If changing the algorithm at runtime isn't handled fully and the hw
AFAIU gets out of sync (i.e. static entries get lost from hw, but
retained in the linux bridge), maybe it would make sense to reject
changing it while e.g. a bridge exist?

Does a bridge actually make a difference?

 * @DSA_CMD_FORWARD: This tag is used on all bulk traffic passing
 *     through the switch tree, including the flows that are directed
 *     towards the CPU. Its device/port tuple encodes the original
 *     source port on which the packet ingressed. It can also be used
 *     on transmit by the CPU to defer the forwarding decision to the
 *     hardware, based on the current config of PVT/VTU/ATU
 *     etc. Source address learning takes places if enabled on the
 *     receiving DSA/CPU port.

It seems to me, a port not in a bridge will still use the ATU. And you
can add multicast entries to the ATU without being in a bridge.

If you want to make it conditional, it probably needs to be all user
ports are admin down.

      Andrew