diff --git a/debian.kvm/config/annotations b/debian.kvm/config/annotations
index 07cb318f57e0..d99bb3bab260 100644
--- a/debian.kvm/config/annotations
+++ b/debian.kvm/config/annotations
@@ -53,8 +53,8 @@ CONFIG_CPU_FREQ_STAT                            note<'dependancy of boot essenti
 CONFIG_CRASH_DUMP                               policy<{'amd64': 'n'}>
 CONFIG_CRASH_DUMP                               note<'LP:1363180'>
 
-CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE          policy<{'amd64': '-'}>
-CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE          note<'Obsolete w/ no known userspace dependencies'>
+CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE          policy<{'amd64': 'n'}>
+CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE          note<'TODO: update note'>
 
 CONFIG_DM_VERITY                                policy<{'amd64': 'm'}>
 CONFIG_DM_VERITY                                note<'LP: #2019040'>
@@ -1119,11 +1119,9 @@ CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE         policy<{'amd64': '-'}>
 CONFIG_BOOT_PRINTK_DELAY                        policy<{'amd64': 'n'}>
 CONFIG_BPFILTER                                 policy<{'amd64': 'n'}>
 CONFIG_BPFILTER_UMH                             policy<{'amd64': '-'}>
-CONFIG_BPF_JIT                                  policy<{'amd64': 'n'}>
-CONFIG_BPF_JIT_ALWAYS_ON                        policy<{'amd64': '-'}>
-CONFIG_BPF_JIT_DEFAULT_ON                       policy<{'amd64': '-'}>
+CONFIG_BPF_JIT_ALWAYS_ON                        policy<{'amd64': 'n'}>
 CONFIG_BPF_KPROBE_OVERRIDE                      policy<{'amd64': '-'}>
-CONFIG_BPF_LSM                                  policy<{'amd64': '-'}>
+CONFIG_BPF_LSM                                  policy<{'amd64': 'n'}>
 CONFIG_BPF_STREAM_PARSER                        policy<{'amd64': 'n'}>
 CONFIG_BPQETHER                                 policy<{'amd64': '-'}>
 CONFIG_BRCMDBG                                  policy<{'amd64': '-'}>
@@ -1688,9 +1686,9 @@ CONFIG_CRYPTO_TWOFISH_COMMON                    policy<{'amd64': '-'}>
 CONFIG_CRYPTO_TWOFISH_X86_64                    policy<{'amd64': 'n'}>
 CONFIG_CRYPTO_TWOFISH_X86_64_3WAY               policy<{'amd64': 'n'}>
 CONFIG_CRYPTO_USER                              policy<{'amd64': 'n'}>
-CONFIG_CRYPTO_USER_API                          policy<{'amd64': '-'}>
+CONFIG_CRYPTO_USER_API                          policy<{'amd64': 'y'}>
 CONFIG_CRYPTO_USER_API_AEAD                     policy<{'amd64': 'n'}>
-CONFIG_CRYPTO_USER_API_HASH                     policy<{'amd64': 'n'}>
+CONFIG_CRYPTO_USER_API_HASH                     policy<{'amd64': 'y'}>
 CONFIG_CRYPTO_USER_API_RNG                      policy<{'amd64': 'n'}>
 CONFIG_CRYPTO_USER_API_RNG_CAVP                 policy<{'amd64': '-'}>
 CONFIG_CRYPTO_USER_API_SKCIPHER                 policy<{'amd64': 'n'}>
@@ -4271,39 +4269,33 @@ CONFIG_NETXEN_NIC                               policy<{'amd64': '-'}>
 CONFIG_NET_9P_RDMA                              policy<{'amd64': '-'}>
 CONFIG_NET_9P_VIRTIO                            policy<{'amd64': 'y'}>
 CONFIG_NET_9P_XEN                               policy<{'amd64': '-'}>
-CONFIG_NET_ACT_BPF                              policy<{'amd64': '-'}>
-CONFIG_NET_ACT_CONNMARK                         policy<{'amd64': '-'}>
-CONFIG_NET_ACT_CSUM                             policy<{'amd64': '-'}>
-CONFIG_NET_ACT_CT                               policy<{'amd64': '-'}>
-CONFIG_NET_ACT_CTINFO                           policy<{'amd64': '-'}>
-CONFIG_NET_ACT_GACT                             policy<{'amd64': '-'}>
-CONFIG_NET_ACT_GATE                             policy<{'amd64': '-'}>
-CONFIG_NET_ACT_IFE                              policy<{'amd64': '-'}>
-CONFIG_NET_ACT_IPT                              policy<{'amd64': '-'}>
-CONFIG_NET_ACT_MIRRED                           policy<{'amd64': '-'}>
-CONFIG_NET_ACT_MPLS                             policy<{'amd64': '-'}>
-CONFIG_NET_ACT_NAT                              policy<{'amd64': '-'}>
-CONFIG_NET_ACT_PEDIT                            policy<{'amd64': '-'}>
-CONFIG_NET_ACT_POLICE                           policy<{'amd64': '-'}>
-CONFIG_NET_ACT_SAMPLE                           policy<{'amd64': '-'}>
-CONFIG_NET_ACT_SIMP                             policy<{'amd64': '-'}>
-CONFIG_NET_ACT_SKBEDIT                          policy<{'amd64': '-'}>
-CONFIG_NET_ACT_SKBMOD                           policy<{'amd64': '-'}>
-CONFIG_NET_ACT_TUNNEL_KEY                       policy<{'amd64': '-'}>
-CONFIG_NET_ACT_VLAN                             policy<{'amd64': '-'}>
-CONFIG_NET_CLS                                  policy<{'amd64': '-'}>
-CONFIG_NET_CLS_ACT                              policy<{'amd64': '-'}>
-CONFIG_NET_CLS_BASIC                            policy<{'amd64': '-'}>
-CONFIG_NET_CLS_BPF                              policy<{'amd64': '-'}>
-CONFIG_NET_CLS_CGROUP                           policy<{'amd64': '-'}>
-CONFIG_NET_CLS_FLOW                             policy<{'amd64': '-'}>
-CONFIG_NET_CLS_FLOWER                           policy<{'amd64': '-'}>
-CONFIG_NET_CLS_FW                               policy<{'amd64': '-'}>
-CONFIG_NET_CLS_MATCHALL                         policy<{'amd64': '-'}>
-CONFIG_NET_CLS_ROUTE4                           policy<{'amd64': '-'}>
-CONFIG_NET_CLS_RSVP                             policy<{'amd64': '-'}>
-CONFIG_NET_CLS_RSVP6                            policy<{'amd64': '-'}>
-CONFIG_NET_CLS_U32                              policy<{'amd64': '-'}>
+CONFIG_NET_ACT_BPF                              policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_CONNMARK                         policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_CSUM                             policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_CT                               policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_CTINFO                           policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_GACT                             policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_GATE                             policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_IPT                              policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_MIRRED                           policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_MPLS                             policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_NAT                              policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_PEDIT                            policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_POLICE                           policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_SAMPLE                           policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_SIMP                             policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_SKBEDIT                          policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_SKBMOD                           policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_TUNNEL_KEY                       policy<{'amd64': 'n'}>
+CONFIG_NET_ACT_VLAN                             policy<{'amd64': 'n'}>
+CONFIG_NET_CLS_BASIC                            policy<{'amd64': 'n'}>
+CONFIG_NET_CLS_BPF                              policy<{'amd64': 'y'}>
+CONFIG_NET_CLS_FLOW                             policy<{'amd64': 'n'}>
+CONFIG_NET_CLS_FLOWER                           policy<{'amd64': 'n'}>
+CONFIG_NET_CLS_FW                               policy<{'amd64': 'n'}>
+CONFIG_NET_CLS_MATCHALL                         policy<{'amd64': 'n'}>
+CONFIG_NET_CLS_ROUTE4                           policy<{'amd64': 'n'}>
+CONFIG_NET_CLS_U32                              policy<{'amd64': 'n'}>
 CONFIG_NET_DEVLINK                              policy<{'amd64': '-'}>
 CONFIG_NET_DSA                                  policy<{'amd64': 'n'}>
 CONFIG_NET_DSA_AR9331                           policy<{'amd64': '-'}>
@@ -4358,8 +4350,7 @@ CONFIG_NET_DSA_VITESSE_VSC73XX_SPI              policy<{'amd64': '-'}>
 CONFIG_NET_DSA_XRS700X                          policy<{'amd64': '-'}>
 CONFIG_NET_DSA_XRS700X_I2C                      policy<{'amd64': '-'}>
 CONFIG_NET_DSA_XRS700X_MDIO                     policy<{'amd64': '-'}>
-CONFIG_NET_EGRESS                               policy<{'amd64': '-'}>
-CONFIG_NET_EMATCH                               policy<{'amd64': '-'}>
+CONFIG_NET_EMATCH                               policy<{'amd64': 'n'}>
 CONFIG_NET_EMATCH_CANID                         policy<{'amd64': '-'}>
 CONFIG_NET_EMATCH_CMP                           policy<{'amd64': '-'}>
 CONFIG_NET_EMATCH_IPSET                         policy<{'amd64': '-'}>
@@ -4383,43 +4374,40 @@ CONFIG_NET_PKTGEN                               policy<{'amd64': 'n'}>
 CONFIG_NET_POLL_CONTROLLER                      policy<{'amd64': '-'}>
 CONFIG_NET_PTP_CLASSIFY                         policy<{'amd64': '-'}>
 CONFIG_NET_SB1000                               policy<{'amd64': 'n'}>
-CONFIG_NET_SCHED                                policy<{'amd64': 'n'}>
 CONFIG_NET_SCH_ATM                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_CAKE                             policy<{'amd64': '-'}>
+CONFIG_NET_SCH_CAKE                             policy<{'amd64': 'n'}>
 CONFIG_NET_SCH_CBQ                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_CBS                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_CHOKE                            policy<{'amd64': '-'}>
-CONFIG_NET_SCH_CODEL                            policy<{'amd64': '-'}>
-CONFIG_NET_SCH_DEFAULT                          policy<{'amd64': '-'}>
-CONFIG_NET_SCH_DRR                              policy<{'amd64': '-'}>
+CONFIG_NET_SCH_CBS                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_CHOKE                            policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_CODEL                            policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_DRR                              policy<{'amd64': 'n'}>
 CONFIG_NET_SCH_DSMARK                           policy<{'amd64': '-'}>
-CONFIG_NET_SCH_ETF                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_ETS                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_FIFO                             policy<{'amd64': '-'}>
-CONFIG_NET_SCH_FQ                               policy<{'amd64': '-'}>
-CONFIG_NET_SCH_FQ_CODEL                         policy<{'amd64': '-'}>
+CONFIG_NET_SCH_ETF                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_ETS                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_FQ                               policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_FQ_CODEL                         policy<{'amd64': 'n'}>
 CONFIG_NET_SCH_FQ_PIE                           policy<{'amd64': '-'}>
-CONFIG_NET_SCH_GRED                             policy<{'amd64': '-'}>
-CONFIG_NET_SCH_HFSC                             policy<{'amd64': '-'}>
-CONFIG_NET_SCH_HHF                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_HTB                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_INGRESS                          policy<{'amd64': '-'}>
-CONFIG_NET_SCH_MQPRIO                           policy<{'amd64': '-'}>
-CONFIG_NET_SCH_MULTIQ                           policy<{'amd64': '-'}>
-CONFIG_NET_SCH_NETEM                            policy<{'amd64': '-'}>
-CONFIG_NET_SCH_PIE                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_PLUG                             policy<{'amd64': '-'}>
-CONFIG_NET_SCH_PRIO                             policy<{'amd64': '-'}>
-CONFIG_NET_SCH_QFQ                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_RED                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_SFB                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_SFQ                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_SKBPRIO                          policy<{'amd64': '-'}>
-CONFIG_NET_SCH_TAPRIO                           policy<{'amd64': '-'}>
-CONFIG_NET_SCH_TBF                              policy<{'amd64': '-'}>
-CONFIG_NET_SCH_TEQL                             policy<{'amd64': '-'}>
+CONFIG_NET_SCH_GRED                             policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_HFSC                             policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_HHF                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_HTB                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_INGRESS                          policy<{'amd64': 'y'}>
+CONFIG_NET_SCH_MQPRIO                           policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_MULTIQ                           policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_NETEM                            policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_PIE                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_PLUG                             policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_PRIO                             policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_QFQ                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_RED                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_SFB                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_SFQ                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_SKBPRIO                          policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_TAPRIO                           policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_TBF                              policy<{'amd64': 'n'}>
+CONFIG_NET_SCH_TEQL                             policy<{'amd64': 'n'}>
 CONFIG_NET_SELFTESTS                            policy<{'amd64': '-'}>
-CONFIG_NET_TC_SKB_EXT                           policy<{'amd64': '-'}>
+CONFIG_NET_TC_SKB_EXT                           policy<{'amd64': 'n'}>
 CONFIG_NET_TEAM                                 policy<{'amd64': 'n'}>
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP               policy<{'amd64': '-'}>
 CONFIG_NET_TEAM_MODE_BROADCAST                  policy<{'amd64': '-'}>
@@ -4427,6 +4415,8 @@ CONFIG_NET_TEAM_MODE_LOADBALANCE                policy<{'amd64': '-'}>
 CONFIG_NET_TEAM_MODE_RANDOM                     policy<{'amd64': '-'}>
 CONFIG_NET_TEAM_MODE_ROUNDROBIN                 policy<{'amd64': '-'}>
 CONFIG_NET_TULIP                                policy<{'amd64': '-'}>
+CONFIG_NET_U32_MARK                             policy<{'amd64': '-'}>
+CONFIG_NET_U32_PERF                             policy<{'amd64': '-'}>
 CONFIG_NET_VENDOR_3COM                          policy<{'amd64': '-'}>
 CONFIG_NET_VENDOR_8390                          policy<{'amd64': '-'}>
 CONFIG_NET_VENDOR_ADAPTEC                       policy<{'amd64': '-'}>
@@ -5395,7 +5385,6 @@ CONFIG_SCA3300                                  policy<{'amd64': '-'}>
 CONFIG_SCD30_CORE                               policy<{'amd64': '-'}>
 CONFIG_SCD30_I2C                                policy<{'amd64': '-'}>
 CONFIG_SCD30_SERIAL                             policy<{'amd64': '-'}>
-CONFIG_SCHEDSTATS                               policy<{'amd64': 'n'}>
 CONFIG_SCHED_AUTOGROUP                          policy<{'amd64': 'n'}>
 CONFIG_SCHED_OMIT_FRAME_POINTER                 policy<{'amd64': 'n'}>
 CONFIG_SCHED_TRACER                             policy<{'amd64': 'n'}>
