After many rounds of blast-grepping through the kernel source, experimental
kernel printf's, and panic's, here is what kills my -current CATS kernels.

init (process 1) tries to open("/dev/console").  okay.

syscall->sys_open->vn_open->spec_open->cnopen. This is fine too.

BUT! The dev_t that cnopen() tries to open is NODEV (which is (dev_t)-1). 

cnopen() blindly uses the all 1's value of NODEV to index into cdevsw[],
and calls a garbage function pointer, which happens to be an address on
the heap in the kernels I'm presently building from a day-old sup.

The kernel executes garbage until it hits a syscall or something bad, which
explains why the typical panic complained of a syscall in non-USR32 mode.

Okay. Where does the NODEV come from?

Two places. Both the 'dev' argument to cnopen(), and the cn_tab->cn_dev
value that it prefers to always use, are NODEV.

When cnopen() dies, cn_tab == &wsdisplay_cons. This is being set in
wsdisplay_cnattach(), very early in the boot, because if I put a panic
there I never see any output from the experimental kernel.

But, cn_tab->cn_dev is never set. After the message "wsdisplay0 at vga0"
appears, wsdisplay_emul_attach() is called, but it does not set
cn_tab->cn_dev because ap->console is 0.

It turns out that ap->console isn't getting set because vga_is_console()
always returns false. And this is because the bus space tags don't match.

In particular, the vga_console_vc bus space tag is &isa_io_bs_tag.
But the vga0 device bus space tag is &footbridge_pci_io_bs_tag.

Lastly, this is because ebsa285_machdep.c:consinit() makes an explicit call
	vga_cnattach(&isa_io_bs_tag, &isa_mem_bs_tag, -1, 0);


So, either I have to find an ISA VGA card for my CATS machine, or turn off
WSCONS, or forego -current for now and continue running the 1 October CATS
kernel that was graciously provided to me by Andrew McMurry.

Todd Whitesel
toddpw @ best.com