diff --git a/tests/sys/net/Makefile b/tests/sys/net/Makefile
index 3941a502a3a6..40b3a5e5fff6 100644
--- a/tests/sys/net/Makefile
+++ b/tests/sys/net/Makefile
@@ -1,28 +1,33 @@
 # $FreeBSD$
 
-.include <bsd.own.mk>
+PACKAGE=	tests
 
 TESTSDIR=	${TESTSBASE}/sys/net
 BINDIR=		${TESTSDIR}
 
 ATF_TESTS_C+=	if_epair
 ATF_TESTS_SH+=	if_bridge_test
 TEST_METADATA.if_bridge_test+=	required_programs="python"
 ATF_TESTS_SH+=	if_clone_test
 ATF_TESTS_SH+=	if_lagg_test
 ATF_TESTS_SH+=	if_tun_test
 ATF_TESTS_SH+=	if_vlan
 
 TESTS_SUBDIRS+=	routing
 
 # The tests are written to be run in parallel, but doing so leads to random
 # panics.  I think it's because the kernel's list of interfaces isn't properly
 # locked.
 TEST_METADATA+=	is_exclusive=true
 
+${PACKAGE}FILES+=	\
+		stp.py
+
+${PACKAGE}FILESMODE_stp.py=		0555
+
 MAN=
 PROGS+=		randsleep
 
 CFLAGS+=        -I${.CURDIR:H:H}
 
 .include <bsd.test.mk>
diff --git a/tests/sys/net/if_bridge_test.sh b/tests/sys/net/if_bridge_test.sh
index 1f10fe325a2c..4703efed46b8 100755
--- a/tests/sys/net/if_bridge_test.sh
+++ b/tests/sys/net/if_bridge_test.sh
@@ -1,421 +1,466 @@
 # $FreeBSD$
 #
 # SPDX-License-Identifier: BSD-2-Clause-FreeBSD
 #
 # Copyright (c) 2020 The FreeBSD Foundation
 #
 # This software was developed by Kristof Provost under sponsorship
 # from the FreeBSD Foundation.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
 # are met:
 # 1. Redistributions of source code must retain the above copyright
 #    notice, this list of conditions and the following disclaimer.
 # 2. Redistributions in binary form must reproduce the above copyright
 #    notice, this list of conditions and the following disclaimer in the
 #    documentation and/or other materials provided with the distribution.
 #
 # THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 # IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 # ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
 # FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 # DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 # OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 # HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 # LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 # OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 # SUCH DAMAGE.
 
 . $(atf_get_srcdir)/../common/vnet.subr
 
 atf_test_case "bridge_transmit_ipv4_unicast" "cleanup"
 bridge_transmit_ipv4_unicast_head()
 {
 	atf_set descr 'bridge_transmit_ipv4_unicast bridging test'
 	atf_set require.user root
 }
 
 bridge_transmit_ipv4_unicast_body()
 {
 	vnet_init
 
 	epair_alcatraz=$(vnet_mkepair)
 	epair_singsing=$(vnet_mkepair)
 
 	vnet_mkjail alcatraz ${epair_alcatraz}b
 	vnet_mkjail singsing ${epair_singsing}b
 
 	jexec alcatraz ifconfig ${epair_alcatraz}b 192.0.2.1/24 up
 	jexec singsing ifconfig ${epair_singsing}b 192.0.2.2/24 up
 
 	bridge=$(vnet_mkbridge)
 
 	ifconfig ${bridge} up
 	ifconfig ${epair_alcatraz}a up
 	ifconfig ${epair_singsing}a up
 	ifconfig ${bridge} addm ${epair_alcatraz}a
 	ifconfig ${bridge} addm ${epair_singsing}a
 
 	atf_check -s exit:0 -o ignore jexec alcatraz ping -c 3 -t 1 192.0.2.2
 	atf_check -s exit:0 -o ignore jexec singsing ping -c 3 -t 1 192.0.2.1
 }
 
 bridge_transmit_ipv4_unicast_cleanup()
 {
 	vnet_cleanup
 }
 
 atf_test_case "stp" "cleanup"
 stp_head()
 {
 	atf_set descr 'Spanning tree test'
 	atf_set require.user root
 }
 
 stp_body()
 {
 	vnet_init
 
 	epair_one=$(vnet_mkepair)
 	epair_two=$(vnet_mkepair)
 	bridge_a=$(vnet_mkbridge)
 	bridge_b=$(vnet_mkbridge)
 
 	vnet_mkjail a ${bridge_a} ${epair_one}a ${epair_two}a
 	vnet_mkjail b ${bridge_b} ${epair_one}b ${epair_two}b
 
 	jexec a ifconfig ${epair_one}a up
 	jexec a ifconfig ${epair_two}a up
 	jexec a ifconfig ${bridge_a} addm ${epair_one}a
 	jexec a ifconfig ${bridge_a} addm ${epair_two}a
 
 	jexec b ifconfig ${epair_one}b up
 	jexec b ifconfig ${epair_two}b up
 	jexec b ifconfig ${bridge_b} addm ${epair_one}b
 	jexec b ifconfig ${bridge_b} addm ${epair_two}b
 
 	jexec a ifconfig ${bridge_a} 192.0.2.1/24
 
 	# Enable spanning tree
 	jexec a ifconfig ${bridge_a} stp ${epair_one}a
 	jexec a ifconfig ${bridge_a} stp ${epair_two}a
 	jexec b ifconfig ${bridge_b} stp ${epair_one}b
 	jexec b ifconfig ${bridge_b} stp ${epair_two}b
 
 	jexec b ifconfig ${bridge_b} up
 	jexec a ifconfig ${bridge_a} up
 
 	# Give STP time to do its thing
 	sleep 5
 
 	a_discard=$(jexec a ifconfig ${bridge_a} | grep discarding)
 	b_discard=$(jexec b ifconfig ${bridge_b} | grep discarding)
 
 	if [ -z "${a_discard}" ] && [ -z "${b_discard}" ]
 	then
 		atf_fail "STP failed to detect bridging loop"
 	fi
 
 	# We must also have at least some forwarding interfaces
 	a_forwarding=$(jexec a ifconfig ${bridge_a} | grep forwarding)
 	b_forwarding=$(jexec b ifconfig ${bridge_b} | grep forwarding)
 
 	if [ -z "${a_forwarding}" ] && [ -z "${b_forwarding}" ]
 	then
 		atf_fail "STP failed to detect bridging loop"
 	fi
 }
 
 stp_cleanup()
 {
 	vnet_cleanup
 }
 
 atf_test_case "stp_vlan" "cleanup"
 stp_vlan_head()
 {
 	atf_set descr 'Spanning tree on VLAN test'
 	atf_set require.user root
 }
 
 stp_vlan_body()
 {
 	vnet_init
 
 	epair_one=$(vnet_mkepair)
 	epair_two=$(vnet_mkepair)
 	bridge_a=$(vnet_mkbridge)
 	bridge_b=$(vnet_mkbridge)
 
 	vnet_mkjail a ${bridge_a} ${epair_one}a ${epair_two}a
 	vnet_mkjail b ${bridge_b} ${epair_one}b ${epair_two}b
 
 	jexec a ifconfig ${epair_one}a up
 	jexec a ifconfig ${epair_two}a up
 	vlan_a_one=$(jexec a ifconfig vlan create vlandev ${epair_one}a vlan 42)
 	vlan_a_two=$(jexec a ifconfig vlan create vlandev ${epair_two}a vlan 42)
 	jexec a ifconfig ${vlan_a_one} up
 	jexec a ifconfig ${vlan_a_two} up
 	jexec a ifconfig ${bridge_a} addm ${vlan_a_one}
 	jexec a ifconfig ${bridge_a} addm ${vlan_a_two}
 
 	jexec b ifconfig ${epair_one}b up
 	jexec b ifconfig ${epair_two}b up
 	vlan_b_one=$(jexec b ifconfig vlan create vlandev ${epair_one}b vlan 42)
 	vlan_b_two=$(jexec b ifconfig vlan create vlandev ${epair_two}b vlan 42)
 	jexec b ifconfig ${vlan_b_one} up
 	jexec b ifconfig ${vlan_b_two} up
 	jexec b ifconfig ${bridge_b} addm ${vlan_b_one}
 	jexec b ifconfig ${bridge_b} addm ${vlan_b_two}
 
 	jexec a ifconfig ${bridge_a} 192.0.2.1/24
 
 	# Enable spanning tree
 	jexec a ifconfig ${bridge_a} stp ${vlan_a_one}
 	jexec a ifconfig ${bridge_a} stp ${vlan_a_two}
 	jexec b ifconfig ${bridge_b} stp ${vlan_b_one}
 	jexec b ifconfig ${bridge_b} stp ${vlan_b_two}
 
 	jexec b ifconfig ${bridge_b} up
 	jexec a ifconfig ${bridge_a} up
 
 	# Give STP time to do its thing
 	sleep 5
 
 	a_discard=$(jexec a ifconfig ${bridge_a} | grep discarding)
 	b_discard=$(jexec b ifconfig ${bridge_b} | grep discarding)
 
 	if [ -z "${a_discard}" ] && [ -z "${b_discard}" ]
 	then
 		atf_fail "STP failed to detect bridging loop"
 	fi
 
 	# We must also have at least some forwarding interfaces
 	a_forwarding=$(jexec a ifconfig ${bridge_a} | grep forwarding)
 	b_forwarding=$(jexec b ifconfig ${bridge_b} | grep forwarding)
 
 	if [ -z "${a_forwarding}" ] && [ -z "${b_forwarding}" ]
 	then
 		atf_fail "STP failed to detect bridging loop"
 	fi
 }
 
 stp_vlan_cleanup()
 {
 	vnet_cleanup
 }
 
 atf_test_case "static" "cleanup"
 static_head()
 {
 	atf_set descr 'Bridge static address test'
 	atf_set require.user root
 }
 
 static_body()
 {
 	vnet_init
 
 	epair=$(vnet_mkepair)
 	bridge=$(vnet_mkbridge)
 
 	vnet_mkjail one ${bridge} ${epair}a
 
 	ifconfig ${epair}b up
 
 	jexec one ifconfig ${bridge} up
 	jexec one ifconfig ${epair}a up
 	jexec one ifconfig ${bridge} addm ${epair}a
 
 	# Wrong interface
 	atf_check -s exit:1 -o ignore -e ignore \
 	    jexec one ifconfig ${bridge} static ${epair}b 00:01:02:03:04:05
 
 	# Bad address format
 	atf_check -s exit:1 -o ignore -e ignore \
 	    jexec one ifconfig ${bridge} static ${epair}a 00:01:02:03:04
 
 	# Correct add
 	atf_check -s exit:0 -o ignore \
 	    jexec one ifconfig ${bridge} static ${epair}a 00:01:02:03:04:05
 
 	# List addresses
 	atf_check -s exit:0 -o ignore \
 	    jexec one ifconfig ${bridge} addr
 
 	# Delete with bad address format
 	atf_check -s exit:1 -o ignore -e ignore \
 	    jexec one ifconfig ${bridge} deladdr 00:01:02:03:04
 
 	# Delete with unlisted address
 	atf_check -s exit:1 -o ignore -e ignore \
 	    jexec one ifconfig ${bridge} deladdr 00:01:02:03:04:06
 
 	# Correct delete
 	atf_check -s exit:0 -o ignore \
 	    jexec one ifconfig ${bridge} deladdr 00:01:02:03:04:05
 }
 
 static_cleanup()
 {
 	vnet_cleanup
 }
 
 atf_test_case "span" "cleanup"
 span_head()
 {
 	atf_set descr 'Bridge span test'
 	atf_set require.user root
 }
 
 span_body()
 {
 	set -x
 	vnet_init
 
 	epair=$(vnet_mkepair)
 	epair_span=$(vnet_mkepair)
 	bridge=$(vnet_mkbridge)
 
 	vnet_mkjail one ${bridge} ${epair}a ${epair_span}a
 
 	ifconfig ${epair}b up
 	ifconfig ${epair_span}b up
 
 	jexec one ifconfig ${bridge} up
 	jexec one ifconfig ${epair}a up
 	jexec one ifconfig ${epair_span}a up
 	jexec one ifconfig ${bridge} addm ${epair}a
 
 	jexec one ifconfig ${bridge} span ${epair_span}a
 	jexec one ifconfig ${bridge} 192.0.2.1/24
 
 	# Send some traffic through the span
 	jexec one ping -c 1 -t 1 192.0.2.2
 
 	# Check that we see the traffic on the span interface
 	atf_check -s exit:0 \
 		$(atf_get_srcdir)/../netpfil/common/pft_ping.py \
 		--sendif ${epair}b \
 		--to 192.0.2.2 \
 		--recvif ${epair_span}b
 
 	jexec one ifconfig ${bridge} -span ${epair_span}a
 
 	# And no more traffic after we remove the span
 	atf_check -s exit:1 \
 		$(atf_get_srcdir)/../netpfil/common/pft_ping.py \
 		--sendif ${epair}b \
 		--to 192.0.2.2 \
 		--recvif ${epair_span}b
 }
 
 span_cleanup()
 {
 	vnet_cleanup
 }
 
 atf_test_case "delete_with_members" "cleanup"
 delete_with_members_head()
 {
 	atf_set descr 'Delete a bridge which still has member interfaces'
 	atf_set require.user root
 }
 
 delete_with_members_body()
 {
 	vnet_init
 
 	bridge=$(vnet_mkbridge)
 	epair=$(vnet_mkepair)
 
 	ifconfig ${bridge} 192.0.2.1/24 up
 	ifconfig ${epair}a up
 	ifconfig ${bridge} addm ${epair}a
 
 	ifconfig ${bridge} destroy
 }
 
 delete_with_members_cleanup()
 {
 	vnet_cleanup
 }
 
 atf_test_case "mac_conflict" "cleanup"
 mac_conflict_head()
 {
 	atf_set descr 'Ensure that bridges in different jails get different mac addresses'
 	atf_set require.user root
 }
 
 mac_conflict_body()
 {
 	vnet_init
 
 	epair=$(vnet_mkepair)
 
 	# Ensure the bridge module is loaded so jails can use it.
 	tmpbridge=$(vnet_mkbridge)
 
 	vnet_mkjail bridge_mac_conflict_one ${epair}a
 	vnet_mkjail bridge_mac_conflict_two ${epair}b
 
 	jexec bridge_mac_conflict_one ifconfig bridge create
 	jexec bridge_mac_conflict_one ifconfig bridge0 192.0.2.1/24 up \
 	    addm ${epair}a
 	jexec bridge_mac_conflict_one ifconfig ${epair}a up
 
 	jexec bridge_mac_conflict_two ifconfig bridge create
 	jexec bridge_mac_conflict_two ifconfig bridge0 192.0.2.2/24 up \
 	    addm ${epair}b
 	jexec bridge_mac_conflict_two ifconfig ${epair}b up
 
 	atf_check -s exit:0 -o ignore \
 	    jexec bridge_mac_conflict_one ping -c 3 192.0.2.2
 }
 
 mac_conflict_cleanup()
 {
 	vnet_cleanup
 }
 
 atf_test_case "inherit_mac" "cleanup"
 inherit_mac_head()
 {
 	atf_set descr 'Bridge inherit_mac test, #216510'
 	atf_set require.user root
 }
 
 inherit_mac_body()
 {
 	vnet_init
 
 	bridge=$(vnet_mkbridge)
 	epair=$(vnet_mkepair)
 	vnet_mkjail one ${bridge} ${epair}a
 
 	jexec one sysctl net.link.bridge.inherit_mac=1
 
 	# Attempt to provoke the panic described in #216510
 	jexec one ifconfig ${bridge} 192.0.0.1/24 up
 	jexec one ifconfig ${bridge} addm ${epair}a
 }
 
 inherit_mac_cleanup()
 {
 	vnet_cleanup
 }
 
+atf_test_case "stp_validation" "cleanup"
+stp_validation_head()
+{
+	atf_set descr 'Check STP validation'
+	atf_set require.user root
+	atf_set require.progs scapy
+}
+
+stp_validation_body()
+{
+	vnet_init
+
+	epair_one=$(vnet_mkepair)
+	epair_two=$(vnet_mkepair)
+	bridge=$(vnet_mkbridge)
+
+	ifconfig ${bridge} up
+	ifconfig ${bridge} addm ${epair_one}a addm ${epair_two}a
+	ifconfig ${bridge} stp ${epair_one}a stp ${epair_two}a
+
+	ifconfig ${epair_one}a up
+	ifconfig ${epair_one}b up
+	ifconfig ${epair_two}a up
+	ifconfig ${epair_two}b up
+
+	# Wait until the interfaces are no longer discarding
+	while ifconfig ${bridge} | grep 'state discarding' >/dev/null
+	do
+		sleep 1
+	done
+
+	# Now inject invalid STP BPDUs on epair_one and see if they're repeated
+	# on epair_two
+	atf_check -s exit:0 \
+	    $(atf_get_srcdir)/stp.py \
+	    --sendif ${epair_one}b \
+	    --recvif ${epair_two}b
+}
+
+stp_validation_cleanup()
+{
+	vnet_cleanup
+}
+
 atf_init_test_cases()
 {
 	atf_add_test_case "bridge_transmit_ipv4_unicast"
 	atf_add_test_case "stp"
 	atf_add_test_case "stp_vlan"
 	atf_add_test_case "static"
 	atf_add_test_case "span"
 	atf_add_test_case "inherit_mac"
 	atf_add_test_case "delete_with_members"
 	atf_add_test_case "mac_conflict"
+	atf_add_test_case "stp_validation"
 }
diff --git a/tests/sys/net/stp.py b/tests/sys/net/stp.py
new file mode 100644
index 000000000000..4c4c0af4c728
--- /dev/null
+++ b/tests/sys/net/stp.py
@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: BSD-2-Clause
+#
+# Copyright (c) 2021 Kristof Provost <kp@FreeBSD.org>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+#
+
+import argparse
+import scapy.all as sp
+import sys
+import os
+curdir = os.path.dirname(os.path.realpath(__file__))
+netpfil_common = curdir + "/../netpfil/common"
+sys.path.append(netpfil_common)
+from sniffer import Sniffer
+
+def check_stp(args, packet):
+	stp = packet.getlayer(sp.STP)
+	if stp is None:
+		return False
+
+	if stp.rootmac != "00:0c:29:01:01:01":
+		return False
+
+	# Ensure we don't get confused by valid STP packets generated by if_bridge
+	if (stp.maxage >= 6 and stp.maxage <= 40) and \
+	    (stp.hellotime >= 1 and stp.hellotime <= 2) and \
+	    (stp.fwddelay >= 4 and stp.fwddelay <= 30):
+		return False
+
+	print("This packet should have been dropped")
+	print(packet.show())
+	return True
+
+def invalid_stp(send_if):
+	llc = sp.Ether(src="00:0c:29:0b:91:0a", dst="01:80:C2:00:00:00") \
+	    / sp.LLC()
+
+	# Bad maxage
+	stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \
+	        bridgeid=32768, bridgemac="00:0c:29:01:01:01", \
+	        portid=0x8007, maxage=41, hellotime=2, fwddelay=30)
+	sp.sendp(stp, iface=send_if, verbose=False)
+	stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \
+	        bridgeid=32768, bridgemac="00:0c:29:01:01:01", \
+	        portid=0x8007, maxage=5, hellotime=2, fwddelay=30)
+	sp.sendp(stp, iface=send_if, verbose=False)
+
+	# Bad hellotime
+	stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \
+	        bridgeid=32768, bridgemac="00:0c:29:01:01:01", \
+	        portid=0x8007, maxage=40, hellotime=3, fwddelay=30)
+	sp.sendp(stp, iface=send_if, verbose=False)
+	stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \
+	        bridgeid=32768, bridgemac="00:0c:29:01:01:01", \
+	        portid=0x8007, maxage=40, hellotime=1, fwddelay=30)
+	sp.sendp(stp, iface=send_if, verbose=False)
+
+	# Bad fwddelay
+	stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \
+	        bridgeid=32768, bridgemac="00:0c:29:01:01:01", \
+	        portid=0x8007, maxage=40, hellotime=2, fwddelay=31)
+	sp.sendp(stp, iface=send_if, verbose=False)
+	stp = llc / sp.STP(proto=0, rootid=32768, rootmac="00:0c:29:01:01:01", \
+	        bridgeid=32768, bridgemac="00:0c:29:01:01:01", \
+	        portid=0x8007, maxage=40, hellotime=2, fwddelay=3)
+	sp.sendp(stp, iface=send_if, verbose=False)
+
+def main():
+	parser = argparse.ArgumentParser("stp.py",
+		description="STP test tool")
+	parser.add_argument('--sendif', nargs=1,
+		required=True,
+		help='The interface through which the packet(s) will be sent')
+	parser.add_argument('--recvif', nargs=1,
+		help='The interface on which to expect the ICMP echo request')
+
+	args = parser.parse_args()
+
+	sniffer = Sniffer(args, check_stp)
+
+	invalid_stp(args.sendif[0])
+
+	sniffer.join()
+
+	# The 'correct' packet is a corrupt STP packet, so it shouldn't turn up.
+	if sniffer.foundCorrectPacket:
+		sys.exit(1)
+
+if __name__ == '__main__':
+	main()