# PoC DF-4782 — static-console /dev/dcons never wired with si_drv1 → NULL-deref on first write (REPRODUCED sink)

## What this proves

In a kernel built with `device dcons` (sys/conf/files:327; LINT64:2002), the
console path creates /dev/dcons via `dcons_cninit_fini()` (dcons_os.c:383-387)
but `si_drv1` is only wired by `dcons_attach_port()` (dcons_os.c:490-493),
which runs only in the module (KLD) path — `DEV_MODULE` never fires for a
static driver.  The first write to the tty drains `t_outq` through
`dcons_tty_start()`:

```
dc = (struct dcons_softc *)tp->t_dev->si_drv1;   /* dcons_os.c:320 — NULL */
...
dcons_os_putc(dc, clist_getc(&tp->t_outq));      /* dcons_os.c:329 */
    -> dcons_putc(NULL, c)                       /* dcons.c:118 */
    -> ch->buf[ch->pos] reads *(NULL + 8/16)     /* Fatal trap 12 */
```

`cninit_finish()` (sys/kern/tty_cons.c:229) intercepts the console dev's ops
with `dev_ops_intercept`, and `cnopen()/cnwrite()` forward through
`cn_fwd_ops` to the original tty ops — so the tty write path (and the NULL
dereference) is reached exactly as described.

Device node is 0600 root:wheel, so the trigger is a local privileged user
(or anything that can write the console tty, e.g. `logger`-style output via
console redirection) on a custom kernel that compiles dcons in.

## Reproduce (guest, root — sink-level)

```
cd /root/dconsrig && make
kenv dconsnull.mode=2
kldload ./dconsnull.ko
# -> panic: Fatal trap 12, va=0x8, Stopped at dcons_putc: movl 0x8(%rdi),%eax
```

`dconsnull.c` calls the identical exported sink `dcons_putc(NULL, 'A')` that
`dcons_tty_start()` reaches with the unwired si_drv1.

## Full-path trigger (requires custom kernel)

Build a kernel with `device dcons` (headless box: dcons wins console
selection at CN_NORMAL), boot, then as root: `echo hi > /dev/dcons` →
same Fatal trap 12 in `dcons_putc()`.  Not executed here (would need a full
custom-kernel rebuild); mechanism is proven by the sink PoC plus the code
trace: nothing else in the static path ever assigns `si_drv1`.