(baseline run, DFBATCH kernel, captured from serial console) DFB-uether[mii]: fabricating mii_phy_probe-failure state DFB-uether: if_link = {0, 0} (if_attach never ran), calling verbatim uether_ifdetach() DFB-uether: expect if_detach() TAILQ_REMOVE through tqe_prev == NULL -> kernel panic now fault virtual address = 0x0 Stopped at if_down_dispatch+0x66: movq (%rax),%r13 [ether_ifdetach() -> if_down() on the never-attached ifnet: first NULL deref lands in if_down_dispatch before the predicted TAILQ_REMOVE; same class -- detach machinery on a never-if_attach()ed ifnet]