XXX mark two places where we do not hold a threadcount on the dev when

frobbing the cdevsw.

In both cases we examine only the cdevsw and it is a good question if we
weren't better off copying those properties into the cdev in the first
place.  This question will be revisited.

sys/fs/devfs/devfs_rule.c

@@ -604,6 +604,8 @@ devfs_rule_match(struct devfs_krule *dk, struct devfs_dirent *de)
 	 * They're actually testing to see whether the condition does
 	 * *not* match, since the default is to assume the rule should
 	 * be run (such as if there are no conditions).
+	 *
+	 * XXX: lacks threadref on dev
 	 */
 	if (dr->dr_icond & DRC_DSWFLAGS)
 		if (dev == NULL ||

sys/vm/vm_mmap.c

@@ -1094,6 +1094,7 @@ vm_mmap_vnode(struct thread *td, vm_size_t objsize,
 		type = OBJT_DEVICE;
 		handle = vp->v_rdev;
 
+		/* XXX: lack thredref on device */
 		if(vp->v_rdev->si_devsw->d_flags & D_MMAP_ANON) {
 			*maxprotp = VM_PROT_ALL;
 			*flagsp |= MAP_ANON;