diff --git a/NEWS b/NEWS
index 9de1b959..e3cc9736 100644
--- a/NEWS
+++ b/NEWS
@@ -1,8 +1,9 @@
 procps-3.2.7 --> procps-3.2.8
 
+ps: allow "+" in sort specifications, as in man page     rh208217
 ps: document SCHED_BATCH and add "see also" for stime
 ps: man page less ambiguous
-top: normal exit code should be 0          #341272 #354255
+top: normal exit code should be 0          #341272 #354255 rh199174
 pgrep: usage error should exit with 2       #413383
 vmstat: use EXIT_FAILURE -- thanks Yoshio Nakamura   #425492
 sysctl: fix crash -- thanks Steinar Gunderson      #423704
diff --git a/proc/sysinfo.c b/proc/sysinfo.c
index e008e967..cd59534b 100644
--- a/proc/sysinfo.c
+++ b/proc/sysinfo.c
@@ -43,7 +43,9 @@ static int meminfo_fd = -1;
 #define VMINFO_FILE "/proc/vmstat"
 static int vminfo_fd = -1;
 
-static char buf[1024];
+// As of 2.6.24 /proc/meminfo seems to need 888 on 64-bit,
+// and would need 1258 if the obsolete fields were there.
+static char buf[2048];
 
 /* This macro opens filename only if necessary and seeks to 0 so
  * that successive calls to the functions are more efficient.
@@ -531,6 +533,13 @@ unsigned long kb_pagetables;
 static unsigned long kb_vmalloc_chunk;
 static unsigned long kb_vmalloc_total;
 static unsigned long kb_vmalloc_used;
+// seen on 2.6.24-rc6-git12
+static unsigned long kb_anon_pages;
+static unsigned long kb_bounce;
+static unsigned long kb_commit_limit;
+static unsigned long kb_nfs_unstable;
+static unsigned long kb_swap_reclaimable;
+static unsigned long kb_swap_unreclaimable;
 
 void meminfo(void){
   char namebuf[16]; /* big enough to hold any row name */
@@ -540,8 +549,11 @@ void meminfo(void){
   char *tail;
   static const mem_table_struct mem_table[] = {
   {"Active",       &kb_active},       // important
+  {"AnonPages",    &kb_anon_pages},
+  {"Bounce",       &kb_bounce},
   {"Buffers",      &kb_main_buffers}, // important
   {"Cached",       &kb_main_cached},  // important
+  {"CommitLimit",  &kb_commit_limit},
   {"Committed_AS", &kb_committed_as},
   {"Dirty",        &kb_dirty},        // kB version of vmstat nr_dirty
   {"HighFree",     &kb_high_free},
@@ -557,8 +569,11 @@ void meminfo(void){
   {"MemFree",      &kb_main_free},    // important
   {"MemShared",    &kb_main_shared},  // important, but now gone!
   {"MemTotal",     &kb_main_total},   // important
+  {"NFS_Unstable", &kb_nfs_unstable},
   {"PageTables",   &kb_pagetables},   // kB version of vmstat nr_page_table_pages
   {"ReverseMaps",  &nr_reversemaps},  // same as vmstat nr_page_table_pages
+  {"SReclaimable", &kb_swap_reclaimable}, // "swap reclaimable" (dentry and inode structures)
+  {"SUnreclaim",   &kb_swap_unreclaimable},
   {"Slab",         &kb_slab},         // kB version of vmstat nr_slab
   {"SwapCached",   &kb_swap_cached},
   {"SwapFree",     &kb_swap_free},    // important
diff --git a/ps/output.c b/ps/output.c
index 24f7e5e9..ad5d2bd4 100644
--- a/ps/output.c
+++ b/ps/output.c
@@ -612,10 +612,10 @@ static int pr_class(char *restrict const outbuf, const proc_t *restrict const pp
   case  3: return snprintf(outbuf, COLWID, "B");   // SCHED_BATCH
   case  4: return snprintf(outbuf, COLWID, "#4");  // SCHED_ISO? (Con Kolivas)
   case  5: return snprintf(outbuf, COLWID, "#5");  // SCHED_IDLEPRIO? (Con Kolivas)
-  case  8: return snprintf(outbuf, COLWID, "#6");  //
-  case  8: return snprintf(outbuf, COLWID, "#7");  //
+  case  6: return snprintf(outbuf, COLWID, "#6");  //
+  case  7: return snprintf(outbuf, COLWID, "#7");  //
   case  8: return snprintf(outbuf, COLWID, "#8");  //
-  case  8: return snprintf(outbuf, COLWID, "#9");  //
+  case  9: return snprintf(outbuf, COLWID, "#9");  //
   default: return snprintf(outbuf, COLWID, "?");   // unknown value
   }
 }
@@ -971,6 +971,12 @@ static int help_pr_sig(unsigned long long sig){
 }
 #endif
 
+// This one is always thread-specific pending. (from Dragonfly BSD)
+static int pr_tsig(char *restrict const outbuf, const proc_t *restrict const pp){
+  return help_pr_sig(outbuf, pp->_sigpnd);
+}
+// This one is (wrongly?) thread-specific when printing thread lines,
+// but process-pending otherwise.
 static int pr_sig(char *restrict const outbuf, const proc_t *restrict const pp){
   return help_pr_sig(outbuf, pp->signal);
 }
@@ -1331,7 +1337,6 @@ static const format_struct format_array[] = {
 {"fuser",     "FUSER",   pr_fuser,    sr_fuser,   8, USR,    LNX, ET|USER},
 {"gid",       "GID",     pr_egid,     sr_egid,    5,   0,    SUN, ET|RIGHT},
 {"group",     "GROUP",   pr_egroup,   sr_egroup,  8, GRP,    U98, ET|USER},
-{"iac",       "IAC",     pr_nop,      sr_nop,     4,   0,    BSD, AN|RIGHT}, // DragonFly
 {"ignored",   "IGNORED", pr_sigignore,sr_nop,     9,   0,    BSD, TO|SIGNAL}, /*sigignore*/
 {"inblk",     "INBLK",   pr_nop,      sr_nop,     5,   0,    BSD, AN|RIGHT}, /*inblock*/
 {"inblock",   "INBLK",   pr_nop,      sr_nop,     5,   0,    DEC, AN|RIGHT}, /*inblk*/
@@ -1468,6 +1473,7 @@ static const format_struct format_array[] = {
 {"tsess",     "TSESS",   pr_nop,      sr_nop,     5,   0,    BSD, PO|PIDMAX|RIGHT},
 {"tsession",  "TSESS",   pr_nop,      sr_nop,     5,   0,    DEC, PO|PIDMAX|RIGHT},
 {"tsid",      "TSID",    pr_nop,      sr_nop,     5,   0,    BSD, PO|PIDMAX|RIGHT},
+{"tsig",      "PENDING", pr_tsig,     sr_nop,     9,   0,    BSD, ET|SIGNAL},
 {"tsiz",      "TSIZ",    pr_tsiz,     sr_nop,     4,   0,    BSD, PO|RIGHT},
 {"tt",        "TT",      pr_tty8,     sr_tty,     8,   0,    BSD, PO|LEFT},
 {"tty",       "TT",      pr_tty8,     sr_tty,     8,   0,    U98, PO|LEFT}, /* Unix98 requires "TT" but has "TTY" too. :-( */  /* was 3 wide */
diff --git a/ps/parser.c b/ps/parser.c
index 8a6fedb8..5ad9035c 100644
--- a/ps/parser.c
+++ b/ps/parser.c
@@ -729,17 +729,6 @@ static const char *parse_bsd_option(void){
       trace("x Select processes without controlling ttys\n");
       simple_select |= SS_B_x;
       break;
-#if 0
-    case 'y':
-      // DragonFlyBSD iac (interactivity measure) format
-      // uid,pid,ppid,cpu,pri,iac,nice,wchan,state,tt,time,command
-      // (they use 'Y' to sort by this "iac" thing; 'y' implies 'Y')
-      // Range is -127 .. 127, with lower numbers being more
-      // interactive and higher numbers more batch-like.
-      trace("y Display interactivity measure\n");
-      format_flags |= FF_Bv;
-      break;
-#endif
     case '-':
       return "Embedded '-' among BSD options makes no sense.";
       break;
diff --git a/ps/sortformat.c b/ps/sortformat.c
index 1a4cb98e..80427e55 100644
--- a/ps/sortformat.c
+++ b/ps/sortformat.c
@@ -325,6 +325,8 @@ static sort_node *do_one_sort_spec(const char *spec){
   if(*spec == '-'){
     reverse = 1;
     spec++;
+  } else if(*spec == '+'){
+    spec++;
   }
   fs = search_format_array(spec);
   if(fs){
diff --git a/top.c b/top.c
index 69025278..6d4a7ccf 100644
--- a/top.c
+++ b/top.c
@@ -405,6 +405,7 @@ static void bye_bye (FILE *fp, int eno, const char *str)
          * Normal end of execution.
          * catches:
          *    SIGALRM, SIGHUP, SIGINT, SIGPIPE, SIGQUIT and SIGTERM */
+// FIXME: can't do this shit in a signal handler
 static void end_pgm (int sig) NORETURN;
 static void end_pgm (int sig)
 {
@@ -459,6 +460,7 @@ static void std_out (const char *str)
          * Suspend ourself.
          * catches:
          *    SIGTSTP, SIGTTIN and SIGTTOU */
+// FIXME: can't do this shit in a signal handler!
 static void suspend (int dont_care_sig)
 {
   (void)dont_care_sig;
@@ -478,7 +480,7 @@ static void suspend (int dont_care_sig)
    putp(Cap_rmam);
 }
 
-
+
 /*######  Misc Color/Display support  ####################################*/
 
    /* macro to test if a basic (non-color) capability is valid
@@ -673,7 +675,7 @@ static void show_special (int interact, const char *glob)
                *sub_end = '\0';
                snprintf(tmp, sizeof(tmp), "%s%.*s%s", cap, room, sub_beg, Caps_off);
                amt = strlen(tmp);
-               if(rp - tmp + amt + 1 > sizeof tmp)
+               if(rp - row + amt + 1 > sizeof row)
                   goto overflow;  // shit happens
                rp = scat(rp, tmp);
                room -= (sub_end - sub_beg);