IPv6 prefix delegation, VLAN is getting wrong IPv6 addresses

[train_wreck]

I have a 60E that has a public network using the "internal" switch (192.168.168.1/25), and a VLAN 20 (192.168.222.1/27). I have enabled IPv6 prefix delegation, and both networks are getting a /64 from the /59 that my ISP gives me.

The clients on the VLAN are getting IPv6 addresses from both /64s. As a result, their connectivity is degraded, as they try to use the wrong address.

How do I fix this?

Interface config:

1176-pLAN9-co (interface) # show config system interface     edit "wan1"         set vdom "root"         set ip xxxx         set allowaccess ping         set type physical         set role wan         set snmp-index 1         config ipv6             set ip6-mode dhcp             set ip6-allowaccess ping             set dhcp6-prefix-delegation enable             set dhcp6-prefix-hint ::/59         end     next     edit "wan2"         set vdom "root"         set mode dhcp         set allowaccess ping fgfm         set type physical         set role wan         set snmp-index 2     next     edit "dmz"         set vdom "root"         set ip 192.168.221.1 255.255.255.252         set allowaccess ping         set type physical         set role dmz         set snmp-index 3         config ipv6             set ip6-mode delegated             set ip6-allowaccess ping             set ip6-send-adv enable             set ip6-other-flag enable             set ip6-upstream-interface "wan1"             set ip6-subnet ::3:0:0:0:1/64             config ip6-delegated-prefix-list                 edit 1                     set upstream-interface "wan1"                     set autonomous-flag enable                     set onlink-flag enable                     set subnet 0:0:0:3::/64                 next             end         end     next     edit "modem"         set vdom "root"         set mode pppoe         set type physical         set snmp-index 4     next     edit "ssl.root"         set vdom "root"         set type tunnel         set alias "SSL VPN interface"         set snmp-index 5     next     edit "internal"         set vdom "root"         set ip 192.168.168.1 255.255.255.128         set allowaccess ping         set type hard-switch         set stp enable         set device-identification enable         set role lan         set snmp-index 6         config ipv6             set ip6-mode delegated             set ip6-allowaccess ping             set ip6-send-adv enable             set ip6-other-flag enable             set ip6-upstream-interface "wan1"             set ip6-subnet ::1:0:0:0:1/64             config ip6-delegated-prefix-list                 edit 1                     set upstream-interface "wan1"                     set autonomous-flag enable                     set onlink-flag enable                     set subnet 0:0:0:1::/64                 next             end         end     next     edit "Private"         set vdom "root"         set ip 192.168.222.1 255.255.255.224         set allowaccess ping https ssh http         set device-identification enable         set role lan         set snmp-index 7         config ipv6             set ip6-mode delegated             set ip6-allowaccess ping             set ip6-send-adv enable             set ip6-other-flag enable             set ip6-upstream-interface "wan1"             set ip6-subnet ::2:0:0:0:1/64             config ip6-delegated-prefix-list                 edit 1                     set upstream-interface "wan1"                     set autonomous-flag enable                     set onlink-flag enable                     set subnet 0:0:0:2::/64                 next             end         end         set interface "internal"         set vlanid 20     next