===== DF-0676 BASELINE (apply_fix=0, buggy): kldload ng_o2m_df.ko =====
DF0676: m=0xfffff801186e3800 item=0xfffff8008d446000  _NGI_M(item)=0xfffff801186e3800  el_flags=0x1
DF0676: replaying XMIT_ALL m_dup-NULL error path (apply_fix=0):
DF0676:   NG_FREE_ITEM(item)  [marks NGQF_FREE, does NOT clear _NGI_M]
DF0676:   NG_FREE_M(m)        [m_freem(m)]
DF0676: after error path: local m=0  _NGI_M(item)=0xfffff801186e3800 (DANGLING -> freed mbuf)
DF0676: replaying ng_apply_item -> ng_unref_item (refs->0) -> ng_free_item:
DF0676:   NGQF_DATA case: NG_FREE_M(_NGI_M(item))  <-- DOUBLE FREE
DF0676: ng_free_item freed mbuf 0xfffff801186e3800 a 2nd time (double-free executed)
DF0676: mbuf objcache did NOT trap the double-free (silent corruption)
DF0676: 16 fresh m_gethdr: address 0xfffff801186e3800 returned 2 time(s); >=2 => double-free aliasing (use-after-free primitive)

=> Double-free executed SILENTLY (mbuf objcache has no double-free trap on GENERIC).
   The same mbuf address is handed out to two distinct m_gethdr() callers => the two
   mbufs ALIAS the same memory => writes to one corrupt the other => use-after-free.