Linux 6.18 ships the OpenVPN data channel offload module (ovpn) in-tree and it is installed in the ISO, but vyos-1x never actually engages it. Three independent defects keep the kernel datapath unused.

First, get_config() still probes the CLI node enable-dco, which commit rVYOSONEX32b9ac3653fa renamed to offload dco. The check can never fire, so enabling DCO leaves restart_required unset and apply() downgrades to systemctl reload-or-restart. The data channel backend is selected during daemon initialisation, so toggling DCO on a live tunnel does nothing at all.

Second, VTunIf._create() unconditionally pre-creates a persistent TUN device via openvpn --mktun. A DCO interface is not TUN/TAP but link type ovpn, created by the kernel module over netlink; the squatted name makes the kernel reject it with EEXIST and OpenVPN drops to userspace.

Third, verify() had no DCO validation whatsoever, so tap devices, compression, static keys and non-AEAD ciphers were accepted while silently disabling offload.