warden: as a datapoint I'm using ipf with both v4 and v6 but not doing NAT on v6 and haven't seen crashes like this.

I am curious why use NAT on IPv6?

So I guess that's related to the use of NAT for IPv6, as referenced in the bugs pointed out by jclulow. I need to use NAT with IPv6 because my datacenter provider assigned me only a single IPv6 address, so I assigned a few ULA to zones on that host, whose services are then published on the Internet by ipfilter.

warden: have you tried asking the datacentre if they can provide more IPv6 addresses or maybe even some allocation.

that is part of the design of IPv6 that there should be enough space to easily provide plenty of addresses and/or allocate a block of subnets.

eheh, I know... in fact I was a bit surprised they assigned me a single address... I'll ask to their support team, but in the mean time the only way to go is NAT66 :S

IIRC, the minimum IPv6 allocation is supposed to be a /64. They specifically do not want artificial scarcity.

Standards and reality are two separate worlds.

one of these decades maybe the majority of providers/DCs etc. will have caught up. My first dabblings with IPv6 code was only 1/4 of a century ago (tutor on one of my courses was involved in IPv6 in those early days)

:D my first IPv6 experience was Solaris 7 and 6bone;)

way back I used to use an Ultra5 with Solaris 9 (or maybe 10) as my main IPv6 router / firewall (Linux didn't have stateful IPv6 filtering at that time). I can't remember if I also did IPv6 on the previous sparcstation 2 (that was fun to get booted if it was ever switeched off)