# DF-2573 — ng_device_newhook error paths SLIST_REMOVE a connection that was never inserted → guaranteed NULL-deref panic

* File: `sys/netgraph/ng_device.c` (old netgraph)
* Lines: 290 (make_dev failure path) and 300 (readq kmalloc failure path);
  insertion only at 309
* Claim: both error paths call `SLIST_REMOVE` on `new_connection` before it
  is ever linked → empty-list walks NULL immediately, non-empty lists walk
  past the last element to NULL → `SLIST_NEXT(NULL, links)` → fatal trap.

**VERIFIED REPRODUCED (impact: panic, confidence: certain).** Both variants
panicked exactly at the cited lines (DWARF-mapped trap offsets +0x1a3 →
:290 and +0x1f3 → :300), with the verbatim `make_dev failed` /
`readq malloc failed` kprintfs immediately preceding. The fix (delete both
bogus SLIST_REMOVEs) was applied in-guest, rebuilt, and re-verified: same
injections now return -1 cleanly, no panic, normal operation unchanged.

**Reachability caveat (material):** the target file is dead code in the
stock build system (not in `sys/conf/files`, not in the module SUBDIR, and
it no longer compiles against current headers — see VERDICT.md). The
verification compiled it into a custom kernel via a shim; the pristine
source sha256 7850d8ae… is attested at boot, and the ONLY textual change
is the never-invoked constructor signature line (asserted exactly-one-line
by the generator).

## Contents

* `VERDICT.md` — full narrative, mechanics, A/B fix validation
* `ngdpoc_shim_prepend.h` / `ngdpoc_append.c` / `gen_ngdpoc.sh` / `df_ngdpoc.c` /
  `ngdpoc_slab.diff` — the verification rig (verbatim interposition)
* `build.sh` — BASELINE / FIX / REGEN build orchestration (nativekernel)
* `run_df2573_panic.sh` — panic driver (variants A and B)
* `run_df2574_leak.sh` — shared-rig leak runner (see DF-2574)
* `run_fix_validation.sh` — fixed-kernel validation runs
* `panic.A.console.txt`, `panic.B.console.txt` — captured panics
* `trapsite.disasm.txt` — DWARF line mapping of both trap PCs
* `run.panic.log`, `run.leak.log`, `run.fix-validation.log` — session logs
* `build.log` (full untrimmed), `env.txt`, `dmesg.txt`
* `fix.diff` — the validated fix

## Quick reproduce

```
./build.sh BASELINE
./run_df2573_panic.sh     # expect: two Fatal trap 12 panics at
                          # ng_device_newhook+0x1a3 / +0x1f3
./build.sh FIX            # push fix.diff to /tmp/fix.d first (see build.sh)
./run_fix_validation.sh   # expect: no panic, ng_mkpeer = -1, guest alive
```