To trigger races, I wrote a couple of scripts that add and remove IPv6 addresses in a loop, and run several such loops concurrently. With the changes in D2253-2256, I'm no longer able to trigger panics. I also tested with temporary addresses enabled, and configured rtadvd instances on another system to advertise prefixes with very short lifetimes, so that address expiration code is exercised. I'm still working on some further tests.