[Dream Router 7 / U7 Pro] No client on one VLAN can be reached by new connections from ANY source, on ANY port — isolation settings all confirmed off

TL;DR: On my UDR7 + U7 Pro network, nothing can open a new connection to a client on my IoT VLAN — not from another VLAN, not from a client on the same VLAN/same AP, not even from a client on the same radio/channel. The VLAN's own gateway IP responds instantly. No RST, no ICMP unreachable, just a silent timeout every time. Every isolation/firewall/ACL/QoS setting I can find is off. Been debugging this for weeks — posting the full write-up in case anyone's hit this exact thing.

Setup: Dream Router 7 (UDR7), U7 Pro AP, 3x USW Flex 2.5G 5 + 1x USW-Lite-8-PoE switches. VLANs: Default, IOT, Home, Guest — all in the same firewall zone.

Symptom: New TCP/UDP connections to a specific IOT-VLAN client IP never complete — no RST, no ICMP unreachable, just silence. Happens cross-VLAN and same-VLAN/same-AP/same-radio. Only the VLAN's own gateway IP ever responds. Affects 5+ devices across 3 vendors identically — not device-specific.

Ruled out (with real verification): Network Isolation (off), Client Device Isolation (off), Port Isolation on relevant switch ports (off), zone firewall policies (no Home→IoT block exists anywhere; disabled the one IoT→Internal rule that does exist, no change), MAC ACLs (zero configured), QoS rules (zero configured), VLAN tagging (verified end-to-end with the VLAN Viewer — correctly tagged and Native VLAN correct at every hop), hardware offload (disabled entirely, no change), IPS/IDS (zero events), Traffic Flows (zero blocked-flow records ever), config drift (force-provisioned everything, no change).

Cleanest reproduction: Plain Python TCP connect() from a totally different host, bypassing all app protocols — VLAN gateway responds in 0.0006s; three different client IPs on that VLAN, six ports each, all hit a full 3s timeout, every time. A live gateway packet capture during a real connection attempt showed zero packets from the source ever reaching the VLAN's interface.

Status: Ticket open with Ubiquiti support (routing/switching team). They want a same-switch wired-client-to-wired-client test next, which I can't currently do (no spare wired IoT gear). Will update if there's a resolution.

Anyone seen this exact symptom before?