$ id maxx
uid=1001(maxx) gid=1001(max=1001) groups=1001(maxx)
$ /tmp/iface_con create
iface_con: uid=1001 euid=1001 mode=create
RESULT control-socket errno=1 (Operation not permitted)
RESULT unpriv-gated: ng7 ngc_attach caps_priv_check -> EPERM (root-only trigger)
rc=0
# gate: sys/netgraph7/socket/ng_socket.c:182-185
#   if (caps_priv_check(ai->p_ucred, SYSCAP_RESTRICTEDROOT|__SYSCAP_NULLCRED))
#       error = EPERM;   /* ngc_attach(): AF_NG control socket */
=> trigger is ROOT-ONLY on the stock guest.