Summary

sc_get_softc (line 117) and sc_find_softc (line 144) both call device_get_softc() on raw return of devclass_get_device(). device_get_softc() does NOT NULL-check its argument (subr_bus.c:1782-1785 return dev->softc) so any NULL device from devclass_get_device() (out-of-range unit NULL sc_devclass OR sparse device slot dc->devices[i]==NULL for i<maxunit normal with hint-driven sparse units) causes immediate kernel page fault/panic before subsequent if(sc==NULL) check can run. Correct kernel API devclass_get_softc() (subr_bus.c:949-959) NULL-checks device; this file should use it. Trigger: sparse syscons units hint.sc.0.at=nexus hint.sc.2.at=nexus without unit 1 so dc->devices[1]==NULL and sc_find_softc loop (143-150) derefs NULL at i=1. sc_find_softc reached from screen-saver update path (snake_saver.c:68 star_saver.c:67 fred_saver.c:207) invoked when console blanks. Boot/kenv hint config admin-controlled config-dependent panic not unprivileged-escalation availability only.