When managing a device after it is realized, we previously always set the NOW_MANAGED reason, that makes the device fully-managed.
This works based on the assumption that initially an external device has unmanaged flag EXTERNAL_DOWN set, and therefore the device stays unmanaged during realization.
It is possible that an external device appears already with addresses (or attached to a controller); we need to set reason CONNECTION_ASSUMED if it's an external device, so that we don't set sys-iface-state=managed.
ip link add br1 type bridge killall -STOP NetworkManager ip link add dummy1 type dummy ip link set dummy1 master br1 ip link set dummy1 up sleep .5 killall -CONT NetworkManager
After this, dummy1 is fully managed by NM while it shouldn't.