panic: trying to free NULL pointer
ng_fec_constructor() at ng_fec_constructor+0x3ae 0xffffffff8260144e
ng_mkpeer() at ng_mkpeer+0x4c 0xffffffff82617ebc
ng_generic_msg() at ng_generic_msg+0x415 0xffffffff82618835
ng_send_msg() at ng_send_msg+0xf1 0xffffffff82619241
Debugger("panic")
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)

=======================================================================
NOTE: This panic is a SEPARATE ng_fec defect, NOT the DF-0525 race.
Source: kern_slaballoc.c:1407  panic("trying to free NULL pointer")
        fires when kfree(NULL) is called. A code path reached from
        ng_fec_constructor() (sys/netgraph/fec/ng_fec.c:1071-1152)
        calls kfree(NULL). The constructor's error paths also contain a
        latent double-free: at lines 1093/1101 it does
            kfree(ifp, M_NETGRAPH)
        but ifp = &priv->arpcom.ac_if (line 1085) is NOT a separately
        allocated pointer -- it is embedded inside priv. Freeing it then
        freeing priv (1094/1102) corrupts the slab.

Because the shipped ng_fec.ko deterministically panics on node creation,
NO fec bundle / callout tick can ever be instantiated on master DEV.
This blocks live reproduction of the DF-0525 tick-vs-delport race.
(That constructor bug should be filed as a separate finding.)
=======================================================================