# DF-0663 — SLIST_REMOVE on never-inserted element in `ng_device_newhook`

## Bug
`sys/netgraph/ng_device.c:286-309` — `ng_device_newhook()` error branches
at `:290` (make_dev fail) and `:300` (readq kmalloc fail) call
`SLIST_REMOVE(&sc->head, new_connection, ngd_connection, links)` but the
element was never inserted: `SLIST_INSERT_HEAD(&sc->head, ...)` happens
only at `:309`, AFTER both error checks.

`SLIST_REMOVE` (`sys/sys/queue.h:208-220`) walks the list with no NULL
guard, so on a non-member it dereferences NULL → panic.

## IMPORTANT: dead code
The cited file `sys/netgraph/ng_device.c` is NOT in `sys/conf/files` and
is built by no Makefile — it is dead code on all standard kernels. Only
`sys/netgraph7/ng_device.c` (a complete rewrite without this bug) is
built (`optional netgraph7_device`). The bug is real in the dead source,
unreachable in any standard build.

## Build / Run
```sh
cc -O2 -o df0663_slist_sim df0663_slist_sim.c -I/usr/src/sys
./df0663_slist_sim
# Expected: "Segmentation fault" — proving the SLIST_REMOVE macro
# NULL-derefs on a non-member with an empty list.
```

## Expected
- Harness: `Segmentation fault (core dumped)` on the empty-list case.
- Live kernel: nothing — the cited file is not built. See VERDICT.md.