It turns out that my analysis of the error handling here was wrong.

When there's an error, we don't want to free the children, since it
will be stack garbage.  While we did fail to dereference it by setting
devs to 0, we didn't fail to call free.  We never failed to fail, it
was the easiest thing to do.

2 files changed, 9 insertions, 10 deletions

diff --git a/sys/dev/mii/mlphy.c b/sys/dev/mii/mlphy.c
index 9eba9da..d44d36f 100644
--- a/sys/dev/mii/mlphy.c
+++ b/sys/dev/mii/mlphy.c
@@ -194,15 +194,15 @@ mlphy_service(xsc, mii, cmd)
 	 * See if there's another PHY on this bus with us.
 	 * If so, we may need it for 10Mbps modes.
 	 */
-	devs = 0;
-	device_get_children(msc->ml_mii.mii_dev, &devlist, &devs);
-	for (i = 0; i < devs; i++) {
-		if (strcmp(device_get_name(devlist[i]), "mlphy")) {
-			other = device_get_softc(devlist[i]);
-			break;
+	if (device_get_children(msc->ml_mii.mii_dev, &devlist, &devs) == 0) {
+		for (i = 0; i < devs; i++) {
+			if (strcmp(device_get_name(devlist[i]), "mlphy")) {
+				other = device_get_softc(devlist[i]);
+				break;
+			}
 		}
+		free(devlist, M_TEMP);
 	}
-	free(devlist, M_TEMP);
 
 	switch (cmd) {
 	case MII_POLLSTAT:
diff --git a/sys/dev/mii/tlphy.c b/sys/dev/mii/tlphy.c
index 6a603c2..9872cb3 100644
--- a/sys/dev/mii/tlphy.c
+++ b/sys/dev/mii/tlphy.c
@@ -162,9 +162,8 @@ tlphy_attach(device_t dev)
 	sc->sc_mii.mii_pdata = mii;
 
 	capmask = 0xFFFFFFFF;
-	if (mii->mii_instance) {
-		devs = 0;
-		device_get_children(sc->sc_mii.mii_dev, &devlist, &devs);
+	if (mii->mii_instance &&
+	    device_get_children(sc->sc_mii.mii_dev, &devlist, &devs) == 0) {
 		for (i = 0; i < devs; i++) {
 			if (strcmp(device_get_name(devlist[i]), "tlphy")) {
 				other = device_get_softc(devlist[i]);