[*] bridge bridge0 mac=46:9f:26:52:eb:a7 tap=tap0
[*] injecting 200000 frames dst=46:9f:26:52:eb:a7 via /dev/tap0
[*] done injecting 200000 frames
[*] ran 66 delete/re-add cycles
RACE_DONE
RUN_EXIT=0
--- round 2 ---
[*] injecting 100000 frames dst=46:9f:26:52:eb:a7 via /dev/tap0  (x5)
[*] 204 cycles, injector done
R2_DONE
RC=0
--- guest status: up (no panic) ---

Race not triggered in ~700K frame injections / 270 delete cycles.
Bug is code-confirmed (NULL deref at bridge_input:2739, guarded sibling at :2787).
AC:H (high attack complexity) — per-CPU netisr serialization makes window very narrow.