /dev/null
+++ b/external/toxcore/c-toxcore/.github/scripts/cmake-alpine-s390x
@@ -0,0 +1,55 @@
+#!/bin/bash
+# Copyright (C) 2018-2023 nurupo
+
+# Toxcore building
+
+set -eux
+
+cd .. # /work
+. cmake-alpine-run.sh
+
+# === Get VM ready to build the code ===
+
+start_vm
+
+RUN apk add cmake g++ ninja
+
+mv c-toxcore /
+
+# Copy over toxcore code from host to qemu
+scp -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -P "$SSH_PORT" -r /c-toxcore root@localhost:~
+
+cd /c-toxcore
+. ".github/scripts/flags-gcc.sh"
+
+# Make compilation error on a warning
+add_flag -Werror
+
+# - disabling toxav because vpx doesn't work on s390x.
+# - disabling bootstrap daemons because we don't need them for testing (saving time).
+# - disabling shared libraries because it saves a lot of time on building PIC objects.
+# - enable unity build because it saves a lot of time as well (fewer objects to build).
+RUN "cmake -B_build -Hc-toxcore -GNinja \
+  -DCMAKE_C_FLAGS='$C_FLAGS' \
+  -DCMAKE_CXX_FLAGS='$CXX_FLAGS' \
+  -DCMAKE_EXE_LINKER_FLAGS='$LD_FLAGS' \
+  -DCMAKE_SHARED_LINKER_FLAGS='$LD_FLAGS' \
+  -DCMAKE_INSTALL_PREFIX:PATH='_install' \
+  -DCMAKE_UNITY_BUILD=ON \
+  -DMIN_LOGGER_LEVEL=TRACE \
+  -DNON_HERMETIC_TESTS=ON \
+  -DENABLE_SHARED=OFF \
+  -DBUILD_TOXAV=OFF \
+  -DDHT_BOOTSTRAP=OFF \
+  -DBOOTSTRAP_DAEMON=OFF \
+  -DSTRICT_ABI=ON \
+  -DTEST_TIMEOUT_SECONDS=90 \
+  -DUSE_IPV6=OFF \
+  -DAUTOTEST=ON"
+
+RUN 'cmake --build _build --parallel 2 --target install -- -k 0'
+RUN 'cd _build && ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:1 --timeout 90 || true' &
+
+# Give the tests 5 minutes to run. Sometimes, the per-test timeout doesn't
+# work, so we put a global timeout here for everything.
+sleep 300
diff --git a/external/toxcore/c-toxcore/.github/scripts/cmake-freebsd b/external/toxcore/c-toxcore/.github/scripts/cmake-freebsd
new file mode 100755
index 0000000..1301175
--- /dev/null
+++ b/external/toxcore/c-toxcore/.github/scripts/cmake-freebsd
@@ -0,0 +1,58 @@
+#!/bin/bash
+# Copyright (C) 2018-2023 nurupo
+
+# Toxcore building
+
+set -eux
+
+cd .. # /work
+. cmake-freebsd-run.sh
+
+# === Get VM ready to build the code ===
+
+# Unpack image only if it's compressed.
+if [ -f "$IMAGE_NAME.gz" ]; then
+  gunzip "$IMAGE_NAME.gz"
+fi
+
+mv c-toxcore /
+
+start_vm
+
+# Copy over toxcore code from host to qemu
+scp -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -P "$SSH_PORT" -r /c-toxcore root@localhost:~
+
+RUN ls -lh
+
+cd /c-toxcore
+. '.github/scripts/flags-clang.sh'
+
+add_ld_flag -Wl,-z,defs
+
+# Make compilation error on a warning.
+add_flag -Werror
+
+# This triggers on FreeBSD's clang.
+add_flag -Wno-format
+add_flag -Wno-unsafe-buffer-usage
+
+RUN "cmake -B_build -Hc-toxcore \
+  -DCMAKE_C_FLAGS='$C_FLAGS' \
+  -DCMAKE_CXX_FLAGS='$CXX_FLAGS' \
+  -DCMAKE_EXE_LINKER_FLAGS='$LD_FLAGS' \
+  -DCMAKE_SHARED_LINKER_FLAGS='$LD_FLAGS' \
+  -DCMAKE_INSTALL_PREFIX:PATH='_install' \
+  -DMIN_LOGGER_LEVEL=TRACE \
+  -DMUST_BUILD_TOXAV=ON \
+  -DNON_HERMETIC_TESTS=ON \
+  -DSTRICT_ABI=ON \
+  -DTEST_TIMEOUT_SECONDS=120 \
+  -DUSE_IPV6=OFF \
+  -DAUTOTEST=ON"
+
+# We created the VM with the same number of cores as the host, so the host-ran `nproc` here is fine.
+RUN 'cmake --build _build --parallel "$NPROC" --target install -- -k'
+RUN 'cd _build && ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:2 --timeout 120 || true'
+
+# Gracefully shut down the VM.
+stop_vm
diff --git a/external/toxcore/c-toxcore/.github/scripts/cmake-freebsd-stage2 b/external/toxcore/c-toxcore/.github/scripts/cmake-freebsd-stage2
deleted file mode 100755
index f6bdd09..0000000
--- a/external/toxcore/c-toxcore/.github/scripts/cmake-freebsd-stage2
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/bin/bash
-# Copyright (C) 2018-2021 nurupo
-
-# Toxcore building
-
-set -eux
-
-if [ "$PWD" != "/work" ]; then
-  cd ..
-  mv c-toxcore /
-  mkdir c-toxcore
-  cd /work
-fi
-
-. cmake-freebsd-run.sh
-
-# === Get VM ready to build the code ===
-
-gunzip "$IMAGE_NAME.gz"
-
-start_vm
-
-# Copy over toxcore code from host to qemu
-scp -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -P "$SSH_PORT" -r /c-toxcore root@localhost:~
-
-RUN ls -lh
-
-cd /c-toxcore
-. ".github/scripts/flags-clang.sh"
-
-add_ld_flag -Wl,-z,defs
-
-# Make compilation error on a warning
-add_flag -Werror
-
-RUN 'cmake -B_build -Hc-toxcore \
-  -DCMAKE_C_FLAGS="$C_FLAGS" \
-  -DCMAKE_CXX_FLAGS="$CXX_FLAGS" \
-  -DCMAKE_EXE_LINKER_FLAGS="$LD_FLAGS" \
-  -DCMAKE_SHARED_LINKER_FLAGS="$LD_FLAGS" \
-  -DCMAKE_INSTALL_PREFIX:PATH="_install" \
-  -DMIN_LOGGER_LEVEL=TRACE \
-  -DMUST_BUILD_TOXAV=ON \
-  -DNON_HERMETIC_TESTS=ON \
-  -DSTRICT_ABI=ON \
-  -DTEST_TIMEOUT_SECONDS=90 \
-  -DUSE_IPV6=OFF \
-  -DAUTOTEST=ON'
-
-# We created the VM with the same number of cores as the host, so the host-ran `nproc` here is fine
-RUN 'gmake "-j$NPROC" -k install -C_build'
-RUN 'gmake "-j$NPROC" test ARGS="-j50" -C_build || true'
diff --git a/external/toxcore/c-toxcore/.github/scripts/flags.sh b/external/toxcore/c-toxcore/.github/scripts/flags.sh
index 80a56c0..dd7ca18 100644
--- a/external/toxcore/c-toxcore/.github/scripts/flags.sh
+++ b/external/toxcore/c-toxcore/.github/scripts/flags.sh
@@ -28,8 +28,6 @@ add_flag -O3 -march=native
 
 # Warn on non-ISO C.
 add_c_flag -pedantic
-add_c_flag -std=c99
-add_cxx_flag -std=c++11
 
 add_flag -g3
 add_flag -ftrapv
diff --git a/external/toxcore/c-toxcore/.github/settings.yml b/external/toxcore/c-toxcore/.github/settings.yml
index 7f4f86a..18c4542 100644
--- a/external/toxcore/c-toxcore/.github/settings.yml
+++ b/external/toxcore/c-toxcore/.github/settings.yml
@@ -12,36 +12,52 @@ branches:
     protection:
       required_status_checks:
         contexts:
-          - "bazel-asan"
           - "bazel-dbg"
           - "bazel-opt"
-          - "bazel-tsan"
+          - "build-alpine-s390x"
+          - "build-android"
           - "build-compcert"
           - "build-macos"
           - "build-nacl"
           - "build-tcc"
           - "build-win32"
           - "build-win64"
-          - "CodeFactor"
-          - "common / buildifier"
-          - "coverage-linux"
           - "ci/circleci: asan"
+          - "ci/circleci: bazel-asan"
+          - "ci/circleci: bazel-msan"
+          - "ci/circleci: bazel-tsan"
           - "ci/circleci: clang-analyze"
           - "ci/circleci: clang-tidy"
           - "ci/circleci: cpplint"
           - "ci/circleci: infer"
-          - "ci/circleci: msan"
           - "ci/circleci: static-analysis"
           - "ci/circleci: tsan"
           - "ci/circleci: ubsan"
           - "cimple"
+          - "cimplefmt"
+          - "CodeFactor"
           - "code-review/reviewable"
-          - "continuous-integration/appveyor/pr"
+          - "common / buildifier"
+          - "coverage-linux"
           - "docker-bootstrap-node"
           - "docker-bootstrap-node-websocket"
+          - "docker-clusterfuzz"
+          - "docker-esp32"
+          - "docker-fuzzer"
           - "docker-toxcore-js"
+          - "docker-win32"
+          - "docker-win64"
+          - "doxygen"
+          - "freebsd"
+          - "Hound"
+          - "misra"
           - "mypy"
+          - "program-analysis"
           - "sonar-scan"
+          - "tokstyle"
+          - "TokTok.c-toxcore"
+          - "TokTok.c-toxcore (windows_msvc_conan shared)"
+          - "TokTok.c-toxcore (windows_msvc_conan static)"
 
 # Labels specific to c-toxcore.
 labels:
diff --git a/external/toxcore/c-toxcore/.github/workflows/ci.yml b/external/toxcore/c-toxcore/.github/workflows/ci.yml
index 5fa4792..2266f2c 100644
--- a/external/toxcore/c-toxcore/.github/workflows/ci.yml
+++ b/external/toxcore/c-toxcore/.github/workflows/ci.yml
@@ -60,15 +60,6 @@ jobs:
         with:
           file: other/docker/misra/Dockerfile
 
-  cimplefmt:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: recursive
-      - name: Run cimplefmt
-        run: other/docker/cimplefmt/run -u $(find tox* -name "*.[ch]")
-
   build-nacl:
     runs-on: ubuntu-latest
     steps:
@@ -79,6 +70,45 @@ jobs:
         with:
           file: other/docker/autotools/Dockerfile
 
+  build-tcc:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Docker Build
+        uses: docker/build-push-action@v2
+        with:
+          file: other/docker/tcc/Dockerfile
+
+  build-compcert:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Docker Build
+        uses: docker/build-push-action@v2
+        with:
+          file: other/docker/compcert/Dockerfile
+
+  build-alpine-s390x:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Docker Build
+        uses: docker/build-push-action@v2
+        with:
+          file: other/docker/alpine-s390x/Dockerfile
+
+  cimplefmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          submodules: recursive
+      - name: Run cimplefmt
+        run: other/docker/cimplefmt/run -u $(find tox* -name "*.[ch]")
+
   build-win32:
     runs-on: ubuntu-latest
     steps:
@@ -97,16 +127,6 @@ jobs:
       - name: Cross compilation
         run: .github/scripts/cmake-win64 script
 
-  build-freebsd:
-    runs-on: ubuntu-latest
-    container: toxchat/freebsd
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: recursive
-      - name: Build on FreeBSD
-        run: .github/scripts/cmake-freebsd-stage2
-
   build-macos:
     runs-on: macos-latest
     steps:
@@ -125,81 +145,6 @@ jobs:
       - name: Build, test, and upload coverage
         run: .github/scripts/coverage-linux
 
-  build-tcc:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: recursive
-      - name: Install dependencies
-        run:
-          sudo apt-get install -y --no-install-recommends
-            tcc
-            libconfig-dev
-            libopus-dev
-            libsodium-dev
-            libvpx-dev
-      - name: Build with TCC
-        run:
-          tcc
-            -Dinline=static
-            -o send_message_test
-            -Wall -Werror
-            -bench -g
-            auto_tests/auto_test_support.c
-            auto_tests/send_message_test.c
-            testing/misc_tools.c
-            toxav/*.c
-            toxcore/*.c
-            toxcore/*/*.c
-            toxencryptsave/*.c
-            third_party/cmp/*.c
-            $(pkg-config --cflags --libs libsodium opus vpx)
-      - name: Run the test
-        run: "./send_message_test | grep 'tox clients connected'"
-      - name: Build amalgamation file with TCC
-        run:
-          other/make_single_file
-            auto_tests/auto_test_support.c
-            auto_tests/send_message_test.c
-            testing/misc_tools.c |
-          tcc -
-            -o send_message_test
-            -Wall -Werror
-            -bench -g
-            $(pkg-config --cflags --libs libsodium opus vpx)
-      - name: Run the test again
-        run: "./send_message_test | grep 'tox clients connected'"
-
-  build-compcert:
-    runs-on: ubuntu-latest
-    container: toxchat/compcert
-    steps:
-      - uses: actions/checkout@v2
-        with:
-          submodules: recursive
-      - name: Build with CompCert
-        run:
-          ccomp
-            -o send_message_test
-            -Wall -Werror
-            -Wno-c11-extensions
-            -Wno-unknown-pragmas
-            -Wno-unused-variable
-            -fstruct-passing -fno-unprototyped -g
-            auto_tests/auto_test_support.c
-            auto_tests/send_message_test.c
-            testing/misc_tools.c
-            toxav/*.c
-            toxcore/*.c
-            toxcore/*/*.c
-            toxencryptsave/*.c
-            third_party/cmp/*.c
-            -D__COMPCERT__ -DDISABLE_VLA -Dinline=
-            -lpthread $(pkg-config --cflags --libs libsodium opus vpx)
-      - name: Run the test
-        run: "./send_message_test | grep 'tox clients connected'"
-
   build-android:
     runs-on: ubuntu-latest
     steps:
diff --git a/external/toxcore/c-toxcore/.github/workflows/docker.yml b/external/toxcore/c-toxcore/.github/workflows/docker.yml
index 4921013..ad88b43 100644
--- a/external/toxcore/c-toxcore/.github/workflows/docker.yml
+++ b/external/toxcore/c-toxcore/.github/workflows/docker.yml
@@ -6,6 +6,11 @@ on:
   pull_request:
     branches: [master]
 
+# Cancel old PR builds when pushing new commits.
+concurrency:
+  group: docker-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   docker-bootstrap-node:
     runs-on: ubuntu-latest
diff --git a/external/toxcore/c-toxcore/.github/workflows/sonar-scan.yml b/external/toxcore/c-toxcore/.github/workflows/sonar-scan.yml
index 45e32dd..b10bfc8 100644
--- a/external/toxcore/c-toxcore/.github/workflows/sonar-scan.yml
+++ b/external/toxcore/c-toxcore/.github/workflows/sonar-scan.yml
@@ -6,11 +6,16 @@ on:
   pull_request:
     branches: [master]
 
+# Cancel old PR builds when pushing new commits.
+concurrency:
+  group: scan-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   sonar-scan:
     runs-on: ubuntu-latest
     env:
-      SONAR_SCANNER_VERSION: 4.4.0.2170
+      SONAR_SCANNER_VERSION: 5.0.1.3006
       SONAR_SERVER_URL: "https://sonarcloud.io"
       BUILD_WRAPPER_OUT_DIR: build_wrapper_output_directory # Directory where build-wrapper output will be placed
     steps:
@@ -18,10 +23,10 @@ jobs:
         with:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
           submodules: recursive
-      - name: Set up JDK 11
+      - name: Set up JDK 17
         uses: actions/setup-java@v1
         with:
-          java-version: 11
+          java-version: 17
       - name: Download and set up sonar-scanner
         env:
           SONAR_SCANNER_DOWNLOAD_URL: https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${{ env.SONAR_SCANNER_VERSION }}-linux.zip
diff --git a/external/toxcore/c-toxcore/BUILD.bazel b/external/toxcore/c-toxcore/BUILD.bazel
index 4d39dab..d740c21 100644
--- a/external/toxcore/c-toxcore/BUILD.bazel
+++ b/external/toxcore/c-toxcore/BUILD.bazel
@@ -1,8 +1,6 @@
 load("@rules_cc//cc:defs.bzl", "cc_library")
 load("//tools/project:build_defs.bzl", "project")
 
-package(features = ["layering_check"])
-
 project()
 
 genrule(
@@ -10,16 +8,19 @@ genrule(
     srcs = [
         "//c-toxcore/toxav:toxav.h",
         "//c-toxcore/toxcore:tox.h",
+        "//c-toxcore/toxcore:tox_private.h",
         "//c-toxcore/toxencryptsave:toxencryptsave.h",
     ],
     outs = [
         "tox/toxav.h",
         "tox/tox.h",
+        "tox/tox_private.h",
         "tox/toxencryptsave.h",
     ],
     cmd = """
         cp $(location //c-toxcore/toxav:toxav.h) $(GENDIR)/c-toxcore/tox/toxav.h
         cp $(location //c-toxcore/toxcore:tox.h) $(GENDIR)/c-toxcore/tox/tox.h
+        cp $(location //c-toxcore/toxcore:tox_private.h) $(GENDIR)/c-toxcore/tox/tox_private.h
         cp $(location //c-toxcore/toxencryptsave:toxencryptsave.h) $(GENDIR)/c-toxcore/tox/toxencryptsave.h
     """,
     visibility = ["//visibility:public"],
diff --git a/external/toxcore/c-toxcore/CMakeLists.txt b/external/toxcore/c-toxcore/CMakeLists.txt
index 37518ec..9e0aa8f 100644
--- a/external/toxcore/c-toxcore/CMakeLists.txt
+++ b/external/toxcore/c-toxcore/CMakeLists.txt
@@ -14,8 +14,8 @@
 #
 ################################################################################
 
-cmake_minimum_required(VERSION 2.8.12)
-cmake_policy(VERSION 2.8.12)
+cmake_minimum_required(VERSION 3.5)
+cmake_policy(VERSION 3.5)
 project(toxcore)
 
 list(APPEND CMAKE_MODULE_PATH ${toxcore_SOURCE_DIR}/cmake)
@@ -79,21 +79,19 @@ enable_testing()
 
 set(CMAKE_MACOSX_RPATH ON)
 
-if(${CMAKE_VERSION} VERSION_LESS "3.1.0")
-  if(NOT MSVC)
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=c99")
-    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -std=c++17")
-  endif()
-else()
-  # Set standard version for compiler.
+# Set standard version for compiler.
+if(MSVC)
+  # https://developercommunity.visualstudio.com/t/older-winsdk-headers-are-incompatible-with-zcprepr/1593479
   set(CMAKE_C_STANDARD 99)
-  set(CMAKE_CXX_STANDARD 17)
-  set(CMAKE_C_EXTENSIONS OFF)
-  set(CMAKE_CXX_EXTENSIONS OFF)
-
-  message(STATUS "Supported C compiler features = ${CMAKE_C_COMPILE_FEATURES}")
-  message(STATUS "Supported C++ compiler features = ${CMAKE_CXX_COMPILE_FEATURES}")
+else()
+  set(CMAKE_C_STANDARD 11)
 endif()
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_C_EXTENSIONS OFF)
+set(CMAKE_CXX_EXTENSIONS OFF)
+
+message(STATUS "Supported C compiler features = ${CMAKE_C_COMPILE_FEATURES}")
+message(STATUS "Supported C++ compiler features = ${CMAKE_CXX_COMPILE_FEATURES}")
 
 set(MIN_LOGGER_LEVEL "" CACHE STRING "Logging level to use (TRACE, DEBUG, INFO, WARNING, ERROR)")
 if(MIN_LOGGER_LEVEL)
@@ -336,7 +334,8 @@ set(toxcore_PKGCONFIG_REQUIRES ${toxcore_PKGCONFIG_REQUIRES} libsodium)
 set(toxcore_API_HEADERS
   ${toxcore_SOURCE_DIR}/toxcore/tox.h^tox
   ${toxcore_SOURCE_DIR}/toxcore/tox_events.h^tox
-  ${toxcore_SOURCE_DIR}/toxcore/tox_dispatch.h^tox)
+  ${toxcore_SOURCE_DIR}/toxcore/tox_dispatch.h^tox
+  ${toxcore_SOURCE_DIR}/toxcore/tox_private.h^tox)
 
 ################################################################################
 #
diff --git a/external/toxcore/c-toxcore/README.md b/external/toxcore/c-toxcore/README.md
index 9082406..e2d2ecf 100644
--- a/external/toxcore/c-toxcore/README.md
+++ b/external/toxcore/c-toxcore/README.md
@@ -4,8 +4,6 @@
 
 [**Website**](https://tox.chat) **|** [**Wiki**](https://wiki.tox.chat/) **|** [**Blog**](https://blog.tox.chat/) **|** [**FAQ**](https://wiki.tox.chat/doku.php?id=users:faq) **|** [**Binaries/Downloads**](https://tox.chat/download.html) **|** [**Clients**](https://wiki.tox.chat/doku.php?id=clients) **|** [**Compiling**](/INSTALL.md)
 
-**IRC Channels:** Users: [#tox@libera.chat](https://web.libera.chat/#tox), Developers: [#toktok@libera.chat](https://web.libera.chat/#toktok)
-
 ## What is Tox
 
 Tox is a peer to peer (serverless) instant messenger aimed at making security
@@ -39,7 +37,7 @@ on the website, where they are updated at least once every 24 hours:
 
 Detailed installation instructions can be found in [INSTALL.md](INSTALL.md).
 
-Be advised that due to the addition of `cmp` as a submodule, you now also need to initialize the git submodules required by toxcore. This can be done by cloning the repo with the following command: `git clone --recurse-submodules https://github.com/Toktok/c-toxcore` or by running `git submodule update --init` in the root directory of the repo. 
+Be advised that due to the addition of `cmp` as a submodule, you now also need to initialize the git submodules required by toxcore. This can be done by cloning the repo with the following command: `git clone --recurse-submodules https://github.com/Toktok/c-toxcore` or by running `git submodule update --init` in the root directory of the repo.
 
 In a nutshell, if you have [libsodium](https://github.com/jedisct1/libsodium)
 installed, run:
diff --git a/external/toxcore/c-toxcore/auto_tests/BUILD.bazel b/external/toxcore/c-toxcore/auto_tests/BUILD.bazel
index d06ec17..2a20525 100644
--- a/external/toxcore/c-toxcore/auto_tests/BUILD.bazel
+++ b/external/toxcore/c-toxcore/auto_tests/BUILD.bazel
@@ -1,7 +1,5 @@
 load("@rules_cc//cc:defs.bzl", "cc_library", "cc_test")
 
-package(features = ["layering_check"])
-
 cc_library(
     name = "check_compat",
     testonly = True,
diff --git a/external/toxcore/c-toxcore/auto_tests/crypto_test.c b/external/toxcore/c-toxcore/auto_tests/crypto_test.c
index 36da041..4c4f3a6 100644
--- a/external/toxcore/c-toxcore/auto_tests/crypto_test.c
+++ b/external/toxcore/c-toxcore/auto_tests/crypto_test.c
@@ -269,6 +269,30 @@ static void test_large_data_symmetric(void)
     free(m1);
 }
 
+static void test_very_large_data(void)
+{
+    const Random *rng = system_random();
+    ck_assert(rng != nullptr);
+
+    uint8_t nonce[CRYPTO_NONCE_SIZE] = {0};
+    uint8_t pk[CRYPTO_PUBLIC_KEY_SIZE];
+    uint8_t sk[CRYPTO_SECRET_KEY_SIZE];
+    crypto_new_keypair(rng, pk, sk);
+
+    // 100 MiB of data (all zeroes, doesn't matter what's inside).
+    const uint32_t plain_size = 100 * 1024 * 1024;
+    uint8_t *plain = (uint8_t *)malloc(plain_size);
+    uint8_t *encrypted = (uint8_t *)malloc(plain_size + CRYPTO_MAC_SIZE);
+
+    ck_assert(plain != nullptr);
+    ck_assert(encrypted != nullptr);
+
+    encrypt_data(pk, sk, nonce, plain, plain_size, encrypted);
+
+    free(encrypted);
+    free(plain);
+}
+
 static void increment_nonce_number_cmp(uint8_t *nonce, uint32_t num)
 {
     uint32_t num1 = 0;
@@ -340,6 +364,7 @@ int main(void)
     test_endtoend(); /* waiting up to 15 seconds */
     test_large_data();
     test_large_data_symmetric();
+    test_very_large_data();
     test_increment_nonce();
     test_memzero();
 
diff --git a/external/toxcore/c-toxcore/auto_tests/dht_getnodes_api_test.c b/external/toxcore/c-toxcore/auto_tests/dht_getnodes_api_test.c
index d98e9f7..3b54f1c 100644
--- a/external/toxcore/c-toxcore/auto_tests/dht_getnodes_api_test.c
+++ b/external/toxcore/c-toxcore/auto_tests/dht_getnodes_api_test.c
@@ -123,7 +123,7 @@ static void test_dht_getnodes(AutoTox *autotoxes)
         tox_self_get_dht_id(autotoxes[i].tox, public_key_list[i]);
         tox_callback_dht_get_nodes_response(autotoxes[i].tox, getnodes_response_cb);
 
-        printf("Peer %zu dht closenode count total/annouce-capable: %d/%d\n",
+        printf("Peer %zu dht closenode count total/announce-capable: %d/%d\n",
             i,
             tox_dht_get_num_closelist(autotoxes[i].tox),
             tox_dht_get_num_closelist_announce_capable(autotoxes[i].tox)
diff --git a/external/toxcore/c-toxcore/auto_tests/group_message_test.c b/external/toxcore/c-toxcore/auto_tests/group_message_test.c
index d7a00a9..7c90a08 100644
--- a/external/toxcore/c-toxcore/auto_tests/group_message_test.c
+++ b/external/toxcore/c-toxcore/auto_tests/group_message_test.c
@@ -44,6 +44,10 @@ typedef struct State {
 #define TEST_CUSTOM_PACKET "Why'd ya spill yer beans?"
 #define TEST_CUSTOM_PACKET_LEN (sizeof(TEST_CUSTOM_PACKET) - 1)
 
+#define TEST_CUSTOM_PACKET_LARGE "Where is it I've read that someone condemned to death says or thinks, an hour before his death, that if he had to live on some high rock, on such a narrow ledge that he'd only room to stand, and the ocean, everlasting darkness, everlasting solitude, everlasting tempest around him, if he had to remain standing on a square yard of space all his life, a thousand years, eternity, it were better to live so than to die at once. Only to live, to live and live! Life, whatever it may be! ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0123456789"
+#define TEST_CUSTOM_PACKET_LARGE_LEN (sizeof(TEST_CUSTOM_PACKET_LARGE) - 1)
+static_assert(TEST_CUSTOM_PACKET_LARGE_LEN == TOX_GROUP_MAX_CUSTOM_LOSSY_PACKET_LENGTH, "Should be max");
+
 #define TEST_CUSTOM_PRIVATE_PACKET "This is a custom private packet. Enjoy."
 #define TEST_CUSTOM_PRIVATE_PACKET_LEN (sizeof(TEST_CUSTOM_PRIVATE_PACKET) - 1)
 
@@ -187,6 +191,21 @@ static void group_custom_packet_handler(Tox *tox, uint32_t groupnumber, uint32_t
     ++state->custom_packets_received;
 }
 
+static void group_custom_packet_large_handler(Tox *tox, uint32_t groupnumber, uint32_t peer_id, const uint8_t *data,
+                                        size_t length, void *user_data)
+{
+    ck_assert_msg(length == TEST_CUSTOM_PACKET_LARGE_LEN, "Failed to receive large custom packet. Invalid length: %zu\n", length);
+
+    ck_assert(memcmp(data, TEST_CUSTOM_PACKET_LARGE, length) == 0);
+
+    AutoTox *autotox = (AutoTox *)user_data;
+    ck_assert(autotox != nullptr);
+
+    State *state = (State *)autotox->state;
+
+    ++state->custom_packets_received;
+}
+
 static void group_message_handler(Tox *tox, uint32_t groupnumber, uint32_t peer_id, TOX_MESSAGE_TYPE type,
                                   const uint8_t *message, size_t length, uint32_t pseudo_msg_id, void *user_data)
 {
@@ -450,6 +469,19 @@ static void group_message_test(AutoTox *autotoxes)
         iterate_all_wait(autotoxes, NUM_GROUP_TOXES, ITERATION_INTERVAL);
     }
 
+    // tox0 sends a large max sized lossy custom packet
+
+    // overwrite callback for larger packet
+    tox_callback_group_custom_packet(tox0, group_custom_packet_large_handler);
+
+    tox_group_send_custom_packet(tox1, group_number, false, (const uint8_t *)TEST_CUSTOM_PACKET_LARGE, TEST_CUSTOM_PACKET_LARGE_LEN,
+                                 &c_err);
+    ck_assert_msg(c_err == TOX_ERR_GROUP_SEND_CUSTOM_PACKET_OK, "%d", c_err);
+
+    while (state0->custom_packets_received < 3) {
+        iterate_all_wait(autotoxes, NUM_GROUP_TOXES, ITERATION_INTERVAL);
+    }
+
     uint8_t m[TOX_GROUP_MAX_MESSAGE_LENGTH] = {0};
 
     fprintf(stderr, "Doing lossless packet test...\n");
@@ -538,6 +570,8 @@ int main(void)
 #undef TEST_PRIVATE_MESSAGE_LEN
 #undef TEST_CUSTOM_PACKET
 #undef TEST_CUSTOM_PACKET_LEN
+#undef TEST_CUSTOM_PACKET_LARGE
+#undef TEST_CUSTOM_PACKET_LARGE_LEN
 #undef TEST_CUSTOM_PRIVATE_PACKET
 #undef TEST_CUSTOM_PRIVATE_PACKET_LEN
 #undef IGNORE_MESSAGE
diff --git a/external/toxcore/c-toxcore/azure-pipelines.yml b/external/toxcore/c-toxcore/azure-pipelines.yml
index 0b0bd29..941bc33 100644
--- a/external/toxcore/c-toxcore/azure-pipelines.yml
+++ b/external/toxcore/c-toxcore/azure-pipelines.yml
@@ -12,4 +12,4 @@ jobs:
       - bash: python -m pip install conan==1.59.0
       - bash: git submodule update --init --recursive
       - bash: conan install -if _build -o with_tests=True -o shared=$(conan.shared) .
-      - bash: CONAN_CPU_COUNT=50 CTEST_OUTPUT_ON_FAILURE=1 conan build -bf _build -if _build .
+      - bash: CONAN_CPU_COUNT=50 CTEST_OUTPUT_ON_FAILURE=1 conan build -bf _build -if _build . || true
diff --git a/external/toxcore/c-toxcore/cmake/StrictAbi.cmake b/external/toxcore/c-toxcore/cmake/StrictAbi.cmake
index 22b1ca4..f91ec16 100644
--- a/external/toxcore/c-toxcore/cmake/StrictAbi.cmake
+++ b/external/toxcore/c-toxcore/cmake/StrictAbi.cmake
@@ -29,7 +29,7 @@ function(_make_version_script target)
     list(GET sublib 1 ns)
 
     execute_process(
-      COMMAND ${SHELL} -c "egrep '^\\w' ${header} | grep '${ns}_[a-z0-9_]*(' | grep -v '^typedef' | grep -o '${ns}_[a-z0-9_]*(' | egrep -o '\\w+' | sort -u"
+      COMMAND ${SHELL} -c "egrep '^\\w' ${header} | grep '${ns}_[a-z0-9_]*(' | grep -v '^typedef' | grep -o '${ns}_[a-z0-9_]*(' | egrep -o '[a-z0-9_]+' | sort -u"
       OUTPUT_VARIABLE sublib_SYMS
       OUTPUT_STRIP_TRAILING_WHITESPACE)
     string(REPLACE "\n" ";" sublib_SYMS ${sublib_SYMS})
diff --git a/external/toxcore/c-toxcore/other/BUILD.bazel b/external/toxcore/c-toxcore/other/BUILD.bazel
index fbf1abf..253cfcd 100644
--- a/external/toxcore/c-toxcore/other/BUILD.bazel
+++ b/external/toxcore/c-toxcore/other/BUILD.bazel
@@ -1,8 +1,6 @@
 load("@rules_cc//cc:defs.bzl", "cc_binary")
 load("//tools:no_undefined.bzl", "cc_library")
 
-package(features = ["layering_check"])
-
 cc_library(
     name = "bootstrap_node_packets",
     srcs = ["bootstrap_node_packets.c"],
diff --git a/external/toxcore/c-toxcore/other/analysis/run-clang-tidy b/external/toxcore/c-toxcore/other/analysis/run-clang-tidy
index a87b517..d1fcae1 100755
--- a/external/toxcore/c-toxcore/other/analysis/run-clang-tidy
+++ b/external/toxcore/c-toxcore/other/analysis/run-clang-tidy
@@ -2,6 +2,9 @@
 
 CHECKS="*"
 
+# We don't use memcpy_s.
+CHECKS="$CHECKS,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling"
+
 # __attribute__((nonnull)) causes this warning on defensive null checks.
 CHECKS="$CHECKS,-clang-diagnostic-pointer-bool-conversion"
 CHECKS="$CHECKS,-clang-diagnostic-tautological-pointer-compare"
@@ -57,6 +60,27 @@ CHECKS="$CHECKS,-readability-redundant-control-flow"
 CHECKS="$CHECKS,-bugprone-narrowing-conversions"
 CHECKS="$CHECKS,-cppcoreguidelines-narrowing-conversions"
 
+# Mistakenly thinks that
+#   const int a = 0, b = 1;
+#   assert(a < b);
+# is a constant expression in C (it is in C++ though, which is probably why it's
+# mistaken), suggesting to replace 'assert()' with 'static_assert()' in cases
+# where that won't work.
+#
+# There are ways to make 'static_assert()' work, but they are rather annoying --
+# they are somewhat ugly, hurting the readability, and some are error-prone:
+#
+# - Turning 'a' and 'b' into enum constants would make it work, but this falls
+#   apart if the enum types are compared against non-enums down the line
+#     error: enumerated and non-enumerated type in conditional expression [-Werror=extra]
+#
+# - Turning 'a' and 'b' into pre-processor macros is the only option left, but
+#   #defines and #undefs in the middle of a function hurt the readability and
+#   are less idiomatic than simply using 'const int'.
+CHECKS="$CHECKS,-cert-dcl03-c"
+CHECKS="$CHECKS,-hicpp-static-assert"
+CHECKS="$CHECKS,-misc-static-assert"
+
 # TODO(iphydf): We might want some of these. For the ones we don't want, add a
 # comment explaining why not.
 CHECKS="$CHECKS,-clang-analyzer-optin.performance.Padding"
diff --git a/external/toxcore/c-toxcore/other/bootstrap_daemon/BUILD.bazel b/external/toxcore/c-toxcore/other/bootstrap_daemon/BUILD.bazel
index e1a2e41..dce64bb 100644
--- a/external/toxcore/c-toxcore/other/bootstrap_daemon/BUILD.bazel
+++ b/external/toxcore/c-toxcore/other/bootstrap_daemon/BUILD.bazel
@@ -1,7 +1,5 @@
 load("@rules_cc//cc:defs.bzl", "cc_binary")
 
-package(features = ["layering_check"])
-
 cc_binary(
     name = "bootstrap_daemon",
     srcs = glob([
diff --git a/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/Dockerfile b/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/Dockerfile
index a62a488..e86290b 100644
--- a/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/Dockerfile
+++ b/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/Dockerfile
@@ -1,6 +1,6 @@
 ###########################################################
 # Builder image: we compile the code here (static build)
-FROM alpine:3.15.0 AS build
+FROM alpine:3.18.5 AS build
 
 RUN ["apk", "--no-cache", "add",\
  "build-base",\
@@ -62,7 +62,7 @@ RUN ["other/bootstrap_daemon/docker/get-nodes.py", "other/bootstrap_daemon/tox-b
 
 ###########################################################
 # Final image build: this is what runs the bootstrap node
-FROM debian:bullseye-slim
+FROM debian:bookworm-slim
 
 COPY --from=build /usr/local/bin/tox-bootstrapd /usr/local/bin/
 COPY --from=build /src/c-toxcore/other/bootstrap_daemon/tox-bootstrapd.conf /etc/tox-bootstrapd.conf
diff --git a/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/tox-bootstrapd.sha256 b/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/tox-bootstrapd.sha256
index 255d6a8..684a791 100644
--- a/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/tox-bootstrapd.sha256
+++ b/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/tox-bootstrapd.sha256
@@ -1 +1 @@
-b2996d73cab7c7453dc10ccf7ad733622558de3b1ad0db824a379cf96f500379  /usr/local/bin/tox-bootstrapd
+5aac1df4d6c1de289e8e9f646d06099c84fd4d9b80d19f45e3254eec3ece2bff  /usr/local/bin/tox-bootstrapd
diff --git a/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/update-sha256 b/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/update-sha256
index 8bf6e0d..6f352f3 100755
--- a/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/update-sha256
+++ b/external/toxcore/c-toxcore/other/bootstrap_daemon/docker/update-sha256
@@ -3,7 +3,7 @@
 set -eux
 
 docker_build() {
-  docker build -f other/bootstrap_daemon/docker/Dockerfile -t toxchat/bootstrap-node .
+  DOCKER_BUILDKIT=1 docker build --progress=plain -f other/bootstrap_daemon/docker/Dockerfile -t toxchat/bootstrap-node .
 }
 
 # Run Docker build once. If it succeeds, we're good.
@@ -12,12 +12,11 @@ if docker_build; then
 fi
 
 # We're not good. Run it again, but now capture the output.
-OUTPUT=$(docker_build || true 2>&1)
+OUTPUT=$(docker_build 2>&1 || true)
 
 if echo "$OUTPUT" | grep '/usr/local/bin/tox-bootstrapd: FAILED'; then
   # This is a checksum warning, so we need to update it.
-  IMAGE=$(echo "$OUTPUT" | grep '^ ---> [0-9a-f]*$' | grep -o '[0-9a-f]*$' | tail -n1)
-  docker run --rm "$IMAGE" sha256sum /usr/local/bin/tox-bootstrapd >other/bootstrap_daemon/docker/tox-bootstrapd.sha256
+  echo "$OUTPUT" | grep -Eo '[0-9a-f]{64}  /usr/local/bin/tox-bootstrapd' | tail -n1 >other/bootstrap_daemon/docker/tox-bootstrapd.sha256
 fi
 
 # Run once last time to complete the build.
diff --git a/external/toxcore/c-toxcore/other/bootstrap_daemon/src/config.c b/external/toxcore/c-toxcore/other/bootstrap_daemon/src/config.c
index c9701cd..9f579d9 100644
--- a/external/toxcore/c-toxcore/other/bootstrap_daemon/src/config.c
+++ b/external/toxcore/c-toxcore/other/bootstrap_daemon/src/config.c
@@ -1,5 +1,5 @@
 /* SPDX-License-Identifier: GPL-3.0-or-later
- * Copyright © 2016-2018 The TokTok team.
+ * Copyright © 2016-2023 The TokTok team.
  * Copyright © 2014-2016 Tox project.
  */
 
@@ -39,22 +39,28 @@ static void parse_tcp_relay_ports_config(config_t *cfg, uint16_t **tcp_relay_por
         log_write(LOG_LEVEL_WARNING, "No '%s' setting in the configuration file.\n", NAME_TCP_RELAY_PORTS);
         log_write(LOG_LEVEL_WARNING, "Using default '%s':\n", NAME_TCP_RELAY_PORTS);
 
-        uint16_t default_ports[DEFAULT_TCP_RELAY_PORTS_COUNT] = {DEFAULT_TCP_RELAY_PORTS};
+        uint16_t default_ports[] = {DEFAULT_TCP_RELAY_PORTS};
 
-        for (int i = 0; i < DEFAULT_TCP_RELAY_PORTS_COUNT; ++i) {
-            log_write(LOG_LEVEL_INFO, "Port #%d: %u\n", i, default_ports[i]);
+        // Check to avoid calling malloc(0) later on
+        // NOLINTNEXTLINE, clang-tidy: error: suspicious comparison of 'sizeof(expr)' to a constant [bugprone-sizeof-expression,-warnings-as-errors]
+        static_assert(sizeof(default_ports) > 0, "At least one default TCP relay port should be provided");
+
+        const size_t default_ports_count = sizeof(default_ports)/sizeof(*default_ports);
+
+        for (size_t i = 0; i < default_ports_count; ++i) {
+            log_write(LOG_LEVEL_INFO, "Port #%zu: %u\n", i, default_ports[i]);
         }
 
         // similar procedure to the one of reading config file below
-        *tcp_relay_ports = (uint16_t *)malloc(DEFAULT_TCP_RELAY_PORTS_COUNT * sizeof(uint16_t));
+        *tcp_relay_ports = (uint16_t *)malloc(default_ports_count * sizeof(uint16_t));
 
-        for (int i = 0; i < DEFAULT_TCP_RELAY_PORTS_COUNT; ++i) {
+        for (size_t i = 0; i < default_ports_count; ++i) {
 
             (*tcp_relay_ports)[*tcp_relay_port_count] = default_ports[i];
 
             if ((*tcp_relay_ports)[*tcp_relay_port_count] < MIN_ALLOWED_PORT
                     || (*tcp_relay_ports)[*tcp_relay_port_count] > MAX_ALLOWED_PORT) {
-                log_write(LOG_LEVEL_WARNING, "Port #%d: Invalid port: %u, should be in [%d, %d]. Skipping.\n", i,
+                log_write(LOG_LEVEL_WARNING, "Port #%zu: Invalid port: %u, should be in [%d, %d]. Skipping.\n", i,
                           (*tcp_relay_ports)[*tcp_relay_port_count], MIN_ALLOWED_PORT, MAX_ALLOWED_PORT);
                 continue;
             }
diff --git a/external/toxcore/c-toxcore/other/bootstrap_daemon/src/config_defaults.h b/external/toxcore/c-toxcore/other/bootstrap_daemon/src/config_defaults.h
index a48e5fe..2e2c94f 100644
--- a/external/toxcore/c-toxcore/other/bootstrap_daemon/src/config_defaults.h
+++ b/external/toxcore/c-toxcore/other/bootstrap_daemon/src/config_defaults.h
@@ -1,5 +1,5 @@
 /* SPDX-License-Identifier: GPL-3.0-or-later
- * Copyright © 2016-2018 The TokTok team.
+ * Copyright © 2016-2023 The TokTok team.
  * Copyright © 2014-2016 Tox project.
  */
 
@@ -19,8 +19,7 @@
 #define DEFAULT_ENABLE_IPV4_FALLBACK  1 // 1 - true, 0 - false
 #define DEFAULT_ENABLE_LAN_DISCOVERY  1 // 1 - true, 0 - false
 #define DEFAULT_ENABLE_TCP_RELAY      1 // 1 - true, 0 - false
-#define DEFAULT_TCP_RELAY_PORTS       443, 3389, 33445 // comma-separated list of ports. make sure to adjust DEFAULT_TCP_RELAY_PORTS_COUNT accordingly
-#define DEFAULT_TCP_RELAY_PORTS_COUNT 3
+#define DEFAULT_TCP_RELAY_PORTS       443, 3389, 33445 // comma-separated list of ports
 #define DEFAULT_ENABLE_MOTD           1 // 1 - true, 0 - false
 #define DEFAULT_MOTD                  DAEMON_NAME
 
diff --git a/external/toxcore/c-toxcore/other/bootstrap_daemon/src/tox-bootstrapd.c b/external/toxcore/c-toxcore/other/bootstrap_daemon/src/tox-bootstrapd.c
index 8d0e318..5227db7 100644
--- a/external/toxcore/c-toxcore/other/bootstrap_daemon/src/tox-bootstrapd.c
+++ b/external/toxcore/c-toxcore/other/bootstrap_daemon/src/tox-bootstrapd.c
@@ -375,6 +375,7 @@ int main(int argc, char *argv[])
 
     if (!onion) {
         log_write(LOG_LEVEL_ERROR, "Couldn't initialize Tox Onion. Exiting.\n");
+        kill_gca(group_announce);
         kill_announcements(announce);
         kill_forwarding(forwarding);
         kill_dht(dht);
@@ -454,7 +455,7 @@ int main(int argc, char *argv[])
         if (tcp_relay_port_count == 0) {
             log_write(LOG_LEVEL_ERROR, "No TCP relay ports read. Exiting.\n");
             kill_onion_announce(onion_a);
-	        kill_gca(group_announce);
+            kill_gca(group_announce);
             kill_announcements(announce);
             kill_forwarding(forwarding);
             kill_onion(onion);
diff --git a/external/toxcore/c-toxcore/other/bootstrap_daemon/websocket/websockify/BUILD.bazel b/external/toxcore/c-toxcore/other/bootstrap_daemon/websocket/websockify/BUILD.bazel
index a364319..bfe2fc5 100644
--- a/external/toxcore/c-toxcore/other/bootstrap_daemon/websocket/websockify/BUILD.bazel
+++ b/external/toxcore/c-toxcore/other/bootstrap_daemon/websocket/websockify/BUILD.bazel
@@ -1,7 +1,5 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
-package(features = ["-layering_check"])
-
 go_library(
     name = "go_default_library",
     srcs = ["websockify.go"],
diff --git a/external/toxcore/c-toxcore/other/docker/alpine-s390x/Dockerfile b/external/toxcore/c-toxcore/other/docker/alpine-s390x/Dockerfile
new file mode 100644
index 0000000..8ac7679
--- /dev/null
+++ b/external/toxcore/c-toxcore/other/docker/alpine-s390x/Dockerfile
@@ -0,0 +1,6 @@
+FROM toxchat/alpine-s390x:latest
+
+WORKDIR /work/c-toxcore
+COPY . /work/c-toxcore/
+
+RUN [".github/scripts/cmake-alpine-s390x"]
diff --git a/external/toxcore/c-toxcore/other/docker/alpine-s390x/run b/external/toxcore/c-toxcore/other/docker/alpine-s390x/run
new file mode 100755
index 0000000..f77eede
--- /dev/null
+++ b/external/toxcore/c-toxcore/other/docker/alpine-s390x/run
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -eux
+BUILD=alpine-s390x
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
diff --git a/external/toxcore/c-toxcore/other/docker/autotools/run b/external/toxcore/c-toxcore/other/docker/autotools/run
index 895ff3c..aadb144 100755
--- a/external/toxcore/c-toxcore/other/docker/autotools/run
+++ b/external/toxcore/c-toxcore/other/docker/autotools/run
@@ -1,3 +1,5 @@
 #!/bin/sh
 
-docker build -t toxchat/c-toxcore:autotools -f other/docker/autotools/Dockerfile .
+set -eux
+BUILD=autotools
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
diff --git a/external/toxcore/c-toxcore/other/docker/cimplefmt/run b/external/toxcore/c-toxcore/other/docker/cimplefmt/run
index 5016a06..1211bb8 100755
--- a/external/toxcore/c-toxcore/other/docker/cimplefmt/run
+++ b/external/toxcore/c-toxcore/other/docker/cimplefmt/run
@@ -5,4 +5,4 @@ if [ "$1" = "-u" ]; then
   docker pull toxchat/haskell:hs-cimple
   docker build -t toxchat/cimplefmt -f other/docker/cimplefmt/Dockerfile .
 fi
-docker run --rm -v "$PWD:/work" toxchat/cimplefmt "$@"
+docker run --name toxcore-cimplefmt --rm -v "$PWD:/work" toxchat/cimplefmt "$@"
diff --git a/external/toxcore/c-toxcore/other/docker/circleci/run b/external/toxcore/c-toxcore/other/docker/circleci/run
index 22aedf9..668e0fc 100755
--- a/external/toxcore/c-toxcore/other/docker/circleci/run
+++ b/external/toxcore/c-toxcore/other/docker/circleci/run
@@ -3,4 +3,4 @@
 SANITIZER="${1:-asan}"
 
 docker build -t toxchat/c-toxcore:circleci other/docker/circleci
-docker run --rm -it -v "$PWD:/c-toxcore" toxchat/c-toxcore:circleci "$SANITIZER"
+docker run --name toxcore-circleci --rm -it -v "$PWD:/c-toxcore" toxchat/c-toxcore:circleci "$SANITIZER"
diff --git a/external/toxcore/c-toxcore/other/docker/compcert/Dockerfile b/external/toxcore/c-toxcore/other/docker/compcert/Dockerfile
new file mode 100644
index 0000000..bcc6138
--- /dev/null
+++ b/external/toxcore/c-toxcore/other/docker/compcert/Dockerfile
@@ -0,0 +1,30 @@
+FROM toxchat/compcert:latest
+
+WORKDIR /work
+COPY auto_tests/ /work/auto_tests/
+COPY testing/ /work/testing/
+COPY toxav/ /work/toxav/
+COPY toxcore/ /work/toxcore/
+COPY toxencryptsave/ /work/toxencryptsave/
+COPY third_party/ /work/third_party/
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+RUN ccomp \
+ -o send_message_test \
+ -Wall -Werror \
+ -Wno-c11-extensions \
+ -Wno-unknown-pragmas \
+ -Wno-unused-variable \
+ -fstruct-passing -fno-unprototyped -g \
+ auto_tests/auto_test_support.c \
+ auto_tests/send_message_test.c \
+ testing/misc_tools.c \
+ toxav/*.c \
+ toxcore/*.c \
+ toxcore/*/*.c \
+ toxencryptsave/*.c \
+ third_party/cmp/*.c \
+ -D__COMPCERT__ -DDISABLE_VLA -Dinline= \
+ -lpthread $(pkg-config --cflags --libs libsodium opus vpx) \
+ && ./send_message_test | grep 'tox clients connected'
diff --git a/external/toxcore/c-toxcore/other/docker/compcert/run b/external/toxcore/c-toxcore/other/docker/compcert/run
new file mode 100755
index 0000000..8b03c84
--- /dev/null
+++ b/external/toxcore/c-toxcore/other/docker/compcert/run
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -eux
+BUILD=compcert
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
diff --git a/external/toxcore/c-toxcore/other/docker/coverage/run b/external/toxcore/c-toxcore/other/docker/coverage/run
index cfb5769..a170812 100755
--- a/external/toxcore/c-toxcore/other/docker/coverage/run
+++ b/external/toxcore/c-toxcore/other/docker/coverage/run
@@ -4,4 +4,4 @@ set -eux
 
 docker build -t toxchat/c-toxcore:sources -f other/docker/sources/Dockerfile .
 docker build -t toxchat/c-toxcore:coverage other/docker/coverage
-docker run --rm -it -p "28192:80" toxchat/c-toxcore:coverage
+docker run --name toxcore-coverage --rm -it -p "28192:80" toxchat/c-toxcore:coverage
diff --git a/external/toxcore/c-toxcore/other/docker/doxygen/run b/external/toxcore/c-toxcore/other/docker/doxygen/run
index 85b24cb..c702ba5 100755
--- a/external/toxcore/c-toxcore/other/docker/doxygen/run
+++ b/external/toxcore/c-toxcore/other/docker/doxygen/run
@@ -3,4 +3,4 @@
 set -eux
 
 docker build -t toxchat/c-toxcore:docs -f other/docker/doxygen/Dockerfile .
-docker run --rm -it -p "28192:80" toxchat/c-toxcore:docs
+docker run --name toxcore-docs --rm -it -p "28192:80" toxchat/c-toxcore:docs
diff --git a/external/toxcore/c-toxcore/other/docker/freebsd/Dockerfile b/external/toxcore/c-toxcore/other/docker/freebsd/Dockerfile
new file mode 100644
index 0000000..9c5f09e
--- /dev/null
+++ b/external/toxcore/c-toxcore/other/docker/freebsd/Dockerfile
@@ -0,0 +1,6 @@
+FROM toxchat/freebsd:latest
+
+WORKDIR /work/c-toxcore
+COPY . /work/c-toxcore/
+
+RUN [".github/scripts/cmake-freebsd"]
diff --git a/external/toxcore/c-toxcore/other/docker/freebsd/run b/external/toxcore/c-toxcore/other/docker/freebsd/run
new file mode 100755
index 0000000..f4448a4
--- /dev/null
+++ b/external/toxcore/c-toxcore/other/docker/freebsd/run
@@ -0,0 +1,5 @@
+#!/bin/sh
+
+set -eux
+BUILD=freebsd
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
diff --git a/external/toxcore/c-toxcore/other/docker/misra/run b/external/toxcore/c-toxcore/other/docker/misra/run
index ab228f7..2f96bb4 100755
--- a/external/toxcore/c-toxcore/other/docker/misra/run
+++ b/external/toxcore/c-toxcore/other/docker/misra/run
@@ -1,3 +1,5 @@
 #!/bin/sh
 
-docker build -f other/docker/misra/Dockerfile .
+set -eux
+BUILD=misra
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
diff --git a/external/toxcore/c-toxcore/other/docker/perf/run b/external/toxcore/c-toxcore/other/docker/perf/run
index 44f336c..4834614 100755
--- a/external/toxcore/c-toxcore/other/docker/perf/run
+++ b/external/toxcore/c-toxcore/other/docker/perf/run
@@ -3,7 +3,7 @@
 set -eux
 
 docker build -t toxchat/c-toxcore:perf -f other/docker/perf/Dockerfile .
-docker run --privileged --rm -it \
+docker run --name toxcore-perf --privileged --rm -it \
   -v "$PWD:/work/c-toxcore" \
   toxchat/c-toxcore:perf \
   "$@"
diff --git a/external/toxcore/c-toxcore/other/docker/tcc/Dockerfile b/external/toxcore/c-toxcore/other/docker/tcc/Dockerfile
index 9a8a2e0..65ab3e7 100644
--- a/external/toxcore/c-toxcore/other/docker/tcc/Dockerfile
+++ b/external/toxcore/c-toxcore/other/docker/tcc/Dockerfile
@@ -1,4 +1,4 @@
-FROM ubuntu:20.04
+FROM ubuntu:22.04
 
 RUN apt-get update && \
  DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
@@ -17,6 +17,9 @@ COPY testing/ /work/testing/
 COPY toxav/ /work/toxav/
 COPY toxcore/ /work/toxcore/
 COPY toxencryptsave/ /work/toxencryptsave/
+COPY third_party/ /work/third_party/
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 RUN tcc \
  -Dinline=static \
@@ -31,9 +34,9 @@ RUN tcc \
  toxcore/*/*.c \
  toxencryptsave/*.c \
  third_party/cmp/*.c \
- $(pkg-config --cflags --libs libsodium opus vpx)
+ $(pkg-config --cflags --libs libsodium opus vpx) \
+ && ./send_message_test | grep 'tox clients connected'
 
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 COPY other/make_single_file /work/other/
 RUN \
  other/make_single_file \
@@ -44,4 +47,5 @@ RUN \
    -o send_message_test \
    -Wall -Werror \
    -bench -g \
-   $(pkg-config --cflags --libs libsodium opus vpx)
+   $(pkg-config --cflags --libs libsodium opus vpx) \
+ && ./send_message_test | grep 'tox clients connected'
diff --git a/external/toxcore/c-toxcore/other/docker/tcc/run b/external/toxcore/c-toxcore/other/docker/tcc/run
index be28a71..870852b 100755
--- a/external/toxcore/c-toxcore/other/docker/tcc/run
+++ b/external/toxcore/c-toxcore/other/docker/tcc/run
@@ -1,5 +1,5 @@
 #!/bin/sh
 
 set -eux
-
-docker build -t toxchat/c-toxcore:tcc -f other/docker/tcc/Dockerfile .
+BUILD=tcc
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
diff --git a/external/toxcore/c-toxcore/other/docker/tokstyle/run b/external/toxcore/c-toxcore/other/docker/tokstyle/run
index 30c2a73..c743def 100755
--- a/external/toxcore/c-toxcore/other/docker/tokstyle/run
+++ b/external/toxcore/c-toxcore/other/docker/tokstyle/run
@@ -1,3 +1,5 @@
 #!/bin/sh
 
-docker build -f other/docker/tokstyle/Dockerfile .
+set -eux
+BUILD=tokstyle
+docker build -t "toxchat/c-toxcore:$BUILD" -f "other/docker/$BUILD/Dockerfile" .
diff --git a/external/toxcore/c-toxcore/other/fun/BUILD.bazel b/external/toxcore/c-toxcore/other/fun/BUILD.bazel
index 7a489f8..6ff96db 100644
--- a/external/toxcore/c-toxcore/other/fun/BUILD.bazel
+++ b/external/toxcore/c-toxcore/other/fun/BUILD.bazel
@@ -1,7 +1,5 @@
 load("@rules_cc//cc:defs.bzl", "cc_binary")
 
-package(features = ["layering_check"])
-
 #cc_binary(
 #    name = "cracker",
 #    testonly = 1,
diff --git a/external/toxcore/c-toxcore/other/fun/save-generator.c b/external/toxcore/c-toxcore/other/fun/save-generator.c
index 7e8aa34..6f65a95 100644
--- a/external/toxcore/c-toxcore/other/fun/save-generator.c
+++ b/external/toxcore/c-toxcore/other/fun/save-generator.c
@@ -73,10 +73,15 @@ static void print_information(Tox *tox)
     int length = snprintf(nospam_str, sizeof(nospam_str), "%08X", nospam);
     nospam_str[length] = '\0';
 
-    uint8_t *name = (uint8_t *)malloc(tox_self_get_name_size(tox) + 1);
-    assert(name != nullptr);
+    size_t name_size = tox_self_get_name_size(tox);
+    uint8_t *name = (uint8_t *)malloc(name_size + 1);
+
+    if (!name) {
+        return;
+    }
+
     tox_self_get_name(tox, name);
-    name[tox_self_get_name_size(tox)] = '\0';
+    name[name_size] = '\0';
 
     printf("INFORMATION\n");
     printf("----------------------------------\n");
@@ -86,6 +91,8 @@ static void print_information(Tox *tox)
     printf("Status message: %s.\n", GENERATED_STATUS_MESSAGE);
     printf("Number of friends: %zu.\n", tox_self_get_friend_list_size(tox));
     printf("----------------------------------\n");
+
+    free(name);
 }
 
 int main(int argc, char *argv[])
diff --git a/external/toxcore/c-toxcore/other/proxy/BUILD.bazel b/external/toxcore/c-toxcore/other/proxy/BUILD.bazel
index aa17c6d..a63593f 100644
--- a/external/toxcore/c-toxcore/other/proxy/BUILD.bazel
+++ b/external/toxcore/c-toxcore/other/proxy/BUILD.bazel
@@ -1,7 +1,5 @@
 load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
 
-package(features = ["layering_check"])
-
 go_library(
     name = "go_default_library",
     srcs = ["proxy_server.go"],
diff --git a/external/toxcore/c-toxcore/super_donators/BUILD.bazel b/external/toxcore/c-toxcore/super_donators/BUILD.bazel
index 353e34a..f268d5d 100644
--- a/external/toxcore/c-toxcore/super_donators/BUILD.bazel
+++ b/external/toxcore/c-toxcore/super_donators/BUILD.bazel
@@ -1,7 +1,5 @@
 load("@rules_cc//cc:defs.bzl", "cc_binary")
 
-package(features = ["layering_check"])
-
 cc_binary(
     name = "grencez_tok5",
     srcs = ["grencez_tok5.c"],
diff --git a/external/toxcore/c-toxcore/testing/BUILD.bazel b/external/toxcore/c-toxcore/testing/BUILD.bazel
index 4f27503..52a7786 100644
--- a/external/toxcore/c-toxcore/testing/BUILD.bazel
+++ b/external/toxcore/c-toxcore/testing/BUILD.bazel
@@ -1,7 +1,5 @@
 load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 
-package(features = ["layering_check"])
-
 CIMPLE_FILES = [
     "//c-toxcore/toxav:cimple_files",
     "//c-toxcore/toxcore:cimple_files",
diff --git a/external/toxcore/c-toxcore/testing/fuzzing/BUILD.bazel b/external/toxcore/c-toxcore/testing/fuzzing/BUILD.bazel
index 7144954..2aada41 100644
--- a/external/toxcore/c-toxcore/testing/fuzzing/BUILD.bazel
+++ b/external/toxcore/c-toxcore/testing/fuzzing/BUILD.bazel
@@ -2,8 +2,6 @@ load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 load("@rules_fuzzing//fuzzing:cc_defs.bzl", "cc_fuzz_test")
 load("@rules_fuzzing//fuzzing/private:binary.bzl", "fuzzing_binary")  # buildifier: disable=bzl-visibility
 
-package(features = ["layering_check"])
-
 cc_library(
     name = "fuzz_support",
     srcs = [
diff --git a/external/toxcore/c-toxcore/third_party/BUILD.bazel b/external/toxcore/c-toxcore/third_party/BUILD.bazel
index 97f4d09..7a004d8 100644
--- a/external/toxcore/c-toxcore/third_party/BUILD.bazel
+++ b/external/toxcore/c-toxcore/third_party/BUILD.bazel
@@ -1,7 +1,5 @@
 load("//tools:no_undefined.bzl", "cc_library")
 
-package(features = ["layering_check"])
-
 cc_library(
     name = "cmp",
     srcs = ["cmp/cmp.c"],
diff --git a/external/toxcore/c-toxcore/toxav/BUILD.bazel b/external/toxcore/c-toxcore/toxav/BUILD.bazel
index ca88f13..f9a669e 100644
--- a/external/toxcore/c-toxcore/toxav/BUILD.bazel
+++ b/external/toxcore/c-toxcore/toxav/BUILD.bazel
@@ -1,8 +1,6 @@
 load("@rules_cc//cc:defs.bzl", "cc_test")
 load("//tools:no_undefined.bzl", "cc_library")
 
-package(features = ["layering_check"])
-
 exports_files(
     srcs = ["toxav.h"],
     visibility = ["//c-toxcore:__pkg__"],
diff --git a/external/toxcore/c-toxcore/toxcore/BUILD.bazel b/external/toxcore/c-toxcore/toxcore/BUILD.bazel
index 4701cf4..46d1cb4 100644
--- a/external/toxcore/c-toxcore/toxcore/BUILD.bazel
+++ b/external/toxcore/c-toxcore/toxcore/BUILD.bazel
@@ -2,10 +2,11 @@ load("@rules_cc//cc:defs.bzl", "cc_test")
 load("@rules_fuzzing//fuzzing:cc_defs.bzl", "cc_fuzz_test")
 load("//tools:no_undefined.bzl", "cc_library")
 
-package(features = ["layering_check"])
-
 exports_files(
-    srcs = ["tox.h"],
+    srcs = [
+        "tox.h",
+        "tox_private.h",
+    ],
     visibility = ["//c-toxcore:__pkg__"],
 )
 
@@ -76,6 +77,22 @@ cc_test(
     ],
 )
 
+cc_library(
+    name = "logger",
+    srcs = ["logger.c"],
+    hdrs = ["logger.h"],
+    visibility = [
+        "//c-toxcore/auto_tests:__pkg__",
+        "//c-toxcore/other:__pkg__",
+        "//c-toxcore/other/bootstrap_daemon:__pkg__",
+        "//c-toxcore/toxav:__pkg__",
+    ],
+    deps = [
+        ":attributes",
+        ":ccompat",
+    ],
+)
+
 cc_library(
     name = "bin_pack",
     srcs = ["bin_pack.c"],
@@ -84,6 +101,7 @@ cc_library(
     deps = [
         ":attributes",
         ":ccompat",
+        ":logger",
         "//c-toxcore/third_party:cmp",
     ],
 )
@@ -158,22 +176,6 @@ cc_test(
     ],
 )
 
-cc_library(
-    name = "logger",
-    srcs = ["logger.c"],
-    hdrs = ["logger.h"],
-    visibility = [
-        "//c-toxcore/auto_tests:__pkg__",
-        "//c-toxcore/other:__pkg__",
-        "//c-toxcore/other/bootstrap_daemon:__pkg__",
-        "//c-toxcore/toxav:__pkg__",
-    ],
-    deps = [
-        ":attributes",
-        ":ccompat",
-    ],
-)
-
 cc_library(
     name = "state",
     srcs = ["state.c"],
@@ -339,6 +341,7 @@ cc_library(
     deps = [
         ":LAN_discovery",
         ":attributes",
+        ":bin_pack",
         ":ccompat",
         ":crypto_core",
         ":logger",
@@ -366,6 +369,7 @@ cc_test(
 
 cc_fuzz_test(
     name = "DHT_fuzz_test",
+    size = "small",
     srcs = ["DHT_fuzz_test.cc"],
     corpus = ["//tools/toktok-fuzzer/corpus:DHT_fuzz_test"],
     deps = [
@@ -405,6 +409,7 @@ cc_library(
 
 cc_fuzz_test(
     name = "forwarding_fuzz_test",
+    size = "small",
     srcs = ["forwarding_fuzz_test.cc"],
     #corpus = ["//tools/toktok-fuzzer/corpus:forwarding_fuzz_test"],
     deps = [
@@ -603,6 +608,7 @@ cc_library(
 
 cc_fuzz_test(
     name = "group_announce_fuzz_test",
+    size = "small",
     srcs = ["group_announce_fuzz_test.cc"],
     #corpus = ["//tools/toktok-fuzzer/corpus:group_announce_fuzz_test"],
     deps = [
@@ -706,6 +712,7 @@ cc_test(
 
 cc_fuzz_test(
     name = "group_moderation_fuzz_test",
+    size = "small",
     srcs = ["group_moderation_fuzz_test.cc"],
     corpus = ["//tools/toktok-fuzzer/corpus:group_moderation_fuzz_test"],
     deps = [
@@ -862,6 +869,7 @@ cc_test(
 
 cc_fuzz_test(
     name = "tox_events_fuzz_test",
+    size = "small",
     srcs = ["tox_events_fuzz_test.cc"],
     corpus = ["//tools/toktok-fuzzer/corpus:tox_events_fuzz_test"],
     deps = [
diff --git a/external/toxcore/c-toxcore/toxcore/DHT.c b/external/toxcore/c-toxcore/toxcore/DHT.c
index 80f477c..397e18c 100644
--- a/external/toxcore/c-toxcore/toxcore/DHT.c
+++ b/external/toxcore/c-toxcore/toxcore/DHT.c
@@ -9,10 +9,12 @@
 #include "DHT.h"
 
 #include <assert.h>
+#include <limits.h>
 #include <stdlib.h>
 #include <string.h>
 
 #include "LAN_discovery.h"
+#include "bin_pack.h"
 #include "ccompat.h"
 #include "logger.h"
 #include "mono_time.h"
@@ -360,12 +362,32 @@ int packed_node_size(Family ip_family)
 }
 
 
-int pack_ip_port(const Logger *logger, uint8_t *data, uint16_t length, const IP_Port *ip_port)
+/** @brief Packs an IP structure.
+ *
+ * It's the caller's responsibility to make sure `is_ipv4` tells the truth. This
+ * function is an implementation detail of @ref bin_pack_ip_port.
+ *
+ * @param is_ipv4 whether this IP is an IP4 or IP6.
+ *
+ * @retval true on success.
+ */
+non_null()
+static bool bin_pack_ip(Bin_Pack *bp, const IP *ip, bool is_ipv4)
 {
-    if (data == nullptr) {
-        return -1;
+    if (is_ipv4) {
+        return bin_pack_bin_b(bp, ip->ip.v4.uint8, SIZE_IP4);
+    } else {
+        return bin_pack_bin_b(bp, ip->ip.v6.uint8, SIZE_IP6);
     }
+}
 
+/** @brief Packs an IP_Port structure.
+ *
+ * @retval true on success.
+ */
+non_null()
+static bool bin_pack_ip_port(Bin_Pack *bp, const Logger *logger, const IP_Port *ip_port)
+{
     bool is_ipv4;
     uint8_t family;
 
@@ -387,32 +409,34 @@ int pack_ip_port(const Logger *logger, uint8_t *data, uint16_t length, const IP_
         // TODO(iphydf): Find out why we're trying to pack invalid IPs, stop
         // doing that, and turn this into an error.
         LOGGER_TRACE(logger, "cannot pack invalid IP: %s", net_ip_ntoa(&ip_port->ip, &ip_str));
+        return false;
+    }
+
+    return bin_pack_u08_b(bp, family)
+           && bin_pack_ip(bp, &ip_port->ip, is_ipv4)
+           && bin_pack_u16_b(bp, net_ntohs(ip_port->port));
+}
+
+non_null()
+static bool bin_pack_ip_port_handler(Bin_Pack *bp, const Logger *logger, const void *obj)
+{
+    return bin_pack_ip_port(bp, logger, (const IP_Port *)obj);
+}
+
+int pack_ip_port(const Logger *logger, uint8_t *data, uint16_t length, const IP_Port *ip_port)
+{
+    const uint32_t size = bin_pack_obj_size(bin_pack_ip_port_handler, logger, ip_port);
+
+    if (size > length) {
         return -1;
     }
 
-    if (is_ipv4) {
-        const uint32_t size = 1 + SIZE_IP4 + sizeof(uint16_t);
-
-        if (size > length) {
-            return -1;
-        }
-
-        data[0] = family;
-        memcpy(data + 1, &ip_port->ip.ip.v4, SIZE_IP4);
-        memcpy(data + 1 + SIZE_IP4, &ip_port->port, sizeof(uint16_t));
-        return size;
-    } else {
-        const uint32_t size = 1 + SIZE_IP6 + sizeof(uint16_t);
-
-        if (size > length) {
-            return -1;
-        }
-
-        data[0] = family;
-        memcpy(data + 1, &ip_port->ip.ip.v6, SIZE_IP6);
-        memcpy(data + 1 + SIZE_IP6, &ip_port->port, sizeof(uint16_t));
-        return size;
+    if (!bin_pack_obj(bin_pack_ip_port_handler, logger, ip_port, data, length)) {
+        return -1;
     }
+
+    assert(size < INT_MAX);
+    return (int)size;
 }
 
 int dht_create_packet(const Memory *mem, const Random *rng,
@@ -511,33 +535,25 @@ int unpack_ip_port(IP_Port *ip_port, const uint8_t *data, uint16_t length, bool
     }
 }
 
+/** @brief Pack a single node from a node array.
+ *
+ * @retval true on success.
+ */
+non_null()
+static bool bin_pack_node_handler(Bin_Pack *bp, const Logger *logger, const void *arr, uint32_t index)
+{
+    const Node_format *nodes = (const Node_format *)arr;
+    return bin_pack_ip_port(bp, logger, &nodes[index].ip_port)
+           && bin_pack_bin_b(bp, nodes[index].public_key, CRYPTO_PUBLIC_KEY_SIZE);
+}
+
 int pack_nodes(const Logger *logger, uint8_t *data, uint16_t length, const Node_format *nodes, uint16_t number)
 {
-    uint32_t packed_length = 0;
-
-    for (uint32_t i = 0; i < number && packed_length < length; ++i) {
-        const int ipp_size = pack_ip_port(logger, data + packed_length, length - packed_length, &nodes[i].ip_port);
-
-        if (ipp_size == -1) {
-            return -1;
-        }
-
-        packed_length += ipp_size;
-
-        if (packed_length + CRYPTO_PUBLIC_KEY_SIZE > length) {
-            return -1;
-        }
-
-        memcpy(data + packed_length, nodes[i].public_key, CRYPTO_PUBLIC_KEY_SIZE);
-        packed_length += CRYPTO_PUBLIC_KEY_SIZE;
-
-#ifndef NDEBUG
-        const uint32_t increment = ipp_size + CRYPTO_PUBLIC_KEY_SIZE;
-        assert(increment == PACKED_NODE_SIZE_IP4 || increment == PACKED_NODE_SIZE_IP6);
-#endif
+    const uint32_t size = bin_pack_obj_array_size(bin_pack_node_handler, logger, nodes, number);
+    if (!bin_pack_obj_array(bin_pack_node_handler, logger, nodes, number, data, length)) {
+        return -1;
     }
-
-    return packed_length;
+    return size;
 }
 
 int unpack_nodes(Node_format *nodes, uint16_t max_num_nodes, uint16_t *processed_data_len, const uint8_t *data,
@@ -2829,8 +2845,9 @@ void dht_save(const DHT *dht, uint8_t *data)
         }
     }
 
-    state_write_section_header(old_data, DHT_STATE_COOKIE_TYPE, pack_nodes(dht->log, data, sizeof(Node_format) * num,
-                               clients, num), DHT_STATE_TYPE_NODES);
+    state_write_section_header(
+            old_data, DHT_STATE_COOKIE_TYPE, pack_nodes(dht->log, data, sizeof(Node_format) * num, clients, num),
+            DHT_STATE_TYPE_NODES);
 
     mem_delete(dht->mem, clients);
 }
diff --git a/external/toxcore/c-toxcore/toxcore/DHT.h b/external/toxcore/c-toxcore/toxcore/DHT.h
index 6021958..3e5ab36 100644
--- a/external/toxcore/c-toxcore/toxcore/DHT.h
+++ b/external/toxcore/c-toxcore/toxcore/DHT.h
@@ -214,6 +214,16 @@ int packed_node_size(Family ip_family);
 non_null()
 int pack_ip_port(const Logger *logger, uint8_t *data, uint16_t length, const IP_Port *ip_port);
 
+/** @brief Unpack IP_Port structure from data of max size length into ip_port.
+ *
+ * len_processed is the offset of data currently unpacked.
+ *
+ * @return size of unpacked ip_port on success.
+ * @retval -1 on failure.
+ */
+non_null()
+int unpack_ip_port(IP_Port *ip_port, const uint8_t *data, uint16_t length, bool tcp_enabled);
+
 /** @brief Encrypt plain and write resulting DHT packet into packet with max size length.
  *
  * @return size of packet on success.
@@ -226,16 +236,6 @@ int dht_create_packet(const Memory *mem, const Random *rng,
                       const uint8_t *plain, size_t plain_length,
                       uint8_t *packet, size_t length);
 
-/** @brief Unpack IP_Port structure from data of max size length into ip_port.
- *
- * len_processed is the offset of data currently unpacked.
- *
- * @return size of unpacked ip_port on success.
- * @retval -1 on failure.
- */
-non_null()
-int unpack_ip_port(IP_Port *ip_port, const uint8_t *data, uint16_t length, bool tcp_enabled);
-
 /** @brief Pack number of nodes into data of maxlength length.
  *
  * @return length of packed nodes on success.
diff --git a/external/toxcore/c-toxcore/toxcore/DHT_fuzz_test.cc b/external/toxcore/c-toxcore/toxcore/DHT_fuzz_test.cc
index e9673ae..a978fdd 100644
--- a/external/toxcore/c-toxcore/toxcore/DHT_fuzz_test.cc
+++ b/external/toxcore/c-toxcore/toxcore/DHT_fuzz_test.cc
@@ -1,6 +1,8 @@
 #include "DHT.h"
 
+#include <cassert>
 #include <cstdlib>
+#include <cstring>
 #include <vector>
 
 #include "../testing/fuzzing/fuzz_support.h"
@@ -36,6 +38,16 @@ void TestUnpackNodes(Fuzz_Data &input)
         LOGGER_ASSERT(logger, packed_size == processed_data_len,
             "packed size (%d) != unpacked size (%d)", packed_size, processed_data_len);
         logger_kill(logger);
+
+        // Check that packed nodes can be unpacked again and result in the
+        // original unpacked nodes.
+        Node_format nodes2[node_count];
+        uint16_t processed_data_len2;
+        const int packed_count2 = unpack_nodes(
+            nodes2, node_count, &processed_data_len2, packed.data(), packed.size(), tcp_enabled);
+        assert(processed_data_len2 == processed_data_len);
+        assert(packed_count2 == packed_count);
+        assert(memcmp(nodes, nodes2, sizeof(Node_format) * packed_count) == 0);
     }
 }
 
diff --git a/external/toxcore/c-toxcore/toxcore/Makefile.inc b/external/toxcore/c-toxcore/toxcore/Makefile.inc
index be37f93..88be145 100644
--- a/external/toxcore/c-toxcore/toxcore/Makefile.inc
+++ b/external/toxcore/c-toxcore/toxcore/Makefile.inc
@@ -1,7 +1,8 @@
 lib_LTLIBRARIES += libtoxcore.la
 
 libtoxcore_la_include_HEADERS = \
-                        ../toxcore/tox.h
+                        ../toxcore/tox.h \
+                        ../toxcore/tox_private.h
 
 libtoxcore_la_includedir = $(includedir)/tox
 
diff --git a/external/toxcore/c-toxcore/toxcore/Messenger.c b/external/toxcore/c-toxcore/toxcore/Messenger.c
index 136838d..cd1e53d 100644
--- a/external/toxcore/c-toxcore/toxcore/Messenger.c
+++ b/external/toxcore/c-toxcore/toxcore/Messenger.c
@@ -757,6 +757,20 @@ int m_set_statusmessage(Messenger *m, const uint8_t *status, uint16_t length)
     return 0;
 }
 
+static Userstatus userstatus_from_int(uint8_t status)
+{
+    switch (status) {
+        case 0:
+            return USERSTATUS_NONE;
+        case 1:
+            return USERSTATUS_AWAY;
+        case 2:
+            return USERSTATUS_BUSY;
+        default:
+            return USERSTATUS_INVALID;
+    }
+}
+
 int m_set_userstatus(Messenger *m, uint8_t status)
 {
     if (status >= USERSTATUS_INVALID) {
@@ -767,7 +781,7 @@ int m_set_userstatus(Messenger *m, uint8_t status)
         return 0;
     }
 
-    m->userstatus = (Userstatus)status;
+    m->userstatus = userstatus_from_int(status);
 
     for (uint32_t i = 0; i < m->numfriends; ++i) {
         m->friendlist[i].userstatus_sent = false;
@@ -923,7 +937,7 @@ static int set_friend_statusmessage(const Messenger *m, int32_t friendnumber, co
 non_null()
 static void set_friend_userstatus(const Messenger *m, int32_t friendnumber, uint8_t status)
 {
-    m->friendlist[friendnumber].userstatus = (Userstatus)status;
+    m->friendlist[friendnumber].userstatus = userstatus_from_int(status);
 }
 
 non_null()
@@ -2024,7 +2038,7 @@ non_null(1, 3) nullable(5)
 static int m_handle_packet_offline(Messenger *m, const int i, const uint8_t *data, const uint16_t data_length, void *userdata)
 {
     if (data_length == 0) {
-    	set_friend_status(m, i, FRIEND_CONFIRMED, userdata);
+        set_friend_status(m, i, FRIEND_CONFIRMED, userdata);
     }
 
     return 0;
@@ -2081,9 +2095,9 @@ static int m_handle_packet_userstatus(Messenger *m, const int i, const uint8_t *
         return 0;
     }
 
-    const Userstatus status = (Userstatus)data[0];
+    const Userstatus status = userstatus_from_int(data[0]);
 
-    if (status >= USERSTATUS_INVALID) {
+    if (status == USERSTATUS_INVALID) {
         return 0;
     }
 
@@ -2403,8 +2417,8 @@ static int m_handle_packet(void *object, int i, const uint8_t *temp, uint16_t le
             return m_handle_packet_file_data(m, i, data, data_length, userdata);
         case PACKET_ID_MSI:
             return m_handle_packet_msi(m, i, data, data_length, userdata);
-	    case PACKET_ID_INVITE_GROUPCHAT:
-	        return m_handle_packet_invite_groupchat(m, i, data, data_length, userdata);
+        case PACKET_ID_INVITE_GROUPCHAT:
+            return m_handle_packet_invite_groupchat(m, i, data, data_length, userdata);
     }
 
     return handle_custom_lossless_packet(object, i, temp, len, userdata);
@@ -2627,7 +2641,7 @@ void do_messenger(Messenger *m, void *userdata)
         if (m->tcp_server != nullptr) {
             /* Add self tcp server. */
             IP_Port local_ip_port;
-            local_ip_port.port = m->options.tcp_server_port;
+            local_ip_port.port = net_htons(m->options.tcp_server_port);
             local_ip_port.ip.family = net_family_ipv4();
             local_ip_port.ip.ip.v4 = get_ip4_loopback();
             add_tcp_relay(m->net_crypto, &local_ip_port, tcp_server_public_key(m->tcp_server));
@@ -3153,7 +3167,7 @@ static void pack_groupchats(const GC_Session *c, Bin_Pack *bp)
 }
 
 non_null()
-static bool pack_groupchats_handler(Bin_Pack *bp, const void *obj)
+static bool pack_groupchats_handler(Bin_Pack *bp, const Logger *log, const void *obj)
 {
     pack_groupchats((const GC_Session *)obj, bp);
     return true;  // TODO(iphydf): Return bool from pack functions.
@@ -3163,7 +3177,7 @@ non_null()
 static uint32_t saved_groups_size(const Messenger *m)
 {
     GC_Session *c = m->group_handler;
-    return bin_pack_obj_size(pack_groupchats_handler, c);
+    return bin_pack_obj_size(pack_groupchats_handler, m->log, c);
 }
 
 non_null()
@@ -3185,7 +3199,7 @@ static uint8_t *groups_save(const Messenger *m, uint8_t *data)
 
     data = state_write_section_header(data, STATE_COOKIE_TYPE, len, STATE_TYPE_GROUPS);
 
-    if (!bin_pack_obj(pack_groupchats_handler, c, data, len)) {
+    if (!bin_pack_obj(pack_groupchats_handler, m->log, c, data, len)) {
         LOGGER_FATAL(m->log, "failed to pack group chats into buffer of length %u", len);
         return data;
     }
@@ -3622,7 +3636,9 @@ Messenger *new_messenger(Mono_Time *mono_time, const Memory *mem, const Random *
     m->onion = new_onion(m->log, m->mem, m->mono_time, m->rng, m->dht);
     m->onion_a = new_onion_announce(m->log, m->mem, m->rng, m->mono_time, m->dht);
     m->onion_c = new_onion_client(m->log, m->mem, m->rng, m->mono_time, m->net_crypto);
-    m->fr_c = new_friend_connections(m->log, m->mono_time, m->ns, m->onion_c, options->local_discovery_enabled);
+    if (m->onion_c != nullptr) {
+        m->fr_c = new_friend_connections(m->log, m->mono_time, m->ns, m->onion_c, options->local_discovery_enabled);
+    }
 
     if ((options->dht_announcements_enabled && (m->forwarding == nullptr || m->announce == nullptr)) ||
             m->onion == nullptr || m->onion_a == nullptr || m->onion_c == nullptr || m->fr_c == nullptr) {
diff --git a/external/toxcore/c-toxcore/toxcore/attributes.h b/external/toxcore/c-toxcore/toxcore/attributes.h
index 3da768f..3d3aeda 100644
--- a/external/toxcore/c-toxcore/toxcore/attributes.h
+++ b/external/toxcore/c-toxcore/toxcore/attributes.h
@@ -18,7 +18,7 @@
 #define GNU_PRINTF(f, a)
 #endif
 
-#if defined(__GNUC__) && defined(_DEBUG) && !defined(__OPTIMIZE__)
+#if defined(__GNUC__) && defined(_DEBUG)
 #define non_null(...) __attribute__((__nonnull__(__VA_ARGS__)))
 #else
 #define non_null(...)
diff --git a/external/toxcore/c-toxcore/toxcore/bin_pack.c b/external/toxcore/c-toxcore/toxcore/bin_pack.c
index 3575803..51f2ff5 100644
--- a/external/toxcore/c-toxcore/toxcore/bin_pack.c
+++ b/external/toxcore/c-toxcore/toxcore/bin_pack.c
@@ -62,21 +62,47 @@ static void bin_pack_init(Bin_Pack *bp, uint8_t *buf, uint32_t buf_size)
     cmp_init(&bp->ctx, bp, null_reader, null_skipper, buf_writer);
 }
 
-bool bin_pack_obj(bin_pack_cb *callback, const void *obj, uint8_t *buf, uint32_t buf_size)
-{
-    Bin_Pack bp;
-    bin_pack_init(&bp, buf, buf_size);
-    return callback(&bp, obj);
-}
-
-uint32_t bin_pack_obj_size(bin_pack_cb *callback, const void *obj)
+uint32_t bin_pack_obj_size(bin_pack_cb *callback, const Logger *logger, const void *obj)
 {
     Bin_Pack bp;
     bin_pack_init(&bp, nullptr, 0);
-    callback(&bp, obj);
+    if (!callback(&bp, logger, obj)) {
+        return UINT32_MAX;
+    }
     return bp.bytes_pos;
 }
 
+bool bin_pack_obj(bin_pack_cb *callback, const Logger *logger, const void *obj, uint8_t *buf, uint32_t buf_size)
+{
+    Bin_Pack bp;
+    bin_pack_init(&bp, buf, buf_size);
+    return callback(&bp, logger, obj);
+}
+
+uint32_t bin_pack_obj_array_size(bin_pack_array_cb *callback, const Logger *logger, const void *arr, uint32_t count)
+{
+    Bin_Pack bp;
+    bin_pack_init(&bp, nullptr, 0);
+    for (uint32_t i = 0; i < count; ++i) {
+        if (!callback(&bp, logger, arr, i)) {
+            return UINT32_MAX;
+        }
+    }
+    return bp.bytes_pos;
+}
+
+bool bin_pack_obj_array(bin_pack_array_cb *callback, const Logger *logger, const void *arr, uint32_t count, uint8_t *buf, uint32_t buf_size)
+{
+    Bin_Pack bp;
+    bin_pack_init(&bp, buf, buf_size);
+    for (uint32_t i = 0; i < count; ++i) {
+        if (!callback(&bp, logger, arr, i)) {
+            return false;
+        }
+    }
+    return true;
+}
+
 Bin_Pack *bin_pack_new(uint8_t *buf, uint32_t buf_size)
 {
     Bin_Pack *bp = (Bin_Pack *)calloc(1, sizeof(Bin_Pack));
diff --git a/external/toxcore/c-toxcore/toxcore/bin_pack.h b/external/toxcore/c-toxcore/toxcore/bin_pack.h
index 51646c0..6df21e0 100644
--- a/external/toxcore/c-toxcore/toxcore/bin_pack.h
+++ b/external/toxcore/c-toxcore/toxcore/bin_pack.h
@@ -8,6 +8,7 @@
 #include <stdint.h>
 
 #include "attributes.h"
+#include "logger.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -23,18 +24,29 @@ typedef struct Bin_Pack Bin_Pack;
  * This function would typically cast the `void *` to the actual object pointer type and then call
  * more appropriately typed packing functions.
  */
-typedef bool bin_pack_cb(Bin_Pack *bp, const void *obj);
+typedef bool bin_pack_cb(Bin_Pack *bp, const Logger *logger, const void *obj);
+
+/** @brief Function used to pack an array of objects.
+ *
+ * This function would typically cast the `void *` to the actual object pointer type and then call
+ * more appropriately typed packing functions.
+ *
+ * @param arr is the object array as void pointer.
+ * @param index is the index in the object array that is currently being packed.
+ */
+typedef bool bin_pack_array_cb(Bin_Pack *bp, const Logger *logger, const void *arr, uint32_t index);
 
 /** @brief Determine the serialised size of an object.
  *
  * @param callback The function called on the created packer and packed object.
+ * @param logger Optional logger object to pass to the callback.
  * @param obj The object to be packed, passed as `obj` to the callback.
  *
- * @return The packed size of the passed object according to the callback. UINT32_MAX in case of
- *   errors such as buffer overflow.
+ * @return The packed size of the passed object according to the callback.
+ * @retval UINT32_MAX in case of errors such as buffer overflow.
  */
-non_null(1) nullable(2)
-uint32_t bin_pack_obj_size(bin_pack_cb *callback, const void *obj);
+non_null(1) nullable(2, 3)
+uint32_t bin_pack_obj_size(bin_pack_cb *callback, const Logger *logger, const void *obj);
 
 /** @brief Pack an object into a buffer of a given size.
  *
@@ -45,14 +57,57 @@ uint32_t bin_pack_obj_size(bin_pack_cb *callback, const void *obj);
  * overflows `uint32_t`, this function returns `false`.
  *
  * @param callback The function called on the created packer and packed object.
+ * @param logger Optional logger object to pass to the callback.
  * @param obj The object to be packed, passed as `obj` to the callback.
  * @param buf A byte array large enough to hold the serialised representation of `obj`.
  * @param buf_size The size of the byte array. Can be `UINT32_MAX` to disable bounds checking.
  *
  * @retval false if an error occurred (e.g. buffer overflow).
  */
+non_null(1, 4) nullable(2, 3)
+bool bin_pack_obj(bin_pack_cb *callback, const Logger *logger, const void *obj, uint8_t *buf, uint32_t buf_size);
+
+/** @brief Determine the serialised size of an object array.
+ *
+ * Calls the callback `count` times with increasing `index` argument from 0 to
+ * `count`. This function is here just so we don't need to write the same
+ * trivial loop many times and so we don't need an extra struct just to contain
+ * an array with size so it can be passed to `bin_pack_obj_size`.
+ *
+ * @param callback The function called on the created packer and each object to
+ *   be packed.
+ * @param logger Optional logger object to pass to the callback.
+ * @param arr The object array to be packed, passed as `arr` to the callback.
+ * @param count The number of elements in the object array.
+ *
+ * @return The packed size of the passed object array according to the callback.
+ * @retval UINT32_MAX in case of errors such as buffer overflow.
+ */
 non_null(1, 3) nullable(2)
-bool bin_pack_obj(bin_pack_cb *callback, const void *obj, uint8_t *buf, uint32_t buf_size);
+uint32_t bin_pack_obj_array_size(bin_pack_array_cb *callback, const Logger *logger, const void *arr, uint32_t count);
+
+/** @brief Pack an object array into a buffer of a given size.
+ *
+ * Calls the callback `count` times with increasing `index` argument from 0 to
+ * `count`. This function is here just so we don't need to write the same
+ * trivial loop many times and so we don't need an extra struct just to contain
+ * an array with size so it can be passed to `bin_pack_obj`.
+ *
+ * Similar to `bin_pack_obj` but for arrays. Does not write the array length, so
+ * if you need that, write it manually using `bin_pack_array`.
+ *
+ * @param callback The function called on the created packer and packed object
+ *   array.
+ * @param logger Optional logger object to pass to the callback.
+ * @param arr The object array to be packed, passed as `arr` to the callback.
+ * @param count The number of elements in the object array.
+ * @param buf A byte array large enough to hold the serialised representation of `arr`.
+ * @param buf_size The size of the byte array. Can be `UINT32_MAX` to disable bounds checking.
+ *
+ * @retval false if an error occurred (e.g. buffer overflow).
+ */
+non_null(1, 3, 5) nullable(2)
+bool bin_pack_obj_array(bin_pack_array_cb *callback, const Logger *logger, const void *arr, uint32_t count, uint8_t *buf, uint32_t buf_size);
 
 /** @brief Allocate a new packer object.
  *
diff --git a/external/toxcore/c-toxcore/toxcore/crypto_core_test.cc b/external/toxcore/c-toxcore/toxcore/crypto_core_test.cc
index 4f2a9f3..c3c8a6f 100644
--- a/external/toxcore/c-toxcore/toxcore/crypto_core_test.cc
+++ b/external/toxcore/c-toxcore/toxcore/crypto_core_test.cc
@@ -12,11 +12,30 @@ namespace {
 
 using HmacKey = std::array<uint8_t, CRYPTO_HMAC_KEY_SIZE>;
 using Hmac = std::array<uint8_t, CRYPTO_HMAC_SIZE>;
+using PublicKey = std::array<uint8_t, CRYPTO_PUBLIC_KEY_SIZE>;
+using SecretKey = std::array<uint8_t, CRYPTO_SECRET_KEY_SIZE>;
 using ExtPublicKey = std::array<uint8_t, EXT_PUBLIC_KEY_SIZE>;
 using ExtSecretKey = std::array<uint8_t, EXT_SECRET_KEY_SIZE>;
 using Signature = std::array<uint8_t, CRYPTO_SIGNATURE_SIZE>;
 using Nonce = std::array<uint8_t, CRYPTO_NONCE_SIZE>;
 
+TEST(CryptoCore, EncryptLargeData)
+{
+    const Random *rng = system_random();
+    ASSERT_NE(rng, nullptr);
+
+    Nonce nonce{};
+    PublicKey pk;
+    SecretKey sk;
+    crypto_new_keypair(rng, pk.data(), sk.data());
+
+    // 100 MiB of data (all zeroes, doesn't matter what's inside).
+    std::vector<uint8_t> plain(100 * 1024 * 1024);
+    std::vector<uint8_t> encrypted(plain.size() + CRYPTO_MAC_SIZE);
+
+    encrypt_data(pk.data(), sk.data(), nonce.data(), plain.data(), plain.size(), encrypted.data());
+}
+
 TEST(CryptoCore, IncrementNonce)
 {
     Nonce nonce{};
@@ -60,7 +79,8 @@ TEST(CryptoCore, Signatures)
 
     EXPECT_TRUE(create_extended_keypair(pk.data(), sk.data()));
 
-    std::vector<uint8_t> message;
+    std::vector<uint8_t> message{0};
+    message.clear();
 
     // Try a few different sizes, including empty 0 length message.
     for (uint8_t i = 0; i < 100; ++i) {
@@ -82,7 +102,8 @@ TEST(CryptoCore, Hmac)
     HmacKey sk;
     new_hmac_key(rng, sk.data());
 
-    std::vector<uint8_t> message;
+    std::vector<uint8_t> message{0};
+    message.clear();
 
     // Try a few different sizes, including empty 0 length message.
     for (uint8_t i = 0; i < 100; ++i) {
diff --git a/external/toxcore/c-toxcore/toxcore/group_announce_test.cc b/external/toxcore/c-toxcore/toxcore/group_announce_test.cc
index d3d5d71..4f0eac6 100644
--- a/external/toxcore/c-toxcore/toxcore/group_announce_test.cc
+++ b/external/toxcore/c-toxcore/toxcore/group_announce_test.cc
@@ -50,8 +50,10 @@ TEST_F(Announces, CanBeCreatedAndDeleted)
     GC_Public_Announce ann{};
     ann.chat_public_key[0] = 0x88;
     ASSERT_NE(gca_add_announce(mono_time_, gca_, &ann), nullptr);
+#ifndef _DEBUG
     ASSERT_EQ(gca_add_announce(mono_time_, gca_, nullptr), nullptr);
     ASSERT_EQ(gca_add_announce(mono_time_, nullptr, &ann), nullptr);
+#endif
 }
 
 TEST_F(Announces, AnnouncesCanTimeOut)
@@ -103,7 +105,9 @@ TEST_F(Announces, AnnouncesGetAndCleanup)
 
     cleanup_gca(gca_, ann2.chat_public_key);
     ASSERT_EQ(gca_get_announces(gca_, &announces, 1, ann2.chat_public_key, empty_pk), 0);
+#ifndef _DEBUG
     ASSERT_EQ(gca_get_announces(gca_, nullptr, 1, ann2.chat_public_key, empty_pk), -1);
+#endif
 }
 
 struct AnnouncesPack : ::testing::Test {
@@ -162,19 +166,23 @@ TEST_F(AnnouncesPack, PublicAnnounceCanBePackedAndUnpacked)
 
 TEST_F(AnnouncesPack, UnpackEmptyPublicAnnounce)
 {
+#ifndef _DEBUG
     GC_Public_Announce ann{};
     std::vector<uint8_t> packed(GCA_PUBLIC_ANNOUNCE_MAX_SIZE);
 
     EXPECT_EQ(gca_unpack_public_announce(logger_, nullptr, 0, &ann), -1);
     EXPECT_EQ(gca_unpack_public_announce(logger_, packed.data(), packed.size(), nullptr), -1);
+#endif
 }
 
 TEST_F(AnnouncesPack, PackEmptyPublicAnnounce)
 {
+#ifndef _DEBUG
     GC_Public_Announce ann{};
     std::vector<uint8_t> packed(GCA_PUBLIC_ANNOUNCE_MAX_SIZE);
     EXPECT_EQ(gca_pack_public_announce(logger_, packed.data(), packed.size(), nullptr), -1);
     EXPECT_EQ(gca_pack_public_announce(logger_, nullptr, 0, &ann), -1);
+#endif
 }
 
 TEST_F(AnnouncesPack, PublicAnnouncePackNull)
@@ -198,7 +206,9 @@ TEST_F(AnnouncesPack, PublicAnnouncePackNull)
 
 TEST_F(AnnouncesPack, AnnouncesValidationCheck)
 {
+#ifndef _DEBUG
     EXPECT_EQ(gca_is_valid_announce(nullptr), false);
+#endif
 
     GC_Announce announce = {0};
     EXPECT_EQ(gca_is_valid_announce(&announce), false);
@@ -217,8 +227,10 @@ TEST_F(AnnouncesPack, UnpackIncompleteAnnouncesList)
 
     GC_Announce announce;
     EXPECT_EQ(gca_unpack_announces_list(logger_, data, sizeof(data), &announce, 1), -1);
+#ifndef _DEBUG
     EXPECT_EQ(gca_unpack_announces_list(logger_, data, sizeof(data), nullptr, 1), -1);
     EXPECT_EQ(gca_unpack_announces_list(logger_, nullptr, 0, &announce, 1), -1);
+#endif
 }
 
 TEST_F(AnnouncesPack, PackedAnnouncesListCanBeUnpacked)
@@ -246,17 +258,21 @@ TEST_F(AnnouncesPack, PackingEmptyAnnounceFails)
     std::vector<uint8_t> packed(gca_pack_announces_list_size(1));
     EXPECT_EQ(
         gca_pack_announces_list(logger_, packed.data(), packed.size(), &announce, 1, nullptr), -1);
+#ifndef _DEBUG
     EXPECT_EQ(
         gca_pack_announces_list(logger_, packed.data(), packed.size(), nullptr, 1, nullptr), -1);
     EXPECT_EQ(gca_pack_announces_list(logger_, nullptr, 0, &announce, 1, nullptr), -1);
+#endif
 }
 
 TEST_F(AnnouncesPack, PackAnnounceNull)
 {
+#ifndef _DEBUG
     std::vector<uint8_t> data(GCA_ANNOUNCE_MAX_SIZE);
     GC_Announce announce;
     ASSERT_EQ(gca_pack_announce(logger_, nullptr, 0, &announce), -1);
     ASSERT_EQ(gca_pack_announce(logger_, data.data(), data.size(), nullptr), -1);
+#endif
 }
 
 }  // namespace
diff --git a/external/toxcore/c-toxcore/toxcore/group_chats.c b/external/toxcore/c-toxcore/toxcore/group_chats.c
index adc425e..311960d 100644
--- a/external/toxcore/c-toxcore/toxcore/group_chats.c
+++ b/external/toxcore/c-toxcore/toxcore/group_chats.c
@@ -182,7 +182,7 @@ static void kill_group_friend_connection(const GC_Session *c, const GC_Chat *cha
 
 uint16_t gc_get_wrapped_packet_size(uint16_t length, Net_Packet_Type packet_type)
 {
-    assert(length <= MAX_GC_PACKET_CHUNK_SIZE);
+    assert(length <= (packet_type == NET_PACKET_GC_LOSSY ? MAX_GC_CUSTOM_LOSSY_PACKET_SIZE : MAX_GC_PACKET_CHUNK_SIZE));
 
     const uint16_t min_header_size = packet_type == NET_PACKET_GC_LOSSY
                                      ? GC_MIN_LOSSY_PAYLOAD_SIZE
@@ -226,10 +226,20 @@ GC_Connection *get_gc_connection(const GC_Chat *chat, int peer_number)
     return &peer->gconn;
 }
 
-/** Returns the amount of empty padding a packet of designated length should have. */
-static uint16_t group_packet_padding_length(uint16_t length)
+/** Returns the max packet size, not wrapped */
+static uint16_t group_packet_max_packet_size(Net_Packet_Type net_packet_type)
 {
-    return (MAX_GC_PACKET_CHUNK_SIZE - length) % GC_MAX_PACKET_PADDING;
+    if (net_packet_type == NET_PACKET_GC_LOSSY) {
+        return MAX_GC_CUSTOM_LOSSY_PACKET_SIZE;
+    } else {
+        return MAX_GC_PACKET_CHUNK_SIZE;
+    }
+}
+
+/** Returns the amount of empty padding a packet of designated length should have. */
+static uint16_t group_packet_padding_length(uint16_t length, uint16_t max_length)
+{
+    return (max_length - length) % GC_MAX_PACKET_PADDING;
 }
 
 void gc_get_self_nick(const GC_Chat *chat, uint8_t *nick)
@@ -1270,8 +1280,8 @@ static uint16_t unpack_gc_shared_state(GC_SharedState *shared_state, const uint8
     memcpy(&voice_state, data + len_processed, sizeof(uint8_t));
     len_processed += sizeof(uint8_t);
 
-    shared_state->voice_state = (Group_Voice_State)voice_state;
-    shared_state->privacy_state = (Group_Privacy_State)privacy_state;
+    shared_state->voice_state = group_voice_state_from_int(voice_state);
+    shared_state->privacy_state = group_privacy_state_from_int(privacy_state);
 
     return len_processed;
 }
@@ -1483,9 +1493,10 @@ static int group_packet_unwrap(const Logger *log, const GC_Connection *gconn, ui
 int group_packet_wrap(
     const Logger *log, const Random *rng, const uint8_t *self_pk, const uint8_t *shared_key, uint8_t *packet,
     uint16_t packet_size, const uint8_t *data, uint16_t length, uint64_t message_id,
-    uint8_t gp_packet_type, uint8_t net_packet_type)
+    uint8_t gp_packet_type, Net_Packet_Type net_packet_type)
 {
-    const uint16_t padding_len = group_packet_padding_length(length);
+    const uint16_t max_packet_size = group_packet_max_packet_size(net_packet_type);
+    const uint16_t padding_len = group_packet_padding_length(length, max_packet_size);
     const uint16_t min_packet_size = net_packet_type == NET_PACKET_GC_LOSSLESS
                                      ? length + padding_len + CRYPTO_MAC_SIZE + 1 + ENC_PUBLIC_KEY_SIZE + CRYPTO_NONCE_SIZE + GC_MESSAGE_ID_BYTES + 1
                                      : length + padding_len + CRYPTO_MAC_SIZE + 1 + ENC_PUBLIC_KEY_SIZE + CRYPTO_NONCE_SIZE + 1;
@@ -1495,8 +1506,8 @@ int group_packet_wrap(
         return -1;
     }
 
-    if (length > MAX_GC_PACKET_CHUNK_SIZE) {
-        LOGGER_ERROR(log, "Packet payload size (%u) exceeds maximum (%u)", length, MAX_GC_PACKET_CHUNK_SIZE);
+    if (length > max_packet_size) {
+        LOGGER_ERROR(log, "Packet payload size (%u) exceeds maximum (%u)", length, max_packet_size);
         return -1;
     }
 
@@ -1563,7 +1574,7 @@ non_null()
 static bool send_lossy_group_packet(const GC_Chat *chat, const GC_Connection *gconn, const uint8_t *data,
                                     uint16_t length, uint8_t packet_type)
 {
-    assert(length <= MAX_GC_PACKET_CHUNK_SIZE);
+    assert(length <= MAX_GC_CUSTOM_LOSSY_PACKET_SIZE);
 
     if (!gconn->handshaked || gconn->pending_delete) {
         return false;
@@ -3510,8 +3521,8 @@ unsigned int gc_get_peer_connection_status(const GC_Chat *chat, uint32_t peer_id
 {
     const int peer_number = get_peer_number_of_peer_id(chat, peer_id);
 
-    if (peer_number_is_self(peer_number)) {  // we cannot have a connection with ourselves
-        return 0;
+    if (peer_number_is_self(peer_number)) {
+        return chat->self_udp_status ==  SELF_UDP_STATUS_NONE ? 1 : 2;
     }
 
     const GC_Connection *gconn = get_gc_connection(chat, peer_number);
@@ -7224,7 +7235,9 @@ static int get_new_group_index(GC_Session *c)
 
     c->chats[new_index] = empty_gc_chat;
 
-    memset(&c->chats[new_index].saved_invites, -1, sizeof(c->chats[new_index].saved_invites));
+    for (size_t i = 0; i < sizeof(c->chats[new_index].saved_invites)/sizeof(*c->chats[new_index].saved_invites); ++i) {
+        c->chats[new_index].saved_invites[i] = -1;
+    }
 
     ++c->chats_index;
 
@@ -7279,7 +7292,7 @@ static bool init_gc_tcp_connection(const GC_Session *c, GC_Chat *chat)
 
 /** Initializes default shared state values. */
 non_null()
-static void init_gc_shared_state(GC_Chat *chat, const Group_Privacy_State privacy_state)
+static void init_gc_shared_state(GC_Chat *chat, Group_Privacy_State privacy_state)
 {
     chat->shared_state.maxpeers = MAX_GC_PEERS_DEFAULT;
     chat->shared_state.privacy_state = privacy_state;
diff --git a/external/toxcore/c-toxcore/toxcore/group_chats.h b/external/toxcore/c-toxcore/toxcore/group_chats.h
index 821e629..066b717 100644
--- a/external/toxcore/c-toxcore/toxcore/group_chats.h
+++ b/external/toxcore/c-toxcore/toxcore/group_chats.h
@@ -142,7 +142,7 @@ non_null(1, 2, 3, 4, 5) nullable(7)
 int group_packet_wrap(
     const Logger *log, const Random *rng, const uint8_t *self_pk, const uint8_t *shared_key, uint8_t *packet,
     uint16_t packet_size, const uint8_t *data, uint16_t length, uint64_t message_id,
-    uint8_t gp_packet_type, uint8_t net_packet_type);
+    uint8_t gp_packet_type, Net_Packet_Type net_packet_type);
 
 /** @brief Returns the size of a wrapped/encrypted packet with a plain size of `length`.
  *
@@ -162,7 +162,7 @@ uint16_t gc_get_wrapped_packet_size(uint16_t length, Net_Packet_Type packet_type
  * Returns -4 if the sender does not have permission to speak.
  * Returns -5 if the packet fails to send.
  */
-non_null(1, 2, 3, 4) nullable(5)
+non_null(1, 2) nullable(5)
 int gc_send_message(const GC_Chat *chat, const uint8_t *message, uint16_t length, uint8_t type,
                     uint32_t *message_id);
 
@@ -391,10 +391,13 @@ non_null(1) nullable(3)
 int gc_get_peer_public_key_by_peer_id(const GC_Chat *chat, uint32_t peer_id, uint8_t *public_key);
 
 /** @brief Gets the connection status for peer associated with `peer_id`.
+ *
+ * If `peer_id` designates ourself, the return value indicates whether we're capable
+ * of making UDP connections with other peers, or are limited to TCP connections.
  *
  * Returns 2 if we have a direct (UDP) connection with a peer.
  * Returns 1 if we have an indirect (TCP) connection with a peer.
- * Returns 0 if peer_id is invalid or corresponds to ourselves.
+ * Returns 0 if peer_id is invalid.
  *
  * Note: Return values must correspond to Tox_Connection enum in API.
  */
diff --git a/external/toxcore/c-toxcore/toxcore/group_common.h b/external/toxcore/c-toxcore/toxcore/group_common.h
index 6bb6dcb..7daec30 100644
--- a/external/toxcore/c-toxcore/toxcore/group_common.h
+++ b/external/toxcore/c-toxcore/toxcore/group_common.h
@@ -34,7 +34,7 @@
 #define MAX_GC_MESSAGE_SIZE GROUP_MAX_MESSAGE_LENGTH
 #define MAX_GC_MESSAGE_RAW_SIZE (MAX_GC_MESSAGE_SIZE + GC_MESSAGE_PSEUDO_ID_SIZE)
 #define MAX_GC_CUSTOM_LOSSLESS_PACKET_SIZE 1373
-#define MAX_GC_CUSTOM_LOSSY_PACKET_SIZE MAX_GC_PACKET_CHUNK_SIZE
+#define MAX_GC_CUSTOM_LOSSY_PACKET_SIZE 1373
 #define MAX_GC_PASSWORD_SIZE 32
 #define MAX_GC_SAVED_INVITES 10
 #define MAX_GC_PEERS_DEFAULT 100
@@ -401,7 +401,8 @@ int unpack_gc_saved_peers(GC_Chat *chat, const uint8_t *data, uint16_t length);
 
 /** @brief Packs all valid entries from saved peerlist into `data`.
  *
- * If `processed` is non-null it will be set to the length of the packed data.
+ * If `processed` is non-null it will be set to the length of the packed data
+ * on success, and will be untouched on error.
  *
  * Return the number of packed saved peers on success.
  * Return -1 if buffer is too small.
diff --git a/external/toxcore/c-toxcore/toxcore/group_connection.c b/external/toxcore/c-toxcore/toxcore/group_connection.c
index ceef162..5d03696 100644
--- a/external/toxcore/c-toxcore/toxcore/group_connection.c
+++ b/external/toxcore/c-toxcore/toxcore/group_connection.c
@@ -453,6 +453,7 @@ int gcc_handle_packet_fragment(const GC_Session *c, GC_Chat *chat, uint32_t peer
     gconn = get_gc_connection(chat, peer_number);
 
     if (gconn == nullptr) {
+        free(payload);
         return 0;
     }
 
diff --git a/external/toxcore/c-toxcore/toxcore/group_pack.c b/external/toxcore/c-toxcore/toxcore/group_pack.c
index db41ba9..c63a46a 100644
--- a/external/toxcore/c-toxcore/toxcore/group_pack.c
+++ b/external/toxcore/c-toxcore/toxcore/group_pack.c
@@ -9,7 +9,6 @@
 
 #include "group_pack.h"
 
-#include <assert.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
@@ -19,6 +18,32 @@
 #include "ccompat.h"
 #include "util.h"
 
+Group_Privacy_State group_privacy_state_from_int(uint8_t value)
+{
+    switch (value) {
+        case 0:
+            return GI_PUBLIC;
+        case 1:
+            return GI_PRIVATE;
+        default:
+            return GI_PUBLIC;
+    }
+}
+
+Group_Voice_State group_voice_state_from_int(uint8_t value)
+{
+    switch (value) {
+        case 0:
+            return GV_ALL;
+        case 1:
+            return GV_MODS;
+        case 2:
+            return GV_FOUNDER;
+        default:
+            return GV_ALL;
+    }
+}
+
 non_null()
 static bool load_unpack_state_values(GC_Chat *chat, Bin_Unpack *bu)
 {
@@ -44,8 +69,8 @@ static bool load_unpack_state_values(GC_Chat *chat, Bin_Unpack *bu)
     }
 
     chat->connection_state = manually_disconnected ? CS_DISCONNECTED : CS_CONNECTING;
-    chat->shared_state.privacy_state = (Group_Privacy_State)privacy_state;
-    chat->shared_state.voice_state = (Group_Voice_State)voice_state;
+    chat->shared_state.privacy_state = group_privacy_state_from_int(privacy_state);
+    chat->shared_state.voice_state = group_voice_state_from_int(voice_state);
 
     // we always load saved groups as private in case the group became private while we were offline.
     // this will have no detrimental effect if the group is public, as the correct privacy
@@ -125,7 +150,7 @@ static bool load_unpack_mod_list(GC_Chat *chat, Bin_Unpack *bu)
 
     if (chat->moderation.num_mods > MOD_MAX_NUM_MODERATORS) {
         LOGGER_ERROR(chat->log, "moderation count %u exceeds maximum %u", chat->moderation.num_mods, MOD_MAX_NUM_MODERATORS);
-        return false;
+        chat->moderation.num_mods = MOD_MAX_NUM_MODERATORS;
     }
 
     uint8_t *packed_mod_list = (uint8_t *)malloc(chat->moderation.num_mods * MOD_LIST_ENTRY_SIZE);
@@ -193,7 +218,10 @@ static bool load_unpack_self_info(GC_Chat *chat, Bin_Unpack *bu)
         return false;
     }
 
-    assert(self_nick_len <= MAX_GC_NICK_SIZE);
+    if (self_nick_len > MAX_GC_NICK_SIZE) {
+        LOGGER_ERROR(chat->log, "self_nick too big (%u bytes), truncating to %d", self_nick_len, MAX_GC_NICK_SIZE);
+        self_nick_len = MAX_GC_NICK_SIZE;
+    }
 
     if (!bin_unpack_bin_fixed(bu, self_nick, self_nick_len)) {
         LOGGER_ERROR(chat->log, "Failed to unpack self nick bytes");
@@ -206,7 +234,10 @@ static bool load_unpack_self_info(GC_Chat *chat, Bin_Unpack *bu)
         return false;
     }
 
-    assert(chat->numpeers > 0);
+    if (chat->numpeers == 0) {
+        LOGGER_ERROR(chat->log, "Failed to unpack self: numpeers should be > 0");
+        return false;
+    }
 
     GC_Peer *self = &chat->group[0];
 
@@ -369,9 +400,12 @@ static void save_pack_self_info(const GC_Chat *chat, Bin_Pack *bp)
 {
     bin_pack_array(bp, 4);
 
-    const GC_Peer *self = &chat->group[0];
+    GC_Peer *self = &chat->group[0];
 
-    assert(self->nick_length <= MAX_GC_NICK_SIZE);
+    if (self->nick_length > MAX_GC_NICK_SIZE) {
+        LOGGER_ERROR(chat->log, "self_nick is too big (%u). Truncating to %d", self->nick_length, MAX_GC_NICK_SIZE);
+        self->nick_length = MAX_GC_NICK_SIZE;
+    }
 
     bin_pack_u16(bp, self->nick_length); // 1
     bin_pack_u08(bp, (uint8_t)self->role); // 2
diff --git a/external/toxcore/c-toxcore/toxcore/group_pack.h b/external/toxcore/c-toxcore/toxcore/group_pack.h
index ae831ac..9d18840 100644
--- a/external/toxcore/c-toxcore/toxcore/group_pack.h
+++ b/external/toxcore/c-toxcore/toxcore/group_pack.h
@@ -32,4 +32,7 @@ void gc_save_pack_group(const GC_Chat *chat, Bin_Pack *bp);
 non_null()
 bool gc_load_unpack_group(GC_Chat *chat, Bin_Unpack *bu);
 
+Group_Privacy_State group_privacy_state_from_int(uint8_t value);
+Group_Voice_State group_voice_state_from_int(uint8_t value);
+
 #endif // GROUP_PACK_H
diff --git a/external/toxcore/c-toxcore/toxcore/mono_time.c b/external/toxcore/c-toxcore/toxcore/mono_time.c
index 418deec..2ce817f 100644
--- a/external/toxcore/c-toxcore/toxcore/mono_time.c
+++ b/external/toxcore/c-toxcore/toxcore/mono_time.c
@@ -165,7 +165,7 @@ Mono_Time *mono_time_new(const Memory *mem, mono_time_current_time_cb *current_t
     // Maximum reproducibility. Never return time = 0.
     mono_time->base_time = 1;
 #else
-    mono_time->base_time = (uint64_t)time(nullptr) - (current_time_monotonic(mono_time) / 1000ULL);
+    mono_time->base_time = (uint64_t)time(nullptr) * 1000ULL - current_time_monotonic(mono_time);
 #endif
 
     mono_time_update(mono_time);
@@ -190,14 +190,13 @@ void mono_time_free(const Memory *mem, Mono_Time *mono_time)
 
 void mono_time_update(Mono_Time *mono_time)
 {
-    uint64_t cur_time = 0;
 #ifdef OS_WIN32
     /* we actually want to update the overflow state of mono_time here */
     pthread_mutex_lock(&mono_time->last_clock_lock);
     mono_time->last_clock_update = true;
 #endif
-    cur_time = mono_time->current_time_callback(mono_time->user_data) / 1000ULL;
-    cur_time += mono_time->base_time;
+    const uint64_t cur_time =
+        mono_time->base_time + mono_time->current_time_callback(mono_time->user_data);
 #ifdef OS_WIN32
     pthread_mutex_unlock(&mono_time->last_clock_lock);
 #endif
@@ -211,21 +210,22 @@ void mono_time_update(Mono_Time *mono_time)
 #endif
 }
 
-uint64_t mono_time_get(const Mono_Time *mono_time)
+uint64_t mono_time_get_ms(const Mono_Time *mono_time)
 {
-#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+#if !defined(ESP_PLATFORM) && !defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
     // Fuzzing is only single thread for now, no locking needed */
-    return mono_time->cur_time;
-#else
-#ifndef ESP_PLATFORM
     pthread_rwlock_rdlock(mono_time->time_update_lock);
 #endif
     const uint64_t cur_time = mono_time->cur_time;
-#ifndef ESP_PLATFORM
+#if !defined(ESP_PLATFORM) && !defined(FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION)
     pthread_rwlock_unlock(mono_time->time_update_lock);
 #endif
     return cur_time;
-#endif
+}
+
+uint64_t mono_time_get(const Mono_Time *mono_time)
+{
+    return mono_time_get_ms(mono_time) / 1000ULL;
 }
 
 bool mono_time_is_timeout(const Mono_Time *mono_time, uint64_t timestamp, uint64_t timeout)
@@ -245,9 +245,10 @@ void mono_time_set_current_time_callback(Mono_Time *mono_time,
     }
 }
 
-/**
- * Return current monotonic time in milliseconds (ms). The starting point is
- * unspecified.
+/** @brief Return current monotonic time in milliseconds (ms).
+ *
+ * The starting point is unspecified and in particular is likely not comparable
+ * to the return value of `mono_time_get_ms()`.
  */
 uint64_t current_time_monotonic(Mono_Time *mono_time)
 {
diff --git a/external/toxcore/c-toxcore/toxcore/mono_time.h b/external/toxcore/c-toxcore/toxcore/mono_time.h
index fa1df84..bcd3d95 100644
--- a/external/toxcore/c-toxcore/toxcore/mono_time.h
+++ b/external/toxcore/c-toxcore/toxcore/mono_time.h
@@ -61,8 +61,16 @@ void mono_time_free(const Memory *mem, Mono_Time *mono_time);
 non_null()
 void mono_time_update(Mono_Time *mono_time);
 
-/**
- * Return unix time since epoch in seconds.
+/** @brief Return current monotonic time in milliseconds (ms).
+ *
+ * The starting point is UNIX epoch as measured by `time()` in `mono_time_new()`.
+ */
+non_null()
+uint64_t mono_time_get_ms(const Mono_Time *mono_time);
+
+/** @brief Return a monotonically increasing time in seconds.
+ *
+ * The starting point is UNIX epoch as measured by `time()` in `mono_time_new()`.
  */
 non_null()
 uint64_t mono_time_get(const Mono_Time *mono_time);
@@ -73,9 +81,10 @@ uint64_t mono_time_get(const Mono_Time *mono_time);
 non_null()
 bool mono_time_is_timeout(const Mono_Time *mono_time, uint64_t timestamp, uint64_t timeout);
 
-/**
- * Return current monotonic time in milliseconds (ms). The starting point is
- * unspecified.
+/** @brief Return current monotonic time in milliseconds (ms).
+ *
+ * The starting point is unspecified and in particular is likely not comparable
+ * to the return value of `mono_time_get_ms()`.
  */
 non_null()
 uint64_t current_time_monotonic(Mono_Time *mono_time);
diff --git a/external/toxcore/c-toxcore/toxcore/network.c b/external/toxcore/c-toxcore/toxcore/network.c
index 0dd3c53..3e0e6f4 100644
--- a/external/toxcore/c-toxcore/toxcore/network.c
+++ b/external/toxcore/c-toxcore/toxcore/network.c
@@ -1184,11 +1184,11 @@ Networking_Core *new_networking_ex(
     int n = 1024 * 1024 * 2;
 
     if (net_setsockopt(ns, temp->sock, SOL_SOCKET, SO_RCVBUF, &n, sizeof(n)) != 0) {
-        LOGGER_ERROR(log, "failed to set socket option %d", SO_RCVBUF);
+        LOGGER_WARNING(log, "failed to set socket option %d", SO_RCVBUF);
     }
 
     if (net_setsockopt(ns, temp->sock, SOL_SOCKET, SO_SNDBUF, &n, sizeof(n)) != 0) {
-        LOGGER_ERROR(log, "failed to set socket option %d", SO_SNDBUF);
+        LOGGER_WARNING(log, "failed to set socket option %d", SO_SNDBUF);
     }
 
     /* Enable broadcast on socket */
diff --git a/external/toxcore/c-toxcore/toxcore/tox.h b/external/toxcore/c-toxcore/toxcore/tox.h
index 23dca42..b3c7de0 100644
--- a/external/toxcore/c-toxcore/toxcore/tox.h
+++ b/external/toxcore/c-toxcore/toxcore/tox.h
@@ -3307,7 +3307,7 @@ uint32_t tox_group_max_message_length(void);
 /**
  * Maximum length of a group custom lossy packet.
  */
-#define TOX_GROUP_MAX_CUSTOM_LOSSY_PACKET_LENGTH 500
+#define TOX_GROUP_MAX_CUSTOM_LOSSY_PACKET_LENGTH 1373
 
 uint32_t tox_group_max_custom_lossy_packet_length(void);
 
@@ -3967,7 +3967,8 @@ Tox_Group_Role tox_group_peer_get_role(const Tox *tox, uint32_t group_number, ui
 /**
  * Return the type of connection we have established with a peer.
  *
- * This function will return an error if called on ourselves.
+ * If `peer_id` designates ourself, the return value indicates whether we're capable
+ * of making UDP connections with other peers, or are limited to TCP connections.
  *
  * @param group_number The group number of the group we wish to query.
  * @param peer_id The ID of the peer whose connection status we wish to query.
diff --git a/external/toxcore/c-toxcore/toxcore/tox_events.c b/external/toxcore/c-toxcore/toxcore/tox_events.c
index b757ab0..c61d31f 100644
--- a/external/toxcore/c-toxcore/toxcore/tox_events.c
+++ b/external/toxcore/c-toxcore/toxcore/tox_events.c
@@ -326,20 +326,20 @@ bool tox_events_unpack(Tox_Events *events, Bin_Unpack *bu)
     return true;
 }
 
-non_null(1) nullable(2)
-static bool tox_events_bin_pack_handler(Bin_Pack *bp, const void *obj)
+non_null(1) nullable(2, 3)
+static bool tox_events_bin_pack_handler(Bin_Pack *bp, const Logger *logger, const void *obj)
 {
     return tox_events_pack((const Tox_Events *)obj, bp);
 }
 
 uint32_t tox_events_bytes_size(const Tox_Events *events)
 {
-    return bin_pack_obj_size(tox_events_bin_pack_handler, events);
+    return bin_pack_obj_size(tox_events_bin_pack_handler, nullptr, events);
 }
 
 void tox_events_get_bytes(const Tox_Events *events, uint8_t *bytes)
 {
-    bin_pack_obj(tox_events_bin_pack_handler, events, bytes, UINT32_MAX);
+    bin_pack_obj(tox_events_bin_pack_handler, nullptr, events, bytes, UINT32_MAX);
 }
 
 Tox_Events *tox_events_load(const Tox_System *sys, const uint8_t *bytes, uint32_t bytes_size)
diff --git a/external/toxcore/c-toxcore/toxcore/tox_unpack.c b/external/toxcore/c-toxcore/toxcore/tox_unpack.c
index 26d1c76..76127c5 100644
--- a/external/toxcore/c-toxcore/toxcore/tox_unpack.c
+++ b/external/toxcore/c-toxcore/toxcore/tox_unpack.c
@@ -9,6 +9,17 @@
 #include "bin_unpack.h"
 #include "ccompat.h"
 
+static Tox_Conference_Type tox_conference_type_from_int(uint32_t value)
+{
+    switch (value) {
+        case 0:
+            return TOX_CONFERENCE_TYPE_TEXT;
+        case 1:
+            return TOX_CONFERENCE_TYPE_AV;
+        default:
+            return TOX_CONFERENCE_TYPE_TEXT;
+    }
+}
 bool tox_unpack_conference_type(Bin_Unpack *bu, Tox_Conference_Type *val)
 {
     uint32_t u32;
@@ -17,10 +28,23 @@ bool tox_unpack_conference_type(Bin_Unpack *bu, Tox_Conference_Type *val)
         return false;
     }
 
-    *val = (Tox_Conference_Type)u32;
+    *val = tox_conference_type_from_int(u32);
     return true;
 }
 
+static Tox_Connection tox_connection_from_int(uint32_t value)
+{
+    switch (value) {
+        case 0:
+            return TOX_CONNECTION_NONE;
+        case 1:
+            return TOX_CONNECTION_TCP;
+        case 2:
+            return TOX_CONNECTION_UDP;
+        default:
+            return TOX_CONNECTION_NONE;
+    }
+}
 bool tox_unpack_connection(Bin_Unpack *bu, Tox_Connection *val)
 {
     uint32_t u32;
@@ -29,10 +53,23 @@ bool tox_unpack_connection(Bin_Unpack *bu, Tox_Connection *val)
         return false;
     }
 
-    *val = (Tox_Connection)u32;
+    *val = tox_connection_from_int(u32);
     return true;
 }
 
+static Tox_File_Control tox_file_control_from_int(uint32_t value)
+{
+    switch (value) {
+        case 0:
+            return TOX_FILE_CONTROL_RESUME;
+        case 1:
+            return TOX_FILE_CONTROL_PAUSE;
+        case 2:
+            return TOX_FILE_CONTROL_CANCEL;
+        default:
+            return TOX_FILE_CONTROL_RESUME;
+    }
+}
 bool tox_unpack_file_control(Bin_Unpack *bu, Tox_File_Control *val)
 {
     uint32_t u32;
@@ -41,10 +78,21 @@ bool tox_unpack_file_control(Bin_Unpack *bu, Tox_File_Control *val)
         return false;
     }
 
-    *val = (Tox_File_Control)u32;
+    *val = tox_file_control_from_int(u32);
     return true;
 }
 
+static Tox_Message_Type tox_message_type_from_int(uint32_t value)
+{
+    switch (value) {
+        case 0:
+            return TOX_MESSAGE_TYPE_NORMAL;
+        case 1:
+            return TOX_MESSAGE_TYPE_ACTION;
+        default:
+            return TOX_MESSAGE_TYPE_NORMAL;
+    }
+}
 bool tox_unpack_message_type(Bin_Unpack *bu, Tox_Message_Type *val)
 {
     uint32_t u32;
@@ -53,10 +101,23 @@ bool tox_unpack_message_type(Bin_Unpack *bu, Tox_Message_Type *val)
         return false;
     }
 
-    *val = (Tox_Message_Type)u32;
+    *val = tox_message_type_from_int(u32);
     return true;
 }
 
+static Tox_User_Status tox_user_status_from_int(uint32_t value)
+{
+    switch (value) {
+        case 0:
+            return TOX_USER_STATUS_NONE;
+        case 1:
+            return TOX_USER_STATUS_AWAY;
+        case 2:
+            return TOX_USER_STATUS_BUSY;
+        default:
+            return TOX_USER_STATUS_NONE;
+    }
+}
 bool tox_unpack_user_status(Bin_Unpack *bu, Tox_User_Status *val)
 {
     uint32_t u32;
@@ -65,7 +126,7 @@ bool tox_unpack_user_status(Bin_Unpack *bu, Tox_User_Status *val)
         return false;
     }
 
-    *val = (Tox_User_Status)u32;
+    *val = tox_user_status_from_int(u32);
     return true;
 }
 
diff --git a/external/toxcore/c-toxcore/toxencryptsave/BUILD.bazel b/external/toxcore/c-toxcore/toxencryptsave/BUILD.bazel
index bbd5e0e..917d9c0 100644
--- a/external/toxcore/c-toxcore/toxencryptsave/BUILD.bazel
+++ b/external/toxcore/c-toxcore/toxencryptsave/BUILD.bazel
@@ -1,7 +1,5 @@
 load("//tools:no_undefined.bzl", "cc_library")
 
-package(features = ["layering_check"])
-
 exports_files(
     srcs = ["toxencryptsave.h"],
     visibility = ["//c-toxcore:__pkg__"],