IPv6 neighbour solicitations being sent from wrong address?

From: Lexi Winter <lexi_at_le-fay.org>
Date: Sat, 04 May 2024 10:06:44 UTC
hi,

running: FreeBSD 15.0-CURRENT #35 lf/main-n269047-3466614a5454: Tue Apr
30 03:48:53 BST 2024
srcmastr@daphne.eden.le-fay.org:/src/obj/src/freebsd/lf/main/amd64.amd64/sys/LF

i have a host with a single vnet jail.

the host has an epair interface:

# ifconfig epair0a
epair0a: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=8<VLAN_MTU>
	ether 020c.2a51.7a0a
	inet6 fe80::1%epair0a/64 scopeid 0x6
	groups: epair
	media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
	status: active
	nd6 options=1<PERFORMNUD>

the jail has the other end of the epair interface:

# ifconfig epair0b
epair0b: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=8<VLAN_MTU>
	ether 020c.2a51.7a0b
	inet 185.73.44.139/32 broadcast 185.73.44.139
	inet6 fe80::2%epair0b/64 scopeid 0x7
	inet6 2001:ba8:4015:ffff::1/128
	groups: epair
	media: Ethernet 10Gbase-T (10Gbase-T <full-duplex>)
	status: active
	nd6 options=1<PERFORMNUD>

the host has a route to 2001:ba8:4015:ffff::1/128 via the epair
interface:

Internet6:
Destination                       Gateway                       Flags   Nhop#    Mtu    Netif Expire
2001:ba8:4015:ffff::1             link#6                        UH         22   1500  epair0a

looking at tcpdump, it seems like the host is sending ICMP neighbour
solicitation over the epair interface from a strange IP address, and the
jail ignores the requests until the host sends from fe80::1 instead:

11:03:13.418029 02:0c:2a:51:7a:0a > 02:0c:2a:51:7a:0b, ethertype IPv6 (0x86dd), length 86: 2001:ba8:4015:1::1 > 2001:ba8:4015:ffff::1: ICMP6, neighbor solicitation, who has 2001:ba8:4015:ffff::1, length 32
11:03:14.417986 02:0c:2a:51:7a:0a > 02:0c:2a:51:7a:0b, ethertype IPv6 (0x86dd), length 86: 2001:ba8:4015:1::1 > 2001:ba8:4015:ffff::1: ICMP6, neighbor solicitation, who has 2001:ba8:4015:ffff::1, length 32
11:03:16.527722 02:0c:2a:51:7a:0a > 33:33:ff:00:00:01, ethertype IPv6 (0x86dd), length 86: fe80::1 > ff02::1:ff00:1: ICMP6, neighbor solicitation, who has 2001:ba8:4015:ffff::1, length 32
11:03:16.527746 02:0c:2a:51:7a:0b > 02:0c:2a:51:7a:0a, ethertype IPv6 (0x86dd), length 86: fe80::2 > fe80::1: ICMP6, neighbor advertisement, tgt is 2001:ba8:4015:ffff::1, length 32

2001:ba8:4015:1::1 is configured on a different interface on the host,
xn0.

is this expected behaviour?  i would have expected the host to send
these from the IP addressed configured on the relevant interface, which
is fe80::1.