OK, this looks like a known v4.8 stable regression, caused by the
backport of commit 5d41ce29e3b9 ("net: icmp6_send should use dst dev to
determine L3 domain") introduced in v4.8.10.
Should be fixed by commit 79dc7e3f1cd3 ("net: handle no dst on skb in
icmp6_send") as soon as Debian moves to v4.9
Ref https://bugzilla.kernel.org/show_bug.cgi?id=189851
Bjørn
