pfSense

Same here, as already said in #12947#note-24.

For the moment I use this shell script in a cron-job every minute:

#!/bin/sh
IFACE="$1" 
IFS=" 
" 
if DEP_V6_ADDRESSES=$(/sbin/ifconfig "$IFACE" | grep 'deprecated'); then
    for line in $DEP_V6_ADDRESSES; do
        dep_v6_addr=$(echo "$line" | sed -E 's/.*inet6 ([0-9a-fA-F\.:]+) prefixlen ([0-9]+).*/\1\/\2/')
        /usr/bin/logger -t clean_ipv6_addr.sh "Found deprecated IPv6 address ${dep_v6_addr} on ${IFACE} - deleting" 
        /sbin/ifconfig "$IFACE" inet6 "$dep_v6_addr" delete
    done
    /etc/rc.newwanipv6 "$IFACE" 
fi

But this just a workaround, and should not be the "solution".

Although this does restore basic connectivity, it defeats downstream prefix invalidation.
Deprecated prefixes in the kernel serve the purpose of holding the knowledge about shortly expired prefixes, so for instance radvd can continue revoking them downstream by advertising them with a valid lifetime of 0. A prperly behaving upstream router will also do that, which will fight against the script for about 2 hours by continously adding the deprecated prefix back-in and worst case cause some route flapping and/or ddns ddos as long as pfsense (everything above the kernel) doesn't handle prefix selection properly.

This script also doesn't force the renewal of delegated prefixes (tracked interface) doesn't it? As I understand, this just restores internet connectivity to the firewall itself.