DF-2897 — mute/close state-machine leak in /dev/console bookkeeping

Summary (analysis-only; Low severity, deterministic, root-gated)

cnclose() (sys/kern/tty_cons.c:403-404) returns immediately — without updating cn_is_open / cn_phys_is_open — whenever the console is muted (cn_fwd_ops == NULL, set by cnuninit() at :248). The un-mute path sysctl_kern_consmute() (tty_cons.c:265-278) then re-opens the physical console device purely on the strength of the stale cn_is_open flag with the stale openflag/openmode snapshot from the previous opener.

Sequence (no race required):

1. Root opens /dev/console (cnopen sets cn_is_open=1, snapshots openmode/openflag, forwards open to the physical console dev).
2. Root mutes: sysctl kern.consmute=1 → dev_dclose(cn_dev) forwarded, cnuninit() restores ops, cn_fwd_ops = NULL, cn_dev = NULL. /dev/console fd is still open, cn_is_open stays 1 — correct so far.
3. Root closes the /dev/console fd → cnclose hits cn_tab == NULL || cn_fwd_ops == NULL at :403 → returns 0 without clearing cn_is_open (or cn_phys_is_open).
4. Root un-mutes: sysctl kern.consmute=0 → cninit_finish() re-hooks, then if (cn_is_open) dev_dopen(cn_dev, openflag, openmode, ...) re-opens the physical console device although nobody holds /dev/console anymore.

Effects: the underlying console device (e.g. the serial/ttyv tty) is held open forever with no file descriptor behind it — it can no longer be closed through /dev/console (subsequent /dev/console opens/closes desync against the phantom open; DF-0124's unsynchronized bookkeeping amplifies this), and it is re-opened with a stale flags snapshot from a previous, possibly different, privileged opener.

Same stale flag applies to cn_phys_is_open when the physical device is closed while muted (the intercept is removed, so the close bypasses cnclose entirely): a later /dev/console close then declines to forward the close (if (cn_phys_is_open) return(0) at :429-430) and the real device close is never delivered.

Preconditions: root must toggle kern.consmute around the close — an administrative action (the sysctl is privileged), hence Low severity: state-machine/resource bug, not an unprivileged attack surface.

Why no Phase V

Low severity, root-gated, no memory-safety consequence — per the audit contract Phase V is reserved for Critical/High or memcorrupt/privesc findings. The logic above is fully deterministic and citable to source; verdict.json records status untested for the DB.

Suggested fix (sketch, not applied)

In cnclose(), update the bookkeeping before the muted early-return:

if (cn_tab == NULL || cn_fwd_ops == NULL) {
        /* keep bookkeeping in sync even while muted */
        if (dev == cn_devfsdev || dev == cn_tab->cn_dev) {
                if (dev == cn_tab->cn_dev)
                        cn_phys_is_open = 0;
                else
                        cn_is_open = 0;
        }
        return (0);
}

(and have the un-mute path re-open only when cn_is_open legitimately reflects a live /dev/console fd).