FWIW, it’s actually quite simple: the code there was a brain fart while attempting to ward off global multicast addresses – and we don’t currently have a test harness using globally routable IPs, so none of our tests caught it. Such a test harness is on the way but it’s early days for Boundary.
As for being unattended for over a week, I’ll note that the company is on holiday shutdown and the code is fully open source. If rolling back to 0.1.2 is not possible, it’s pretty trivial to fix this yourself (as you did).
We’ll release a 0.1.4 this upcoming week with this addressed.