Fix DF-3279: bridge_ioctl_addspan() allocates a bridge_ifinfo for the
span bif (if_bridge.c:1823-1828) but bridge_delete_span() freed only
the bif, leaking sizeof(struct bridge_ifinfo) (~120 bytes) of kernel
memory per spanport add/del cycle.  Measured on the guest: +2.28 MB of
devbuf in-use after 20000 cycles.

--- a/sys/net/bridge/if_bridge.c
+++ b/sys/net/bridge/if_bridge.c
@@ -1152,7 +1152,10 @@ bridge_delete_span(struct bridge_softc *sc, struct bridge_iflist *bif)
 	KASSERT(bif->bif_ifp->if_bridge == NULL,
 	    ("%s: not a span interface", __func__));
 
 	TAILQ_REMOVE(&sc->sc_spanlist, bif, bif_next);
+	if (bif->bif_info != NULL)
+		kfree(bif->bif_info, M_DEVBUF);
 	kfree(bif, M_DEVBUF);
 }