I wonder if NetworkManager or polkit is doing some sort of opaque meddling with POSIX capabilities? The CAP_NET_* options, in particular. I'm grasping at straws

I wonder if NetworkManager or polkit is doing some sort of opaque meddling with POSIX capabilities? The CAP_NET_* options, in particular. I'm grasping at straws here, certainly, but your description of the events leads me to suspect something in that general direction.