DF-3277 baseline run #3 (stock kernel #0) — full PoC stdout captured on the
serial console (/dev/ttyd0 redirect; the box panics at the end).
Reconstructed verbatim from the serial-console capture at run time.

    [+] pinned to cpu0
    [+] bridge up (link2), waiting for STP forwarding
        t= 0 tap0: state=1 flags=0x17 | tap1: state=1 flags=0x17
        t= 1 tap0: state=2 flags=0x17 | tap1: state=2 flags=0x17
        t= 2 tap0: state=3 flags=0x17 | tap1: state=3 flags=0x37
    [+] tap0 stp state=3 flags=0x17 (3=fwd 5=bonded)
    [+] spanport tap3 added+deleted (list head corrupted)
    [+] list order before bonding traffic:    [member order: tap2 tap1 tap0]
    [+] bridge0 flags=0xffffc043 (LINK2=0x4000 UP=0x1 RUN=0x40)
    tap0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
    	ether 02:00:00:00:00:10
    tap1: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
    	ether 02:00:00:00:00:10
    tap2: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
    	ether 02:00:00:00:00:22
        [bridge0 ipackets=0 opackets=3 ibytes=0 ierrors=0 oerrors=0]
    (bcast learn frame)
        [bridge0 ipackets=0 opackets=3 ibytes=0 ierrors=0 oerrors=0]
    [+] after bcast learn frame:    [rtable: 02:00:00:00:00:55->tap0]
    [+] after ucast learn frame:    [rtable: 02:00:00:00:00:55->tap0]
    [+] bonding traffic injected (INSERT_TAIL fired on cpu0)
    [+] list order after bonding traffic:    [member order: tap2 tap0 tap1]   <-- round-robin fired
    [+] rtable after:    [rtable: 02:00:00:00:00:66->tap2 02:00:00:00:00:55->tap0]
    panic: bridge_delete_span: not a span interface
    cpuid = 0
    Trace beginning at frame 0xfffff8008d1f8a20
    bridge_delete_span() at bridge_delete_span+0x87 0xffffffff82622f37 
    bridge_delete_span() at bridge_delete_span+0x87 0xffffffff82622f37 
    bridge_ioctl_delspan() at bridge_ioctl_delspan+0x58 0xffffffff82622fb8 
    bridge_control_dispatch() at bridge_control_dispatch+0x64 0xffffffff826220e4 
    netmsg_service_loop() at netmsg_service_loop+0xe9 0xffffffff807464a9 
    Debugger("panic")

Notes:
- (ipackets stays 0 because SIOCGIFDATA does not aggregate DFly's
  per-cpu ifnet counters; the rtable/learning/states prove processing.)
- The delspan("tap1") probe at the end found tap1 -- a MEMBER with
  if_bridge == sc -- linked on sc_spanlist: the wrong-list
  TAILQ_REMOVE clobbered sc_iflists[0].tqh_last and the bonding
  INSERT_TAIL wrote the member bif into sc_spanlist.tqh_first.
- Three independent baseline runs panicked with this identical
  signature (see panic.txt for the second run's capture).