When kea6 is configured with shared-network that contain option, and subnet (within that shared-network) which has assigned class with the same option defined - Kea ignores option defined in class.

Example configuration:

{
    "Dhcp6":
    {
        "renew-timer":1000,
        "rebind-timer":2000,
        "preferred-lifetime":3000,
        "valid-lifetime":4000,
        "client-classes":[
        {
            "name":"Client_Class_1",
            "test":"substring(option[1].hex,8,2)==0xf2f1",
            "option-data":[
            {
                "csv-format":true,
                "code":23,
                "data":"2001:db8::888",
                "name":"dns-servers",
                "space":"dhcp6"
            }
            ]
        }
        ],
        "interfaces-config":
        {
            "interfaces":["eth2"]
        },
        "lease-database":
        {
            "type":"memfile"
        },
        "shared-networks":[
        {
            "name":"name-abc",
            "interface":"eth2",
            "option-data":[
            {
                "csv-format":true,
                "code":23,
                "data":"2001:db8::1",
                "name":"dns-servers",
                "space":"dhcp6"
            }
            ],
            "subnet6":[
            {
                "subnet":"2001:db8:a::/64",
                "client-class":"Client_Class_1",
                "pools":[
                {
                    "pool":"2001:db8:a::1-2001:db8:a::10"
                }
                ]
            }
            ]
        }
        ]
    }
}

Packet is evaluated correctly, option 23 has value that is configured on shared-network level, not what is in the class.

DEBUG [kea-dhcp6.eval/18704] EVAL_DEBUG_EQUAL Popping 0xF2F1 and 0xF2F1 pushing result 'true'
INFO  [kea-dhcp6.dhcp6/18704] EVAL_RESULT Expression Client_Class_1 evaluated to 1

but message is created incorreclty:

DHCP6_RESPONSE_DATA responding with packet type 2 data is localAddr=[ff02::1:2]:547 remoteAddr=[fe80::800:27ff:fe00:1]:546
msgtype=2(ADVERTISE), transid=0xeda107
type=00001, len=00010: 00:03:00:01:66:55:44:33:f2:f1
type=00002, len=00014: 00:01:00:01:21:81:be:d4:08:00:27:19:b8:2a
type=00003(IA_NA), len=00040: iaid=39866, t1=1000, t2=2000,
options:
  type=00005(IAADDR), len=00024: address=2001:db8:a::1, preferred-lft=3000, valid-lft=4000
type=00023, len=00016: 2001:db8::1

Entire logs and network capture attached.

Number of subnets within shared-network, or number of shared-networks makes no difference - bug occur.

When client has reservation with option X it correctly overrides option configured on shared-network level.