Resolved! uptime of 213 days considered harmful
Most of the current ASA/Firepower firmwares have a bug where the stop processing ARP packets after 213 days of uptime. Bit me Wednesday, ouch! The workaround is to schedule a reload before that happens. No security implications. Field notice: h...