After repeating the "toggle all the flags" dance two more times and a reboot later, vlans suddenly _do_ work on those interfaces, with default flags. I have no idea what was messed up before - but now the configuration survives reboot. Sorry for all the panic. Happy networking, Christoph -- Spare Space