Herbert Xu wrote:

Can you also attach a dump for connections that do work under
2.6.27? That should tell us whether this MAC is genuine.

Done. I also realised my wireshark display filter was dst_host rather 
than simply host - it looks as though replies _do_ come back but for 
some reason are ignored? My apologies.

The 2.6.27 dump contains a connection to a local file mirror 
(203.21.20.200) and an attempted connection to store.apple.com 
(17.149.156.10).

If it is bogus, can you dump on the other interfaces to see
who is corrupting it?

I believe the differing MAC addresses on the PPP remote endpoint are due 
to my ISP having multiple layer 2 termination routers for 
load-balancing/redundancy and not a symptom of the issue.

Cheers,
Dean