IPv6 disappeared from r3’s LTE backup while the modem was still sending router advertisements. The interface had accumulated ten global SLAAC addresses. They all shared the same interface identifier, but most of their network prefixes were malformed and outside the LTE provider’s allocation.
Prefix rotation itself was expected. The modem supplies a new autonomous /64 through a Prefix Information Option, and Linux constructs an address from it. The problem was the lifetime attached to each option: valid forever, preferred forever.
Linux was doing exactly what it had been told. Without a later advertisement withdrawing an old prefix or reducing its lifetime, every generated address remained on the interface. Repeated rotations gradually approached the kernel’s per-interface IPv6 address limit. Once that limit was reached, the next legitimate prefix could be advertised without producing a usable address. Even before then, selecting the first global address was no longer a safe way to choose a source for an isolated LTE probe.
I cannot fix the modem, and disabling router advertisements on r3 would also discard the LTE default route and its learned link-local gateway. Blindly flushing global addresses was not safe either. During a broken handover, an older provider prefix might still be the only one that was actually routed.
The failover supervisor now reconciles the LTE advertisement before it makes route decisions or probes the backup. On every run it actively solicits one RA and requires exactly one advertising router and one autonomous /64. The router must match the kernel-accepted RA default, and the prefix must sit inside the provider aggregate already established for this LTE service. An ambiguous, missing or out-of-allocation advertisement fails closed without deleting anything.
After accepting the advertisement, the supervisor considers only global addresses installed as proto kernel_ra. It waits for duplicate-address detection to finish and requires exactly one usable address from the current /64. Static addresses and addresses on other interfaces are outside the cleanup scope.
Malformed addresses outside the provider aggregate can then be removed, with a hard upper bound on how many deletions one run may perform. Older addresses inside the provider aggregate are treated more carefully: they remain until the newly advertised source passes an IPv6 probe through an isolated LTE policy-routing table. Only after that proof does the supervisor prune the previous provider prefixes. The probe source is the reconciled current address, not whichever global address the kernel happens to list first.
The regression tests cover malformed prefixes, multiple PIOs, a router mismatch, tentative addresses, excessive cleanup, preservation of static addresses, and the two-stage handover from an older provider prefix. Fixed-cardinality metrics report reconciliation success, remaining SLAAC address count and removals without putting prefixes into labels.
After the change was merged and deployed, the accumulated RA state converged and LTE IPv6 recovered. The modem is still an unreliable source of lifecycle information; r3 now treats each advertisement as input to validate and reconcile rather than durable truth.