diff --git a/stand/lua/cli.lua b/stand/lua/cli.lua
index cfdc69a520a0..12f6b57642db 100644
--- a/stand/lua/cli.lua
+++ b/stand/lua/cli.lua
@@ -1,251 +1,266 @@
 --
 -- SPDX-License-Identifier: BSD-2-Clause-FreeBSD
 --
 -- Copyright (c) 2018 Kyle Evans <kevans@FreeBSD.org>
 --
 -- Redistribution and use in source and binary forms, with or without
 -- modification, are permitted provided that the following conditions
 -- are met:
 -- 1. Redistributions of source code must retain the above copyright
 --    notice, this list of conditions and the following disclaimer.
 -- 2. Redistributions in binary form must reproduce the above copyright
 --    notice, this list of conditions and the following disclaimer in the
 --    documentation and/or other materials provided with the distribution.
 --
 -- THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 -- ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 -- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 -- ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 -- FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 -- DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 -- OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 -- HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 -- LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 -- OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 -- SUCH DAMAGE.
 --
 -- $FreeBSD$
 --
 
 local config = require("config")
 local core = require("core")
 
 local cli = {}
 
 if not pager then
 	-- shim for the pager module that just doesn't do it.
 	-- XXX Remove after 12.2 goes EoL.
 	pager = {
 		open = function() end,
 		close = function() end,
 		output = function(str)
 			printc(str)
 		end,
 	}
 end
 
 -- Internal function
 -- Parses arguments to boot and returns two values: kernel_name, argstr
 -- Defaults to nil and "" respectively.
 -- This will also parse arguments to autoboot, but the with_kernel argument
 -- will need to be explicitly overwritten to false
 local function parseBootArgs(argv, with_kernel)
 	if with_kernel == nil then
 		with_kernel = true
 	end
 	if #argv == 0 then
 		if with_kernel then
 			return nil, ""
 		else
 			return ""
 		end
 	end
 	local kernel_name
 	local argstr = ""
 
 	for _, v in ipairs(argv) do
 		if with_kernel and v:sub(1,1) ~= "-" then
 			kernel_name = v
 		else
 			argstr = argstr .. " " .. v
 		end
 	end
 	if with_kernel then
 		return kernel_name, argstr
 	else
 		return argstr
 	end
 end
 
 local function setModule(module, loading)
 	if loading and config.enableModule(module) then
 		print(module .. " will be loaded")
 	elseif not loading and config.disableModule(module) then
 		print(module .. " will not be loaded")
 	end
 end
 
 -- Declares a global function cli_execute that attempts to dispatch the
 -- arguments passed as a lua function. This gives lua a chance to intercept
 -- builtin CLI commands like "boot"
 -- This function intentionally does not follow our general naming guideline for
 -- functions. This is global pollution, but the clearly separated 'cli' looks
 -- more like a module indicator to serve as a hint of where to look for the
 -- corresponding definition.
 function cli_execute(...)
 	local argv = {...}
 	-- Just in case...
 	if #argv == 0 then
 		return loader.command(...)
 	end
 
 	local cmd_name = argv[1]
 	local cmd = cli[cmd_name]
 	if cmd ~= nil and type(cmd) == "function" then
 		-- Pass argv wholesale into cmd. We could omit argv[0] since the
 		-- traditional reasons for including it don't necessarily apply,
 		-- it may not be totally redundant if we want to have one global
 		-- handling multiple commands
 		return cmd(...)
 	else
 		return loader.command(...)
 	end
 
 end
 
 function cli_execute_unparsed(str)
 	return cli_execute(loader.parse(str))
 end
 
 -- Module exports
 
 function cli.boot(...)
 	local _, argv = cli.arguments(...)
 	local kernel, argstr = parseBootArgs(argv)
 	if kernel ~= nil then
 		loader.perform("unload")
 		config.selectKernel(kernel)
 	end
 	core.boot(argstr)
 end
 
 function cli.autoboot(...)
 	local _, argv = cli.arguments(...)
 	local argstr = parseBootArgs(argv, false)
 	core.autoboot(argstr)
 end
 
 cli['boot-conf'] = function(...)
 	local _, argv = cli.arguments(...)
 	local kernel, argstr = parseBootArgs(argv)
 	if kernel ~= nil then
 		loader.perform("unload")
 		config.selectKernel(kernel)
 	end
 	core.autoboot(argstr)
 end
 
 cli['read-conf'] = function(...)
 	local _, argv = cli.arguments(...)
 	config.readConf(assert(core.popFrontTable(argv)))
 end
 
 cli['reload-conf'] = function()
 	config.reload()
 end
 
 cli["enable-module"] = function(...)
 	local _, argv = cli.arguments(...)
 	if #argv == 0 then
 		print("usage error: enable-module module")
 		return
 	end
 
 	setModule(argv[1], true)
 end
 
 cli["disable-module"] = function(...)
 	local _, argv = cli.arguments(...)
 	if #argv == 0 then
 		print("usage error: disable-module module")
 		return
 	end
 
 	setModule(argv[1], false)
 end
 
 cli["toggle-module"] = function(...)
 	local _, argv = cli.arguments(...)
 	if #argv == 0 then
 		print("usage error: toggle-module module")
 		return
 	end
 
 	local module = argv[1]
 	setModule(module, not config.isModuleEnabled(module))
 end
 
 cli["show-module-options"] = function()
 	local module_info = config.getModuleInfo()
 	local modules = module_info['modules']
 	local blacklist = module_info['blacklist']
 	local lines = {}
 
 	for module, info in pairs(modules) do
 		if #lines > 0 then
 			lines[#lines + 1] = ""
 		end
 
 		lines[#lines + 1] = "Name:        " .. module
 		if info.name then
 			lines[#lines + 1] = "Path:        " .. info.name
 		end
 
 		if info.type then
 			lines[#lines + 1] = "Type:        " .. info.type
 		end
 
 		if info.flags then
 			lines[#lines + 1] = "Flags:       " .. info.flags
 		end
 
 		if info.before then
 			lines[#lines + 1] = "Before load: " .. info.before
 		end
 
 		if info.after then
 			lines[#lines + 1] = "After load:  " .. info.after
 		end
 
 		if info.error then
 			lines[#lines + 1] = "Error:       " .. info.error
 		end
 
 		local status
 		if blacklist[module] and not info.force then
 			status = "Blacklisted"
 		elseif info.load == "YES" then
 			status = "Load"
 		else
 			status = "Don't load"
 		end
 
 		lines[#lines + 1] = "Status:      " .. status
 	end
 
 	pager.open()
 	for _, v in ipairs(lines) do
 		pager.output(v .. "\n")
 	end
 	pager.close()
 end
 
+cli["disable-device"] = function(...)
+	local _, argv = cli.arguments(...)
+	local d, u
+
+	if #argv == 0 then
+		print("usage error: disable-device device")
+		return
+	end
+
+	d, u = string.match(argv[1], "(%w*%a)(%d+)")
+	if d ~= nil then
+		loader.setenv("hint." .. d .. "." .. u .. ".disabled", "1")
+	end
+end
+
 -- Used for splitting cli varargs into cmd_name and the rest of argv
 function cli.arguments(...)
 	local argv = {...}
 	local cmd_name
 	cmd_name, argv = core.popFrontTable(argv)
 	return cmd_name, argv
 end
 
 return cli
diff --git a/stand/lua/cli.lua.8 b/stand/lua/cli.lua.8
index 390831d21452..fe1cd0450557 100644
--- a/stand/lua/cli.lua.8
+++ b/stand/lua/cli.lua.8
@@ -1,154 +1,160 @@
 .\"
 .\" SPDX-License-Identifier: BSD-2-Clause-FreeBSD
 .\"
 .\" Copyright (c) 2018 Kyle Evans <kevans@FreeBSD.org>
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
-.Dd December 17, 2020
+.Dd July 24, 2021
 .Dt CLI.LUA 8
 .Os
 .Sh NAME
 .Nm cli.lua
 .Nd FreeBSD Lua CLI module
 .Sh DESCRIPTION
 .Nm
 contains the main functionality required to add new CLI commands, which can be
 executed at the loader prompt.
 .Pp
 Before hooking into the functionality provided by
 .Nm ,
 it must be included with a statement such as the following:
 .Pp
 .Dl local cli = require("cli")
 .Ss Adding new commands
 New loader commands may be created by adding functions to the object returned by
 requiring the
 .Nm
 module.
 .Pp
 For instance:
 .Pp
 .Bd -literal -offset indent -compact
 local cli = require("cli")
 
 cli.foo = function(...)
 	-- Expand args to command name and the rest of argv.  These arguments
 	-- are pushed directly to the stack by loader, then handed off to
 	-- cli_execute.  cli_execute then passes them on to the invoked
 	-- function, where they appear as varargs that must be peeled apart into
 	-- their respective components.
 	local _, argv = cli.arguments(...)
 
 	print("This is the foo command!")
 	for k, v in ipairs(argv) do
 		print("arg #" .. tostring(k) .. ": '" .. v .. "'")
 	end
 	-- Perform a loader command directly.  This will not get dispatched back
 	-- to Lua, so it is acceptable to have a function of the exact same name
 	-- in loader.  Lua will have the first chance to handle any commands
 	-- executed at the loader prompt.
 	loader.perform("foo")
 end
 .Ed
 .Pp
 This function may be invoked by a user at the loader prompt by simply typing
 .Ic foo .
 Arguments may be passed to it as usual, space-delimited.
 .Ss Default Commands
 The
 .Nm
 module provides the following default commands:
 .Bl -bullet
 .\"-width toggle-module -offset indent
 .It
 .Ic autoboot
 .It
 .Ic boot
 .It
 .Ic boot-conf
 .It
 .Ic reload-conf
 .It
-.Ic enable-module
+.Ic device-disable
 .It
 .Ic disable-module
 .It
+.Ic enable-module
+.It
 .Ic toggle-module
 .It
 .Ic show-module-options
 .El
 .Pp
 For
 .Ic autoboot ,
 .Ic boot ,
 and
 .Ic boot-conf ,
 the
 .Xr core.lua 8
 module will load all ELF modules as-needed before executing the equivalent
 built-in loader commands.
 All non-kernel arguments to these commands are passed in the same order to the
 loader command.
 .Pp
 The
 .Ic reload-conf
 command will reload the configuration from disk.
 This is useful if you have manually changed currdev and would like to easily
 reload the configuration from the new device.
 .Pp
 The
 .Ic enable-module ,
 .Ic disable-module ,
 and
 .Ic toggle-module
 commands manipulate the list of modules to be loaded along with the kernel.
 Modules blacklisted are considered disabled by
 .Ic toggle-module .
 These commands will override any such restriction as needed.
 The
 .Ic show-module-options
 command will dump the list of modules that loader has been made aware of and
 any applicable options using paged output.
+.Pp
+The
+.Ic device-disable
+command sets the environment variable that disables the device argument.
 .Ss Exported Functions
 The following functions are exported from
 .Nm :
 .Bl -tag -width cli.arguments -offset indent
 .It Fn cli.arguments ...
 Takes varargs passed on the stack from
 .Xr loader 8
 to
 .Ic cli_execute ,
 splits them out into two return values: the command name, traditionally argv[0],
 and the rest of argv.
 .El
 .Sh SEE ALSO
 .Xr loader.conf 5 ,
 .Xr core.lua 8 ,
 .Xr loader 8
 .Sh AUTHORS
 The
 .Nm
 file was originally written by
 .An Kyle Evans Aq Mt kevans@FreeBSD.org .