DF-3523 requires BOTH layers (each alone measured insufficient in-guest):

(1) sys/kern/kern_timeout.c — restore the callout_stop(9) contract so an
    inline-completed armed stop reports PREVENTED (rval > 0).  This is the
    already-validated DF-3521 fix, included here as kern_timeout.diff
    (apply first).  Without it, ng_uncallout's cleanup is not even
    reached on this kernel (layer 1).

(2) sys/netgraph7/netgraph/ng_base.c — ng_uncallout() must ACTUALLY free
    the callout-argument item.  In netgraph7 NG_FREE_ITEM() is a
    flag-only macro (netgraph.h:817-820: KKASSERT + set NGQF_FREE;
    nothing consumes the flag), so even with the return contract fixed
    the item, its node reference and its hook reference leak on every
    successful armed-cancel (layer 2 — measured: kernel #1 alone still
    leaked 5.76K allocs / 830 KB per 30k cycles).

--- a/sys/netgraph7/netgraph/ng_base.c
+++ b/sys/netgraph7/netgraph/ng_base.c
@@ -3288,7 +3288,8 @@ ng_uncallout(struct callout *c, node_p node)
 		 * We successfully removed it from the queue before it ran
 		 * So now we need to unreference everything that was
 		 * given extra references. (NG_FREE_ITEM does this).
 		 */
 		NG_FREE_ITEM(item);
+		ng_free_item(item);	/* NG_FREE_ITEM is flag-only in ng7 */
 	}
 	callout_set_arg(c, NULL);
 
 	return (rval);