panic: try holding ifnet lock in netisr
cpuid = 0
Trace beginning at frame 0xfffff8008d1f87e0
ifnet_lock() at ifnet_lock+0x62 0xffffffff807304d2 
ifnet_lock() at ifnet_lock+0x62 0xffffffff807304d2 
if_attach() at if_attach+0x4db 0xffffffff80730a8b 
ng_iface_constructor() at ng_iface_constructor+0x22d 0xffffffff8265653d 
ng_mkpeer() at ng_mkpeer+0x4c 0xffffffff82618ebc 
ng_generic_msg() at ng_generic_msg+0x415 0xffffffff82619835 
Debugger("panic")

---------------------------------------------------------------------------
With ONLY the DF-3485 fix applied (fix.diff), the trigger no longer panics
with "trying to free NULL pointer": the kfree(NULL) call is gone from the
machine code (disasm.fixed.txt). Creation now proceeds past ng_iface_get_unit()
and dies later at the if_attach() call (ng_iface.c:605) with the *different*
panic documented as DF-3486 ("try holding ifnet lock in netisr"). This
signature change is the direct validation that the DF-3485 defect was
eliminated. Applying the DF-3486 fix as well makes node creation succeed
(see findings/poc/DF-3486/fix_run.log).