With that change, it now works both for the "reply_from_interface=1" and "reply_src=lo2" case for me, with LLAs present and "config at boot".

Mmmmh. I have patched my kernel, and hlim is set up correctly now (64), and I can nicely see the packets go out:

I have tested this, and it "sort of" works.

This new patch, with the logic error regarding PRUS_IPV6 check fixed, still leads to EINVAL for me.

I gave this a test today, and it did not work for me. Namely, when using sendto() on a 12.1-RELEASE-p3 kernel with this patch applied (it applied with little fuzz, so I assume this was okay to do) I get EINVAL for every IPv4-UDP packet sent over my dual-stack socket. Unmodified 12.1-RELEASE-p3 with the same code will just ignore the option and use the primary IPv4 address of the interface.