in pms_proc_mouse, wsmouse_input is called with an uninitialized 'dz' variable if the sc->protocol->type is not PMS_STANDARD or PMS_INTELLI.
Index: pms.c =================================================================== RCS file: /cvs/src/sys/dev/pckbc/pms.c,v retrieving revision 1.43 diff -u -p -r1.43 pms.c --- pms.c 31 May 2013 19:21:09 -0000 1.43 +++ pms.c 28 Jun 2013 16:13:02 -0000 @@ -595,7 +595,7 @@ void pms_proc_mouse(struct pms_softc *sc) { u_int buttons; - int dx, dy, dz; + int dx, dy, dz; buttons = butmap[sc->packet[0] & PMS_PS2_BUTTONSMASK]; dx = (sc->packet[0] & PMS_PS2_XNEG) ? @@ -604,11 +604,12 @@ pms_proc_mouse(struct pms_softc *sc) (int)sc->packet[2] - 256 : sc->packet[2]; switch (sc->protocol->type) { - case PMS_STANDARD: - dz = 0; - break; case PMS_INTELLI: dz = (signed char)sc->packet[3]; + break; + case PMS_STANDARD: + default: + dz = 0; break; }