Hello Rob:

I have reproduced the issue and it is not related to the size of your configuration but then I didn't really think it would be. The problem is that the client classification of a packet is done BEFORE the global statements are executed for that packet.  This means the classification is actually being done based on the binding variables set by previous packet. 

You can see this in the logs. A SOLICIT from a bad client matches because the previous packet was from a good client.  The ensuing REQUEST from the bad client does not match because the variables are now based on the bad client's SOLICIT.

The reason this is not an issue for your V4 configuration is because your match argument is "hardware" and that value is available directly from the packet when classification is done.  

The "match" clause can support expressions such as match pick_first_value(...) or match suffix(option dhcp6.client-id,6) and so forth. Those are calculated as part of the classification evaluation.  You should be able to come up with expressions that will meet your needs but you would have to repeat them for each class declaration.  Not as clean as what you wanted to do but the software currently won't support that.

I'll continue to explore this and will keep you updated.

Regards,

Thomas Markwalder
ISC Software Engineering