===== DF-0676 FIXED (apply_fix=1, NGI_GET_M detach): kldload ng_o2m_df.ko =====
DF0676: replaying XMIT_ALL m_dup-NULL error path (apply_fix=1):
DF0676:   [FIX] NGI_GET_M(item,m) detached mbuf (_NGI_M=NULL)
DF0676:   NG_FREE_ITEM(item)  [marks NGQF_FREE; _NGI_M already NULL]
DF0676:   NG_FREE_M(m)        [m_freem(m)]
DF0676: after error path: local m=0  _NGI_M(item)=0 (DANGLING -> freed mbuf)
DF0676: replaying ng_apply_item -> ng_unref_item (refs->0) -> ng_free_item:
DF0676:   NGQF_DATA case: NG_FREE_M(_NGI_M(item))  <-- (now a no-op: _NGI_M is NULL)
DF0676: ng_free_item freed mbuf 0 a 2nd time (ng_free_item saw NULL -> no double free)
DF0676: 16 fresh m_gethdr: address 0 returned 0 time(s); >=2 => double-free aliasing (use-after-free primitive)

=> With NGI_GET_M detaching the mbuf, _NGI_M(item) is NULL before ng_free_item runs,
   so the NGQF_DATA case is a no-op. No double-free. Aliasing count drops 2 -> 0.