The fucking VRF configuration reported incorrect MAC addresses because of a firmware bug.
But we have since turned everything off and on again, so it will never happen again.