diff --git a/sys/kern/subr_bus.c b/sys/kern/subr_bus.c
--- a/sys/kern/subr_bus.c
+++ b/sys/kern/subr_bus.c
@@ -3885,10 +3885,18 @@
 
 	/*
 	 * Populate the return array.
+	 *
+	 * SECURITY: do NOT copy the raw kernel virtual address of device_t (or
+	 * its parent) into dv_handle/dv_parent.  The hw.bus.devices node is
+	 * world-readable (CTLFLAG_RD; the sysctl framework gates only writes via
+	 * SYSCAP, never reads), so disclosing the raw device_t pointers to
+	 * unprivileged users defeats KASLR and reveals kernel heap layout.
+	 * udev is already zeroed above, so the two handle fields stay 0.
+	 * (Userland that needs to correlate parent/child should use a
+	 * non-reversible cookie rather than the raw pointer; that is left as a
+	 * follow-up since the only such consumer is devinfo(8).)
 	 */
 	bzero(&udev, sizeof(udev));
-	udev.dv_handle = (uintptr_t)dev;
-	udev.dv_parent = (uintptr_t)dev->parent;
 	if (dev->nameunit != NULL)
 		strlcpy(udev.dv_name, dev->nameunit, sizeof(udev.dv_name));
 	if (dev->desc != NULL)