untrusted comment: signature from openbsd 6.3 base secret key
RWRxzbLwAd76ZTdDWtYK+RTF9mz5OdmIwqhpJFLB9pB6i/XNyb4QzdOcpsE5Ld1dvvU0HVe8qR8W80avmiWRm7dh/e3QTbkgewM=

OpenBSD 6.3 errata 003, April 21, 2018:

ARP replies could be sent on the wrong member interface of a bridge(4).

Apply by doing:
   signify -Vep /etc/signify/openbsd-63-base.pub -x 003_arp.patch.sig \
       -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
   KK=`sysctl -n kern.osversion | cut -d# -f1`
   cd /usr/src/sys/arch/`machine`/compile/$KK
   make obj
   make config
   make
   make install

Index: sys/netinet/if_ether.c
===================================================================
RCS file: /cvs/src/sys/netinet/if_ether.c,v
retrieving revision 1.234
retrieving revision 1.234.2.1
diff -u -p -r1.234 -r1.234.2.1
--- sys/netinet/if_ether.c      13 Mar 2018 16:42:22 -0000      1.234
+++ sys/netinet/if_ether.c      17 Apr 2018 18:50:27 -0000      1.234.2.1
@@ -86,7 +86,8 @@ struct rtentry *arplookup(struct in_addr
void in_arpinput(struct ifnet *, struct mbuf *);
void in_revarpinput(struct ifnet *, struct mbuf *);
int arpcache(struct ifnet *, struct ether_arp *, struct rtentry *);
-void arpreply(struct ifnet *, struct mbuf *, struct in_addr *, uint8_t *);
+void arpreply(struct ifnet *, struct mbuf *, struct in_addr *, uint8_t *,
+    unsigned int);

struct niqueue arpinq = NIQUEUE_INITIALIZER(50, NETISR_ARP);

@@ -267,12 +268,16 @@ arprequest(struct ifnet *ifp, u_int32_t
}

void
-arpreply(struct ifnet *ifp, struct mbuf *m, struct in_addr *sip, uint8_t *eaddr)
+arpreply(struct ifnet *ifp, struct mbuf *m, struct in_addr *sip, uint8_t *eaddr,
+    unsigned int rdomain)
{
       struct ether_header *eh;
       struct ether_arp *ea;
       struct sockaddr sa;

+       m_resethdr(m);
+       m->m_pkthdr.ph_rtableid = rdomain;
+
       ea = mtod(m, struct ether_arp *);
       ea->arp_op = htons(ARPOP_REPLY);
       ea->arp_pro = htons(ETHERTYPE_IP); /* let's be sure! */
@@ -574,7 +579,7 @@ in_arpinput(struct ifnet *ifp, struct mb
                               goto out;
                       eaddr = LLADDR(satosdl(rt->rt_gateway));
               }
-               arpreply(ifp, m, &itaddr, eaddr);
+               arpreply(ifp, m, &itaddr, eaddr, rdomain);
               rtfree(rt);
               return;
       }