Seems a similar report of Bad udp cksum on packets from odhcp6c - #8 by vcunat - Turris OS 4.x - Turris forum
capture on ingress happens prior the kernel processes a frame, i.e. WS’s checksum computation may not align with the kernel’s.
conntrack might be helpful, also the ndptool app.
marginal notes:
547 is the source port in the context. What about other potentially relevant firewall rules, e.g. RA (icmpv6 type 134) | NA (icmpv6 type 136)?
As per Linux documentation on VLAN tag management of DSA ports there is no mention of adding virtual interface on top of the DSA port.