Lots of sanity checks are done on ICMP6 redirect messages. One of
these is to ensure that the source address in the ip6 header matches
the next-hop gateway address of the destination in the redirect
payload. The problem is that the source address in the ip6 header
will have its scope id embedded in it but the next-hop address will
not if the target is a global address. For globals, the scope id
is explicitly stripped.
The fix is to grab the interface index from the interface pointer
passed in through the header mbuf, and stuff that back into the
next-hop gateway.