diff --git a/protocol/bridge/backend_darwin.go b/protocol/bridge/backend_darwin.go
index e73b8f8e0..ae93311be 100644
--- a/protocol/bridge/backend_darwin.go
+++ b/protocol/bridge/backend_darwin.go
@@ -23,6 +23,12 @@ var (
 	bridgeInet6LocalBase = netip.MustParseAddr("2001:db8:1::1")
 )
 
+// The darwin forwarding path silently drops frames larger than the outgoing
+// interface MTU (no ICMP, no counter), and virtualized ingress interfaces
+// (vmnet LRO) deliver TCP frames coalesced far beyond their own 1500 MTU, so
+// the bridge tun must accept full-size IP packets.
+const bridgeTunMTU = 0xffff
+
 type backendDarwin struct {
 	backendBase
 
@@ -89,6 +95,7 @@ func (b *backendDarwin) start() error {
 		Logger:                    b.logger,
 		EXP_ExternalConfiguration: true,
 		EXP_MultiPendingPackets:   true,
+		EXP_SendMsgX:              true,
 	})
 	if err != nil {
 		return E.Cause(err, "create bridge tun")
diff --git a/protocol/bridge/backend_linux.go b/protocol/bridge/backend_linux.go
index 734c6a5df..3cd722751 100644
--- a/protocol/bridge/backend_linux.go
+++ b/protocol/bridge/backend_linux.go
@@ -20,6 +20,8 @@ import (
 const (
 	defaultBridgeRuleIndex      = 100
 	defaultBridgeTableIndexBase = 2200
+
+	bridgeTunMTU = 1500
 )
 
 type backendLinux struct {
diff --git a/protocol/bridge/packet.go b/protocol/bridge/packet.go
index 1e6a28ebe..fec9c626b 100644
--- a/protocol/bridge/packet.go
+++ b/protocol/bridge/packet.go
@@ -13,7 +13,6 @@ import (
 )
 
 const (
-	bridgeTunMTU         = 1500
 	maxPacketLength      = 0xffff
 	bridgeMaxInstances   = 254
 	bridgeWriteBatchSize = 32
diff --git a/protocol/bridge/packet_windows.go b/protocol/bridge/packet_windows.go
new file mode 100644
index 000000000..35ac1cf5c
--- /dev/null
+++ b/protocol/bridge/packet_windows.go
@@ -0,0 +1,5 @@
+//go:build windows && (amd64 || 386)
+
+package bridge
+
+const bridgeTunMTU = 1500