Line-accurate confirmation (dead code in-tree: both shipped filters
(sys/net/accf_data/accf_data.c:55-59, accf_http) set accf_create
NULL, so the :2043 block cannot execute without a third-party KLD
defining accf_create - root):
sys/kern/uipc_socket.c:2043-2049 allocates strlen(af_name)+1 and
   strcpy's afap->af_NAME into so_accept_filter_str, but the field
   is consumed as the saved user ARGument: getsockopt
   (:2341-2342) copies it back into afap->af_ARG. FreeBSD stores
   af_arg. accf_create itself still receives the correct af_arg at
   :2051; the round-trip is what breaks.