How embarrassing! It turns out there was a security hole lurking in Linux’s netfilter firewall program.
