# DF-3552 evidence pack — v1 ng_sample newhook bookkeeping defects

`sys/netgraph/ng_sample.c` `ng_xxx_newhook()`/`ng_xxx_disconnect()`:
(1) free-slot search loop has no `break` → every `dlciNN` hook fails
ENOBUFS (:221-227); (2) `sizeof` vs `strlen` off-by-one skips the first
digit of the hook name (:210) → `dlci5` = EINVAL, `dlci55` parses as 5;
(3) `channel[chan].dlci` never assigned (:228-232) → dup detection and the
demux search are dead; (4) `debughook` never cleared on disconnect
(:238-241, :460-466) — latent stale pointer, never dereferenced.

## Build / Run

Same `v1demo.c`, `build.sh` and module setup as the DF-3550 pack (one
directory up). Decisive commands:

```
kldload ng_socket ; kldload /root/ngs1/ng_sample.ko
/root/v1demo hooktest dlci55    # expect: ENOBUFS (55) from missing break
/root/v1demo hooktest dlci5     # expect: EINVAL (22) from sizeof off-by-one
```

## Expected

```
CONNECT dlci55: FAILED errno=55 (No buffer space available)
CONNECT dlci5:  FAILED errno=22 (Invalid argument)
```

See `run.log` (from the same decisive session as DF-3550's).