ICMPv6 Router Solicitations are generated with invalid checksums

Bad codepath in ndp/src/util.rs:

// dst == None here
cksum(src, dst, ICMP6_RS_ULP_LEN, &mut out);

// but None means ff02::2 here
let dst = SocketAddrV6::new(
    dst.unwrap_or(ALL_ROUTERS_MCAST),
    0,
    0,
    ifindex,
);

cksum(None) internally uses ALL_NODES_MCAST (ff02::1), which is correct for Router Advertisements. But send_rs(None) sends Router Solicitations to ALL_ROUTERS_MCAST (ff02::2).

ICMPv6 checksums include the IPv6 pseudo-header destination, so multicast RS packets are checksummed for ff02::1 but sent to ff02::2. Receivers should drop them as invalid

Start in ndp/src/util.rs at the cksum call and send_rs(None) path. Trace how the destination is selected for the IPv6 pseudo-header and for transmission. The fix is done when Router Solicitations sent to ff02::2 use that same destination in their checksum and are no longer rejected as invalid.