dev_is_good() tests a sentinel that is never installed: dead_dev_ops is assigned to no cdev, making every dead-device fence in the kernel dead code

Summary

dev_is_good() returns 0 only when dev->si_ops == &dead_dev_ops. A tree-wide search shows dead_dev_ops (defined zero-filled at kern_device.c:83) is never assigned to any cdev's si_ops: the only si_ops writers are devfs_new_cdev (devfs_core.c:2459) and dev_ops_intercept/dev_ops_restore (kern_device.c:663/674 — console only). The comments at kern_conf.c:336 ('revectors its ops to &dead_dev_ops') and :474 document a revectoring that devfs_destroy_dev_worker never performs. Consequently the guards at vfs_subr.c:1215 (v_associate_rdev), vfs_subr.c:2531, and vfs_conf.c:452/522 can never reject a destroyed device. No direct exploit (sysref keeps the cdev struct alive, so dispatch hits still-mapped driver ops; the module-lifetime hazard is the already-filed DF-2896 family) — inert defense-in-depth plus a misleading API contract. Fix: test a dedicated SI_DESTROYED flag set by devfs_destroy_dev_worker (or actually implement the promised revectoring under devfs_lock).

Timeline

• 2026-09-02 Discovered during pass-2 audit of kern_conf.c (GLM 5.3).