If we have a an existing router dropping it preference (high -> low) in "overflow" condition, we would update dr in the beginning, but fail to maintain sort order for V_nd6_defrouter.

Can we restrict this check to dr == NULL use case?

Sorry it took me so long to update this. To much on the plate.

Sorry for commenting on it lately. There is a use case with router and many IPv6 interfaces that I'd like to discuss.

As the size check is done in nd6_prelist_add(), it is traversed by both nd6_ra_input() and SIOCAIFADDR_IN6 codepath. The latter may result in inability to configure more than 64 IPv6-enabled interfaces by default.
Would it be possible to introduce some check (no expiration time?) that permits static configuration regardless of the variable value? Could you also consider something like nd6_ra_prefixes_max sysctl name, to indicate the review intent (DoS protection, but not the overall IPv6 limit)?

Aren't these per-VNET limits?

Indeed, I think we should only apply the limit to prefixes added via router advertisements.

I believe expiration time cannot be used to determine whether to count the prefix against the limit, since there is nothing disallowing routers from advertising prefixes with infinite lifetimes. For now we could add a new NDPRF_ flag to indicate whether the prefix was generated from a router advertisement.

Extra newline.