M6 and IP-passthrough with routable static IP

I have an M6 Pro (MR6550) and a T-Mobile business internet account, and I'm unable to use the M6 in passthrough mode.

The M6 (the hotspot) does some pretty inexplicable things.  Like ARP my firewall from 192.168.3.1.

As I said, my firewall has a public routable (non RFC-1918) address, so 192.168.3.1 is not going to be adjacent on the subnet, and therefore my firewall will drop the ARP request at a minimum, and potentially trigger the IDS as there being misconfiguration of a peer on the network or even someone doing malicious probes.

It also sends SSDP packets to my network segment as multicasts.  Why?  Only hackers use SSDP on a WAN interface: to figure out (1) if you're misconfigured and (2) to know what sort of machines are on your network so they can tailor attacks after fingerprinting the hosts and looking up their attack surfaces and vulnerabilities.

But more to the point, it's a modem/bridge.  It should be operating at layer 2 on the Ethernet side, and layer 3 on the 4G/5G side.

The correct behavior is trivial:

(1) When the APN provisioning is received from the 5G carrier, PROXY ARP the default gateway's IP address with your own (M6's) MAC address (or GARP it, that works too if the firewall has been sysctl'd to accept GARP's on a public interface... which is sometimes used for man-in-the-middle attacks on public networks).

(2) Then ARP REQUEST the firewall's IP address so you know where to forward the packets.

That 2nd step is likely unnecessary, since most IP neighbor implementations cache the address of an ARP requestor in anticipation of their being return traffic (i.e. some sort of answer).

You don't need SSDP.  Or mDNS.  Or to be trying to figure out anything about what's attached to the firewall.  That's just suspicious behavior.

Also, don't IPv6 SSDP me if I'm not provisioned for IPv6!  That just fills my logs with noise.

If I do a ping -c 1000 8.8.8.8 then I see spans of 8 or 9 packets being passed, then 20 or so dropped, then 8 or 9 passed, then 20 or so dropped... until the test completes.

How did this not turn up during homologation testing?  I'm getting 62-70% packet loss!!!