# DF-0271 PoC — bridge_input NULL deref

## Build
```
cc -o bridge_race bridge_race.c
```

## Run (as root)
```
sh ./run.sh
```
Requires `if_bridge.ko`. Creates bridge0 + tap0, injects frames dst=bridge-MAC
while racing member deletion.

## Expected
Race-condition trigger (AC:H). May panic with NULL deref in bridge_input if
the member is deleted between packet arrival and bridge_lookup_member_if.
The race window is very narrow; multiple runs may be needed. Code path is
confirmed regardless (missing NULL check vs guarded siblings).