# DF-3007 — `devfs_uninit` passes NULL to `devfs_msg_send` -> guaranteed NULL-pointer write (latent)

- **File:** `sys/vfs/devfs/devfs_core.c:2751` (`devfs_msg_send(DEVFS_TERMINATE_CORE, NULL)`)
  + `sys/vfs/devfs/devfs_core.c:1112-1119` (unconditional deref)
  + `sys/sys/msgport2.h:33-38` (`lwkt_initmsg` stores through `msg`)
- **Class:** CWE-476 NULL pointer dereference (write)
- **Severity:** Info — latent: unreachable on a stock system (see VERDICT)

## Build / Run

No build. As root on the guest:

```sh
shutdown -r now     # then inspect the serial console / boot log
```

## Expected (had the path executed)

`devfs_msg_send` immediately executes `lwkt_initmsg(&devfs_msg->hdr, ...)`
with `devfs_msg == NULL` — `hdr` is the first member of `struct devfs_msg`
(`sys/sys/devfs.h:165-166`), so this is a write to address 0 -> kernel panic.

## Observed

Two clean reboots, no panic, guest returns to `login:` — the SYSUNINIT entry
never executes on this configuration (static-kernel `sysuninit_set` has no
consumer on DragonFly; SYSUNINITs run only for KLD modules via
`linker_file_sysuninit`, `sys/kern/kern_linker.c:535`). Details and the
dead-path trace are in VERDICT.md. `run.log` holds the reboot attempt log.

## Fix

`fix.diff` — allocate a real message (`devfs_msg_get()`); it is auto-freed
via `devfs_dispose_port`'s `devfs_msg_autofree_reply`. Compile-validated in
the fix build.