Errata patches for the kernel's Address Resolution Protocol implementation have been released for OpenBSD 6.3.
ARP replies could be sent on the wrong member of a bridge(4) interface. Binary updates for the amd64, i386, and arm64 platforms are available via the syspatch utility. Source code patches can be found on the errata page: https://www.openbsd.org/errata63.html As this affects the kernel, a reboot will be needed after patching.