Summary

sc_get_cons_priority (162-182) iterates devtab via resource_locate()/resource_query_unit() but unlike sibling scidentify (line 74) never skips negative unit. resource_query_unit() returns devtab[i].unit which CAN be negative for generic devtab entry (resource_find subr_bus.c:2283-2295 handles unit<0). Negative unit propagates to caller sccninit (syscons.c:1836-1839) where sc_get_softc(unit SC_KERNEL_CONSOLE) returns NULL (if(unit<0) return NULL guard at syscons_nexus.c:111-112) and immediately following ->console_scp deref panics. sc_get_cons_priority stores negative u into *unit (line 177-181); sccninit does sc_console=sc_get_softc(unit)->console_scp NULL deref. Defect is inconsistency with scidentify which has u<0 continue guard at 73-75. Trigger: generic sc devtab entry (unit<0) from malformed/generic syscons hint hint.sc.-1.flags=0x100 in loader. Early-boot kernel panic during console attach. DoS only admin/loader access required not unprivileged runtime user.