=== DF-0524: ng_fec stored raw ifnet pointer -> UAF ===

[1] Adding port to fec bundle:
  addport: stored raw ptr 0x8004904a0 (if_index=5) — NO if_ref taken

[2] Interface detached (e.g. kldunload driver, if_destroy):
  if_detach: freeing ifnet 0x8004904a0 (if_index=5) — fec still holds dangling ptr!

[3] fec tick fires — dereferences fec_if:
  fec_tick: port 0 if_index=1094795585 flags=0x41414141 (ok)
RUN_EXIT=1