diff --git a/sys/netgraph/ng_bridge.c b/sys/netgraph/ng_bridge.c
--- a/sys/netgraph/ng_bridge.c
+++ b/sys/netgraph/ng_bridge.c
@@ -739,7 +739,10 @@
 
 	/* Look up packet's source Ethernet address in hashtable */
 	if ((host = ng_bridge_get(priv, eh->ether_shost)) != NULL) {
-		/* Update time since last heard from this host */
+		/* Update time since last heard from this host.
+		 * This is safe without locking, because it's
+		 * the only operation during shared access.
+		 */
 		host->staleness = 0;
 
 		/* Did host jump to a different link? */