How in the world did we go from unbound sending to 10.0.0.6 to having a
  multicast (239.255.255.253) address as our source!

I think you are converged, but this sort of follows from binding to a
multicast address.

You might file a PR that the bind-to-multicast succeeded, although
reading in_pcbbind() it seems that it is intended to do something
useful.  Perhaps the intent is to get only packets for that group, and
not to affect the outgoing source address process.  But it really
seems like something is broken in the kernel.