good news, after doing a factory default, virgin update to 384.8_2
putting in all my static lan ip, ssids and lan qos settings by hand,
installing diversion with pixelserv (no log, small block file)
my fios isp clamped without issue.
once i installed stubby - it all went to hell and i got no isp back.
so my problem is with stubby on ac3100 on fios, not merlin
shame stubby's broken to me now cause i really liked having
it's secure DNS transport protection.
now all i enjoy is DNSSEC from what merlin is doing for us.
my dnsleaktest still resolves to all cloudfire dns hosts,
but without putty my lookups are unencrypted to my isp,
and verizon is the worst when it comes to spying on us.