As part of supporting oxidecomputer/opte#167, the OPTE external IP workaround, we added secondary MAC addresses to the underlay VNICs. This allows the VNIC to pretend it has multiple MAC addresses, which allows external hosts to learn that it can reach the guest's external IP through the VNIC. This needs to be excised.