# STOCK MODULE (boot 1 and 2): any ngctl mkpeer fec ... ->
panic: trying to free NULL pointer
 _kfree() at _kfree+0x558
 _kfree() at _kfree+0x558
 ng_fec_constructor() at ng_fec_constructor+0x3ae
 ng_mkpeer() ...
# instrumented module proved the deleted NULL guard:
FECDBG: ctor enter ng_fec_units=0 len=0 in_use=0
FECDBG: get_unit freeing old units 0        <-- guard taken on NULL (gcc UB)
# HARNESS MODULE (ctor-UB fix only), sysctl-driven verbatim rcvmsg/addport:
$ sysctl kern.fechg.op=create
FECHG: create -> 0 slot 0
$ sysctl kern.fechg.op='oob 8 4141414141414141'
fec0: tried to add iface AAAAAAAAXXXX, which doesn't seem to exist
FECHG: oob(8) -> 2
$ sysctl kern.fechg.op='oob 4 43434343'
fec0: tried to add iface CCCC, which doesn't seem to exist
# arglen=8 data 'AAAAAAAA' (no NUL): printed string is 12 chars - 4 bytes of
# groomed adjacent heap ('XXXX') consumed past the message data => OOB read