devfs_fo_stat dereferences DEVFS_NODE(vp)->d_dev without the NULL guard getattr has → NULL-deref panic when the device node was torn down under an open fd

Summary

devfs_vop_getattr guards 'if (node == NULL) return EIO' because devfs_freep NULLs vp->v_data on device destruction; devfs_fo_stat calls vn_stat (→getattr, guarded) and then unconditionally does sb->st_rdev = devid_from_dev(DEVFS_NODE(vp)->d_dev) at :1432 — a detach racing between the getattr and :1432 NULL-derefs. Needs a device destroyed while an fd is open (revoke/driver detach — root-mediated; pty protocol blocks the unpriv variant), then fstat(fd) races the detach → panic. Not executed (root pre-condition); direct code-path. Fix: cache node once at fo_stat entry and guard, or take the vp lock around the stat critical section.

Timeline

• 2026-09-02 Discovered during pass-2 audit of devfs_vnops.c (GLM 5.3).