Line-accurate confirmation:
sys/kern/kern_device.c:261-283 dev_dmmap: builds struct dev_mmap_args
   on the stack, never presets a_result, then returns ap.a_result on
   success (uninitialized stack if the driver forgot it)
sys/kern/kern_device.c:448-467 dev_dpsize: same for a_result
sys/kern/kern_device.c:310-326 dev_dclone: fills only a_head;
   a_name/a_namelen/a_cred/a_mode stay stack garbage; zero callers
   besides the prototype (devfs_clone invokes handlers directly with
   initialized structs)
sys/kern/kern_device.c:471-473 dev_dkqfilter comment documents the
   intended contract ('We explicitly preset a_result to 0')
All in-tree d_mmap/d_psize implementations set a_result on success
(checked driver-by-driver in pass 2); latent defense-in-depth gap.