UDP published-port forwarding silently drops datagrams larger than 1472 bytes #2620

Describe the bug

UDP datagrams sent to a published container port on 127.0.0.1 are delivered only if the payload is ≤ 1472 bytes. Larger datagrams never reach the container's socket, with no error on either side. 1472 is exactly the largest UDP payload that fits in a 1500-byte MTU packet (1472 + 8 UDP + 20 IPv4 = 1500), which suggests the forwarding path can't handle datagrams exceeding the VM link MTU.

To Reproduce

Receiver, in a container with a published UDP port:

docker run --rm -p 9999:9999/udp python:3-alpine python -c "
import socket
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.bind(('0.0.0.0', 9999))
while True:
    d, _ = s.recvfrom(65535)
    print(len(d), flush=True)
"

Sender, on the macOS host:

python3 -c "
import socket, time
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
for n in (1000, 1472, 1473, 1600):
    s.sendto(bytes(n), ('127.0.0.1', 9999))
    print('sent', n)
    time.sleep(0.2)
"

Expected behavior

Expected

Container prints 1000 1472 1473 1600.

Actual

Container prints 1000 1472 only. Nothing is logged or reported for the two larger datagrams.

Diagnostic report (REQUIRED)

OrbStack info:
Version: 2.2.1
Commit: 0e182b501fcd9e05b99ffb363fce03610390c400 (v2.2.1)

System info:
macOS: 14.8.7 (23J520)
CPU: arm64, 14 cores
CPU model: Apple M3 Max
Model: Mac15,11
Memory: 36 GiB

Full report: https://orbstack.dev/_admin/diag/orbstack-diagreport_2026-08-01T10-28-12.183552Z.zip

Screenshots and additional context (optional)