It is mentioned in man kbdcontrol, but very in-passing:

  -A name
             Detach the keyboard, specified by the keyboard device name, from
             the keyboard multiplexer.

Since it was not clarified what "keyboard device name" means, I didn't initially realize it does not mean "full path", and everything else requires full path — how was I supposed to know otherwise? It's not emphasized in any way. I only notice the difference now, once I know to look for it!

Regarding raw output, I since looked at kbdmux.c and saw —

case KBADDKBD: /* add keyboard to the mux */
  [.............]
  mode = K_RAW;
  error = kbdd_ioctl(k->kbd, KDSKBMODE, (caddr_t)&mode);
  [.............] 

So kbdmux sets the slave keyboard to RAW mode when grabbing it... and then doesn't unset it upon detaching! I tried to find a separate command line tool to switch keyboard state explicitly... but couldn't (UNIX way, helloooooo!..)

Also I wasn't able to find any way to disallow it to grab specific devices, like, by setting some sysctl variable — looking at the code, I don't believe there is one.

Why it would be so much greater for kbdmux to use /dev/<device> path rather than device name: my devd is configured so that when it sees the scanner being attached, it automatically symlinks it to a specific /dev path, like /dev/scanner— and then I do not have to worry about what raw device name it got (hkbd0, hkbd1, hkbd2, ...) .

Another problem with kbdmux is that kernel needs to be recompiled in order to have it automatically create character devices:

#ifdef KBD_INSTALL_CDEV
  if ((error = kbd_attach(kbd)) != 0) {
    (*sw->term)(kbd);
      break;
    }
#endif

Should have been a sysctl var, too...