Summary

backlight_register() calls make_dev() but discards returned cdev_t -- assignment sc->cdev = is missing (backlight.c:116-117). Softc allocated M_ZERO so sc->cdev is NULL. Line 118 sc->cdev->si_drv1 = sc writes through NULL (offset ~0x158 into struct cdev). Line 119 make_dev_alias(sc->cdev...) and line 126 return sc->cdev also deref/return NULL but unreachable because 118 panics first. Porting regression from FreeBSD where line reads sc->cdev = make_dev(...). backlight_register is documented public kernel KPI (backlight.h:32 man page). Any in-tree or third-party driver calling it triggers immediate unconditional kernel panic. Currently no in-tree caller so dormant; moment a DRM/GPU/keyboard-backlight driver wired every system with that hardware panics at boot/module-load. Root (kldload module calling backlight_register) or physical trigger today.