run.log — DF-3486 baseline reproduction (stock kernel, stock modules)
=======================================================================

    # kldload ng_socket ng_eiface && ngctl mkpeer . eiface e0 ether
    (no output; ssh session dies - guest panicked)

    $ dfbsd-qemu/vm.sh status
    down
    $ tail dfbsd-qemu/boot.log
    panic: try holding ifnet lock in netisr
    cpuid = 0
    Trace beginning at frame 0xfffff8008d1f87b0
    ifnet_lock() at ifnet_lock+0x62 0xffffffff807304d2
    ifnet_lock() at ifnet_lock+0x62 0xffffffff807304d2
    if_attach() at if_attach+0x4db 0xffffffff80730a8b
    ether_ifattach_bpf() at ether_ifattach_bpf+0x45 0xffffffff80739e35
    ng_eiface_constructor() at ng_eiface_constructor+0xf6 0xffffffff826562f6
    ng_mkpeer() at ng_mkpeer+0x4c 0xffffffff82618ebc
    Debugger("panic")

Status: reproduced / impact=panic / deterministic (every eiface creation).

Cross-check via ng_iface (panic.iface_path.txt): with DF-3485 alone fixed,
ng_iface creation panics identically at ng_iface.c:605 — both v1
interface-creating constructors violate the same if_attach() context
requirement, and stock ng_iface_rmnode's if_detach() (ng_iface.c:801) is a
further latent instance.