#1 Framed-IPv6-Prefix attrib is sent incorrectly from Simulator
According to RFC 3162 section 2.3 (http://www.faqs.org/rfcs/rfc3162.html) the Framed-IPv6-Prefix should be sent as binary octets. It appears to be sending the prefix as a string directly copied from the input field. As per the RFC, after the type (97) and length (from 4 to 20), there is a reserved byte that should be 0 and then the length of the prefix in bits, followed by the prefix (in binary octets) where if the prefix size is not a multiple of 8, then the last byte's bits should be padded out with 0s. A full IPv6 address is 128 bits but the prefix can be any number of bits up to 128, eg 27. The string representation of an IPv6 prefix is eg "A123:B456:C789:DE80::/57" where 57 indicates the number of bits in the prefix, and :: indicates the rest of the address is 0s (similar to normal IPv6 address formatting). The NAS-IPv6-Address attribute is correctly parsed from it's string representation eg "A123:B456:C789:D123::E456:F789" and sent in proper binary form, but the prefix attribute appears to be sent as a string and does not complain about bad characters or wrong format or anything if you enter an incorrect prefix (although the log says it is sent as binary, the length is always the number of chararcters in the prefix string as entered).
As a work around, you can enter the prefix using the binary octet method of entering attribute values. eg "0x0039A123B456C789DE80" will send the 57 bit IPv6 prefix "A123:B456:C789:DE80::/57". The two leading bytes are the reserved 0 byte followed by the prefix length in bits (57 == 0x39).