pfSense

In ticket 24032478035, disabling XML-RPC for Captive Portal helped stop the issue from occurring. The symptoms were very similar.

Danilo Zrenjanin wrote in #note-1:

In ticket 24032478035, disabling XML-RPC for Captive Portal helped stop the issue from occurring. The symptoms were very similar.

For our setup, we disabled XML-RPC for Captive Portal (both forwards and backwards) and this issue persisted.

See if the following patch helps - it can be applied using the System Patches package.

diff --git a/src/etc/inc/captiveportal.inc b/src/etc/inc/captiveportal.inc
index 78f907f39a..0298c46245 100644
--- a/src/etc/inc/captiveportal.inc
+++ b/src/etc/inc/captiveportal.inc
@@ -2671,6 +2671,9 @@ function filter_captiveportal_ether() {
         $interfaces = captiveportal_zone_interfaces($cpcfg);

         if (!empty($interfaces)) {
+            /* prevent ARP from being sent to dummynet */
+            $rules .= "ether pass in quick on { {$interfaces} } proto 0x0806 tag \"{$rdrtag}\"\n";
+            $rules .= "ether pass out quick on { {$interfaces} } proto 0x0806\n";
             /* set 'rdr' tag for further captive portal web portal redirection */
             $rules .= "ether pass on { {$interfaces} } tag \"{$rdrtag}\"\n";
             /* anchor to set the PASS tag for authenticated clients */
@@ -2847,7 +2850,7 @@ function captiveportal_ether_configure_entry($hostent, $anchor, $user_auth = fal
     }

     $rules = "ether pass in quick {$macfrom} {$l3from} tag {$tag} dnpipe {$pipeup}\n";
-    $rules .= "ether pass out quick {$macto} {$l3to} tag {$tag} dnpipe {$pipedown}\n";
+    $rules .= "ether pass out quick {$macto} {$l3to} dnpipe {$pipedown}\n";

     captiveportal_load_pfctl("{$cpzoneprefix}_{$anchor}", $host, $rules);
 }

Make sure to reload the filter after applying the patch.

We've upgraded to 25.07.1 and applied the patch. Without the patch it only managed a few hours before losing ARP, but it's now managed almost two days and is still up. So that's looking fairly promising.