DF-3500 facet 2: rmnode -> ng_fec_stop -> unbalanced ifnet_deserialize_all
(captured 2026-09-13 23:06 UTC; module had only E1 applied, ng_fec_stop path
was stock; teardown driven from a normal thread via fecdrive "shutdown")

    FECDRIVE: cmd='shutdown'
    panic: assertion "IS_SERIALIZED((s))" failed in lwkt_serialize_exit at /usr/src/sys/kern/lwkt_serialize.c:138
    cpuid = 2
    Trace beginning at frame 0xfffff8011817a658
    lwkt_serialize_exit() at lwkt_serialize_exit+0x7a 0xffffffff8067ca8a
    lwkt_serialize_exit() at lwkt_serialize_exit+0x7a 0xffffffff8067ca8a
    ng_fec_stop() at ng_fec_stop+0x38 0xffffffff8265d1a8
    ng_fec_rmnode() at ng_fec_rmnode+0x1c 0xffffffff8265e55c
    ng_rmnode() at ng_rmnode+0x47 0xffffffff826189f7
    fecdrive_sysctl() at fecdrive_sysctl+0x22b 0xffffffff8266031b
    Debugger("panic")

ng_fec_stop() begins with ifnet_deserialize_all(ifp) (ng_fec.c:549, marked
"XXX") but is called from ng_fec_rmnode (ng_fec.c:1222) without the interface
serializer held -> INVARIANTS panic on every node teardown.

DF-3500 facet 3: delport -> member if_ioctl without serializer
(captured 2026-09-13 23:15 UTC; module had E1+E2, delport path stock; teardown
driven from a normal thread)

    FECDRIVE: cmd='shutdown'
    panic: assertion "IS_SERIALIZED((_arr[_i]))" failed in ifnet_serialize_array_assert at /usr/src/sys/net/if_var.h:864
    cpuid = 5
    Trace beginning at frame 0xfffff80117a5c628
    vtnet_serialize_assert() at vtnet_serialize_assert+0x6c 0xffffffff80a706ac
    vtnet_serialize_assert() at vtnet_serialize_assert+0x6c 0xffffffff80a706ac
    vtnet_stop() at vtnet_stop+0x41 0xffffffff80a6e131
    vtnet_ioctl() at vtnet_ioctl+0x2f8 0xffffffff80a70638
    ng_fec_delport.part.3() at ng_fec_delport.part.3+0xb6 0xffffffff8265e066
    ng_fec_rmnode() at ng_fec_rmnode+0x1c ... (stack truncated in serial log)
    Debugger("panic")

ng_fec_delport calls bifp->if_ioctl(bifp, SIOCSIFFLAGS, NULL, NULL) directly
(ng_fec.c:454-455) without ifnet_serialize_all(bifp) -> the member driver's
serializer assertion fires on every delport/rmnode-with-members.