IPv6 NAT destination-translation corrupts source address (copy-paste bug)

Summary

NAT default-protocol AF_INET6 dest branch: guard tests daddr(:3896) but body writes PF_ACPY(saddr,...)(:3898) should be daddr. IPv4 sibling(:3883-3887) correct. Copy-paste from source branch. IPv6 NAT policy not enforced for dest + source corrupted. Remote: non-TCP/UDP/ICMPv6 IPv6 packet matching NAT rule.