Herbert Xu wrote:

Can you please take a look at /proc/net/snmp on the host and the
guest to see if IP InDiscards is non-zero?

Both are 0

Also now that we know the problem is definitely in the host/guest
please take another set of dumps on the interfaces leading to and
within the guest to see exactly which path of the system is dropping
the reply.

Attached (all are the exact same attempted connection), and reveal some 
interesting information.

The path the inbound traffic should take is
1. vlan50 (host)
2. tap interface vnet3 (host) / eth0 (guest)
3. ppp0 (guest)

It looks as though when it is sent out the tap interface the payload 
length is incorrect in the PPPoE section of the frame. When it arrives 
via vlan50 it appears fine. Or at least that's what wireshark highlights 
for me :)

Dean