ng7 ng_hub: two cross-wired hubs plus one entry hook form a config-free forwarding cycle — with the entry hook created last, one injected byte makes the hub's single synchronous NG_FWD_ITEM_HOOK recurse unbounded until the LWKT token array overflows: deterministic kernel panic (DF-3540 class, purest instance; natural hook order instead yields a 10.5k pkt/s packet-multiplication storm from one byte)

Summary

ng_hub_rcvdata forwards every item to all hooks except the arrival one: m_dup copies via NG_SEND_DATA_ONLY and the last hook in LIST_FOREACH order gets the single NG_FWD_ITEM_HOOK. ng_hub registers no newhook method so ng_add_hook accepts arbitrary hook names/counts (LIST_INSERT_HEAD -> iteration = reverse creation order), and neither node nor framework detects cycles. Two cross-wired hubs plus one socket entry hook are an injectable cycle built purely from generic MKPEER/CONNECT/RMHOOK messages - no node-local configuration, unlike DF-3540 (ng_bpf SET_PROGRAM) and DF-3553 (ng_tee direction hooks). When the FWD lands on a cycle hook (entry hook created LAST via RMHOOK+CONNECT) the SAME item recurses with no hop bound on stock - each hop takes the destination node token recursively until the token-array KKASSERT panics. With the natural construction the cycle instead runs on the ASYNC m_dup successors: one injected byte produced 159,022 packets in 15.1s (~10.5k pkt/s). VERIFIED live both modes; DF-3540's framework hop-bound fix validated in-guest (-Werror clean, PoC survives with exactly 16 packets drained then ELOOP, vs stock panic). Residual async storm documented (self-limiting, no panic). Root-gated.