I am seeing the same issue. Please post if you have an answer

Yes, inside of the PacketTunnel Provider we use sockets to bind to an interface. This is used for faster failover, avoiding bad networks and aggregating for speed. With include all networks set to on, we can successfully bind to pdp_ip0 when en0 is active however , attempting to use that socket it gets routed through the default en0 interface. You can test it out when binding to pdp_ip0 with include all networks on, sending a ping to ifconfig and it will return with the default interfaces IP.