panic: trying to free NULL pointer
cpuid = 0
Trace beginning at frame 0xfffff8008d1f8850
_kfree() at _kfree+0x558 0xffffffff806583d8 
_kfree() at _kfree+0x558 0xffffffff806583d8 
ng_fec_constructor() at ng_fec_constructor+0x3ae 0xffffffff8262144e 
ng_mkpeer() at ng_mkpeer+0x4c 0xffffffff82637ebc 
ng_generic_msg() at ng_generic_msg+0x415 0xffffffff82638835 
ng_send_msg() at ng_send_msg+0xf1 0xffffffff82639241 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

---
NOTE: This panic is in ng_fec_constructor (a SEPARATE latent bug in the
fec node constructor that tries to kfree a NULL pointer when invoked via
ngctl mkpeer with a hook name that doesn't include family/type/proto).
This is NOT the DF-0503 UAF (which is about stored fec_if pointers in
the bundle runtime paths).  It does, however, confirm that the ng_fec
module is exercised by the netgraph message path and that the cited
DF-0503 code paths (ng_fec_addport/delport/tick/input/start) are
reachable in principle — they just require a successfully-constructed
fec node first, which this separate bug prevents.