DF-3271 panic traces (all INVARIANTS kernel, netgraph7 modules kldload'ed)
==========================================================================

[occurrence 1] organic, during DF-3270 leak work (groom-node creation), 2026-09-09 ~21:57 UTC
  panic: hashdestroy: hash not empty
  cpuid = 0
  Trace beginning at frame 0xfffff801182cb990
  hashdestroy() at hashdestroy+0x3a 0xffffffff8066555a
  hashdestroy() at hashdestroy+0x3a 0xffffffff8066555a
  ng_make_node_common() at ng_make_node_common+0x21f 0xffffffff82600c9f
  ng_make_node() at ng_make_node+0x3b 0xffffffff82600d4b
  ng_apply_item() at ng_apply_item+0x666 0xffffffff82601fb6
  ngthread() at ngthread+0x18 0xffffffff82603488
  Debugger("panic")

[occurrence 2] bounded repro loop (12x ./df3270_exploit -g 6), session 2, 2026-09-09 ~22:08 UTC
  panic: hashdestroy: hash not empty
  hashdestroy() at hashdestroy+0x3a 0xffffffff8066555a
  hashdestroy() at hashdestroy+0x3a 0xffffffff8066555a
  ng_make_node_common() at ng_make_node_common+0x21f 0xffffffff82600c9f
  ng_make_node() at ng_make_node+0x3b 0xffffffff82600d4b
  ng_apply_item() at ng_apply_item+0x666 0xffffffff82601fb6
  ngthread() at ngthread+0x18 0xffffffff82603488

[occurrence 3] FRESH GUEST (vm.sh reset with-src), stock modules, same loop:
  panic: hashdestroy: hash not empty
  cpuid = 0
  Trace beginning at frame 0xfffff801182d1990
  hashdestroy() at hashdestroy+0x3a 0xffffffff8066555a
  hashdestroy() at hashdestroy+0x3a 0xffffffff8066555a
  ng_make_node_common() at ng_make_node_common+0x21f 0xffffffff82600c9f
  ng_make_node() at ng_make_node+0x3b 0xffffffff82600d4b
  ng_apply_item() at ng_apply_item+0x666 0xffffffff82601fb6
  ngthread() at ngthread+0x18 0xffffffff82603488

[occurrence 4] FRESH GUEST, netgraph.ko REBUILT WITH the ng_name_hmask->ng_ID_hmask
  one-line fix at ng_base.c:996 (note the shifted inlined-frame offset +0x21b
  proving the patched module was active) - panic PERSISTS:
  panic: hashdestroy: hash not empty
  cpuid = 0
  Trace beginning at frame 0xfffff80117ba3990
  hashdestroy() at hashdestroy+0x3a 0xffffffff8066555a
  hashdestroy() at hashdestroy+0x3a 0xffffffff8066555a
  ng_make_node_common() at ng_make_node_common+0x21b 0xffffffff82600c9b
  ng_make_node() at ng_make_node+0x3b 0xffffffff82600d4b
  ng_apply_item() at ng_apply_item+0x666 0xffffffff82601fb6
  ngthread() at ngthread+0x18 0xffffffff82603488

All four: guest dead in DDB, ssh gone, vm.sh status => down.