Missing bounds check in devclass_alloc_unit permits heap underflow write / NULL-deref panic for negative non-wildcard unit

Summary

devclass_alloc_unit validates wired unit only with unit>=0 nested inside conditional skipped for negative values. Negative non-wildcard unit (<-1) bypasses table-grow branch and returned as-is caller then executes dc->devices[dev->unit]=dev writing at negative array index heap buffer underflow or for fresh devclass dc->devices==NULL write near NULL panics kernel. No unprivileged runtime path injects unit requires buggy/malicious loadable driver kldload root or crafted boot hints. Memory-safety defect certain but concrete unprivileged trigger not demonstrated.