[不连接] TUN 入站，sniff+routeOnly+AsIs，直连 IPv6 流量无法连接

### 完整性要求 - [x] 我读完了 issue 模板中的所有注释，确保填写符合要求。 - [x] 我保证阅读了文档，了解所有我编写的配置文件项的含义，而不是大量堆砌看似有用的选项或默认值。 - [x] 我提供了完整的配置文件和日志，而不是出于自己的判断只给出截取的部分。 - [x] 我搜索了 issues, 没有发现已提出的类似问题。 - [x] 问题在 Release 最新的版本上可以成功复现 ### 描述 Xray 26.9.9 (Xray, Penetrates Everything.) 52a412d (go1.27.1 windows/amd64) TUN入站，并配置 sniffing+routeOnly，出站 freedom+domainStrategy: AsIs Xray 程序启动后，前几秒直连 IPv6 可以正常连接。过了几秒后，直连 IPv6 流量无法连接。 测试命令： ```curl -v -I https://www.baidu.com --resolve 'www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc]' --max-time 3``` 附上的 log 里面有两次测试连接，第一次 [17:13:46] 是前几秒能够连接的，第二次 [17:13:56] 是后面开始不能连接的。 可以看到第二次连接缺少了后面的```proxy/freedom: connection opened to tcp:[2408:871a:2100:186c:0:ff:b07e:3fbc]:443, local endpoint [my00:home:ipv6:addr::]:10658, remote endpoint [2408:871a:2100:186c:0:ff:b07e:3fbc]:443``` 与 https://github.com/XTLS/Xray-core/issues/6281 问题相同，但前面的 issue 最终无反馈，因此新开一个 issue ### 重现方式 见描述和配置 ### 客户端配置

{
  "log": {
    "access": "access.log",
    "error": "error.log",
    "dnsLog": true,
    "loglevel": "debug"
  },
  "inbounds": [
    {
      "tag": "in-tun",
      "protocol": "tun",
      "settings": {
        "name": "tun0",
        "mtu": 1400,
        "gateway": ["10.0.0.1/16", "fdfe::1/64"],
        "userLevel": 0,
        "autoSystemRoutingTable": ["0.0.0.0/0", "::/0"],
        "autoOutboundsInterface": "auto"
      },
      "sniffing": {
        "enabled": true,
        "routeOnly": true,
        "destOverride": [
          "http",
          "tls",
          "quic"
        ]
      }
    }
  ],
  "outbounds": [
    {
      "tag": "out-direct",
      "protocol": "freedom",
      "settings": {
        "domainStrategy": "AsIs"
      }
    }
  ]
}

### 服务端配置 NONE ### 客户端日志 Xray access.log: [access.log](https://github.com/user-attachments/files/32329010/access.log) Xray error.log: [error.log](https://github.com/user-attachments/files/32329013/error.log) curl log: ``` PS C:\Users\homepc> curl -v -I https://www.baidu.com --resolve 'www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc]' --max-time 3 * Added www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc] to DNS cache * Hostname www.baidu.com was found in DNS cache * Host www.baidu.com:443 was resolved. * IPv6: 2408:871a:2100:186c:0:ff:b07e:3fbc * IPv4: (none) * Trying [2408:871a:2100:186c:0:ff:b07e:3fbc]:443... * schannel: disabled automatic use of client certificate * ALPN: curl offers http/1.1 * ALPN: server accepted http/1.1 * Established connection to www.baidu.com (2408:871a:2100:186c:0:ff:b07e:3fbc port 443) from fdfe::1 port 10657 * using HTTP/1.x > HEAD / HTTP/1.1 > Host: www.baidu.com > User-Agent: curl/8.21.0 > Accept: */* > * Request completely sent off < HTTP/1.1 200 OK HTTP/1.1 200 OK < Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform < Content-Length: 0 Content-Length: 0 < Content-Type: text/html Content-Type: text/html < Pragma: no-cache Pragma: no-cache < Server: bfe Server: bfe < Set-Cookie: BAIDUID=90D90D3CFC9D59C03F226F0B72628458:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000 Set-Cookie: BAIDUID=90D90D3CFC9D59C03F226F0B72628458:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000 < Set-Cookie: BAIDUID_BFESS=90D90D3CFC9D59C03F226F0B72628458:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000; Secure; SameSite=None Set-Cookie: BAIDUID_BFESS=90D90D3CFC9D59C03F226F0B72628458:FG=1; Path=/; Domain=baidu.com; Max-Age=31536000; Secure; SameSite=None < Date: Thu, 17 Sep 2026 09:13:45 GMT Date: Thu, 17 Sep 2026 09:13:45 GMT < * Connection #0 to host www.baidu.com:443 left intact PS C:\Users\homepc> curl -v -I https://www.baidu.com --resolve 'www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc]' --max-time 3 * Added www.baidu.com:443:[2408:871a:2100:186c:0:ff:b07e:3fbc] to DNS cache * Hostname www.baidu.com was found in DNS cache * Host www.baidu.com:443 was resolved. * IPv6: 2408:871a:2100:186c:0:ff:b07e:3fbc * IPv4: (none) * Trying [2408:871a:2100:186c:0:ff:b07e:3fbc]:443... * schannel: disabled automatic use of client certificate * ALPN: curl offers http/1.1 * Connection timed out after 3013 milliseconds * closing connection #0 curl: (28) Connection timed out after 3013 milliseconds ``` ### 服务端日志 NONE