I wrote some loops to manually add duplicate addresses on a pair of bridged VMs. This would previously cause a number of different crashes, but now works properly. I used vmstat -m while testing to make sure we aren't leaking memory from the ip6ndp bucket.
If multiple threads attempt to add/remove address on the same interface simultaneously, we get a crash elsewhere. I'll try to address that next.
rstone@ reported on freebsd-current that an earlier version of this patch fixed a reproducible DAD-related crash that he was seeing.