diff --git a/sys/vfs/devfs/devfs_core.c b/sys/vfs/devfs/devfs_core.c
--- a/sys/vfs/devfs/devfs_core.c
+++ b/sys/vfs/devfs/devfs_core.c
@@ -969,7 +969,14 @@
 	msg->mdv_ino.ino = target;
 	devfs_msg_send_sync(DEVFS_INODE_TO_VNODE, msg);
 	vp = msg->mdv_ino.vp;
-	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
+	/*
+	 * The dispatcher may set mdv_ino.vp to NULL when no devfs node
+	 * matches `target` (devfs_iterate_topology returns NULL).
+	 * Guard vn_lock to avoid a NULL-deref panic; callers already
+	 * translate vp==NULL into ENOENT.
+	 */
+	if (vp != NULL)
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
 	devfs_msg_put(msg);
 
 	return vp;