The handler for VT_GETSTATE assumes that the state structure is read by the
Linux kernel.  It is not; and it is perfectly reasonable to pass it an
unitialized structure.  On exit, only two fields are initialized on return, but
valgrind gets that part right.

Here's the diff: 

Index: coregrind/m_syswrap/syswrap-generic.c
===================================================================
--- coregrind/m_syswrap/syswrap-generic.c       (revision 6412)
+++ coregrind/m_syswrap/syswrap-generic.c       (working copy)
@@ -3992,7 +3992,6 @@
       PRE_MEM_READ( "ioctl(VT_SETMODE)", ARG3, sizeof(struct vki_vt_mode) );
       break;
    case VKI_VT_GETSTATE:
-      PRE_MEM_READ( "ioctl(VT_GETSTATE)", ARG3, sizeof(struct vki_vt_stat) );
       PRE_MEM_WRITE( "ioctl(VT_GETSTATE).v_active",
                      (Addr) &(((struct vki_vt_stat*) ARG3)->v_active),
                      sizeof(((struct vki_vt_stat*) ARG3)->v_active));