$ id maxx
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
$ ngctl mkpeer . eiface e0 ether
ngctl: can't create node: Operation not permitted
rc=71
$ ngctl list
ngctl: can't create node: Operation not permitted
rc=71

Reachability gate: sys/netgraph/socket/ng_socket.c:172-176
  if (caps_priv_check(ai->p_ucred,
                      SYSCAP_RESTRICTEDROOT | __SYSCAP_NULLCRED) != 0)
          error = EPERM;      /* ngc_attach(): AF_NETGRAPH control socket */
=> DF-3486 trigger is ROOT-ONLY, like DF-3485.