fix_build.log — DF-3486 fix build (module-only; both modules)
==============================================================

    # cd /usr/src && patch -p1 < /tmp/fixB_eiface.diff && patch -p1 < /tmp/fixB_iface.diff
    Patching file sys/netgraph/eiface/ng_eiface.c using Plan A:
      Hunk #1 succeeded at 41.  #2 at 86.  #3 at 312.  #4 at 406.  #5 at 601.
    Patching file sys/netgraph/iface/ng_iface.c using Plan A:
      Hunk #1 succeeded at 65.  #2 at 104.  #3 at 540.  #4 at 676.  #5 at 880.

    # cd sys/netgraph/eiface && make
    cc -O2 ... -Werror -DKLD_MODULE ... -c ng_eiface.c        (clean)
    cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv -r -Wl,-d -o ng_eiface.ko ng_eiface.o

    # cd ../iface && make
    cc -O2 ... -c ng_iface.c                                  (clean)
    cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv -r -Wl,-d -o ng_iface.ko ng_iface.o

    (ng_iface.ko additionally carries the DF-3485 fix — required, since
     without it creation dies in ng_iface_get_unit first; the two defects
     are independent but both block the same lifecycle)

Fix content (fix.diff):
  * ng_eiface.c: ether_ifattach() moved into a short-lived kernel thread
    (ng_eiface_attach_thread); attach_state/down_pending under a spinlock;
    ng_eiface_rmnode() defers the interface-down block when the attach is
    still in flight.
  * ng_iface.c: if_attach()+bpfattach() moved into ng_iface_attach_thread;
    ng_iface_rmnode() no longer calls bpfdetach/if_detach from the netisr
    control path — teardown ownership is transferred atomically
    (PENDING/CANCELLED inline; DONE -> ng_iface_detach_thread; RUNNING ->
    DYING handled by the attach thread itself).