=== Guest environment (DF-0525 verification) ===
uname: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
kernel config: X86_64_GENERIC (options INVARIANTS ON by default)
cc: cc 8.3 [DragonFly] Release/2019-02-22
snapshot: with-src (#0 unpatched baseline, full /usr/src tree + warm obj)

=== kldstat (default boot) ===
 1    5 0xffffffff80200000  1ad8538 kernel
 2    1 0xffffffff81cd9000    7c288 ehci.ko
 3    1 0xffffffff81d56000    8c778 xhci.ko

=== Module availability ===
ng_fec.ko: SHIPPED in /boot/kernel/ (old netgraph v1), loadable (kldload rc=0)
ng_socket (control socket): compiled into kernel (kldload reports "already loaded or in kernel")

=== Privilege boundary (netgraph control socket) ===
ngc_attach() in sys/netgraph/socket/ng_socket.c:172 requires
    caps_priv_check(ai->p_ucred, SYSCAP_RESTRICTEDROOT | __SYSCAP_NULLCRED)
=> opening the netgraph control socket / issuing NGM_FEC_* control messages
   (create node, add/del port) REQUIRES root. DF-0525 is root-reachable only.

=== Observed (separate defect, blocks DF-0525 live trigger) ===
kldload ng_fec.ko  (rc=0)
ngctl mkpeer fec ether fec   =>  immediate kernel panic:
   panic: trying to free NULL pointer
   ng_fec_constructor() at ng_fec_constructor+0x3ae
   (kfree(NULL) reached from the constructor -- a SEPARATE ng_fec bug,
    not the DF-0525 tick/delport race. It prevents any fec bundle/tick
    from being created, so the DF-0525 race cannot be live-triggered.)