IPv6 (NDP?) issues on secondary bridge

Hi there,

I've been doing IPv6 routing for OpenVZ CTs with venet for a while and it works like a charm. Notably this allows me *not* to bridge them on the main interface. This is a requirement for us because of the policy of the hosting environment.

Now, I'd like to treat KVMs, with the same requirements, so I set up a secondary bridge (vmbr1), with no physical interface on it, whereas the usual vmbr0 has the main physical interface. The end result is something that works for a few minutes unless I specify all routes manually between the guest and the host using link-local addresses. After a while or a reboot, ping6 does not pass between them. On the other hand, the very same bridge provides IPv4 for NATing without a hitch.

(details on PVE version at the end)

From inside the VM, if I find the link-local address of vmbr1 and use it as default route, and give the host a route to the VM's global address via the VM's link-local address, it works. Even this impractical way of doing is not enough, because the bridge's link-local address changes at each reboot. I had great hopes that fixing the bridge's MAC address would help, but it did not.

Another way to make it work is to give the host an explicit route to the guest, using this time knowledge of the guests' link-local address.

The bridge has only VMs and a CT :

The CT has been added because it starts first in the host boot sequence, and that helps with stability of the MAC address, but the problems were identical before I tried that.

I played a bit with neighbor proxy to no convincing result.
I tried enabling STP, with no result.

I played a bit with tcpdump to investigate. It seems that NDP packets from the host don't reach the guest and vice-versa. I had the feeling for a while that launching tcpdump actually fixed (again, temporarily) the ping, but if there's a side effect of that kind, it's not systematic. For instance, after a reboot, everything is stuck until I set up a static route using link-local addresses

I'm not very knowledgeable in layer2 matters, but it looks as an issue at this level of the stack. Maybe there's something very simple that I'm overlooking, but I'm running out of ideas.

Does all of this ring a bell to anyone ?

Configuration details:

On the host:
On the guest:
Pinging a VM from the host
And from inside a VM (CentOS 7 if that matters) :

On the host:

Now a setup that works (using link-local addresses everywhere).

Host:
Guest:
With this ping6 between host and guest work, and on top of that, I can reach the VM from the internet.
After rebooting the host, the LL address of vmbr1 has changed:

and now for something really puzzling, right after the reboot I did to write this message, the ping worked although the guest's default route is on a LL address that does not exist any more, but this lasted less than 10 mins.

Proxmox software versions: