Solutions

Operational: disable auto tunnel support whenever possible
Don't run relays, if you don't need it
Operational: filter out IPv6 packets with IPv4 compatible src/dst, whenever possible
Send ICMPv6 net unreach
# route add -inet6 ::/96 ::1 -reject

Protocol: require exact match between IPv4 src/dst and IPv6 compatible address src/dst
Relays are the source of problem
May invalidate some of scenarios, seems to be non issue for me
::/96 cannot be routed between ASes/sites
Even in an AS/a site, relay setup is not documented
6to4 is taking over