diff --git a/sys/netgraph7/ng_device.c b/sys/netgraph7/ng_device.c
--- a/sys/netgraph7/ng_device.c
+++ b/sys/netgraph7/ng_device.c
@@ -389,6 +389,7 @@
 
 	/* pass the ioctl data into the ->data area */
 	datap = (struct ngd_param_s *)msg->data;
+	/* addr points at the ioctl arg buffer; copied by value downstream, not stored as a live kernel ptr */
 	datap->p = addr;
 
 	NG_SEND_MSG_HOOK(error, sc->node, msg, connection->active_hook, 0);