$ id maxx
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
$ ngctl mkpeer . iface inet inet
ngctl: can't create node: Operation not permitted
rc=71
$ ngctl list
ngctl: can't create node: Operation not permitted
rc=71

Reachability gate: sys/netgraph/socket/ng_socket.c:172-176
  if (caps_priv_check(ai->p_ucred,
                      SYSCAP_RESTRICTEDROOT | __SYSCAP_NULLCRED) != 0) {
          error = EPERM;      /* ngc_attach(): AF_NETGRAPH control socket */
  }
=> the DF-3485 trigger (and every ngctl node-creation path) is ROOT-ONLY.
No unprivileged reachability was found for either DF-3485 or DF-3486.