Turns out the actual reason my video streaming was broken was an upstream kernel bug where under certain circumstances if a packet too big ICMP was received on one interface but a different interface was sending the traffic, the cache on the egress interface wouldn't be properly updated, so full marks to Fastly for diagnosing that and working to get it upstream: https://lore.kernel.org/netdev/4be64c29-f495-4fdb-a565-2540745d5412@fastly.com/T/