=== BASELINE (unfixed netgraph7 ng_tee) ===
[+] opened AF_NETGRAPH control socket (fd=3)
[+] mkpeer tee left2right<->left2right  (left/right hooks NOT connected)
[+] named the tee node 'tee0'
[+] sending NGM_FLOW_COOKIE to 'tee0:' (addressed by name => lasthook=NULL)
[+] EXPECT: kernel panic / fatal trap 12 (page fault) in ng_tee_rcvmsg
(ssh connection died — kernel panicked)

=== PANIC SIGNATURE (from dfbsd-qemu/boot.log) ===
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x20
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff8260b473
stack pointer	        = 0x10:0xfffff80117a879c0
frame pointer	        = 0x10:0xfffff80117a87a10
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 12 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      ng_tee_rcvmsg+0x83:     movq    0x20(%rdx),%rax
db> 

=== PATCHED (fixed ng_tee with lasthook != NULL guard) — Run 1 ===
[+] opened AF_NETGRAPH control socket (fd=3)
[+] mkpeer tee left2right<->left2right  (left/right hooks NOT connected)
[+] named the tee node 'tee0'
[+] sending NGM_FLOW_COOKIE to 'tee0:' (addressed by name => lasthook=NULL)
[+] EXPECT: kernel panic / fatal trap 12 (page fault) in ng_tee_rcvmsg
[?] sendto returned without panic -> bug NOT triggered on this kernel
RUN_EXIT=0

=== PATCHED — Run 2 (determinism check) ===
[+] opened AF_NETGRAPH control socket (fd=3)
[+] mkpeer tee left2right<->left2right  (left/right hooks NOT connected)
[+] named the tee node 'tee0'
[+] sending NGM_FLOW_COOKIE to 'tee0:' (addressed by name => lasthook=NULL)
[+] EXPECT: kernel panic / fatal trap 12 (page fault) in ng_tee_rcvmsg
[?] sendto returned without panic -> bug NOT triggered on this kernel
RUN_EXIT=0