For the archives sake, we finally solved this. pppoe(4) never requests an mru during lcp negotiation (and acks any reasonable mru offered). In our case we were being offered an mru (1492) by the BT AC (BRAS) which we ack'd. With the mru agreed at both ends of the link our auth with the BT bras succeeded.
We were *not* being offered an mru by our ISP's AC. Therefore, because pppoe(4) never requests one, no mru was negotiated for the link. This caused our subsequent auth response to be ignored by our ISP's AC. (Is that a bug at the ISP's equipment or a bug in pppoe(4)?) I hacked sppp(4) to nak any lcp configure request it received that didn't include an mru option, setting the option value in the nak to mru = 1492. This ensures the mru is always negotiated and now our auth to our ISP succeeds. I believe ppp(8) does something similar too (hence why ppp(8) worked for us where pppoe(4) didn't). I'm not sure if pppoe(4) should always attempt mru negotiation but I'll cook up a patch anyway most likely using the configured mtu of the pppoe interface as the initial mru option value.
