DF-3276 fix validation run — FIXED kernel #1 (Thu Sep 10 00:48:01 UTC 2026,
sys/net/bridge/if_bridge.c patched: bridge_span mirrors via
bridge_handoff(sc, dst_if, mc, 0); NULL guard in bridge_enqueue_handler).

Command: sh run.sh   (bridge0 + tap0/tap1 members + tap2 span port, then
span_panic injects 8 ARP broadcast frames into tap0)

Output:
    bridge0: flags=c08043<UP,BROADCAST,RUNNING,MULTICAST,BRIDGE,PROXY> ...
    member: tap1 flags=3<LEARNING,DISCOVER>
    member: tap0 flags=3<LEARNING,DISCOVER>
    === setup done, injecting (span port added inside poc) ===
    [+] tap2 is now a span port of bridge0 (if_bridge == NULL)
    [+] injected frame 0 into tap0
    [+] injected frame 1 into tap0
    [+] injected frame 2 into tap0
    [+] injected frame 3 into tap0
    [+] injected frame 4 into tap0
    [+] injected frame 5 into tap0
    [+] injected frame 6 into tap0
    [+] injected frame 7 into tap0
    [-] still alive -- no panic observed
    RUN_RC=2

Guest state afterwards: up (`vm.sh status` = up; subsequent commands ran).

BASELINE (same PoC, stock kernel #0): panic "Fatal trap 12 ... fault
virtual address = 0x3b8 / Stopped at bridge_handoff+0x11: movq
0x3b8(%rdi),%rax" before the first frame was reported — see panic.txt.