This is not really i386 specific.

You can try to chmod /dev/ugen0 to 666, or chown it to you.

If that doesn't work, run scanimage -L under ktrace and then run kdump
and see what call gets EPERM.

I have found that 'scanimage -L' behaves differently from the actual
frontends.  But that may be for scsi scanners.