OK, to solve my own question: turns out only /dev/fb0 is (under Kali) owned by root:video while /dev/vchiq is owned root:root. Further, /dev/vchiq is NOT group read/writable.

Changing ownership from root:root to root:video and adding rw permissions for group to /dev/vchiq "solves" the issue, i.e. it allows Mathematica to work. While that's good, there are two things that are NOT good: a) the failure mode is absolutely horrid. b) what are the security implications of allowing regular users read write access to low level hardware? To make such permissions a requirement for Mathematica is, shall we say it politely, questionable.

The problem still exists as of 12.1.1:

➜  ~ wolfram
Mathematica 12.1.1 Kernel for Linux ARM (32-bit)
Copyright 1988-2020 Wolfram Research, Inc.

Mathematica 12.1.1 Kernel cannot find a valid password.

For automatic Web Activation enter your activation key
(enter return to skip Web Activation): 

You will need to get a password from your
license certificate or from Wolfram Research
(http://register.wolfram.com).
Machine name:   raspi2
MathID: 4703-79205-43531

You will need a valid activation key and password in order
to proceed. Go to http://user.wolfram.com to
register your activation key and obtain the password.

Enter your Activation key [format xxxx-xxxx-xxxxxx]: 

Enter your password: 

The password you entered is not valid.
Please press Enter to quit.

Adding the user to the video group fixed it for me. I figure adding full command output as above may help others (like a future me, once I've forgotten this) find this thread.

Edited to add: To fix the problem for the current user (regardless of that user's name), you can use:

sudo usermod -a -G video $(whoami)

To add a user that can run the Wolfram Language:

pi@test-pi ~ $ sudo adduser pi2
Adding user pi2' ...
Adding new grouppi2' (1004) ...
Adding new user pi2' (1001) with grouppi2' ...
Creating home directory /home/pi2' ...
Copying files from/etc/skel' ...
[...]

Add it to the 'video' group (required as part of a number of checks that the Wolfram Language is running on a Raspberry Pi):

pi@test-pi ~ $ sudo usermod -a -G video pi2

Switch to 'pi2' account, and run the wolfram engine:

pi@test-pi ~ $ su - pi2
pi2@test-pi ~ $ wolfram
Wolfram Language (Raspberry Pi Pilot Release)
Copyright 1988-2015 Wolfram Research
Information & help: wolfram.com/raspi

In[1]:=

I agree it is a counterintuitive way to fail. The appropriate developers have been made aware of this issue.

Mathematica on 2nd Pi2 fixed the same way. We can but hope there are enough good keywords in this thread to bring other sufferers to this solution. I'd still quite like to know why, though.

Thanks again, Ilian!

yup, adding the user to the video group did the trick for me as well. Thanks!

What user are you running Mathematica as? Is that user a member of the 'video' group?

sudo usermod -a -G video myuser

should do the trick.

I've tried uninstall and reinstall, unsuccessfully. I found file '/opt/Wolfram/WolframEngine/10.0/Configuration/Licensing/mathpass' which contains what looks like an activation key, and entered that, but it appears to have expired. How is anyone using Mathematica on Raspberry Pi if no licensing and activation information is available?