ospf6d crashes in large multi-area configuration about frr HOT 3 OPEN

How many routes (internal/external/summaries) were in the single area 0 before you switched over to multiple areas? How many routers were in area 0, and how many are in the non-area 0 areas now? Did y'all switch the ABR to the new area number first, or the other routers in the area?

We could be looking at a scale/timing/ordering issue ... these might be helpful in getting a better idea of how to reproduce or where the problem is ...

This hasn't happened since the switchover, or is this continuous?

from frr.

If possible it might be helpful here to get a full dump of the LSDBs; you could replace the leading 32 bits of all IPv6 addresses and the leading 16 bits of all IPv4 addresses (Router & LS IDs) with some random constant? If necessary we can find some way to pass that around privately…

from frr.

We have already reverted the change (back to single-area setup), since the ospf6d crashes were not limited to the changeover time, but persisted afterwards (occuring with higher frequency if there was any IGP instability I think) making IPv6 pretty much unusable.
Thus we are a bit limited on what information we can provide from the running multi-area setup.
Aside from the debug output from ospf6d (which the excerpts in the bug description are from) and bgpd (which I don't think are relevant), I also have a (at least partial) dump of the LSA database and we also have a OSPFv3 traffic dump on one of the links of one router, which covers the time of one of the crashes.
We can share all of that privately.

Summary information from R3 while in multi-area configuration:

r3# show ipv6 ospf6 
 OSPFv3 Routing Process (0) with Router-ID 5.226.z.z
 Running 01:42:49
 LSA minimum arrival 1000 msecs
 Maximum-paths 256
 Administrative distance 110
 Initial SPF scheduling delay 0 millisec(s)
 Minimum hold time between consecutive SPFs 50 millsecond(s)
 Maximum hold time between consecutive SPFs 5000 millsecond(s)
 Hold time multiplier is currently 1
 SPF algorithm last executed 01:20:45 ago, reason N-
 Last SPF duration 0 sec 5257 usec
 SPF timer is inactive
 Number of AS scoped LSAs is 298
 Number of areas in this router is 2
 Authentication Sequence number info
  Higher sequence no 40, Lower sequence no 0
 Area 0
     Number of Area scoped LSAs is 254
     Interface attached to this area: xe5-0.[..]
     SPF last executed 4845.769896s ago
 Area 255.255.255.255
     Number of Area scoped LSAs is 278
     Interface attached to this area: loop0 xe5-0.[..]
     SPF last executed 4845.773712s ago

The area 255.255.255.255 contained around 15 routers, while in total there were around 25 routers (doubt that actually qualifies as large, but it certainly is not a small 3 router setup either).

Route Summary (in multi-area config):

r3# show ipv6 ospf6 route summary 
Number of OSPFv3 routes: 684
Number of Destination: 297
Number of Alternative routes: 387
Number of Equal Cost Multi Path: 32
Number of Intra-Area routes: 86
Number of Inter-Area routes: 115
Number of External-1 routes: 461
Number of External-2 routes: 22

For the exact numbers for each area I will have to dig into the debug session log files a bit more.

from frr.