I tracked down the function responsible for changing the MAC header. It is skb_vlan_untag() called from __allowed_ingress() in net/bridge/br_vlan.c. Before skb_vlan_untag() is called, the MAC headers are perfect and afterward they are altered as previously described. I'll continue digging into that function, but if any of you have insight into what skb_vlan_untag() does and why it might alter the MAC header the way it does in this special case, I would appreciate the help.
Thanks, Brandon -- CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain proprietary, confidential or privileged information or otherwise be protected by law. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please notify the sender and destroy all copies and the original message.