untrusted comment: verify with openbsd-66-base.pub
RWSvK/c+cFe24HuxPJYgTefoBwEe3A6uTPNflkVOvaqo+cztke1HC30msJsRzFmOiGJNnraNbhZdBm/cV0hn/VzIzmhvjQsiFQo=

OpenBSD 6.6 errata 027, May 13, 2020:

An out-of-bounds index access in wscons(4) can cause a kernel crash.

Apply by doing:
    signify -Vep /etc/signify/openbsd-66-base.pub -x 027_wscons.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/dev/wscons/wsdisplay.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsdisplay.c,v
retrieving revision 1.133
diff -u -p -r1.133 wsdisplay.c
--- sys/dev/wscons/wsdisplay.c	1 Jul 2019 19:38:40 -0000	1.133
+++ sys/dev/wscons/wsdisplay.c	10 May 2020 20:51:01 -0000
@@ -1253,7 +1253,7 @@ wsdisplay_internal_ioctl(struct wsdispla
 
 	case WSDISPLAYIO_GETSCREENTYPE:
 #define d ((struct wsdisplay_screentype *)data)
-		if (d->idx >= sc->sc_scrdata->nscreens)
+		if (d->idx < 0 || d->idx >= sc->sc_scrdata->nscreens)
 			return(EINVAL);
 
 		d->nidx = sc->sc_scrdata->nscreens;
Index: sys/dev/wscons/wsemulconf.c
===================================================================
RCS file: /cvs/src/sys/dev/wscons/wsemulconf.c,v
retrieving revision 1.9
diff -u -p -r1.9 wsemulconf.c
--- sys/dev/wscons/wsemulconf.c	14 Mar 2015 03:38:50 -0000	1.9
+++ sys/dev/wscons/wsemulconf.c	10 May 2020 20:51:01 -0000
@@ -78,7 +78,7 @@ wsemul_pick(const char *name)
 const char *
 wsemul_getname(int idx)
 {
-	if (idx >= nitems(wsemul_conf) - 1)
+	if (idx < 0 || idx >= nitems(wsemul_conf) - 1)
 		return (NULL);
 	return (wsemul_conf[idx]->name);
 }