DF-3277 fix validation run — FIXED kernel #1 (Thu Sep 10 00:48:01 UTC 2026,
bridge_delete_span TAILQ_REMOVE corrected to &sc->sc_spanlist).

Command: ./bond_corrupt   (identical PoC to the baseline panic runs)

Output (tail):
    [+] list order before bonding traffic:    [member order: tap2 tap1 tap0]
    [+] bridge0 flags=0xffffc043 (LINK2=0x4000 UP=0x1 RUN=0x40)
    tap0: ... ether 02:00:00:00:00:10
    tap1: ... ether 02:00:00:00:00:10     # same-MAC bonding set, STP FORWARDING
    tap2: ... ether 02:00:00:00:00:22
    [+] after bcast learn frame:    [rtable: 02:00:00:00:00:55->tap0]
    [+] after ucast learn frame:    [rtable: 02:00:00:00:00:55->tap0]
    [+] bonding traffic injected (INSERT_TAIL fired on cpu0)
    [+] list order after bonding traffic:    [member order: tap2 tap1 tap0]
    [+] rtable after:    [rtable: 02:00:00:00:00:66->tap2 02:00:00:00:00:55->tap0]
    [+] delspan(tap1) probe rc=-1 errno=2 (No such file or directory)
    [+] destroying bridge0 ...
    [-] bridge destroyed cleanly, no visible corruption
    RUN_RC=2

Guest state afterwards: up.

Decisive A/B vs baseline (stock kernel):
- baseline: same chain ended in `panic: bridge_delete_span: not a span
  interface` — the delspan("tap1") probe FOUND the member on the span
  list, proving sc_spanlist.tqh_first had been cross-linked by the
  INSERT_TAIL through the corrupted tqh_last.
- fixed: the probe correctly returns ENOENT (tap1 is not a span port),
  bonding round-robin operates on the correct list, bridge destroy is
  clean, no panic.