dcons DMA buffer allocated without M_ZERO: stale kernel memory leaked to FireWire peer

Summary

dcons_os.c L462-463 contigmalloc(dg.size,M_DEVBUF,0,...) flags=0 no M_ZERO. vm_contig.c:517-540 only pmap_zero_page when (flags&M_ZERO) at :533 so returned memory contains whatever allocator last had. dcons_init() dcons.c:193-207 and dcons_init_port() dcons.c:127-155 populate only 48-byte struct dcons_buf header; ~16KB of TX/RX ring areas never zeroed. dcons_crom_attach() dcons_crom.c:170-185 loads buffer for DMA dmamap_cb() publishes dcons_paddr L146 exposing to FireWire peers via Configuration ROM. Peer on 1394 bus DMA-reads up to ~16KB uninitialized kernel memory. Caveats keeping Info: (1) FireWire peer with bus-master can already DMA arbitrary host memory so grants nothing new; (2) ring overwritten progressively by console traffic exposure shrinks. Becomes Low/Medium if FireWire DMA restricted to dcons region only (IOMMU/fwohci filter). Fix: pass M_ZERO to contigmalloc.