# fixed-module rebuild (guest session, captured verbatim):
$ cd /usr/src && patch -p1 --batch < fix_df3526_only.diff
Hmm...  Looks like a unified diff to me...
Patching file sys/netgraph7/iface/ng_iface.c using Plan A...
Hunk #1 succeeded at 294 with fuzz 1 (offset 1 line).
done
$ cd sys/netgraph7/iface && make
cc -O2 ... -c ng_iface.c
cc -Wl,--build-id=sha1 -nostdlib ... -r -o ng_iface.ko ng_iface.o
FIXED_BUILT
# verify guard restored:
$ objdump -d ng_iface.ko | sed -n ...   (disasm.fix26.txt)
 d5f: test  %r14d,%r14d      <- if (units_len > 0)  [bcopy guard]
 d62: jg    e02 ...
 d86: test  %r10,%r10        <- if (ng_iface_units != NULL)  [kfree guard]
 d89: je    daa ...
 d9d: callq ...              <- kfree