Captured live from the serial console during DF-3482 verification
(2026-09-13, fresh `vm.sh reset with-src` boot, stock INVARIANTS kernel #0):

    $ kldload ng_socket.ko ng_ppp.ko ng_ksocket.ko ng_eiface.ko
    $ ngctl mkpeer . eiface e0 ether

    panic (guest dies, vm.sh status -> down):

    ng_eiface_constructor() at ng_eiface_constructor+0xf6 0xffffffff8268d2f6
    ng_mkpeer() at ng_mkpeer+0x4 0xffffffff82618ebc
    Debugger("panic")

    CPU0 stopping CPUs: 0x0000003e
     stopped
    Stopped at      Debugger+0x7c:  movb   $0,0xbdaf09(%rip)
    db>

(The full panic banner scrolled past the retained window; the identical
iface-variant panic in panic.iface_constructor.txt shows the message:
 "panic: trying to free NULL pointer", same _kfree frames, from
 ng_iface_constructor+0x3a2.  The eiface constructor shares the same
 hand-kmalloc'd-ifnet + if_attach pattern.)

Effect: ng_eiface node creation is crash-on-sight for a root control-socket
user on this stock kernel; this blocked the ng_iface/ng_eiface-output race
topologies for DF-3482 and DF-3481 (see those VERDICT.md files).