cmx_kqfilter is the only entry point without the sc==NULL||sc->dying guard — kevent() on a still-open fd after card detachment dereferences the NULL softc (kernel NULL-deref panic)

Summary

Every sibling entry validates sc/dying; kqfilter assigns kn_hook and computes klist=&sc->kq.ki_note unconditionally. No device_busy at open so detach is not blocked by open fds - card removal frees the softc and the next kevent on the still-dispatchable cdev dereferences NULL+offsetof(kq). The author's own filter_read defensively NULL-checks - registration missed it. Root-only device + physical removal. Guard fix.