--- sys/kern/subr_bus.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/fixsrc/sys/kern/subr_bus.c	2026-10-24 13:14:50.717342896 +0000
@@ -1066,6 +1066,11 @@
 {
 	int unit = *unitp;
 
+	/* DF-2544: negative non-wildcard units bypass every check and
+	 * later index dc->devices[] out of bounds. */
+	if (unit < -1)
+		return (EINVAL);
+
 	PDEBUG(("unit %d in devclass %s", unit, DEVCLANAME(dc)));
 
 	/* If we have been given a wired unit number, check for existing device */