Wang Liang [off-list ref] wrote:

When send a broadcast packet to a tap device, which was added to a bridge,
br_nf_local_in() is called to confirm the conntrack. If another conntrack
with the same hash value is added to the hash table, which can be
triggered by a normal packet to a non-bridge device, the below warning
may happen.

I placed this in nf.git:testing.

In case netdev maintainers want to take it directly:

Acked-by: Florian Westphal <fw@strlen.de>