Additional info:

--
root@whirlpool:~# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 00:25:90:13:44:a4 brd ff:ff:ff:ff:ff:ff
    inet a.b.c.211/24 brd 188.165.231.255 scope global eth0
    inet x.y.z.220/32 scope global eth0
    inet x.y.z.221/32 scope global eth0
    inet x.y.z.223/32 scope global eth0
    inet instance.public.ip.address/32 scope global eth0:pub
    inet6 fe80::225:90ff:fe13:44a4/64 scope link 
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 00:25:90:13:44:a5 brd ff:ff:ff:ff:ff:ff
4: eth0.2187@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 00:25:90:13:44:a4 brd ff:ff:ff:ff:ff:ff
    inet 169.254.169.254/32 scope link eth0.2187
    inet 10.0.0.1/8 scope global eth0.2187
    inet6 fe80::225:90ff:fe13:44a4/64 scope link 
       valid_lft forever preferred_lft forever
7: eucabr10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 00:25:90:13:44:a4 brd ff:ff:ff:ff:ff:ff
    inet 10.32.8.1/24 brd 10.32.8.255 scope global eucabr10:priv
8: <email address hidden>: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 00:25:90:13:44:a4 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::225:90ff:fe13:44a4/64 scope link 
       valid_lft forever preferred_lft forever
---
root@whirlpool:~# cat /etc/eucalyptus/eucalyptus.conf
# /etc/eucalyptus/eucalyptus.conf
#
# These are the Ubuntu Enterprise Cloud's default Eucalyptus parameters.

# Affects: All
# See: **NOTE** below
EUCALYPTUS="/"
EUCA_USER="eucalyptus"

# Affects: CLC, Walrus, SC
DISABLE_DNS="N"
CLOUD_OPTS="-Xmx512m"

# Affects: SC
DISABLE_EBS="N"
DISABLE_ISCSI="N"

# Affects: CC, NC
# See: **NOTE** below
ENABLE_WS_SECURITY="Y"
LOGLEVEL="DEBUG"
VNET_PUBINTERFACE="eth0"
VNET_CLOUDIP="x.y.z.220"
VNET_PRIVINTERFACE="eth0.2187"
VNET_MODE="MANAGED"
VNET_DHCPOPTS="option interface-mtu 1496;"

# Affects: CC
# See: **NOTE** below
CC_PORT="8774"
SCHEDPOLICY="ROUNDROBIN"
POWER_IDLETHRESH="300"
POWER_WAKETHRESH="300"
NC_SERVICE="axis2/services/EucalyptusNC"
VNET_DHCPDAEMON="/usr/sbin/dhcpd"
VNET_DHCPUSER="dhcpd"
DISABLE_TUNNELLING="N"
NODES=""
VNET_ADDRSPERNET="256"
VNET_SUBNET="10.32.0.0"
VNET_NETMASK="255.240.0.0"
#VNET_DNS=""
VNET_PUBLICIPS="instance.public.ips.208-instance.public.ips.223"
--

NB: You may notice that VNET_PRIVINTERFACE already is a VLAN, but this seems to work OK so long as I reduce the MTU on instances by 4 bytes for the VLAN tag. And it still works fine with dhcpd3.

Perhaps dhcpd goes through a different code path for discovery on VLAN interfaces?

I'm just too tired to work any more on this today...I'll debug everything properly some time over the next week, but this system is far from "clean" and probably not entirely typical, so I wouldn't want to assert that things are still not fixed if it appears OK for people doing more formal testing here.