It took several hours of banging my head against the wall this morning.
Turns out it's not CSF at fault.
It's the darned kernel. We're running pre-2.6.20. Which means CSF kills the connections unintentionally.
HOWEVER! I can at least say that IPv6in4 now works!
Try checking shatteredtears.com via IPv6.
So... the solution is to essentially disable CSF and/or upgrade to post-2.6.2x kernel and reenable CSF to make it work.
For now, I'm just going to wait for a kernel upgrade and leave CSF disabled. :/