FIXED module (ng_iface.c with fix.diff applied, same stock flags).
The kfree is now dominated by a real NULL test:

 60d:	4d 85 c0             	test   %r8,%r8        # r8 = ng_iface_units
 610:	74 32                	je     644            # NULL -> skip bcopy AND kfree
 612:	48 c1 e2 02          	shl    $0x2,%rdx
 616:	4c 89 c6             	mov    %r8,%rsi       # src = ng_iface_units (non-NULL here)
 619:	48 89 c7             	mov    %rax,%rdi
 623:	e8 00 00 00 00       	callq  628            # memmove (bcopy)
 628:	4c 8b 45 b8          	mov    -0x48(%rbp),%r8
 62c:	48 c7 c6 00 00 00 00 	mov    $0x0,%rsi      # M_NETGRAPH (reloc 0x62f)
 633:	4c 89 c7             	mov    %r8,%rdi
 636:	e8 00 00 00 00       	callq  63b            # _kfree (reloc 0x637) -- only reached when non-NULL

First-call path (units == NULL) now jumps over both the bcopy and the
kfree.  Validated live: with this module the "trying to free NULL pointer"
panic no longer occurs (see panic.after_fix.txt for the next, independent
defect that then becomes reachable).