I cut over to RFC 7217 stable IPv6 privacy addressing on my primary FreeBSD box. This should save me from the auto-doxxing portion of Torment Nexus.

I can tie things down at the border now, although I've let Windows talk IPv6 now. RFC 7217 addresses are specified to be stable as long as one does not migrate link or *presumably* renumber the prefix on the link.

One must add ifconfig "stableaddr" options in rc.conf for the relevant links, and explicitly enable the new feature with doas sysctl net.inet6.ip6.use_stableaddr=1.

doas sysctl net.inet6.ip6.use_tempaddr=0 is needed to stop using regular privacy addresses (which can co-exist and are still preferred) after the fact.

Restart netif and rtsold as appropriate. A side effect is that the regular EUI64 derived SLAAC addresses just do not appear on the wire now. This does not affect link-local.