Yes you are missing the subtle fact that it is only possible to classify a single port-based untagged VLAN in ingress. There is only one PVID per port to map incoming untagged frames to, but there may be several untagged VLANs on egress.
Would it be possible to craft some text to describe this? -- to unsubscribe send a message to radiusext-request@ops.ietf.org with the word 'unsubscribe' in a single line as the message text body. archive: <http://psg.com/lists/radiusext/>