Per-channel bytes (fresh counters)   : 137
Per-channel bytes (stressed counters): 359
status_8370 header bytes (approx)    : 200
NG_TEXTRESPONSE buffer               : 1024

All 32 channels open (worst case):
  fresh counters    used=4584  OOB=3560 bytes
  stressed counters used=11688  OOB=10664 bytes
  overflow starts at >= 7 open channels (fresh)

CONFIRMED: status_chans writes ~4584 bytes into a 1024-byte kmalloc(M_NETGRAPH) response buffer -> 3560-byte heap overflow with all 32 channels open. Content is partly attacker-influenced (counter magnitude via traffic pattern, channel open/close via ng_socket mkpeer). Reliable panic + heap grooming -> kernel code execution on systems where the musycc node can be created.
RUN_EXIT=0