The old behavior was that NULL matched only bridges without known identities; the correct behavior is that NULL should match all bridges (assuming that their addr:port matches).