Per-channel bytes (fresh) : 213 Per-channel bytes (stressed): 377 Header bytes (conservative) : 600 NG_TEXTRESPONSE buffer : 1024 Overflow starts at >= 2 open channels (fresh) All 32 channels open: fresh used=7416 OOB=6392 bytes stressed used=12664 OOB=11640 bytes CONFIRMED: ngmn_rcvmsg writes ~7416 bytes into a 1024-byte kmalloc(M_NETGRAPH) response buffer -> 6392-byte heap overflow with all 32 channels open. Reliable panic + heap grooming on hosts that have the Siemens Easy321-R1 mn NIC. RUN_EXIT=0