Good(ish) news, in that I think I’ve identified the source of the problem: There’s a window of about 4 seconds during the SQ-6 boot process in which all traffic from the “network” socket is leaked to the Dante network (at least to the primary). If there happen to be any DHCP requests in that time, then devices on the Dante network can end up with IP addresses from the control network.
I’ve updated my support ticket with this information and a packet capture demonstrating leaked traffic.