pfSense

I can't reproduce this here, dpinger is using the interface IPv6 address as expected. In the dpinger command line and also confirmed by packet capture.

That said, there are other cases where this has happened unpredictably (making it difficult to reproduce). See #14646 for a recent example, and #14392 which may also be similar.

It's worth checking the code around there to see if it may be using similar methods which might need adjusting.

It would help to know a couple things, though:

1. If you look at the process list (ps uxaww | grep dpinger) -- does the dpinger command for your IPv6 gateway show it using the VIP or the interface address?
2. If you look at Diagnostics > States and filter on the monitor IP address, what does the state look like? Does it show any NAT involved?
3. Do you have any NPt, outbound NAT, 1:1 NAT, or other NAT rules which may be causing the outbound ICMP6 traffic to be translated to the CARP VIP?

In that screenshot you can see that dpinger is using the CARP IP on a IPv6 gateway.
And this happens with all IPv6 gateways.