Here's a patch which seems to fix the problem.
diff -ur xl2tpd-1.3.1+dfsg.orig/avpsend.c xl2tpd-1.3.1+dfsg/avpsend.c --- xl2tpd-1.3.1+dfsg.orig/avpsend.c 2011-10-06 20:22:05.000000000 +0100 +++ xl2tpd-1.3.1+dfsg/avpsend.c 2012-07-03 23:28:35.719506220 +0100 @@ -25,13 +25,18 @@ _u16 s3; } __attribute__ ((packed)); -void add_header(struct buffer *buf, _u8 length, _u16 type) { + +void add_nonmandatory_header(struct buffer *buf, _u8 length, _u16 type) { struct avp_hdr *avp = (struct avp_hdr *) (buf->start + buf->len); - avp->length = htons (length | MBIT); + avp->length = htons (length); avp->vendorid = htons (VENDOR_ID); avp->attr = htons (type); } +void add_header(struct buffer *buf, _u8 length, _u16 type) { + add_nonmandatory_header(buf, length|MBIT, type); +} + /* * These routines should add avp's to a buffer * to be sent @@ -82,7 +87,7 @@ int add_firmware_avp (struct buffer *buf) { struct half_words *ptr = (struct half_words *) (buf->start + buf->len + sizeof(struct avp_hdr)); - add_header(buf, 0x8, 0x6); + add_nonmandatory_header(buf, 0x8, 0x6); ptr->s0 = htons (FIRMWARE_REV); buf->len += 0x8; return 0; @@ -103,7 +108,7 @@ int add_vendor_avp (struct buffer *buf) { - add_header(buf, 0x6 + strlen (VENDOR_NAME), 0x8); + add_nonmandatory_header(buf, 0x6 + strlen (VENDOR_NAME), 0x8); strcpy ((char *) (buf->start + buf->len + sizeof(struct avp_hdr)), VENDOR_NAME); buf->len += 0x6 + strlen (VENDOR_NAME); return 0; @@ -228,7 +233,7 @@ int add_rxspeed_avp (struct buffer *buf, int speed) { struct half_words *ptr = (struct half_words *) (buf->start + buf->len + sizeof(struct avp_hdr)); - add_header(buf, 0xA, 0x26); + add_nonmandatory_header(buf, 0xA, 0x26); ptr->s0 = htons ((speed >> 16) & 0xFFFF); ptr->s1 = htons (speed & 0xFFFF); buf->len += 0xA; @@ -238,7 +243,7 @@ int add_physchan_avp (struct buffer *buf, unsigned int physchan) { struct half_words *ptr = (struct half_words *) (buf->start + buf->len + sizeof(struct avp_hdr)); - add_header(buf, 0xA, 0x19); + add_nonmandatory_header(buf, 0xA, 0x19); ptr->s0 = htons ((physchan >> 16) & 0xFFFF); ptr->s1 = htons (physchan & 0xFFFF); buf->len += 0xA;