pfSense

traffic coming in on a gif interface wrongly matches the out direction on the gif. For instance this:

pass out route-to ( gif0 2610:x:x:x::2 ) inet6 from 2610:x:x:x::1/64 to !2610:x:x:x::1/64 keep state 

traffic inbound on gif0 matches that rule and applies the route-to, which breaks connectivity from the IP on the remote side of the gif as it gets routed right back out the gif where it came in. Take out the route-to and reload the ruleset, and it works. Still wrongly matches the 'pass out' rule though.