=== DF-2595 fix validation: rebuild ng_bpf.ko (module-only, KERNBUILDDIR=warm obj) ===
Source: /usr/src/sys/netgraph/bpf/ng_bpf.c with fix.diff applied (totlen==0 guard).
Note: ng_bpf.c Makefile also compiles ../../net/bpf_filter.c into the module.

cc -O2 -pipe -D_KERNEL ... -c ng_bpf.c
cc -O2 -pipe -D_KERNEL ... -c ../../net/bpf_filter.c
cc -Wl,--build-id=sha1 ... -r -o ng_bpf.ko ng_bpf.o bpf_filter.o
MAKE_RC=0
ng_bpf.ko 14104 bytes; patched sha256 d6407950c2e81e92dec12c6bf7231dbfa204eb1d49118f61aa802afa5c4b50bf

Disasm of ng_bpf_rcvdata confirms the guard:
   27: mov  0xb8(%rsi),%r12d      # totlen = m->m_pkthdr.len
   35: test %r12d,%r12d
   38: je   190 <ng_bpf_rcvdata+0x180>   # if totlen==0 -> NG_FREE_DATA + return 0

Reload: kldunload ng_bpf (rc=0, graph torn down) -> kldload ng_bpf (rc=0). No reboot needed.