diff -r 6501bd85f686 -r aaf6bcb7593f base/xdm/build.sh
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/xdm/build.sh	Thu Jul 23 22:22:54 2026 -0500
@@ -0,0 +1,55 @@
+#!/bin/sh
+# Build script for xdm (autotools, Template A).
+#
+# xdm authenticates via PAM (illumos <security/pam_appl.h> + -lpam, both in
+# base). configure autodetects PAM but we pass --with-pam to make it a hard
+# requirement (fail loudly rather than silently building a crypt(3)-only xdm).
+#
+# XDMCP: no --without-xdmcp exists in 1.1.17 (PKG_CHECK_MODULES(DMCP, xdmcp)
+# is unconditional). The UDP listener is disabled at runtime instead via the
+# shipped config's `DisplayManager.requestPort: 0` (see package.toml).
+#
+# Patches (patches/, applied -p1 below): illumos portability fixes discovered
+# during the alpha10 build. See each patch header for the specific reason.
+set -e
+
+# Resolve the port dir (holds patches/) BEFORE cd'ing into the extracted source.
+PORTDIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+cd "$SRCDIR"
+
+# --- Hammerhead/illumos portability patches ---
+# coral runs this script under zsh; an unmatched glob is a hard error there,
+# so enable NULL_GLOB (empty expansion) when running under zsh. The [ -f ]
+# guard covers the /bin/sh case (glob stays literal).
+if [ -n "$ZSH_VERSION" ]; then setopt NULL_GLOB 2>/dev/null || true; fi
+for p in "$PORTDIR"/patches/*.patch; do
+    [ -f "$p" ] || continue
+    echo "==> Applying patch: $(basename "$p")"
+    patch -p1 < "$p"
+done
+
+# MANDATORY libtool fix (Task 4a): this release's libtool-generated
+# `configure` has no illumos/hammerhead arm in its dynamic-linker detection
+# `case $host_os in ...` block; unmatched OS falls through to
+# `*) dynamic_linker=no ;;` forcing static-only. Piggyback hammerhead onto
+# the kopensolaris arm.
+if [ -f configure ]; then
+    sed -i -E 's/(kopensolaris\*-gnu)([^)]*\))/\1 | hammerhead*\2/' configure
+fi
+
+export PKG_CONFIG_PATH="$PREFIX/lib/pkgconfig:$PREFIX/share/pkgconfig:$PKG_CONFIG_PATH"
+export CFLAGS="${CFLAGS} -I$PREFIX/include -D__EXTENSIONS__ -D_POSIX_PTHREAD_SEMANTICS"
+export LDFLAGS="${LDFLAGS} -L$PREFIX/lib -R$PREFIX/lib"
+
+./configure \
+    --prefix="$PREFIX" \
+    --build="$BUILD_TRIPLE" \
+    --host="$BUILD_TRIPLE" \
+    --sysconfdir="$SYSCONFDIR" \
+    --disable-static \
+    --with-pam \
+    --with-xdmconfigdir="$PREFIX/lib/X11/xdm"
+
+gmake -j${JOBS:-1}
+gmake install DESTDIR="$PKGDIR"
diff -r 6501bd85f686 -r aaf6bcb7593f base/xdm/package.toml
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/xdm/package.toml	Thu Jul 23 22:22:54 2026 -0500
@@ -0,0 +1,35 @@
+# xdm - X Display Manager (X.Org)
+# The classic X11 display manager: starts a local X server on the console
+# VT and presents a graphical Xaw login greeter, authenticating via PAM.
+# Second task of the XLibre/xdm greeter plan
+# (docs/roadmap/DESKTOP_XLIBRE_XDM_GREETER_PLAN.md).
+#
+# XDMCP note: this release has no --without-xdmcp configure toggle
+# (PKG_CHECK_MODULES(DMCP, xdmcp) is unconditional, so libXdmcp is a hard
+# build dep). The remote-login/chooser UDP listener is instead disabled at
+# runtime by the shipped default config: config/xdm-config sets
+# `DisplayManager.requestPort: 0`, so xdm does not open the XDMCP socket.
+#
+# https://gitlab.freedesktop.org/xorg/app/xdm
+
+[package]
+name = "xdm"
+version = "1.1.17"
+release = 1
+description = "X Display Manager (login greeter, PAM auth)"
+url = "https://xorg.freedesktop.org/releases/individual/app/"
+license = "MIT"
+maintainer = "Chris Tusa <chris.tusa@leafscale.com>"
+arch = "x86_64"
+
+[dependencies]
+runtime = ["libXaw", "libXt", "libXmu", "libXpm", "libX11", "libXdmcp", "libXau", "libXext", "libXinerama"]
+build = ["libXaw", "libXt", "libXmu", "libXpm", "libX11", "libXdmcp", "libXau", "libXext", "libXinerama", "xorgproto", "util-macros"]
+
+[[source]]
+file = "xdm-1.1.17.tar.xz"
+urls = ["https://xorg.freedesktop.org/archive/individual/app/xdm-1.1.17.tar.xz"]
+checksum = "9494aef0911a031c53670725b5c8c9bb9d3f7c5ea7318b1f72ddd9dcbbeceb6a"
+
+[build]
+parallel = true
diff -r 6501bd85f686 -r aaf6bcb7593f base/xdm/patches/0001-pam-const-qual-hammerhead.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/base/xdm/patches/0001-pam-const-qual-hammerhead.patch	Thu Jul 23 22:22:54 2026 -0500
@@ -0,0 +1,40 @@
+Fix PAM const-qualifier detection for Hammerhead/illumos.
+
+xdm keys the `XDM_PAM_QUAL` const qualifier (used on the pam_conv callback
+and pam_get_item() arguments) on `#ifdef __sun`, assuming any __sun target
+uses the classic Solaris non-const PAM prototypes. Hammerhead's GCC defines
+__sun, but its <security/pam_appl.h> defaults to the CONST-qualified form
+(int (*conv)(int, const struct pam_message **, ...) and pam_get_item(...,
+const void **)) unless _PAM_LEGACY_NONCONST is defined. With __sun alone,
+XDM_PAM_QUAL expands empty (non-const) and greet.c fails to compile under
+GCC 14 with -Wincompatible-pointer-types (now a hard error):
+
+  greet.c:496: initialization of 'int (*)(int, const struct pam_message **,...)'
+               from incompatible pointer type 'int (*)(int, struct pam_message **,...)'
+  greet.c:588/613/735: passing argument 3 of 'pam_get_item' from incompatible
+               pointer type
+
+Gate the non-const branch on _PAM_LEGACY_NONCONST as well, so the qualifier
+matches whichever prototype form the PAM headers actually present. On
+Hammerhead this selects `const`, matching the default headers; on a legacy
+Solaris that defines _PAM_LEGACY_NONCONST it stays empty as before.
+
+--- a/greeter/greet.c
++++ b/greeter/greet.c
+@@ -152,9 +152,13 @@ static XtIntervalId	pingTimeout;
+
+ #ifdef USE_PAM
+
+-#ifdef __sun
+-/* Solaris does not const qualify arguments to pam_get_item() or the
+-   PAM conversation function that Linux-PAM and others do. */
++#if defined(__sun) && defined(_PAM_LEGACY_NONCONST)
++/* Classic Solaris did not const qualify arguments to pam_get_item() or the
++   PAM conversation function that Linux-PAM and others do. Hammerhead's
++   <security/pam_appl.h> defaults to the const-qualified (non-legacy) form
++   unless _PAM_LEGACY_NONCONST is defined, and Hammerhead's GCC also defines
++   __sun, so key the qualifier on _PAM_LEGACY_NONCONST rather than on __sun
++   alone. */
+ # define XDM_PAM_QUAL /**/
+ #else
+ # define XDM_PAM_QUAL const