=== DF-0529 baseline run (UNPATCHED #0 kernel, with-src snapshot) ===
command: kldload netgraph; kldload ng_fec; ngctl mkpeer .: fec myhook peerhook
modules loaded: netgraph.ko (id 4), ng_fec.ko (id 5)

ng_fec node creation (ngctl mkpeer) -> kernel PANIC (guest dies, ssh hangs).
This is deterministic: EVERY ng_fec node creation panics in ng_fec_constructor.

panic signature (from dfbsd-qemu/boot.log serial console):
  panic: trying to free NULL pointer
  cpuid = 0
  _kfree() at _kfree+0x558 0xffffffff806583d8
  _kfree() at _kfree+0x558 0xffffffff806583d8
  ng_fec_constructor() at ng_fec_constructor+0x3ae 0xffffffff8263f44e
  ng_mkpeer() at ng_mkpeer+0x4c 0xffffffff82600ebc
  ng_generic_msg() at ng_generic_msg+0x415 0xffffffff82601835
  ng_send_msg() at ng_send_msg+0xf1 0xffffffff82602241
  Debugger("panic")
  Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip)
  db>

Reproduced 4+ times across separate boots; identical signature each time.

NOTE: the panic fires on EVERY node creation, not "under memory pressure"
as the finding summary speculated. This makes the bug more severe than filed.