Incomplete records may contain packets in their hold queue - https://reviews.freebsd.org/source/src/browse/main/sys/net/if_llatbl.h;89e58b955cf5d2187af5f2460d11b64f4d229c8a$69. When you remove an incomplete record, its packets should be freed in
lltable_drop_entry_queue - https://reviews.freebsd.org/source/src/browse/main/sys/net/if_llatbl.c;89e58b955cf5d2187af5f2460d11b64f4d229c8a$286. But NDP code never increases la_numheld, and the removal doesn't happen.
To fix I make a common function to add a packet to the record's hold queue - lltable_append_entry_queue. I use this function in ARP and NDP code instead of their custom implementations.