Ipv6 Magic routing

I have a strange problem on a GNS3 simulation. I configure the IPv6 addresses shown on the routers.
R1 can not ping R3 (2000:23::3) as expected.

I enable RIPng on R1 interface 0
I enable RIPng on R2 interface 0

R1 still can not ping 2000:23::3 as expected

I enable RIPng on R2 interface 1 (RIPng is not enabled on R3; in fact ipv6 unicast-routing is not enabled on R3)
Now R1 can ping 2000:23::3 !!!

R1#sh ipv6 route rip
IPv6 Routing Table - 5 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
       U - Per-user Static route
       I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
       O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
R   2000:23::/64 [120/2]
     via FE80::CA02:5FF:FEB7:0, FastEthernet0/0
R1#

Now from R3

R3#sh ipv6 route
IPv6 Routing Table - 6 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
       U - Per-user Static route
       I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
       O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
C   2000:23::/64 [0/0]
     via ::, FastEthernet0/1
L   2000:23::3/128 [0/0]
     via ::, FastEthernet0/1
C   2000:34::/64 [0/0]
     via ::, FastEthernet1/0
L   2000:34::3/128 [0/0]
     via ::, FastEthernet1/0
L   FE80::/10 [0/0]
     via ::, Null0
L   FF00::/8 [0/0]
     via ::, Null0
R3#ping 2000:12::1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2000:12::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 12/18/28 ms

HOW can R3 ping R1 without a route ???

ipv6 CEF is not running on R3

R3#sh ipv6 proto          
IPv6 Routing Protocol is "connected"
IPv6 Routing Protocol is "static"
R3#

Found a possible reason

R3#sh ipv6 int f0/1
FastEthernet0/1 is up, line protocol is up
  IPv6 is enabled, link-local address is FE80::CA03:5FF:FEC6:1 
  Global unicast address(es):
    2000:23::3, subnet is 2000:23::/64 
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::1:FF00:3
    FF02::1:FFC6:1
  MTU is 1500 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
 <strong> Default router is FE80::CA02:5FF:FEB7:1 on FastEthernet0/1</strong>
R2#sh ipv6 int f0/1
FastEthernet0/1 is up, line protocol is up
  IPv6 is enabled, <strong>link-local address is FE80::CA02:5FF:FEB7:1 </strong>
  Global unicast address(es):
    2000:23::2, subnet is 2000:23::/64 
  Joined group address(es):
    FF02::1
    FF02::2
    FF02::9
    FF02::1:FF00:2
    FF02::1:FFB7:1
  MTU is 1500 bytes
  ICMP error messages limited to one every 100 milliseconds
  ICMP redirects are enabled
  ND DAD is enabled, number of DAD attempts: 1
  ND reachable time is 30000 milliseconds
  ND advertised reachable time is 0 milliseconds
  ND advertised retransmit interval is 0 milliseconds
 <strong> ND router advertisements are sent every 200 seconds</strong>
  ND router advertisements live for 1800 seconds
  Hosts use stateless autoconfig for addresses.

So is R2 sending ND messages and some how this creates a hidden default route on R3 ?
Should this feature be turned off when we are using a routing protocol ?

Stuart,
Your discovery is correct. Notice the end of the output for R2:

Hosts use stateless autoconfig for addresses

R3 was actually able to send pings over to R1 the whole time, but it wasn’t until you enabled RIPng on R2’s interface towards R3 that R1 knew about a route back to R3. You could test this by removing the RIP routing protocol entirely, and simply create a static IPv6 route on R1 that says 2000:23::/64 go to 2000:12::2

I don’t know what version of IOS you are using in GNS3, but current 15 code will actually show this hidden route–check this out:

IPv6 Routing Table - default - 4 entries
Codes: C - Connected, L - Local, S - Static, U - Per-user Static route
       B - BGP, HA - Home Agent, MR - Mobile Router, R - RIP
       H - NHRP, I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea
       IS - ISIS summary, D - EIGRP, EX - EIGRP external, NM - NEMO
       ND - ND Default, NDp - ND Prefix, DCE - Destination, NDr - Redirect
       O - OSPF Intra, OI - OSPF Inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2, l - LISP
ND  ::/0 [2/0]
     via FE80::2, FastEthernet0/1

Part of what IPv6 SLAAC does is have routers advertise themselves as default gateway candidates (this is the default behavior). So this is where the Neighbor Discovery route of ::/0 is coming from.