panic: trying to free NULL pointer
cpuid = 0
Trace beginning at frame 0xfffff8008d1f8850
_kfree() at _kfree+0x558 0xffffffff806583d8 
_kfree() at _kfree+0x558 0xffffffff806583d8 
ng_iface_constructor() at ng_iface_constructor+0x3a2 0xffffffff82656622 
ng_mkpeer() at ng_mkpeer+0x4c 0xffffffff82618ebc 
ng_generic_msg() at ng_generic_msg+0x415 0xffffffff82619835 
ng_send_msg() at ng_send_msg+0xf1 0xffffffff8261a241 
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db> 

---------------------------------------------------------------------------
Captured live from the serial console (dfbsd-qemu/boot.log) on 2026-09-13,
fresh boot of the stock INVARIANTS kernel #0, trigger:

    # kldload ng_socket ng_iface
    # ngctl mkpeer . iface inet inet

Reproduced first-try, every try (deterministic: ng_iface_units == NULL on
the first-ever ng_iface node creation). The same trace (modulo module load
address) was independently captured during the DF-3482 ng_ppp run and is
re-confirmed here on the current image.

Note: the return address ng_iface_constructor+0x3a2 is the instruction
after the `callq _kfree` at +0x39d inside the *inlined* ng_iface_get_unit()
(see disasm.stock.txt); DWARF maps it to ng_iface.c:295
(kfree(ng_iface_units, M_NETGRAPH)).