Update: It seems the issue is related to the network, not NetBSD at all. After trying more in the Debian Linux machine, it seems to also drop IPv6 connectivity intermittently. `ip -6 neigh show` (its ndp -a equivalent) shows the following:
2a06:a880:3::1 dev eth0 lladdr 0c:59:9c:8c:dc:e4 router STALE 2a06:a880:3::1 dev eth0 lladdr 0c:59:9c:8c:dc:e4 router DELAY 2a06:a880:3::1 dev eth0 lladdr 0c:59:9c:8c:dc:e4 router DELAY 2a06:a880:3::1 dev eth0 lladdr 0c:59:9c:8c:dc:e4 router PROBE 2a06:a880:3::1 dev eth0 lladdr 0c:59:9c:8c:dc:e4 router PROBE 2a06:a880:3::1 dev eth0 lladdr 0c:59:9c:8c:dc:e4 router PROBE 2a06:a880:3::1 dev eth0 lladdr 0c:59:9c:8c:dc:e4 router PROBE 2a06:a880:3::1 dev eth0 router FAILED 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router FAILED 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router FAILED 2a06:a880:3::1 dev eth0 router FAILED 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 router INCOMPLETE 2a06:a880:3::1 dev eth0 lladdr 0c:59:9c:8c:dc:e4 router REACHABLE It's also having trouble resolving the gateway through NDP after the entry gets stale, and the connection drops meanwhile. So it's having the exact same behavior, although Linux seems to be more lenient and it seems to retry more before expiring the NDP entry. I'm mimicking this behavior on NetBSD through the following tunables: net.inet6.icmp6.nd6_mmaxtries=15 net.inet6.icmp6.nd6_umaxtries=15 net.inet6.icmp6.nd6_delay=30 net.inet6.icmp6.nd6_prune=3600 It's a lot closer to Linux now, but it doesn't fix the problem - if there's no IPv6 traffic for a while, it will have to probe for the gateway again, which takes around 30-120 seconds of retries, which is unacceptable for services. These tunables let me at least keep an outgoing ping to keep the NDP entry alive, but that's janky. I'm bringing the issue to the provider. If I show them Linux is having the same issue I'm sure they'll listen this time. Thanks to the people who took a look!
