Last allocated time is not Kea thread safe.
Now the first race between setLastAllocated() called from pickAddressInternal (so inside a lock guard) and getPreferredSubnet() called by allocateUnreservedLeases6() in its second pass.
The key here is the "Preferred": in a shared network the getPreferredSubnet() routine returns the most recently used subnet using the last_allocated_time_ table which is of course updated with last_allocated_ia_ and co by setLastAllocated().
There is already a mutex so we should use it. It is currently private to the Allocator class member of AllocEngine so it requires some work.