Ohkay.. getting weird now... but I can confirm that this is working.

So if I understand this correctly, since 2.6.4 there's a feature for certain network cards to discard oversized packets?
And since the MTU is decreased by the VPN client from 1500 to 1400 (to fit the encryption within the 1500 byte packet size boundary),
the network card mistakenly calculates with the newly configured MTU of 1400 instead of 1500, making encrytion exceed this MTU size?

So I can consider this a bug in those drivers then, I would think...

Or am I taking wrong conclusions here?

As I said, the workaround is working, so it's not a big deal... just trying to understand the problem.