When the guest/namespace sends a zero-length UDP packet out via the TAP interface, the packet isn't propagated on the outbound interface.  Zero length packets can safely be dropped on stream protocols, but not datagram protocols.

I observed this experimenting with socat's null-eof and shut-null options, and confirmed with packet captures.

Steps to reproduce:
  1. Run a packet capture on the host's loopback interface
  2. Run pasta with -p to capture packets
  3. On the host, run:
      socat -u UDP4-LISTEN:10000,null-eof STDOUT
  4. In the namespace, run:
      socat -u OPEN:/dev/null UDP4:<gateway address>:10000,shut-null

Expected results:
  * Listening socat exits once the sending socat has completed
  * Both packet captures show zero length UDP packet

Actual results:
  * Listening socat continues waiting
  * Only the "inner" packet capture (from pasta) shows the zero length UDP packet