diff --git a/base/dnsmasq/debian/meta_data.yaml b/base/dnsmasq/debian/meta_data.yaml
new file mode 100644
index 000000000..407a31f77
--- /dev/null
+++ b/base/dnsmasq/debian/meta_data.yaml
@@ -0,0 +1,6 @@
+---
+debver: 2.85-1
+archive: https://snapshot.debian.org/archive/debian/20211110T150056Z/pool/main/d/dnsmasq
+revision:
+  dist: $STX_DIST
+  PKG_GITREVCOUNT: true
diff --git a/base/dnsmasq/debian/patches/close-tftp-sockets-immediately.patch b/base/dnsmasq/debian/patches/close-tftp-sockets-immediately.patch
new file mode 100644
index 000000000..fc6cb3038
--- /dev/null
+++ b/base/dnsmasq/debian/patches/close-tftp-sockets-immediately.patch
@@ -0,0 +1,28 @@
+From 858e259bf7125695c068301d0ef56cc4750d6544 Mon Sep 17 00:00:00 2001
+From: Don Penney <don.penney@windriver.com>
+Date: Thu, 15 Sep 2016 13:32:03 -0400
+Subject: [PATCH 1/1] Close tftp sockets immediately
+
+---
+ src/tftp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/tftp.c b/src/tftp.c
+index d7d050f..ecc6ce8 100644
+--- a/src/tftp.c
++++ b/src/tftp.c
+@@ -847,9 +847,11 @@ int do_tftp_script_run(void)
+   if ((transfer = daemon->tftp_done_trans))
+     {
+       daemon->tftp_done_trans = transfer->next;
++#if 0 /* Disable delayed closing of TFTP UDP socket */
+ #ifdef HAVE_SCRIPT
+       queue_tftp(transfer->file->size, transfer->file->filename, &transfer->peer);
+ #endif
++#endif
+       free_transfer(transfer);
+       return 1;
+     }
+-- 
+1.9.1
+
diff --git a/base/dnsmasq/debian/patches/dnsmasq-update-ipv6-leases-from-config.patch b/base/dnsmasq/debian/patches/dnsmasq-update-ipv6-leases-from-config.patch
new file mode 100644
index 000000000..129c467a2
--- /dev/null
+++ b/base/dnsmasq/debian/patches/dnsmasq-update-ipv6-leases-from-config.patch
@@ -0,0 +1,83 @@
+From 1a91b72146893dab1cca1354dd3b0a8fa74d6b55 Mon Sep 17 00:00:00 2001
+From: Scott Little <scott.little@windriver.com>
+Date: Tue, 18 Oct 2016 13:07:56 -0400
+Subject: WRS: Patch22: dnsmasq-update-ipv6-leases-from-config.patch
+
+---
+ src/lease.c | 53 +++++++++++++++++++++++++++++++++++++++++++----------
+ 1 file changed, 43 insertions(+), 10 deletions(-)
+
+diff --git a/src/lease.c b/src/lease.c
+index 69e698c..bc56c47 100644
+--- a/src/lease.c
++++ b/src/lease.c
+@@ -218,6 +218,18 @@ void lease_init(time_t now)
+   dns_dirty = 1;
+ }
+ 
++static int lease_match_config_addr(struct dhcp_lease *lease, struct dhcp_config *config)
++{
++    if (!(lease->flags & (LEASE_TA | LEASE_NA)) && (config->flags & CONFIG_ADDR))
++      return (lease->addr.s_addr == config->addr.s_addr);
++#ifdef HAVE_DHCP6
++    else if ((lease->flags & (LEASE_TA | LEASE_NA)) && (config->flags & CONFIG_ADDR6))
++      return IN6_ARE_ADDR_EQUAL(&config->addr6, &lease->addr6);
++#endif
++    else
++      return 0;
++}
++
+ void lease_update_from_configs(void)
+ {
+   /* changes to the config may change current leases. */
+@@ -226,16 +238,37 @@ void lease_update_from_configs(void)
+   struct dhcp_config *config;
+   char *name;
+   
+-  for (lease = leases; lease; lease = lease->next)
+-    if (lease->flags & (LEASE_TA | LEASE_NA))
+-      continue;
+-    else if ((config = find_config(daemon->dhcp_conf, NULL, lease->clid, lease->clid_len, 
+-				   lease->hwaddr, lease->hwaddr_len, lease->hwaddr_type, NULL, NULL)) && 
+-	     (config->flags & CONFIG_NAME) &&
+-	     (!(config->flags & CONFIG_ADDR) || config->addr.s_addr == lease->addr.s_addr))
+-      lease_set_hostname(lease, config->hostname, 1, get_domain(lease->addr), NULL);
+-    else if ((name = host_from_dns(lease->addr)))
+-      lease_set_hostname(lease, name, 1, get_domain(lease->addr), NULL); /* updates auth flag only */
++  for (lease = leases; lease; lease = lease->next) {
++    if (lease->flags & LEASE_TA)
++      continue;  /* we do not update temporary ipv6 leases */
++
++    config = find_config(daemon->dhcp_conf, NULL, lease->clid, lease->clid_len,
++                         (lease->hwaddr_len > 0 ? lease->hwaddr : NULL),
++                         lease->hwaddr_len, lease->hwaddr_type, NULL, NULL);
++    if (config)
++      {
++        if ((!(config->flags & (CONFIG_ADDR | CONFIG_ADDR6))) ||
++            lease_match_config_addr(lease, config))
++          {
++            /*
++             * Either we matched on a config that doesn't have an address in
++             * which case we'll just use the hostname, or we matched on a
++             * config that has the same IP address.
++             */
++            if (!(lease->flags & (LEASE_TA | LEASE_NA)))
++              lease_set_hostname(lease, config->hostname, 1, get_domain(lease->addr), NULL);
++#ifdef HAVE_DHCP6
++            else
++              lease_set_hostname(lease, config->hostname, 1, get_domain6(&lease->addr6), NULL);
++#endif
++            continue;  /* lease updated; move on to next lease */
++          }
++      }
++
++    /* attempt to find a matching DNS cache entry for an IPv4 entry */
++    if (!(lease->flags & (LEASE_TA | LEASE_NA)) && (name = host_from_dns(lease->addr)))
++       lease_set_hostname(lease, name, 1, get_domain(lease->addr), NULL); /* updates auth flag only */
++  }
+ }
+ 
+ static void ourprintf(int *errp, char *format, ...)
+-- 
+2.7.4
+
diff --git a/base/dnsmasq/debian/patches/series b/base/dnsmasq/debian/patches/series
new file mode 100644
index 000000000..02084b515
--- /dev/null
+++ b/base/dnsmasq/debian/patches/series
@@ -0,0 +1,2 @@
+close-tftp-sockets-immediately.patch
+dnsmasq-update-ipv6-leases-from-config.patch