--- a/sys/netgraph/fec/ng_fec.c
+++ b/sys/netgraph/fec/ng_fec.c
@@ in ng_fec_rmnode():
 	b = &priv->fec_bundle;
+	/* Stop the monitor and wait out an in-flight tick BEFORE freeing:
+	 * ng_fec_tick re-arms while IFF_RUNNING and plain callout_stop does
+	 * not wait for a concurrently executing callout. */
+	priv->arpcom.ac_if.if_flags &= ~IFF_RUNNING;
 	ng_fec_stop(&priv->arpcom.ac_if);
+	callout_stop_sync(&priv->fec_timeout);
@@ (plus the get_unit bcopy UB repair from DF-3506 so the module can build)