W is the LAC and the external router, is the LNS. DHCPv6-based address configuration [26] is not supported by 3GPP specifications. On the other hand, stateless DHCPv6 service to obtain other configuration information is supported [54]. This implies that the M-bit is always zero and that the O-bit may be set to one in the Router Advertisement sent to the UE. The setting of the flags in the Router Advertisement complies with [107], even when it comes to DHCPv6 PD. The 3GPP network allocates each default bearer a unique /64 IPv6 prefix, and uses layer-2 NAS signaling [12, 13] to convey an IID to the UE that is guaranteed not to conflict with gateway's IID. The UE must configure its link-local address using this IID. IPv6 in 3GPP Networks The UE is allowed to use any IID it wishes for the other configured addresses with a greater scope than a link-local as long as the selected IID respects the reserved IID values [108] and IPv6 addressing architecture [21]. There is no restriction, for example, on using privacy extensions for SLAAC [109] or other similar types of mechanisms. However, there are network drivers that fail to pass the IID to the stack and instead synthesize their own IID (usually derived from a locally generated/configured IEEE 802 Media Access Control (MAC) address). If the UE skips the DAD and also has other issues with the NDP (see Section 4.9.1), then there is a small theoretical chance that the UE will configure exactly the same link-local address as the PGW. The address collision may then cause issues in IP connectivity - for instance, the UE not being able to forward any packets to the uplink. Historically NAS signaling has conveyed a full IPv6 address from the network to the UE. This holds only for GPRS [12]. In EPS, only the IID is conveyed over the NAS signaling. Section 4.4.7 discusses further the details of NAS protocol. As an experiment, optional AT-commands AT-CGPADDR and AT+CGCONTRDP [34] can be used to query the modem for the current PDP address. In the 3GPP link model, the /64 IPv6 prefi