EFAULT was happening because inp_join_group() was seeing the user-space thread descriptor in the faked-up sockopt. Prefer nullity to elide to a KVA memcpy(). SMAP would have obscured the panic otherwise expected.
imr_interface was fine, but the unnecessary cast back to its own type in the IA_SIN() macro was obfuscating things. in6_v6_mreq_to_v4() itself was just fine, it was the inputs which were in question.