I identified a likely root cause: my earlier helper used generic nla_* building semantics, while this path needs strict rtnetlink rtattr layout. I’m rewriting net_if, tc_qdisc, and tc_class to use a proven rtattr message builder pattern so heap grooming allocations happen exactly as intended.