[the8472]

PCP has two operating modes, MAP and PEER. The latter should be similar to hole-punching.

And routers can forward PCP requests to their upstream routers. Some dualstack-lite routers do that and according to rumors (random internet forum comments) some CGNATs do support that.