The path MTU is not the NIC MTU
The nic said 1500. Packets of 1451 never came back. 1440 did. The black hole was a hop that dropped DF packets and did not send ICMP too-big, so TCP retried until the flow looked dead for about a minute.
I set the interface to the path I had measured and turned on tcp_mtu_probing. I did not clamp MSS in iptables to a number computed from the wrong nic MTU: that clamp would have been larger than the path, which is the same as doing nothing. The MSS the stack advertises has to come from the path, not from the brochure.