=== DF-0492: ng_l2tp lockless race on seq/window state ===

struct l2tp_seq has NO mutex (confirmed at ng_l2tp.c:120-137)
ng_l2tp_seq_recv_nr (line 1126) has NO crit_enter/lock
Timer callbacks use crit_enter (CPU-local, doesn't block SMP)

Race detected 170019 times in 100ms (xwin[0] read as NULL while unacked)

  BUG CONFIRMED: concurrent access to xwin[] without a common lock.
  In kernel: m_freem(xwin[i]) on CPU A races L2TP_COPY_MBUF(xwin[0])
  on CPU B -> UAF in m_copypacket -> kernel panic or exploitable UAF.
RUN_EXIT=0