untrusted comment: signature from openbsd 6.0 base secret key
RWSho3oKSqgLQ6AGZHP5WaZ87TSASuD0+j8d7zcLc6DFiZ9qdp9hdsWvm7ZqTzwtoTZqGoAvLQ1CLnfS33VxY5/oTukJO/kLwgU=

OpenBSD 6.0 errata 028, June 12, 2017:

An unprivileged console user can cause a kernel crash.

Apply by doing:
   signify -Vep /etc/signify/openbsd-60-base.pub -x 028_wsmux.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   cd /usr/src/sys/arch/`machine`/conf
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   config $KK
   cd ../compile/$KK
   make
   make install

Index: sys/dev/wscons/wsmux.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsmux.c,v
retrieving revision 1.31
diff -u -p -r1.31 wsmux.c
--- sys/dev/wscons/wsmux.c      10 Sep 2015 18:14:52 -0000      1.31
+++ sys/dev/wscons/wsmux.c      12 Jun 2017 16:33:17 -0000
@@ -142,10 +142,10 @@ wsmux_getmux(int n)
                       bcopy(old, new, nwsmux * sizeof(*wsmuxdevs));
               for (i = nwsmux; i < (n + 1); i++)
                       new[i] = NULL;
-               wsmuxdevs = new;
-               nwsmux = n + 1;
               if (old != NULL)
                       free(old, M_DEVBUF, nwsmux * sizeof(*wsmuxdevs));
+               wsmuxdevs = new;
+               nwsmux = n + 1;
       }

       sc = wsmuxdevs[n];