Disallow this:
ifconfig bridge0 create
ifconfig bridge0.1 create
ifconfig bridge0 addm bridge0.1
Also disallow this:
ifconfig vlan1 create
ifconfig bridge0 create
ifconfig bridge0 addm vlan1
ifconfig vlan1 vlan 1 vlandev bridge0
Firstly, this panics due to trying to take BRIDGE_LOCK recursively.
Secondly, even if it worked, it could cause packet forwarding loops.