TL;DR
A network interface change/disconnection, or a cleared (i.e. reset) association.
Apparently, XFAC stands for
X InterF FaceA AssociationC Change
From XFAC (?):
ntpd resets associations when the local network interface (or, really,
IP address) being used for that peer goes away. This means the clock
filter register of 8 samples is cleared, as are all other timekeeping
stats related to the peer. At that time, the "reference ID" or refid
is changed to XFAC to indicate the cause of the cleared (reset)
association. Typically, that XFAC refid is replaced on receipt of the next packet from the server or peer.
A little further down that thread, the same poster also posits that it might also mean:
... Perhaps eXchange interFACe? ...
However, from NTP REFID Specification:
Reference ID (refid): 32-bit code identifying the particular server
or reference clock. The interpretation depends on the value in the
stratum field. For packet stratum 0 (unspecified or invalid), this
is a four-character ASCII [RFC1345] string, called the "kiss code",
used for debugging and monitoring purposes. For stratum 1 (reference
clock), this is a four-octet, left-justified, zero-padded ASCII
string assigned to the reference clock. The authoritative list of
Reference Identifiers is maintained by IANA; however, any string
beginning with the ASCII character "X" is reserved for unregistered
experimentation and development. The identifiers in Figure 12 have
been used as ASCII identifiers:
+------+----------------------------------------------------------+
| ID | Clock Source |
+------+----------------------------------------------------------+
| GOES | Geosynchronous Orbit Environment Satellite |
| GPS | Global Position System |
| GAL | Galileo Positioning System |
| PPS | Generic pulse-per-second |
| IRIG | Inter-Range Instrumentation Group |
| WWVB | LF Radio WWVB Ft. Collins, CO 60 kHz |
| DCF | LF Radio DCF77 Mainflingen, DE 77.5 kHz |
| HBG | LF Radio HBG Prangins, HB 75 kHz |
| MSF | LF Radio MSF Anthorn, UK 60 kHz |
| JJY | LF Radio JJY Fukushima, JP 40 kHz, Saga, JP 60 kHz |
| LORC | MF Radio LORAN C station, 100 kHz |
| TDF | MF Radio Allouis, FR 162 kHz |
| CHU | HF Radio CHU Ottawa, Ontario |
| WWV | HF Radio WWV Ft. Collins, CO |
| WWVH | HF Radio WWVH Kauai, HI |
| NIST | NIST telephone modem |
| ACTS | NIST telephone modem |
| USNO | USNO telephone modem |
| PTB | European telephone modem |
+------+----------------------------------------------------------+
So, the initial X seems to mean that is it experimental:
However, any string
beginning with the ASCII character "X" is reserved for unregistered
experimentation and development.
Nevertheless, the Wikipedia entry for NTP states
The program output may additionally use codes not transmitted in the packet to indicate error, such as XFAC to indicate a network disconnection
