Summary

splash_unregister() terminates active decoder but never NULLs unloaded module entry in static decoder_set[] array. After splash-decoder KLD module unloaded decoder_set[] retains dangling pointer to module freed static splash_decoder_t struct. splash_init() has no re-entrancy guard unconditionally dereferences decoder_set[i] via splash_test()->splash_find_data() (reading decoder->data_type decoder->init/data/data_size) all reads from freed module static struct. syscons caller (syscons.c:3432) only guards with SC_SPLASH_SCRN/SC_KERNEL_CONSOLE flags not on splash dispatcher internal state so syscons detach/re-attach re-enters splash_init hits stale pointer. Trigger: load splash decoder via loader.conf at boot; kldunload splash_pcx splash_unregister runs clears splash_decoder BUT decoder_set[0] still points at now-unloaded pcx_decoder; force splash_init re-run (unload/reload syscons module stack or helper KLD calling exported splash_init()) re-entry iterates decoder_set[0] non-NULL stale splash_test->splash_find_data dereferences stale->data_type page fault reading freed module memory. Impact: kernel panic local DoS. Requires root kldunload + console re-init.