Corrupted IPv6 routing table

[Przemyslaw Frasunek]

Dear all,

We are running FreeBSD 9.2-RELEASE-p3 on few PPPoE access servers, each
servicing about 1000 customers. Each server exchanges customers' /32 (for IPv4)
and /64 (for IPv6) routes using OSPF and BIRD.

Few times in a month, we are experiencing routing table corruption, which causes
spurious IPv6 routes appearing with prefixlen 0:

# netstat -nr -f inet6 | grep "/\0"
2a02:2928:6:989e::/0              fe80::21e:67ff:fe02:e82b%vlan0 UG1       vlan0
2a02:2928:6:989f::/0              fe80::21e:67ff:fe02:e82b%vlan0 UG1       vlan0

It is impossible to delete such routes and they override default route, making
IPv6 networking nonfunctional. They definitely does not originate from OSPF, as
there is an export filter which denies prefixlen < 32.

Has anyone seen this before?