diff --git a/CHANGES b/CHANGES
index 77cdb5ef61..04e6ce2f17 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,16 @@
+6.0.0-dev.441 | 2023-04-26 15:37:59 +0200
+
+  * Update AF-Packet submodule (Arne Welzel, Corelight)
+
+    Include Tim's cleanup and modernization fixes, too.
+
+  * Update AF-Packet submodule (Arne Welzel, Corelight)
+
+    * Mask VLAN ID from tp_vlan_tci field to fix vlan > 4095 reported by Zeek
+      when PCP and/or DEI bits are set.
+    * Descriptive error message when interface is down. Instead of
+      "Invalid argument", Zeek now reports "interface is down".
+
 6.0.0-dev.437 | 2023-04-25 13:07:57 -0700
 
   * Update docs and NEWS to include LLC, SNAP, and Novell packet analyzers (Tim Wojtulewicz)
diff --git a/NEWS b/NEWS
index 1e9de96bab..f58942daec 100644
--- a/NEWS
+++ b/NEWS
@@ -291,6 +291,10 @@ Changed Functionality
 - Support for ARUBA GRE tunnels now covers all of the known protocol type values
   for those tunnels.
 
+- The vlan field reported by the AF_PACKET packet source is now properly
+  masked to exclude PCP and DEI bits. Previously, these bits were included
+  and could cause invalid vlan values > 4095 to be reported.
+
 Removed Functionality
 ---------------------
 
diff --git a/VERSION b/VERSION
index 7bbda78c89..269c2d5c3a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-6.0.0-dev.437
+6.0.0-dev.441
diff --git a/auxil/zeek-af_packet-plugin b/auxil/zeek-af_packet-plugin
index 08935a1b93..acd8e365c6 160000
--- a/auxil/zeek-af_packet-plugin
+++ b/auxil/zeek-af_packet-plugin
@@ -1 +1 @@
-Subproject commit 08935a1b93a2d7710d748737e5e653934977a9cf
+Subproject commit acd8e365c652ea6113b70fbbb1339d42e496819d
diff --git a/testing/btest/btest.cfg b/testing/btest/btest.cfg
index 447715534d..d1714544dc 100644
--- a/testing/btest/btest.cfg
+++ b/testing/btest/btest.cfg
@@ -4,7 +4,7 @@
 build_dir = build
 
 [btest]
-TestDirs    = doc bifs language core scripts coverage signatures plugins broker spicy supervisor telemetry javascript
+TestDirs    = af_packet doc bifs language core scripts coverage signatures plugins broker spicy supervisor telemetry javascript
 TmpDir      = %(testbase)s/.tmp
 BaselineDir = %(testbase)s/Baseline
 IgnoreDirs  = .svn CVS .tmp