# DF-0696 — Missing return after NG_FREE_DATA in ng_etf_rcvdata

## Summary

`sys/netgraph/etf/ng_etf.c:381-392` `ng_etf_rcvdata()` checks
`NG_HOOK_PRIVATE(hook) == NULL` and on that path calls `NG_FREE_DATA(m, meta)`
(which NULLs both pointers) — but **lacks a `return`**. Control falls
through to `if (m->m_len < sizeof(*eh))` which dereferences `NULL` →
page-fault panic.

## How to (attempt to) reproduce

```
./build.sh          # nothing to compile (shell probe)
ssh dfbsd 'kldload ng_socket.ko; kldload ng_etf.ko; kldload ng_ether.ko'
ssh dfbsd 'cd /root/poc/DF-0696 && sh ./run.sh 200'
```

The race is tight (sender must observe HK_INVALID==0 just before
disconnect sets HK_INVALID + private=NULL); a 200-iteration ngctl loop
did not fire on the default kernel.

## Preconditions

- root (netgraph ng_socket creation is privileged).
- concurrent hook disconnect racing with `ng_send_data` calls.

## Impact

Local DoS (panic) once the race fires. No UAF — `NG_FREE_DATA` NULLs the
freed pointers, so this is not a corruption primitive.

## Fix

`fix.diff` adds `return (EINVAL);` immediately after `NG_FREE_DATA`,
matching the apparent original intent (free + bail).