DF-3531 module build (in-guest, root). NOTE: the DF-3514 rehash-only fix is
pre-applied to ng_base.c during the BASELINE measurement so the known module-
build rehash panic (DF-3514) cannot mask the leak; ng_uncallout/ng_callout
stay stock for the baseline. The fix-validation build swaps in fix.diff
(layer 2) plus the DF-3534 ng_tty.c change, on the layer-1 kernel (#1).

--- baseline build (stock behavior under test) ---
$ cd /usr/src/sys/netgraph7/netgraph && make
$ cd ../socket && make
$ cd ../tty    && make
$ kldload /usr/src/sys/netgraph7/netgraph/netgraph.ko
$ kldload /usr/src/sys/netgraph7/socket/ng_socket.ko
$ kldload /usr/src/sys/netgraph7/tty/ng_tty.ko
$ cc -O2 -o ngtty_leak ngtty_leak.c
BUILD_OK (kldstat ids 4/5/6: netgraph.ko ng_socket.ko ng_tty.ko)

--- fix kernel build (layer 1) ---
$ cd /usr/src && patch -p1 < kern_timeout.diff && make nativekernel KERNCONF=X86_64_GENERIC
>>> Kernel build for X86_64_GENERIC completed ... RC=0
$ make installkernel KERNCONF=X86_64_GENERIC
>>> Kernel install for X86_64_GENERIC completed
$ reboot  ->  DragonFly #1: Mon Sep 14 09:24:11 UTC 2026

--- fix module build (layer 2, no oitem hunk) ---
$ (netgraph/socket/tty) make clean && make ; kldload (3 modules)
MODULES_OK ; ng_free_item(item) present in ng_uncallout (objdump reloc
R_X86_64_PLT32 ng_free_item inside the rval>0 gate confirmed)