IPv6 neighbour solicitations being sent from wrong address?

hi,

running: FreeBSD 15.0-CURRENT #35 lf/main-n269047-3466614a5454: Tue Apr
30 03:48:53 BST 2024
[email protected]:/src/obj/src/freebsd/lf/main/amd64.amd64/sys/LF

i have a host with a single vnet jail.

the host has an epair interface:

# ifconfig epair0a
epair0a: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=8<VLAN_MTU>
	ether 020c.2a51.7a0a
	inet6 fe80::1%epair0a/64 scopeid 0x6
	groups: epair
	media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
	status: active
	nd6 options=1<PERFORMNUD>

the jail has the other end of the epair interface:

# ifconfig epair0b
epair0b: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=8<VLAN_MTU>
	ether 020c.2a51.7a0b
	inet 185.73.44.139/32 broadcast 185.73.44.139
	inet6 fe80::2%epair0b/64 scopeid 0x7
	inet6 2001:ba8:4015:ffff::1/128
	groups: epair
	media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
	status: active
	nd6 options=1<PERFORMNUD>

the host has a route to 2001:ba8:4015:ffff::1/128 via the epair
interface:

Internet6:
Destination                       Gateway                       Flags   Nhop#    Mtu    Netif Expire
2001:ba8:4015:ffff::1             link#6                        UH         22   1500  epair0a

looking at tcpdump, it seems like the host is sending ICMP neighbour
solicitation over the epair interface from a strange IP address, and the
jail ignores the requests until the host sends from fe80::1 instead:

11:03:13.418029 02:0c:2a:51:7a:0a > 02:0c:2a:51:7a:0b, ethertype IPv6 (0x86dd), length 86: 2001:ba8:4015:1::1 > 2001:ba8:4015:ffff::1: ICMP6, neighbor solicitation, who has 2001:ba8:4015:ffff::1, length 32
11:03:14.417986 02:0c:2a:51:7a:0a > 02:0c:2a:51:7a:0b, ethertype IPv6 (0x86dd), length 86: 2001:ba8:4015:1::1 > 2001:ba8:4015:ffff::1: ICMP6, neighbor solicitation, who has 2001:ba8:4015:ffff::1, length 32
11:03:16.527722 02:0c:2a:51:7a:0a > 33:33:ff:00:00:01, ethertype IPv6 (0x86dd), length 86: fe80::1 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2001:ba8:4015:ffff::1, length 32
11:03:16.527746 02:0c:2a:51:7a:0b > 02:0c:2a:51:7a:0a, ethertype IPv6 (0x86dd), length 86: fe80::2 > fe80::1: ICMP6, neighbor advertisement, tgt is 2001:ba8:4015:ffff::1, length 32

2001:ba8:4015:1::1 is configured on a different interface on the host,
xn0.

is this expected behaviour?  i would have expected the host to send
these from the IP addressed configured on the relevant interface, which
is fe80::1.

-----BEGIN PGP SIGNATURE-----

iQGzBAABCAAdFiEEuwt6MaPcv/+Mo+ftDHqbqZ41x5kFAmY2CLEACgkQDHqbqZ41
x5mT5gv/c0o3i6wVcGczqGl0nb/b9OVUDnr9tbsZquxFazYx8htxHefrvqkUJNTi
8e04fDBk3qsbGZlc1wR1qPqRMHtHtRH5+4PKBKHCWohvhcVQWSZo6X7ygt9WXtWb
mIGoT4MI7LO8Or7hPwbqs6vRMB2X1nklbavG3O7tOh6gZWdGn4TC1u0mkmF0Zizz
+vMbeDwBWusIY4pKNemWS7gWHfn7CZ1ZsmRn97vphMC4k4M2aHB762KLwJW841Tb
/PM9MSUczLUYUlmP295v3S9kHCiVAi9buWCjPIx4t68QdurtGmJv9BaAmiowB3VX
mYQDOyGUiQGrkcQdTGgb6ayAiOmXvreri+cbR4o4Ei5bV7TgChFI3DbOVZYeO58H
obLolOSg6OrrAw+2I45oR0HJaAqBsGPafON0OyBJnPGpFVhfE9JBroMv/KoP2cEy
5ETXxNaqUxMrHQ+lKOOUjBm21Ii2P/vhPrc5wR7NQt6Oc3TJvn3BwWxr9oEzzQRV
DJMzbJhV
=GE8S
-----END PGP SIGNATURE-----