run.log — DF-3485 baseline reproduction (stock kernel, stock modules)
=======================================================================

    # kldload ng_socket ng_iface && ngctl mkpeer . iface inet inet
    (no output; ssh session dies - guest panicked)

    $ dfbsd-qemu/vm.sh status
    down
    $ tail dfbsd-qemu/boot.log
    panic: trying to free NULL pointer
    cpuid = 0
    Trace beginning at frame 0xfffff8008d1f8850
    _kfree() at _kfree+0x558 0xffffffff806583d8
    _kfree() at _kfree+0x558 0xffffffff806583d8
    ng_iface_constructor() at ng_iface_constructor+0x3a2 0xffffffff82656622
    ng_mkpeer() at ng_mkpeer+0x4c 0xffffffff82618ebc
    ng_generic_msg() at ng_generic_msg+0x415 0xffffffff82619835
    ng_send_msg() at ng_send_msg+0xf1 0xffffffff8261a241
    Debugger("panic")
    CPU0 stopping CPUs: 0x0000003e
     stopped
    Stopped at Debugger+0x7c: movb $0,0xbdaf09(%rip)
    db>

Status: reproduced / impact=panic / deterministic (first node creation).

Independent confirmation: a control run during the DF-3482 ng_ppp
verification produced the identical trace (findings/poc/DF-3482/
panic.iface_constructor.txt).