diff -urp linux-orig/drivers/net/ppp_generic.c linux-new/drivers/net/ppp_generic.c
--- linux-orig/drivers/net/ppp_generic.c	2011-09-18 17:59:18.000000000 -0400
+++ linux-new/drivers/net/ppp_generic.c	2011-09-18 18:05:29.000000000 -0400
@@ -1464,8 +1464,13 @@ static int ppp_mp_explode(struct ppp *pp
 			spin_unlock_bh(&pch->downl);
 			continue;
 		}
-
-		mtu = pch->chan->mtu - hdrlen;
+		
+		/* 
+		 * hdrlen includes the 2-byte PPP protocol field, but the
+		 * MTU counts only the payload excluding the protocol field.
+		 * (RFC1661 Section 2)
+		 */
+		mtu = pch->chan->mtu - (hdrlen - 2);
 		if (mtu < 4)
 			mtu = 4;
 		if (flen > mtu)