HE provided me with the subnet 2001:470:74ca::/48 and I am using several /64 subnets in it.
Now my DSL proider is offering dualstack via the 6rd protocol (1&1 in Germany). I enabled it to test and received the address/subnet 2001:470:74CA:4FE4:21D:AAFF:FE87:CB18/64 via the DSL link.
From what I understood about ipv6 so far, this is a /64 in 2001:470:74ca::/48! But how can my DSL provider delegate a subnet out of the /48 which I received from HE? Or do I get something wrong?
They haven't; the address you're seeing is from HE.
Pretty magic! How does this work? The HE tunnel is terminating on a VM with firewall. And the VM's interface to the DSL modem with 6rd does not expose ipv6 to the modem. Does it use the WAN ipv4 address to identify my /48 at HE?
The only thing I can think of is your router is doing SLAAC and your DSL modem is accepting the advertisement. I'll wager if you turn off your tunnel and reboot your modem, the address will be gone.
I think I tricked myself: The DSL provider requires PPP to assign me an ipv6. Activating PPP, I get an ipv6 subnet which is outside of my HE subnet (as it should be).
When previously activating 6rd on my DSL modem, it somehow created a 6rd tunnel connection to HE - do not ask me how it figured out to use HE.