When an IPv6 pktsnpt is used more than 1 time when it enters gnrc_ipv6.c:515 gnrc_pktbuf_start_write will create a new snip to fill the source address, and the checksum.

    /* seize payload as temporary variable */
    payload = gnrc_pktbuf_start_write(ipv6);

However if this happens payload is never set to the pkt variable which is used to send to the packet on line 592 _send_unicast(iface, l2addr, l2addr_len, pkt);

This line should be: _send_unicast(iface, l2addr, l2addr_len, ipv6); If i'm correct