ICMPv6 HL Exceeded Messages Generated from Wrong Address

[Mark Kamichoff]

Hi - 

I've got FreeBSD 11* in a VM acting as an IPv6 router with a bunch of
tunnel interfaces and a couple virtio interfaces.  I'm seeing some odd
behavior related to ICMPv6 HL exceeded messages (type 3 code 0) when
running traceroutes.  Specifically, the FreeBSD box emits the ICMPv6
messages using the outgoing interface address (ie, toward traceroute
destination) instead of the incoming interface address (expected).

I've a FreeBSD 10.3 box that ran with almost an identical setup (em
instead of virtio, since it was bare metal) that didn't experience this
behavior.

Here's a few examples, along with an obligatory ASCII-art diagram:

https://www.prolixium.com/share/txt/fbsd11-icmpv6hle.txt

I'm not willing to rule out some misconfiguration at this point, but I
really haven't tuned any knobs that I believe would affect this.

Is anyone else with a FreeBSD 11 IPv6 router seeing this type of
behavior?  What parts of my configuration should I share?

- Mark

* = FreeBSD 11.0-PRERELEASE #0 r306218: Thu Sep 22 22:03:59 EDT 2016

-- 
Mark Kamichoff
prox at prolixium.com
http://www.prolixium.com/