dev_dmmap/dev_dpsize don't preset a_result; dead dev_dclone never initializes a_name/a_namelen/a_cred/a_mode — uninitialized kernel stack passed to drivers by the dispatch shim

Summary

The shim builds each driver args struct on the kernel stack but leaves result/output fields uninitialized in three wrappers: dev_dmmap never presets a_result before d_mmap, dev_dpsize never presets a_result, and dev_dclone fills only a_head (a_name/namelen/cred/mode = stack garbage). dev_dkqfilter demonstrates the intended contract by explicitly presetting a_result=0 with a comment. Today every in-tree d_mmap/d_psize sets a_result on success and dev_dclone has zero callers (devfs_clone invokes clone handlers directly with fully-initialized structs) — no current trigger; latent defense-in-depth gap. Fix: zero the whole args struct (= { 0 }) in every wrapper (or delete the dead dev_dclone).

Timeline

• 2026-09-02 Discovered during pass-2 audit of kern_device.c (GLM 5.3).