=== FIRING TRIGGER: data byte -> split:out -> ng_split_rcvdata(out) ===
    (double NG_FREE_ITEM; KKASSERT(!(NGQF_FREE)) would fire on unpatched)
[+] created socket node csock=3 dsock=4
[+] mkpeer split: socket:tx <-> split:out
[*] sending 1 data byte onto split:out -> ng_split_rcvdata(out) -> double NG_FREE_ITEM
[!] data sent; kernel still alive -> no panic
NO_PANIC
INJECT_EXIT=0

=== dmesg confirms the out-hook path still executed (path runs, no panic) ===
ng_split: got packet from out hook!

=== guest healthy after trigger ===
uid=0(root) ... ; uptime confirms responsive