untrusted comment: verify with openbsd-68-base.pub
RWQZj25CSG5R2hiQ4ynoYCsAZVDZlF0b37bBQpySJWkbBc1y5NNhH3UDD/Ltz/j75htxq3T2Tn7sB3ixSksppGAwyFHCYENXBA4=

OpenBSD 6.8 errata 011, January 11, 2021:

When an NDP entry is invalidated the associated layer 2 address
is not invalidated.

Apply by doing:
    signify -Vep /etc/signify/openbsd-68-base.pub -x 011_nd6.patch.sig \
        -m - | (cd /usr/src && patch -p0)

And then rebuild and install a new kernel:
    KK=`sysctl -n kern.osversion | cut -d# -f1`
    cd /usr/src/sys/arch/`machine`/compile/$KK
    make obj
    make config
    make
    make install

Index: sys/netinet6/nd6.c
===================================================================
RCS file: /cvs/src/sys/netinet6/nd6.c,v
diff -u -p -r1.233 nd6.c
--- sys/netinet6/nd6.c	24 Jun 2020 22:03:44 -0000	1.233
+++ sys/netinet6/nd6.c	5 Jan 2021 17:45:25 -0000
@@ -690,8 +690,10 @@ void
 nd6_invalidate(struct rtentry *rt)
 {
 	struct llinfo_nd6 *ln = (struct llinfo_nd6 *)rt->rt_llinfo;
+	struct sockaddr_dl *sdl = satosdl(rt->rt_gateway);
 
 	m_freem(ln->ln_hold);
+	sdl->sdl_alen = 0;
 	ln->ln_hold = NULL;
 	ln->ln_state = ND6_LLINFO_INCOMPLETE;
 	ln->ln_asked = 0;