Reason: the server had IPv6 turned on, and it steadily accumulated privacy IPv6 addresses. These addresses were all sent in a packet describing the supported media endpoints, using UDP.

And yep, eventually it overflowed the MTU and the phones couldn't handle the fragment reassembly.