>It seems to me that before upcalling through pr_input, about four lines
>from the end of ip6_input, m->m_pkthdr.rcvif should be set to
>deliverifp.  Am I hallucinating, or is this really a bug?

	it is not a bug.  i have been running faith daemon on 1.6D without
	any trouble.  ip6_input deliverifp, and m->m_pkthdr.rcvif,
	have nothing to do with TCP packet interception performed by faith(4).
	what you need is an appropriate setup of routing table, like:
	# route add -inet6 3ffe:501:ffff:: -prefixlen 96 ::1 -ifp faith0

	see sys/net/if_faith.d:faithprefix().

itojun