DF-3276 baseline run (stock kernel #0) — ssh transcript.
The panic hit during/right after setup; ssh output flushed only the
ifconfig state; the panic itself is on the serial console (panic.txt).

    bridge0: flags=c08043<UP,BROADCAST,RUNNING,MULTICAST,BRIDGE,PROXY> metric 0 mtu 1500
    	ether 66:65:84:a5:14:c6
    	inet6 fe80::6465:84ff:fea5:14c6%bridge0 prefixlen 64 tentative scopeid 0x6
    	priority 32768 hellotime 2 fwddelay 15 maxage 20
    	member: tap1 flags=3<LEARNING,DISCOVER>
    	member: tap0 flags=3<LEARNING,DISCOVER>
    	groups: bridge
    === setup done, injecting (span port added inside poc) ===
    <ssh session dies here -- guest panicked>

Serial console (panic.txt):

    tap0: MAC address: 00:bd:e1:b7:01:00
    tap1: MAC address: 00:bd:e2:b7:01:01
    tap2: MAC address: 00:bd:e3:b7:01:02
    bridge0: MAC address: 66:65:84:a5:14:c6
    Sep  9 23:59:05 dfbsd kernel: tap0: promiscuous mode enabled
    Sep  9 23:59:05 dfbsd kernel: tap1: promiscuous mode enabled

    Fatal trap 12: page fault while in kernel mode
    cpuid = 0; lapic id = 0
    fault virtual address	= 0x3b8
    fault code		= supervisor read data, page not present
    instruction pointer	= 0x8:0xffffffff82622d11
    current process		= Idle
    kernel: type 12 trap, code=0
    Stopped at      bridge_handoff+0x11:    movq    0x3b8(%rdi),%rax
    db> 

Trigger note: the spanport BRDGADDS ioctl completed and sc_span became
1; the first packet through the bridge (the bridge's own IPv6 DAD
output on the tentative link-local, via bridge_output() ->
bridge_span(), if_bridge.c:2241/2358) mirrored to the span port and
panicked before the PoC's first injected frame was even reported.